Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Computer Crashes or Shuts Down without Warning

Started by periwinkle , Jun 30 2014 07:22 PM

Please log in to reply

#1
periwinkle

Posted 30 June 2014 - 07:22 PM

Member

Member
298 posts

I have a PC with AMD 64 bit operating system using Windows Vista. I leave the computer on all the time, unless I will be out of town for a few days. Lately, my computer will just shut down without warning. Usually, I'll be doing something and within a matter of seconds it just shuts right off. No warning or slowing or anything to indicate an imminent shutdown. Other times, I'll get a blue screen that tells me it crashed. Sometimes it seems to partially shut down. The power will be on, but the screen shuts off and I have to reboot it to get it to work. Also, lately I've had to unplug the computer for a few minutes before I can power it up again. The weather is hot in Arizona right now, but I have the side open and a box fan dedicated to it. The most often occurrence is the immediate shutdown without any warning.

Since November of 2013 my computer has been having this issue. A few times it has prompted me to repair itself or do a system restore. I have done maybe 2-3 system restores since November. Recently (mid-June), the powering off started happening with greater frequency. It happens very randomly. For about 2-3 days, I kept finding the computer off when I returned from work. I'd turn it on and it would stay on for an hour then shut off. It kept doing this more and more. I was worried this was the end. So, I unplugged it for about 10 hours one day and then started it up again. It powered off in 5 minutes. I pushed the power button again and it stayed on after that for a couple of days. Since then, I have restarted it at least 10 times without any hanging or problems. For a while I was afraid to restart it because it would hang and just not boot.

I have recently run about 10 AdAware scans and each time AdAware kept finding objects. Most of the time, AdAware recommends that I quarantine the items. Maybe one time I removed the items, instead of quarantining them. The last scan I did on AdAware came up clean. I can't remember the last time this happened.

So I'm following the steps to post the OTL log.

Here's a link where RShaffer61 (Ron) has helped me: http://www.geekstogo...-warning/page-2

I've been surprised at how long my computer has been staying powered on and the fact that I've done so many restarts without a single hitch. That is unsual.

I will be out of town after 7-3-14, so I may not reply until 7-8-14.

Attached Files

OTL Scan 6-30-14.Txt 527.51KB 259 downloads

Edited by periwinkle, 30 June 2014 - 07:22 PM.

#2
zep516

Posted 30 June 2014 - 08:23 PM

Trusted Helper

Malware Removal
8,107 posts

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Do not attach logs to the forum, paste them directly in. I'm posting your log to the forum. I'm also missing a log called Extra's .txt please post it. Open OTL again, before running a scan in the Extra's registry group select "All" now run scan. OTL will create the extra's log. It will be minimized to the task bar. Please post it.

You have 2 Anti Virus programs running:

The real-time protection of two antivirus programs may conflict with each other and cause the following:

* False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
* Conflicts: Your system may lock up due to both products attempting to access the same file at the same time.
* Performance: More that one antivirus will cause your PC to become slow and it may even crash or blue screen.
* Less protection: Two antivirus trying to scan the same file may interfere with the process and allow a malicious file onto the computer without notice to you.

1 Uninstall Lavasoft adware.

You're running out of free space on your hard drive
Drive C: | 580.72 Gb Total Space | 74.10 Gb Free Space | 12.76% Space Free | Partition Type: NTFS
That free space needs to be at 20% for Windows to function correctly.

Your OTL scan

OTL logfile created on: 6/30/2014 7:24:49 AM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Veronica\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 0.96 Gb Available Physical Memory | 25.52% Memory free
7.71 Gb Paging File | 3.31 Gb Available in Paging File | 42.93% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 580.72 Gb Total Space | 74.10 Gb Free Space | 12.76% Space Free | Partition Type: NTFS
Drive D: | 15.45 Gb Total Space | 7.90 Gb Free Space | 51.14% Space Free | Partition Type: NTFS

Computer Name: VERONICA-PC | User Name: Veronica | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Veronica\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions)
PRC - C:\Users\Veronica\AppData\Local\Google\Update\1.3.24.15\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe ()
PRC - C:\Program Files (x86)\Comodo\Dragon\dragon.exe (Comodo)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake)
PRC - C:\Program Files (x86)\MP3 Skype Recorder\MP3 Skype Recorder.exe (Alexander Nikiforov)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\AGI\core\4.2.0.10752\AGCoreService.exe (AG Interactive)
PRC - C:\Program Files (x86)\Webshots\Webshots.scr (Webshots.com)
PRC - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\IOI\ButtonMonitor.exe ()
PRC - C:\Program Files (x86)\Google\Google Talk\googletalk.exe (Google)
PRC - C:\Windows\PixArt\Pac7302\Monitor.exe (PixArt Imaging Incorporation)
PRC - C:\Program Files (x86)\HDD Thermometer\HDD Thermometer.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Innovative Solutions\DriverMax\sync.dll ()
MOD - C:\Users\Veronica\AppData\Local\Google\Chrome\Application\35.0.1916.153\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\Veronica\AppData\Local\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()
MOD - C:\Users\Veronica\AppData\Local\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
MOD - C:\Users\Veronica\AppData\Local\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll ()
MOD - C:\Program Files (x86)\Comodo\Dragon\ffmpegsumo.dll ()
MOD - C:\Program Files (x86)\Comodo\Dragon\chrome_elf.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\d17ceca243fabda73eefb21d9bd072df\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f87e71868aedbc6c4e8fe7160d17c4ab\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d2b605fc7deda872727d1ed37710420e\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8e6265a54260bddfc05951e764f5bc48\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\957628d9dd7b3bf370a56dca7835a997\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\694a37a84dee2cd2609a1dfab27c0433\mscorlib.ni.dll ()
MOD - C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libGLESv2.dll ()
MOD - C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libEGL.dll ()
MOD - C:\Program Files (x86)\IOI\ButtonMonitor.exe ()
MOD - C:\Program Files (x86)\HDD Thermometer\HDD Thermometer.exe ()

