Chrome can not access internet

Welcome to your place for tech questions! ( Log In or Join today ) Get answers from experts today. (it's 100% free) Virus removal forum

What the Tech > Spyware / Malware / Virus Removal > Virus, Spyware & Malware Removal

Chrome can not access internet, Internet Explorer works

Options

Makofan View Member Profile	Nov 10 2012, 10:41 AM Post #1
Authentic Member Group: Authentic Member Posts: 89 Joined: 9-December 05 Member No.: 45,810 Operating System: Windows XP	Problem: Chrome can not access internet. Removed it, then went to reinstall and Chrome Installer can not access internet The story: Last night, I was trying to speed up an old laptop, so I went into MSCONFIG and disabled on Startup most non-Microsoft tools. This morning, Chrome could not access the internet (I tried both google.ca and facebook.com). I reloaded MSCONFIG and set it back to defauts, rebooted, but have same problem. I tried Internet Explorer, and it worked. I checked Chrome settings for a proxy, but there was none set. I then uninstalled Chrome, and tried to reinstall, but the installer could not connect to the internet. I tried renaming the directories in Users\App Data\Google so it could recreate them, but no luck. At this point I suspected a virus attached to chrome, downloaded OTL and did a scan. Here are the logs. (PS - this is not a work computer,although it started out that way a long time ago - it was retired about 5 years ago). OTL OTL logfile created on: 11/10/2012 10:56:42 AM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\jhitchen\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 510.33 Mb Total Physical Memory \| 251.27 Mb Available Physical Memory \| 49.24% Memory free 1.22 Gb Paging File \| 0.93 Gb Available in Paging File \| 76.03% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 52.34 Gb Total Space \| 25.41 Gb Free Space \| 48.56% Space Free \| Partition Type: NTFS Drive E: \| 7.49 Gb Total Space \| 1.91 Gb Free Space \| 25.49% Space Free \| Partition Type: FAT32 Computer Name: HELEN-LAPTOPXP \| User Name: jhitchen \| Logged in as Administrator. Boot Mode: Normal \| Scan Mode: Current user Company Name Whitelist: Off \| Skip Microsoft Files: Off \| No Company Name Whitelist: On \| File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\jhitchen\Desktop\OTL.exe (OldTimer Tools) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\CCM\CcmExec.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Defender\MpCmdRun.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) PRC - C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) ========== Modules (No Company Name) ========== MOD - C:\WINDOWS\system32\pdfcmnnt.dll () ========== Services (SafeList) ========== SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation) SRV - (AdvancedSystemCareService5) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe (IObit) SRV - (cmdAgent) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO) SRV - (IMFservice) -- C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe (IObit) SRV - (MySQL) -- C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe () SRV - (nlsX86cc) -- C:\WINDOWS\system32\NLSSRV32.EXE (Nalpeiron Ltd.) SRV - (CrypKey License) -- C:\WINDOWS\system32\Crypserv.exe (CrypKey (Canada) Ltd.) SRV - (IntelliAdminRC4) -- C:\Program Files\IntelliAdmin4\Agent\Agent32.exe () SRV - (IntelliAdminRC3) -- C:\WINDOWS\IntelliAdminRC3\Agent32.exe () SRV - (CcmExec) -- C:\WINDOWS\system32\CCM\CcmExec.exe (Microsoft Corporation) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (WDICA) -- File not found DRV - (PDRFRAME) -- File not found DRV - (PDRELI) -- File not found DRV - (PDFRAME) -- File not found DRV - (PDCOMP) -- File not found DRV - (PCIDump) -- File not found DRV - (lbrtfdc) -- File not found DRV - (i2omgmt) -- File not found DRV - (Changer) -- File not found DRV - (Inspect) -- C:\WINDOWS\system32\drivers\inspect.sys (COMODO) DRV - (cmdHlp) -- C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO) DRV - (cmdGuard) -- C:\WINDOWS\system32\drivers\cmdGuard.sys (COMODO) DRV - (SWDUMon) -- C:\WINDOWS\system32\drivers\SWDUMon.sys () DRV - (FileMonitor) -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys () DRV - (UrlFilter) -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys (IObit.com) DRV - (RegFilter) -- C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys (IObit.com) DRV - (SmartDefragDriver) -- C:\WINDOWS\system32\drivers\SmartDefragDriver.sys () DRV - (RsFx0150) -- C:\WINDOWS\system32\drivers\RsFx0150.sys (Microsoft Corporation) DRV - (NetWorkX) -- C:\WINDOWS\system32\Ckldrv.sys () DRV - (NxDrv) -- C:\WINDOWS\system32\drivers\NxDrv.sys (SonicWALL Inc.) DRV - (SSLDrv) -- C:\WINDOWS\system32\drivers\SSLDrv.sys (SonicWALL Inc.) DRV - (prepdrvr) -- C:\WINDOWS\system32\CCM\PrepDrv.sys (Microsoft Corporation) DRV - (SEM43XX) -- C:\WINDOWS\system32\drivers\semwl5.SYS (Broadcom Corporation) DRV - (SEMWModem) -- C:\WINDOWS\system32\drivers\GCXX.sys (Broadcom Corporation) DRV - (SEMWWNIC) -- C:\WINDOWS\system32\drivers\GCXXNet.sys (Broadcom Corporation) DRV - (Sony_EricssonWWSC) -- C:\WINDOWS\system32\drivers\GCXXSC.sys (Broadcom Corporation) DRV - (STAC97) -- C:\WINDOWS\system32\drivers\stac97.sys (SigmaTel, Inc.) DRV - (DgiVecp) -- C:\WINDOWS\system32\drivers\DgivEcp.sys (DeviceGuys, Inc.) DRV - (RT2500) -- C:\WINDOWS\system32\drivers\RT2500.sys (Ralink Technology Inc.) DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation) DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.) DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.) DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea...ferrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea...amp;Form=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:55515 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://google.ca/" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: npNELaunch@sonicwall.com:4.0.0.78 FF - prefs.js..extensions.enabledItems: activegs@freetoolsassociation.com:3.3.433 FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:7.2.8 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll () FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\jhitchen\Application Data\Mozilla\plugins\npgoogletalk.dll (Google) FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\jhitchen\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll () FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C3949AC2-4B17-43ee-B4F1-D26B9D42404D}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/09/25 20:09:23 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/09/25 20:09:23 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/31 09:46:57 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/09/25 20:11:37 \| 000,000,000 \| ---D \| M] [2010/12/18 12:39:02 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Documents and Settings\jhitchen\Application Data\Mozilla\Extensions [2011/04/26 12:00:03 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Documents and Settings\jhitchen\Application Data\Mozilla\Firefox\Profiles\ewk4c1ve.default\extensions [2011/01/14 11:15:19 \| 000,000,000 \| ---D \| M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\jhitchen\Application Data\Mozilla\Firefox\Profiles\ewk4c1ve.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011/04/20 13:33:25 \| 000,000,000 \| ---D \| M] (ActiveGS) -- C:\Documents and Settings\jhitchen\Application Data\Mozilla\Firefox\Profiles\ewk4c1ve.default\extensions\activegs@freetoolsassociation.com [2010/12/23 17:55:04 \| 000,000,000 \| ---D \| M] (NetExtender Launcher) -- C:\Documents and Settings\jhitchen\Application Data\Mozilla\Firefox\Profiles\ewk4c1ve.default\extensions\npNELaunch@sonicwall.com [2011/10/23 20:02:49 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011/08/30 10:33:31 \| 000,000,000 \| ---D \| M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} [2011/10/23 20:02:51 \| 000,000,000 \| ---D \| M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011/12/31 09:46:56 \| 000,121,816 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012/09/25 20:07:42 \| 000,129,176 \| ---- \| M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2011/12/31 09:46:49 \| 000,002,252 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011/12/31 09:46:49 \| 000,002,040 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml ========== Chrome ========== CHR - homepage: http://www.google.com/ CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}, CHR - homepage: http://www.google.com/ CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\gcswf32.dll CHR - plugin: Shockwave Flash (Disabled) = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\jhitchen\Application Data\Mozilla\plugins\npgoogletalk.dll CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\jhitchen\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Acrobat 7.