========== Services (SafeList) ==========

SRV:64bit: - (VSSERV) -- C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe /service File not found
SRV:64bit: - (UPDATESRV) -- C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe /service File not found
SRV:64bit: - (Ati External Event Utility) -- C:\Windows\SysNative\Ati2evxx.exe (ATI Technologies Inc.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (XAudioService) -- C:\Windows\SysNative\DRIVERS\xaudio64.exe (Conexant Systems, Inc.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (DragonUpdater) -- C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe ()
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (Freemake Improver) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe (Freemake)
SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (McAfee ScanAndRepair Svc) -- C:\Program Files (x86)\McAfeeScanAndRepair\McAfeeScanRepairSvc.exe (McAfee, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AGCoreService) -- C:\Program Files (x86)\AGI\core\4.2.0.10752\AGCoreService.exe (AG Interactive)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (RTL8187B) -- C:\Windows\SysNative\DRIVERS\RTL8187B.sys (Realtek Semiconductor Corporation )
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (Lbd) -- C:\Windows\SysNative\DRIVERS\Lbd.sys (Lavasoft AB)
DRV:64bit: - (74385989) -- C:\Windows\SysNative\DRIVERS\74385989.sys (Kaspersky Lab ZAO)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\DRIVERS\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\DRIVERS\avgntflt.sys (Avira GmbH)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\Drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (BlackBox) -- C:\Windows\SysNative\blackbox.dll (Microsoft Corporation)
DRV:64bit: - (R300) -- C:\Windows\SysNative\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (mdmxsdk) -- C:\Windows\SysNative\DRIVERS\mdmxsdk.sys (Conexant)
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RTSTOR) -- C:\Windows\SysNative\drivers\RTSTOR64.SYS (Realtek Semiconductor Corp.)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\DRIVERS\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\DRIVERS\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (yukonx64) -- C:\Windows\SysNative\DRIVERS\yk60x64.sys (Marvell)
DRV:64bit: - (Pnp680) -- C:\Windows\SysNative\DRIVERS\pnp680.sys (Silicon Image, Inc)
DRV:64bit: - (PAC7302) -- C:\Windows\SysNative\DRIVERS\PAC7302.SYS (PixArt Imaging Inc.)
DRV:64bit: - (XAudio) -- C:\Windows\SysNative\DRIVERS\xaudio64.sys (Conexant Systems, Inc.)
DRV:64bit: - (HSF_DPV) -- C:\Windows\SysNative\DRIVERS\CAX_DPV.sys (Conexant Systems, Inc.)
DRV:64bit: - (CAXHWBS2) -- C:\Windows\SysNative\DRIVERS\CAXHWBS2.sys (Conexant Systems, Inc.)
DRV:64bit: - (winachsf) -- C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys (Conexant Systems, Inc.)
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV:64bit: - (BCM43XV) -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys (Broadcom Corporation)
DRV - (Lavasoft Kernexplorer) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys ()
DRV - (Normandy) -- C:\Windows\SysWow64\drivers\Normandy.sys ()
DRV - (BlackBox) -- C:\Windows\SysWow64\drivers\BlackBox.sys ()
DRV - (IDSvia64) -- C:\ProgramData\Symantec\Definitions\SymcData\ipsdefs\20081023.002\IDSviA64.sys (Symantec Corporation)
DRV - (RTL8187B) -- C:\Windows\SysWOW64\drivers\rtl8187B.sys (Realtek Semiconductor Corporation )

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...ys=DTP&M=GT5694
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...ys=DTP&M=GT5694
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...ys=DTP&M=GT5694
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page = http://www.Google.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page Restore =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.c...ys=DTP&M=GT5694
IE - HKLM\..\SearchScopes,DefaultScope = {0BC6E3FA-78EF-4886-842C-5A1258C4455A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}: "URL" = http://search.imgag....q={searchTerms}
IE - HKLM\..\SearchScopes\{A0B271A9-D8AA-8E74-7392-2164D6A1C03C}: "URL" = http://www.iesearch....q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...ys=DTP&M=GT5694
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {DAAF7918-570D-4407-A264-57D857AE91E9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{DAAF7918-570D-4407-A264-57D857AE91E9}: "URL" = http://www.google.co...ie7&rlz=1I7GWYE
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Plus Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: C:\Program Files (x86)\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: C:\Program Files (x86)\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Veronica\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O1DPlugin: C:\Users\Veronica\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Veronica\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Veronica\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013/06/19 17:20:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/05/16 21:54:20 | 000,000,000 | ---D | M]

[2010/04/30 22:16:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Veronica\AppData\Roaming\Mozilla\Extensions
[2010/04/30 22:16:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Veronica\AppData\Roaming\Mozilla\Extensions\[email protected]
[2014/04/15 23:38:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2014/04/15 23:38:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2014/04/15 23:38:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2014/04/15 23:38:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/04/15 23:38:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2014/04/15 23:38:45 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011/04/06 07:40:00 | 000,182,936 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npMcAfeeSRPlgn.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.com/
CHR - plugin: Widevine Content Decryption Module (Enabled) = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.4.600\_platform_specific\win_x86\widevinecdmadapter.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Veronica\AppData\Local\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Veronica\AppData\Local\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Veronica\AppData\Local\Google\Chrome\Application\35.0.1916.153\pdf.dll
CHR - plugin: MicrosoftÂ® Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: McAfeeScanAndRepair (Enabled) = C:\Users\Veronica\AppData\Local\Google\Chrome\Application\plugins\npMcAfeeSRPlgn.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Java Deployment Toolkit 7.0.550.13 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll
CHR - plugin: Java™ Platform SE 7 U55 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\VistaCodecPack\rm\browser\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
CHR - plugin: Windows LiveÂ Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Veronica\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\Veronica\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Renderer (Enabled) = C:\Users\Veronica\AppData\Roaming\Mozilla\plugins\npo1d.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5019_0\
CHR - Extension: YouTube = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.8.3_0\
CHR - Extension: Google Search = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: AdBlock = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.7.5_0\
CHR - Extension: GetSavin = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjildcbkilmkddbbpbjljljdmmlfeppl\5.0_0\
CHR - Extension: Google Wallet = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo> = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.172_0\
CHR - Extension: Gmail = C:\Users\Veronica\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2012/11/29 14:58:48 | 000,444,155 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: റ⌊匠慴瑲漠⁦湥牴敩⁳湩敳瑲摥戠⁹灓批瑯ⴠ匠慥捲⁨敄瑳潲൹ㄊ㜲〮〮ㄮ眉睷〮㜰畧牡⹤潣൭ㄊ㜲〮〮ㄮ〉㜰畧牡⹤潣൭ㄊ㜲〮〮ㄮ〉㠰⹩潣൭ㄊ㜲〮〮ㄮ眉睷〮㠰⹫潣൭ㄊ㜲〮〮ㄮ〉㠰⹫潣൭ㄊ㜲〮〮ㄮ眉睷〮栰⹱潣൭ㄊ㜲〮〮ㄮ〉栰⹱潣൭ㄊ㜲〮〮ㄮ〉〱〴⸲潣൭ㄊ㜲〮〮ㄮ眉睷〮㈳㌴⸹潣൭ㄊ㜲〮〮ㄮ〉㈳㌴⸹潣൭ㄊ㜲〮〮ㄮ眉睷〮捳湡挮浯਍㈱⸷⸰⸰ऱ猰慣⹮潣൭ㄊ㜲〮〮ㄮㄉ〰朰慲楴灳潲敢⹮潣൭ㄊ㜲〮〮ㄮ眉睷ㄮ〰朰慲楴灳潲敢⹮潣൭ㄊ㜲〮〮ㄮㄉ〰渱浡湥挮浯਍㈱⸷⸰⸰ऱ睷⹷〱㄰慮敭⹮潣൭ㄊ㜲〮〮ㄮㄉ〰㠸㈸〹獣挮浯਍㈱⸷⸰⸰ऱ睷⹷〱㠰㠸㤲挰⹳潣൭ㄊ㜲〮〮ㄮ眉睷ㄮ〰敳汸湩獫挮浯਍㈱⸷⸰⸰ऱ〱猰硥楬歮⹳潣൭ㄊ㜲〮〮ㄮㄉ猰步挮浯਍㈱⸷⸰⸰ऱ睷⹷〱敳⹫潣൭ㄊ㜲〮〮ㄮ眉睷ㄮ㈭〰ⴵ敳牡档挮浯਍㈱⸷⸰⸰ऱⴱ〲㔰猭慥捲⹨潣൭ㄊ㜲〮〮ㄮㄉ㌲灦牯⹮湩潦਍㈱⸷⸰⸰ऱ睷⹷㈱昳潰湲椮普൯ㄊ㜲〮〮ㄮㄉ㌲慨獵楴牥略摮敭牨挮浯਍㈱⸷⸰⸰ऱ睷⹷㈱栳畡瑳敩敲湵浤桥⹲潣൭ㄊ㜲〮〮ㄮㄉ㌲潭楶摥睯汮慯⹤潣൭ㄊ㜲〮〮ㄮ眉睷ㄮ㌲潭楶摥睯汮慯⹤潣൭ㄊ㜲〮〮ㄮㄉ㌲楳獭湥挮浯਍㈱⸷⸰⸰ऱ睷⹷㈱猳浩敳⹮潣൭ㄊ㜲〮〮ㄮㄉ㌲潴獰慥捲⹨潣൭ㄊ㜲〮〮ㄮ眉睷ㄮ㌲潴獰慥捲⹨潣൭ㄊ㜲〮〮ㄮㄉ㔲浳⹳潣甮൫ㄊ㜲〮〮ㄮ眉睷ㄮ㔲浳⹳潣甮൫ㄊ㜲〮〮ㄮㄉ㔲浳⹳潣൭ㄊ㜲〮〮ㄮ眉睷ㄮ㔲浳⹳潣൭ㄊ㜲〮〮ㄮㄉ㈳挮浯਍㈱⸷⸰⸰ऱ睷⹷㌱⸲潣൭ㄊ㜲〮〮ㄮㄉ㌳挷敲⹷湩潦਍㈱⸷⸰⸰ऱ睷⹷㌱㜳牣睥椮普൯ㄊ㜲〮〮ㄮ眉睷ㄮ㌳ⴷ牣睥琮൯ㄊ㜲〮〮ㄮㄉ㌳ⴷ牣睥琮൯ㄊ㜲〮〮ㄮ眉睷ㄮ㘳㌱⸶敮൴ㄊ㜲〮〮ㄮㄉ㘳㌱⸶敮൴ㄊ㜲〮〮ㄮㄉ〵牦敥浳⹳敤਍㈱⸷⸰⸰ऱ睷⹷㔱昰敲獥獭搮൥ㄊ㜲〮〮ㄮ眉睷ㄮ㌶獮挮浯਍㈱⸷⸰⸰ऱ㘱渳⹳潣൭ㄊ㜲〮〮ㄮㄉㄷ〲⸳潣൭ㄊ㜲〮〮ㄮㄉ挷湯散瑰⹳湩潦਍㈱⸷⸰⸰ऱ睷⹷㜱潣据灥獴椮普൯ㄊ㜲〮〮ㄮㄉⴷ汰獵挮浯਍㈱⸷⸰⸰ऱ睷⹷㠱〰敳牡档湯楬敮挮浯਍㈱⸷⸰⸰ऱ㠱〰敳牡档湯楬敮挮浯਍㈱⸷⸰⸰ऱ㠱猰慥捲慨獳獩慴瑮挮浯਍㈱⸷⸰⸰ऱ睷⹷㠱猰慥捲慨獳獩慴瑮挮浯਍㈱⸷⸰⸰ऱ㠱猰汯瑵潩獮挮浯਍㈱⸷⸰⸰ऱ睷⹷㠱猰汯瑵潩獮挮浯਍㈱⸷⸰⸰ऱ㠱⸱㘳猵景⹴湩潦਍㈱⸷⸰⸰ऱ睷⹷㠱⸱㘳牡桳牡⹥潤湷潬摡洭⹥湩潦਍㈱⸷⸰⸰ऱ敢牡桳牡⹥潤湷潬摡洭⹥湩潦਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡⹥灭ⴳ畭楺⹣潣൭ㄊ㜲〮〮ㄮ戉慥獲慨敲洮㍰洭穵捩挮浯਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡ⵥつ湷潬摡挮浯਍㈱⸷⸰⸰ऱ敢牡桳牡ⵥつ湷潬摡挮浯਍㈱⸷⸰⸰ऱ敢牡桳牡ⵥ潤湷潬摡漮杲਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡ⵥ潤湷潬摡漮杲਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡ⵥ潤湷潬摡⹳敮൴ㄊ㜲〮〮ㄮ戉慥獲慨敲搭睯汮慯獤渮瑥਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡汥癩⹥潣甮൫ㄊ㜲〮〮ㄮ戉慥獲慨敲楬敶挮⹯歵਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡ⵥ畭楳ⵣ潤湷潬摡⹳潣൭ㄊ㜲〮〮ㄮ戉慥獲慨敲洭獵捩搭睯汮慯獤挮浯਍㈱⸷⸰⸰ऱ敢牡桳牡灥潲〲㜰挮浯਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡灥潲〲㜰挮浯਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡灥潲搭睯汮慯⹤潣൭ㄊ㜲〮〮ㄮ戉慥獲慨敲牰ⵯ潤湷潬摡挮浯਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡ⵥ歵挮浯਍㈱⸷⸰⸰ऱ敢牡桳牡ⵥ歵挮浯਍㈱⸷⸰⸰ऱ睷⹷敢牡桳牡ⵥ獵⹡潣൭ㄊ㜲〮〮ㄮ戉慥獲慨敲甭慳挮浯਍㈱⸷⸰⸰ऱ敢桤浯⹥潣൭ㄊ㜲〮〮ㄮ戉摥慩慤据⹥潣൭ㄊ㜲〮〮ㄮ眉睷戮摥楴敭栭牥敯⹳潣൭ㄊ㜲〮〮ㄮ戉摥楴敭栭牥敯⹳潣൭ㄊ㜲〮〮ㄮ眉睷戮敥慢灰祹戮穩਍㈱⸷⸰⸰ऱ敢扥灡祰⹹楢ൺㄊ㜲〮〮ㄮ眉睷戮来湩猲慥捲⹨潣൭ㄊ㜲〮〮ㄮ戉来湩猲慥捲⹨潣൭ㄊ㜲〮〮ㄮ戉汥慬慢歳瑥晳⹬潣൭ㄊ㜲〮〮ㄮ眉睷戮汥瑳晡⹦歵挮浯਍㈱⸷⸰⸰ऱ敢獬慴晦甮⹫潣൭ㄊ㜲〮〮ㄮ眉睷戮汥瑳晡扦汥瑳晡⹦潣൭ㄊ㜲〮〮ㄮ戉汥瑳晡扦汥瑳瑴牥挮浯਍㈱⸷⸰⸰ऱ睷⹷癥牥摹祡敬瑴牥挮浯਍㈱⸷⸰⸰ऱ癥牥摹祡慭獧挮浯਍㈱⸷⸰⸰ऱ睷⹷癥牥摹祡慭獧挮浯਍㈱⸷⸰⸰ऱ睷⹷癥牥⵹慧敭挮浯਍㈱⸷⸰⸰ऱ癥牥⵹慧敭挮浯਍㈱⸷⸰⸰ऱ睷⹷癥牥瑹楨杮獩牦敥〲㤰挮浯਍㈱⸷⸰⸰ऱ癥牥瑹楨杮獩牦敥〲㤰挮浯਍㈱⸷⸰⸰ऱ癥摩湥散搭瑥捥潴⹲楢ൺㄊ㜲〮〮ㄮ眉睷攮楶敤据敥慲敳⹲潣൭ㄊ㜲〮〮ㄮ攉楶敤据敥慲敳⹲潣൭ㄊ㜲〮〮ㄮ攉楶獬楰敤捲浯捩⹳潣൭ㄊ㜲〮〮ㄮ眉睷攮歶⹯楢ൺㄊ㜲〮〮ㄮ攉歶⹯楢ൺㄊ㜲〮〮ㄮ攉扷祡椮൴ㄊ㜲〮〮ㄮ眉睷攮扷祡椮൴ㄊ㜲〮〮ㄮ攉敷獢慥捲⹨敮൴ㄊ㜲〮〮ㄮ攉眭扥楳整潳畬楴湯⹳潣൭ㄊ㜲〮〮ㄮ攉楷慺摲挮ൣㄊ㜲〮〮ㄮ攉⵷敶獲潩獮挮浯਍㈱⸷⸰⸰ऱ睷⹷睥瘭牥楳湯⹳潣൭ㄊ㜲〮〮ㄮ眉睷攮慸捣獥⹳畲਍㈱⸷⸰⸰ऱ硥捡散獳爮൵ㄊ㜲〮〮ㄮ眉睷攮慸瑣潣敭挮浯਍㈱⸷⸰⸰ऱ硥捡捴浯⹥潣൭ㄊ㜲〮〮ㄮ攉慸瑣爭獥汵獴渮瑥਍㈱⸷⸰⸰ऱ睷⹷硥捡⵴敲畳瑬⹳敮൴ㄊ㜲〮〮ㄮ眉睷攮慸敳癲⹥敮൴ㄊ㜲〮〮ㄮ攉慸敳癲⹥敮൴ㄊ㜲〮〮ㄮ眉睷攮捸汥敬瑮札浡⹥敮൴ㄊ㜲〮〮ㄮ攉捸汥敬瑮札浡⹥敮൴ㄊ㜲〮〮ㄮ攉捸汥敬瑮捳楫⹮潣൭ㄊ㜲〮〮ㄮ眉睷攮捸畬楳敶楶捰獡湩⹯潣൭ㄊ㜲〮〮ㄮ攉捸畬楳敶楶捰獡湩⹯潣൭ㄊ㜲〮〮ㄮ眉睷攮捸畬楳敶硸捸楬獰挮浯਍㈱⸷⸰⸰ऱ硥汣獵癩硥硸汣灩⹳潣൭ㄊ㜲〮〮ㄮ眉睷攮數灵慤整挮浯਍㈱⸷⸰⸰ऱ硥略摰瑡⹥潣൭ㄊ㜲〮〮ㄮ眉睷攮晸潬⹷牯൧ㄊ㜲〮〮ㄮ攉晸潬⹷牯൧ㄊ㜲〮〮ㄮ攉楸⹴敭慧潧挮浯਍㈱⸷⸰⸰ऱ睷⹷硥慰摮楶敤⹯潣൭ㄊ㜲〮〮ㄮ攉灸湡癤摩潥挮浯਍㈱⸷⸰⸰ऱ睷⹷硥汰楡浮敥挮浯਍㈱⸷⸰⸰ऱ硥汰楡浮敥挮浯਍㈱⸷⸰⸰ऱ睷⹷硥汰牯牥瑳牡灴条⹥潣൭ㄊ㜲〮〮ㄮ攉灸潬敲獲慴瑲慰敧挮浯਍㈱⸷⸰⸰ऱ睷瑲污楳整漮杲਍㈱⸷⸰⸰ऱ潴灰牯慴獬瑩⹥牯൧ㄊ㜲〮〮ㄮ眉睷琮灯楲楶牥ⵡ慧敭渮瑥਍㈱⸷⸰⸰ऱ潴牰癩敩慲札浡⹥敮൴ㄊ㜲〮〮ㄮ眉睷琮灯慳⹪潣൭ㄊ㜲〮〮ㄮ琉灯慳⹪潣൭ㄊ㜲〮〮ㄮ眉睷琮灯敳牡档牥挮浯਍㈱⸷⸰⸰ऱ潴獰慥捲敨⹲潣൭ㄊ㜲〮〮ㄮ眉睷琮灯敳牡档潳瑦挮浯਍㈱⸷⸰⸰ऱ潴獰慥捲獨景⹴潣൭ㄊ㜲〮〮ㄮ眉睷琮灯敳畣楲祴慰敧挮浯਍㈱⸷⸰⸰ऱ潴獰捥牵瑩灹条⹥潣൭ㄊ㜲〮〮ㄮ眉睷琮灯敳畣楲祴楳整渮瑥਍㈱⸷⸰⸰ऱ潴獰捥牵瑩獹瑩⹥敮൴ㄊ㜲〮〮ㄮ眉睷琮灯敳汬湩ⵧ硲⹳潣൭ㄊ㜲〮〮ㄮ琉灯敳汬湩ⵧ硲⹳潣൭ㄊ㜲〮〮ㄮ眉睷琮灯楳整甮
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll File not found
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4:64bit: - HKLM..\Run: [PAC7302_Monitor] C:\Windows\PixArt\Pac7302\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BrowserPlugInHelper] "C:\Program Files (x86)\Wondershare\Video Converter Ultimate\BrowserPlugInHelper.exe" File not found
O4 - HKLM..\Run: [ButtonMonitor] C:\Program Files (x86)\IOI\ButtonMonitor.exe ()
O4 - HKLM..\Run: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe (Google)
O4 - HKCU..\Run: [DriverMax] C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions)
O4 - HKCU..\Run: [DriverMax_RESTART] C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions)
O4 - HKCU..\Run: [Facebook Update] "C:\Users\Veronica\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver File not found
O4 - HKCU..\Run: [HydraVisionDesktopManager] C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
O4 - HKCU..\Run: [MP3 Skype Recorder] C:\Program Files (x86)\MP3 Skype Recorder\MP3 Skype Recorder.exe (Alexander Nikiforov)
O4 - HKCU..\Run: [RSD_HDDThermo] C:\Program Files (x86)\HDD Thermometer\HDD Thermometer.exe ()
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O4 - HKCU..\RunOnce: [FFTI] C:\Users\Veronica\AppData\Roaming\Mozilla\Firefox\Profiles\mi75hm47.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Users\Veronica\AppData\Roaming\Mozilla\Firefox\Profiles/mi75hm47.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}" File not found
O4 - Startup: C:\Users\Veronica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webshots.lnk = C:\Program Files (x86)\Webshots\Launcher.exe (Webshots.com)
O4 - Startup: C:\Users\Veronica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_74385989.lnk = File not found
O4 - Startup: C:\Users\Veronica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_83594569.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O8:64bit: - Extra context menu item: &Search - ?p=GRfox000 File not found
O8 - Extra context menu item: &Search - ?p=GRfox000 File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop...t/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} http://www.maricopa....in/mgaxctrl.cab (Autodesk MapGuide ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.55.2)
O16 - DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_45)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.55.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.2.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4FBEC332-55DA-4912-8DF7-4AB47DEDE417}: DhcpNameServer = 192.168.0.1 205.171.2.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4FBEC332-55DA-4912-8DF7-4AB47DEDE417}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FB6D127E-1638-46AA-BE60-19496E8DBAD3}: DhcpNameServer = 192.168.0.1 205.171.2.25
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Veronica\AppData\Roaming\Webshots\The Webshots Desktop\Webshots Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\Veronica\AppData\Roaming\Webshots\The Webshots Desktop\Webshots Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - Unable to obtain root file information for disk D:\
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2014/06/30 07:24:11 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Veronica\Desktop\OTL.exe
[2014/06/30 00:49:13 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard
[2014/06/30 00:49:12 | 000,000,000 | ---D | C] -- C:\cpqsystem
[2014/06/30 00:49:06 | 000,000,000 | ---D | C] -- C:\Windows\LastGood
[2014/06/29 21:21:52 | 000,000,000 | ---D | C] -- C:\Users\Veronica\Desktop\DriverMax Recommended Drivers
[2014/06/29 21:20:57 | 000,000,000 | ---D | C] -- C:\Users\Veronica\Desktop\AdAware Scans
[2014/06/29 21:11:58 | 000,000,000 | ---D | C] -- C:\Users\Veronica\Desktop\Old Firefox Data
[2014/06/29 19:30:27 | 000,000,000 | ---D | C] -- C:\Users\Veronica\AppData\Local\Innovative Solutions
[2014/06/29 19:30:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverMax
[2014/06/29 19:30:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Innovative Solutions
[2014/06/29 18:17:36 | 005,288,408 | ---- | C] (Innovative Solutions ) -- C:\Users\Veronica\Desktop\drivermax_7_34_cnet.exe
[2014/06/28 00:47:31 | 000,000,000 | ---D | C] -- C:\Users\Veronica\AppData\Roaming\ImgBurn
[2014/06/28 00:31:03 | 000,439,296 | ---- | C] (Sendori) -- C:\Windows\SysNative\plsapp64.dll
[2014/06/28 00:25:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
[2014/06/28 00:25:48 | 000,000,000 | ---D | C] -- C:\Users\Veronica\AppData\Roaming\OpenCandy
[2014/06/28 00:25:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ImgBurn
[2014/06/27 23:58:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Memory Test
[2014/06/27 23:56:06 | 003,469,871 | ---- | C] (LIGHTNING UK!) -- C:\Users\Veronica\Desktop\SetupImgBurn_2.5.8.0.exe
[2014/06/26 22:19:18 | 094,714,880 | ---- | C] (AVAST Software) -- C:\Users\Veronica\Desktop\avast_free_antivirus_setup.exe
[2014/06/25 21:13:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWMonitor
[2014/06/25 21:13:58 | 000,000,000 | ---D | C] -- C:\Program Files\HWMonitor
[2014/06/25 21:06:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed
[2014/06/25 21:06:39 | 000,000,000 | ---D | C] -- C:\Program Files\WhoCrashed
[2014/06/25 20:58:24 | 002,668,480 | ---- | C] (Resplendence Software Projects Sp. ) -- C:\Users\Veronica\Desktop\whocrashedSetup.exe
[2014/06/25 20:37:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NirSoft
[4 C:\Users\Veronica\Documents\*.tmp files -> C:\Users\Veronica\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/06/30 07:24:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Veronica\Desktop\OTL.exe
[2014/06/30 07:20:00 | 000,000,940 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2932777127-504153465-3726424614-1000UA.job
[2014/06/30 07:20:00 | 000,000,918 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2932777127-504153465-3726424614-1000Core.job
[2014/06/30 07:16:15 | 000,003,344 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014/06/30 07:16:15 | 000,003,344 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014/06/30 07:11:00 | 000,000,920 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2932777127-504153465-3726424614-1000UA.job
[2014/06/30 06:59:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/06/29 21:16:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/06/29 21:16:06 | 4025,667,584 | -HS- | M] () -- C:\hiberfil.sys
[2014/06/29 19:30:27 | 000,001,040 | ---- | M] () -- C:\Users\Veronica\Desktop\DriverMax.lnk
[2014/06/29 19:16:28 | 000,190,178 | ---- | M] () -- C:\Users\Veronica\Desktop\PitStop Results.jpg
[2014/06/29 18:17:38 | 005,288,408 | ---- | M] (Innovative Solutions ) -- C:\Users\Veronica\Desktop\drivermax_7_34_cnet.exe
[2014/06/28 10:10:00 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2932777127-504153465-3726424614-1000Core.job
[2014/06/28 00:25:52 | 000,001,699 | ---- | M] () -- C:\Users\Veronica\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
[2014/06/28 00:25:52 | 000,001,675 | ---- | M] () -- C:\Users\Public\Desktop\ImgBurn.lnk
[2014/06/27 23:56:07 | 003,469,871 | ---- | M] (LIGHTNING UK!) -- C:\Users\Veronica\Desktop\SetupImgBurn_2.5.8.0.exe
[2014/06/27 23:53:17 | 000,069,043 | ---- | M] () -- C:\Users\Veronica\Desktop\memtest86+-4.20.iso.zip
[2014/06/27 20:25:17 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2014/06/27 20:25:17 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2014/06/26 22:20:43 | 094,714,880 | ---- | M] (AVAST Software) -- C:\Users\Veronica\Desktop\avast_free_antivirus_setup.exe
[2014/06/25 21:21:48 | 000,158,387 | ---- | M] () -- C:\Users\Veronica\Desktop\Speedfan Results.jpg
[2014/06/25 21:17:34 | 000,000,045 | ---- | M] () -- C:\Windows\SysWow64\initdebug.nfo
[2014/06/25 21:00:26 | 001,141,408 | ---- | M] ( ) -- C:\Users\Veronica\Desktop\hwmonitor_1.25-setup.exe
[2014/06/25 20:58:26 | 002,668,480 | ---- | M] (Resplendence Software Projects Sp. ) -- C:\Users\Veronica\Desktop\whocrashedSetup.exe
[2014/06/25 20:36:29 | 000,141,480 | ---- | M] () -- C:\Users\Veronica\Desktop\bluescreenview_setup.exe
[2014/06/22 03:36:00 | 000,000,366 | ---- | M] () -- C:\Windows\tasks\Driver Robot.job
[2014/06/14 18:00:12 | 000,000,040 | ---- | M] () -- C:\Users\Veronica\Desktop\kcdx.m3u
[2014/06/10 21:53:41 | 000,002,112 | ---- | M] () -- C:\Users\Veronica\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2014/06/01 18:29:08 | 001,865,584 | ---- | M] () -- C:\Users\Veronica\Desktop\Swarovski crystal color chart Sept 2013.pdf
[4 C:\Users\Veronica\Documents\*.tmp files -> C:\Users\Veronica\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/06/29 19:30:27 | 000,001,040 | ---- | C] () -- C:\Users\Veronica\Desktop\DriverMax.lnk
[2014/06/29 19:16:27 | 000,190,178 | ---- | C] () -- C:\Users\Veronica\Desktop\PitStop Results.jpg
[2014/06/28 00:25:52 | 000,001,699 | ---- | C] () -- C:\Users\Veronica\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
[2014/06/28 00:25:52 | 000,001,687 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk
[2014/06/28 00:25:52 | 000,001,675 | ---- | C] () -- C:\Users\Public\Desktop\ImgBurn.lnk
[2014/06/28 00:09:15 | 001,839,104 | ---- | C] () -- C:\Users\Veronica\Desktop\mt420.iso
[2014/06/27 23:53:07 | 000,069,043 | ---- | C] () -- C:\Users\Veronica\Desktop\memtest86+-4.20.iso.zip
[2014/06/25 21:21:47 | 000,158,387 | ---- | C] () -- C:\Users\Veronica\Desktop\Speedfan Results.jpg
[2014/06/25 21:00:24 | 001,141,408 | ---- | C] ( ) -- C:\Users\Veronica\Desktop\hwmonitor_1.25-setup.exe
[2014/06/25 20:35:50 | 000,141,480 | ---- | C] () -- C:\Users\Veronica\Desktop\bluescreenview_setup.exe
[2014/06/14 17:59:05 | 000,000,040 | ---- | C] () -- C:\Users\Veronica\Desktop\kcdx.m3u
[2014/06/01 18:29:03 | 001,865,584 | ---- | C] () -- C:\Users\Veronica\Desktop\Swarovski crystal color chart Sept 2013.pdf
[2012/10/25 01:12:15 | 000,727,952 | ---- | C] () -- C:\Windows\SysWow64\WSCM64.dll
[2012/10/16 00:41:08 | 139,883,880 | ---- | C] () -- C:\Users\Veronica\Kaspersky Online Scanner.exe
[2012/06/13 09:21:43 | 000,151,166 | ---- | C] () -- C:\ProgramData\1339604266.bdinstall.bin
[2012/06/08 04:28:08 | 000,148,808 | ---- | C] () -- C:\ProgramData\1339154345.bdinstall.bin
[2012/06/07 20:55:06 | 000,224,937 | ---- | C] () -- C:\ProgramData\1339125945.bdinstall.bin
[2011/12/04 22:42:09 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010/10/18 22:10:03 | 000,000,732 | ---- | C] () -- C:\Users\Veronica\AppData\Local\d3d9caps64.dat
[2010/03/27 01:20:09 | 000,000,000 | ---- | C] () -- C:\Users\Veronica\AppData\Local\prvlcl.dat
[2009/09/03 17:56:18 | 000,072,080 | ---- | C] () -- C:\Users\Veronica\g2mdlhlpx.exe
[2008/10/27 04:41:56 | 000,007,649 | ---- | C] () -- C:\ProgramData\N360BUOptions.ini
[2008/10/20 06:09:47 | 000,000,139 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2008/09/03 08:32:00 | 000,000,873 | ---- | C] () -- C:\Program Files (x86)\WinRAR.lnk
[2008/08/30 21:45:48 | 000,001,356 | ---- | C] () -- C:\Users\Veronica\AppData\Local\d3d9caps.dat
[2008/08/29 04:24:49 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2008/08/28 17:13:44 | 000,189,952 | ---- | C] () -- C:\Users\Veronica\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 08:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014/03/25 09:30:37 | 012,900,864 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014/03/25 06:26:04 | 011,587,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/04/11 00:11:14 | 000,891,392 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/10 23:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008/01/20 19:50:58 | 000,513,024 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2008/12/16 15:27:35 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\agi
[2013/12/30 22:23:35 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Audacity
[2010/02/20 01:12:51 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\AVG9
[2011/08/15 18:28:14 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\BeadTool
[2011/08/18 13:11:50 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\BitTorrent
[2011/08/03 23:44:04 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Cache
[2010/03/14 01:17:24 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Desktopicon
[2013/07/14 23:35:00 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Dropbox
[2011/07/26 14:12:49 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\eFax Messenger
[2008/08/23 23:13:31 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\HDD Thermometer
[2014/06/29 02:19:12 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\ImgBurn
[2011/07/26 14:15:24 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\j2 Global
[2013/06/17 21:47:20 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Lawson
[2011/10/08 18:33:04 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\MP3SkypeRecorder
[2009/11/25 21:08:44 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\NCH Swift Sound
[2014/06/29 19:30:23 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\OpenCandy
[2013/10/29 21:25:05 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Oracle
[2009/03/18 14:23:42 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\OverDrive
[2012/06/07 20:21:43 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\QuickScan
[2009/10/20 03:59:29 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Recordpad
[2010/07/03 07:30:37 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Returnil
[2013/06/02 05:24:56 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Spotify
[2008/08/24 00:39:26 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Webshots
[2012/10/25 01:13:33 | 000,000,000 | ---D | M] -- C:\Users\Veronica\AppData\Roaming\Wondershare Video Converter Ultimate

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2011/10/24 15:21:29 | 000,010,039 | ---- | M] ()(C:\Users\Veronica\Documents\? Om Symbol.docx) -- C:\Users\Veronica\Documents\ॐ Om Symbol.docx
[2011/10/24 15:21:22 | 000,010,039 | ---- | C] ()(C:\Users\Veronica\Documents\? Om Symbol.docx) -- C:\Users\Veronica\Documents\ॐ Om Symbol.docx

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8

< End of report >

Next

We need to do a fix to delete some files using OTL

Double click on the to open the program. On Vista/Win7/Win8 right click select Run As Administrator to start the program. If prompted by UAC, please allow it.

Under the Custom Scans/Fixes box at the bottom, paste in the following

:COMMANDS
[CREATERESTOREPOINT]

:OTL

SRV:[b]64bit:[/b] - (VSSERV) -- C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe /service File not found
SRV:[b]64bit:[/b] - (UPDATESRV) -- C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe /service File not found
O2:[b]64bit:[/b] - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Windows\SysNative\plsapp64.dll (Sendori)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O4 - Startup: C:\Users\Veronica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_74385989.lnk =  File not found
O4 - Startup: C:\Users\Veronica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_83594569.lnk =  File not found
O4 - HKCU..\RunOnce: [FFTI] C:\Users\Veronica\AppData\Roaming\Mozilla\Firefox\Profiles\mi75hm47.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Users\Veronica\AppData\Roaming\Mozilla\Firefox\Profiles/mi75hm47.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}" File not found
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8

:Files
netsh int ip reset c:\resetlog.txt /c
ipconfig /flushdns /c
ipconfig /release /c
ipconfig /renew /c 
ipconfig /flushdns /c

:Commands

[emptytemp]
[resethosts]
[Purity]

Make sure all other windows are closed.
Click the Run Fix button at the top
Let the program run uninterrupted. The computer should reboot when the scan is done. If not, please reboot the computer.
Post the log that is found in C:\_OTL\Moved Files in your next reply.
Open OTL again and click the Quick Scan button.

In your next reply post.

1-OTL Fix Log after reboot that will pop up in front of you
2- New OTL After quick scan
3- Post the OTL Extra's log.

Thanks
Joe

#3
periwinkle

Posted 03 July 2014 - 01:11 AM

Member

Topic Starter
Member
298 posts

Hi Zep/Joe. This is the third time I've tried to post to this topic. I think one of the drivers I installed has messed up my ability to cut and paste. Every time I try to post the OTL logs, the post locks up and I can't do anything else or type or anything! Very frustrating. I'm so tired of these new drivers messing things up!

I am keeping AdAware and I will get rid of Avira eventually. So far, there haven't been any conflicts I'm aware of because I kept the old Avira that was compatible with AdAware. However, Avira does try to upgrade their software every single day and I have to cancel this automatic attempt to upgrade. AdAware has saved me countless times and I will not get rid of it. I have found it to be far more valuable than Avira, even though Avira is billed as an antivirus, and AdAware is mostly for cleaning off ad stuff.

I'm not sure what to do about the OTL logs, as the only other option I can think of is to attach the logs, but you've asked that I don't do that. This post locks up every single time I try to paste the contents of the file and in addition to that, my tabs stop responding and I have to close them and start over! I don't know what kind of driver "upgrade" does that! But it's the only explanation I can think of, as I just upgraded several drivers tonight and now weird stuff is happening. I'm really starting to wonder how bad off I could be with these old drivers if the new ones keep disabling the normal functioning of my computer.

Just to let you know, I will be out of town from 7/3 until 7/8, so please do not close this post. I might take my computer with me though, as I have a friend who is a computer engineer, writes code and know a bit about computer fixes. In the event I have the computer, I might be able to use it, but not sure at this point.

#4
periwinkle

Posted 03 July 2014 - 01:13 AM

Member

Topic Starter
Member
298 posts

Okay, so it worked this time! This is the Extras OTL log:

OTL Extras logfile created on: 7/2/2014 10:15:22 PM - Run 5

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Veronica\Desktop

64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 0.97 Gb Available Physical Memory | 25.92% Memory free

7.71 Gb Paging File | 3.75 Gb Available in Paging File | 48.69% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 580.72 Gb Total Space | 66.08 Gb Free Space | 11.38% Space Free | Partition Type: NTFS

Drive D: | 15.45 Gb Total Space | 7.90 Gb Free Space | 51.14% Space Free | Partition Type: NTFS

Computer Name: VERONICA-PC | User Name: Veronica | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (All) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.chm[@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)

.cpl[@ = cplfile] -- C:\Windows\SysNative\control.exe (Microsoft Corporation)

.hlp[@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.hta[@ = htafile] -- C:\Windows\SysWOW64\mshta.exe (Microsoft Corporation)

.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

.inf[@ = inffile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)

.ini[@ = inifile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

.js[@ = JSFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.jse[@ = JSEFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.reg[@ = regfile] -- C:\Windows\regedit.exe (Microsoft Corporation)

.txt[@ = txtfile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)

.vbe[@ = VBEFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.vbs[@ = VBSFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.wsf[@ = WSFFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

.wsh[@ = WSHFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.bat [@ = batfile] -- "%1" %*

.chm [@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)

.cmd [@ = cmdfile] -- "%1" %*

.com [@ = comfile] -- "%1" %*

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.exe [@ = exefile] -- "%1" %*

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.hta [@ = htafile] -- C:\Windows\SysWOW64\mshta.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

.inf [@ = inffile] -- C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)

.ini [@ = inifile] -- C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)

.url [@ = InternetShortcut] -- C:\Windows\SysWOW64\rundll32.exe (Microsoft Corporation)

.js [@ = JSFile] -- C:\Windows\SysWOW64\WScript.exe (Microsoft Corporation)

.jse [@ = JSEFile] -- C:\Windows\SysWOW64\WScript.exe (Microsoft Corporation)

.pif [@ = piffile] -- "%1" %*

.reg [@ = regfile] -- C:\Windows\SysWow64\regedit.exe (Microsoft Corporation)

.scr [@ = scrfile] -- "%1" /S

.txt [@ = txtfile] -- C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)

.vbe [@ = VBEFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

.vbs [@ = VBSFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

.wsf [@ = WSFFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

.wsh [@ = WSHFile] -- C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

batfile [open] -- "%1" %*

batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

chm.file [open] -- "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)

cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)

cmdfile [open] -- "%1" %*

cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htafile [open] -- C:\Windows\SysWOW64\mshta.exe "%1" %* (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

http [open] -- C:\PROGRA~2\WYZO\WYZO.EXE -requestPending -osint -url "%1"

https [open] -- C:\PROGRA~2\WYZO\WYZO.EXE -requestPending -osint -url "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

inffile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

inffile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

inifile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

inifile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

jsfile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)

jsfile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)

jsfile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)

jsefile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)

jsefile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)

jsefile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [edit] -- %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)

regfile [open] -- regedit.exe "%1" (Microsoft Corporation)

regfile [merge] -- Reg Error: Key error.

regfile [print] -- %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)

txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)

txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)

vbefile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

vbefile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

vbefile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

vbsfile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

vbsfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

vbsfile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

wsffile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)

wsffile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

wsffile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)

wshfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]