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java™ Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - Extension: YouTube = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\xChrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\ CHR - Extension: Google Search = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\xChrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\ CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\xChrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\ CHR - Extension: Gmail = C:\Documents and Settings\jhitchen\Local Settings\Application Data\Google\xChrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2011/05/27 09:47:36 \| 000,000,027 \| ---- \| M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4 - HKLM..\Run: [Windows Defender] c:\program files\windows defender\msascui.exe (Microsoft Corporation) O4 - HKCU..\Run: [Advanced SystemCare 5] C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html File not found O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html File not found O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html File not found O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html File not found O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - Reg Error: Value error. File not found O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - Reg Error: Value error. File not found O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - Reg Error: Value error. File not found O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - Reg Error: Value error. File not found O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - Reg Error: Value error. File not found O15 - HKCU\..Trusted Domains: ceu ([]http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.ca ([retail] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.co.uk ([retail] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.co.uk ([www] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([barracuda] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([emea] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([imagenet] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([otrs] https in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([printers] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([qcglobal] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([retail] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([sharepoint] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com ([www] http in Local intranet) O15 - HKCU\..Trusted Domains: crabtree-evelyn.com.au ([www] http in Local intranet) O15 - HKCU\..Trusted Domains: ctree.net ([ceu] https in Local intranet) O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\common\yinsthelper.dll (YInstStarter Class) O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1292274449669 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu...b?1292338430639 (MUWebControl Class) O16 - DPF: {6EEFD7B1-B26C-440D-B55A-1EC677189F30} https://ssl-vpn.crabtree-evelyn.com/NELX.cab (NELaunchCtrl Class) O16 - DPF: {79D6214F-CFCE-480F-9901-27950E78F1E6} https://ssl-vpn.crabtree-evelyn.com/MLWebCacheCleaner.cab (WebCacheCleaner Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Value error.) O16 - DPF: {A6A216EB-4F7C-11D5-8438-0000B456BA3D} https://ssl-vpn.crabtree-evelyn.com/go/http....1/matn5250.cab (Matn5250 Control) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ctree.net O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{229DEDE7-1FA9-45BA-9DCE-E936DC02BA69}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{229DEDE7-1FA9-45BA-9DCE-E936DC02BA69}: NameServer = 8.26.56.26,156.154.70.22 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DDCA5D3E-086B-4F59-920A-F0FEB7E3F2FD}: NameServer = 8.26.56.26,156.154.70.22 O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/01/19 17:55:21 \| 000,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk ) O35 - HKLM\..comfile [open] -- "%1" % O35 - HKLM\..exefile [open] -- "%1" %* O35 - HKCU\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKCU\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012/11/10 10:54:42 \| 000,602,112 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\jhitchen\Desktop\OTL.exe [2012/11/10 10:25:28 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Google [2012/11/09 18:18:24 \| 000,000,000 \| ---D \| C] -- C:\WINDOWS\pss [2012/10/28 13:54:12 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Java [2012/10/28 13:53:32 \| 000,246,760 \| ---- \| C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe [2012/10/28 13:53:12 \| 000,174,056 \| ---- \| C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe [2012/10/28 13:53:12 \| 000,174,056 \| ---- \| C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe [2012/10/28 13:53:12 \| 000,093,672 \| ---- \| C] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll ========== Files - Modified Within 30 Days ========== [2012/11/10 11:10:12 \| 000,000,990 \| ---- \| M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-801793170-613679141-314601362-1984UA.job [2012/11/10 10:54:52 \| 000,602,112 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\jhitchen\Desktop\OTL.exe [2012/11/10 10:36:03 \| 000,000,890 \| ---- \| M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012/11/10 10:35:10 \| 000,000,330 \| -H-- \| M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job [2012/11/10 10:30:00 \| 000,000,886 \| ---- \| M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012/11/10 10:14:28 \| 000,000,286 \| ---- \| M] () -- C:\WINDOWS\tasks\SmartDefrag_Startup.job [2012/11/10 10:13:41 \| 000,000,284 \| ---- \| M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-801793170-613679141-314601362-1984.job [2012/11/10 10:13:32 \| 000,000,280 \| ---- \| M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-18.job [2012/11/10 10:13:32 \| 000,000,276 \| ---- \| M] () -- C:\WINDOWS\tasks\ASC4_PerformanceMonitor.job [2012/11/10 10:13:29 \| 000,002,206 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2012/11/10 10:13:24 \| 000,000,453 \| ---- \| M] () -- C:\WINDOWS\SMSCFG.ini [2012/11/10 10:12:53 \| 000,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2012/11/09 19:03:03 \| 000,000,938 \| ---- \| M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-801793170-613679141-314601362-1984Core.job [2012/11/09 18:22:55 \| 000,000,327 \| RHS- \| M] () -- C:\boot.ini [2012/11/04 11:04:03 \| 000,573,942 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2012/11/04 11:04:03 \| 000,115,184 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2012/11/03 21:53:04 \| 000,000,292 \| ---- \| M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-801793170-613679141-314601362-1984.job [2012/10/28 13:52:48 \| 000,093,672 \| ---- \| M] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll [2012/10/28 13:52:45 \| 000,821,736 \| ---- \| M] (Oracle Corporation) -- C:\WINDOWS\System32\npDeployJava1.dll [2012/10/28 13:52:45 \| 000,746,984 \| ---- \| M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll [2012/10/28 13:52:45 \| 000,246,760 \| ---- \| M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe [2012/10/28 13:52:45 \| 000,174,056 \| ---- \| M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe [2012/10/28 13:52:45 \| 000,174,056 \| ---- \| M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe [2012/10/28 13:52:45 \| 000,143,872 \| ---- \| M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl ========== Files Created - No Company Name ========== [2012/11/10 10:25:34 \| 000,000,890 \| ---- \| C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012/11/10 10:25:33 \| 000,000,886 \| ---- \| C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012/07/03 19:19:14 \| 000,060,304 \| ---- \| C] () -- C:\Documents and Settings\jhitchen\g2mdlhlpx.exe [2011/09/24 12:15:53 \| 000,000,004 \| ---- \| C] () -- C:\WINDOWS\vx86036.dat [2011/09/24 12:14:55 \| 000,000,087 \| ---- \| C] () -- C:\WINDOWS\Crypkey.ini [2011/09/24 12:14:52 \| 000,023,360 \| ---- \| C] () -- C:\WINDOWS\System32\Ckldrv.sys [2011/09/24 12:14:52 \| 000,011,776 \| ---- \| C] () -- C:\WINDOWS\Ckrfresh.exe [2011/08/20 19:01:24 \| 000,021,840 \| ---- \| C] () -- C:\WINDOWS\System32\SIntfNT.dll [2011/08/20 19:01:24 \| 000,017,212 \| ---- \| C] () -- C:\WINDOWS\System32\SIntf32.dll [2011/08/20 19:01:23 \| 000,012,067 \| ---- \| C] () -- C:\WINDOWS\System32\SIntf16.dll [2011/08/20 18:25:21 \| 000,035,685 \| ---- \| C] () -- C:\WINDOWS\DIIUnin.dat [2011/08/20 15:13:13 \| 000,020,312 \| ---- \| C] () -- C:\WINDOWS\System32\RegistryDefragBootTime.exe [2011/07/10 13:30:57 \| 000,135,104 \| ---- \| C] () -- C:\WINDOWS\Tab16d20.dll [2011/07/10 13:30:57 \| 000,118,784 \| ---- \| C] () -- C:\WINDOWS\DLL32.DLL [2011/07/10 13:30:57 \| 000,118,784 \| ---- \| C] () -- C:\WINDOWS\dll2kusb.dll [2011/07/10 13:30:57 \| 000,048,176 \| ---- \| C] () -- C:\WINDOWS\Imp16d20.dll [2011/07/10 13:30:57 \| 000,028,672 \| ---- \| C] () -- C:\WINDOWS\System32\USBPRN.DLL [2011/07/10 13:30:57 \| 000,028,672 \| ---- \| C] () -- C:\WINDOWS\UninFolder.dll [2011/07/10 13:30:57 \| 000,028,672 \| ---- \| C] () -- C:\WINDOWS\SSTHUNK.DLL [2011/07/10 13:30:57 \| 000,024,576 \| ---- \| C] () -- C:\WINDOWS\NTFAX.EXE [2011/07/10 13:30:57 \| 000,012,800 \| ---- \| C] () -- C:\WINDOWS\SS16FT.DLL [2011/07/10 13:30:57 \| 000,011,079 \| ---- \| C] () -- C:\WINDOWS\LxUsbOpn.dll [2011/07/10 13:30:57 \| 000,002,770 \| ---- \| C] () -- C:\WINDOWS\SSDS32.INI [2011/07/10 13:30:57 \| 000,002,767 \| ---- \| C] () -- C:\WINDOWS\SSDEF32.INI [2011/07/10 13:30:57 \| 000,002,554 \| ---- \| C] () -- C:\WINDOWS\SSDS16.INI [2011/07/10 13:30:57 \| 000,002,478 \| ---- \| C] () -- C:\WINDOWS\ssnew05.ini [2011/07/10 13:30:57 \| 000,002,478 \| ---- \| C] () -- C:\WINDOWS\ssnew04.ini [2011/07/10 13:30:57 \| 000,002,477 \| ---- \| C] () -- C:\WINDOWS\ssnew01.ini [2011/07/10 13:30:57 \| 000,002,474 \| ---- \| C] () -- C:\WINDOWS\ssnew03.ini [2011/07/10 13:30:57 \| 000,002,474 \| ---- \| C] () -- C:\WINDOWS\ssnew02.ini [2011/07/10 13:30:57 \| 000,002,267 \| ---- \| C] () -- C:\WINDOWS\SSDEF16.INI [2011/07/10 13:30:57 \| 000,001,593 \| ---- \| C] () -- C:\WINDOWS\PORTEX16.DLL [2011/07/10 13:30:57 \| 000,000,272 \| ---- \| C] () -- C:\WINDOWS\MyScan.ini [2011/06/28 22:04:49 \| 000,169,808 \| ---- \| C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat [2011/06/16 10:43:43 \| 000,029,520 \| ---- \| C] () -- C:\WINDOWS\System32\SmartDefragBootTime.exe [2011/06/16 10:43:36 \| 000,013,496 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\SmartDefragDriver.sys [2011/05/24 10:31:56 \| 000,695,578 \| ---- \| C] () -- C:\WINDOWS\unins000.exe [2011/05/24 10:31:56 \| 000,001,208 \| ---- \| C] () -- C:\WINDOWS\unins000.dat [2011/05/14 21:56:07 \| 000,000,224 \| ---- \| C] () -- C:\WINDOWS\SIERRA.INI [2011/04/29 11:11:33 \| 000,000,218 \| ---- \| C] () -- C:\Documents and Settings\jhitchen\.recently-used.xbel [2011/04/26 12:09:47 \| 000,011,232 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys [2011/04/10 17:59:01 \| 000,000,664 \| ---- \| C] () -- C:\WINDOWS\System32\d3d9caps.dat [2011/04/06 11:04:52 \| 000,000,407 \| ---- \| C] () -- C:\WINDOWS\MORDOR.INI [2011/04/06 11:04:43 \| 000,002,573 \| ---- \| C] () -- C:\WINDOWS\WAVEMIX.INI [2011/04/06 11:04:26 \| 000,090,702 \| ---- \| C] () -- C:\WINDOWS\SETUP1.EXE [2011/04/02 21:03:50 \| 000,116,224 \| ---- \| C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2011/02/22 19:13:08 \| 000,030,208 \| ---- \| C] () -- C:\Documents and Settings\jhitchen\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011/01/02 13:48:35 \| 000,000,131 \| ---- \| C] () -- C:\Documents and Settings\jhitchen\Local Settings\Application Data\fusioncache.dat [2010/12/18 12:38:55 \| 000,000,000 \| ---- \| C] () -- C:\WINDOWS\nsreg.dat [2008/11/05 11:34:32 \| 000,003,942 \| RHS- \| C] () -- C:\Documents and Settings\jhitchen\ntuser.pol [2005/01/19 19:02:28 \| 000,021,439 \| RHS- \| C] () -- C:\Documents and Settings\All Users\ntuser.pol ========== ZeroAccess Check ========== [2005/01/21 12:25:42 \| 000,000,227 \| RHS- \| M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\System32\shdocvw.dll -- [2008/04/13 19:12:05 \| 001,499,136 \| ---- \| M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\System32\wbem\fastprox.dll -- [2009/02/09 07:10:48 \| 000,473,600 \| ---- \| M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\System32\wbem\wbemess.dll -- [2008/04/13 19:12:08 \| 000,273,920 \| ---- \| M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2011/08/20 14:52:31 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\IObit [2012/04/01 19:48:21 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\MyHeritage [2011/04/08 20:47:19 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\MySQL [2010/12/28 01:29:16 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Nitro PDF [2011/08/07 21:34:49 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Out of the Park Developments [2011/01/02 12:45:24 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\PMB Files [2012/04/21 10:04:48 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion [2011/04/21 20:20:28 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\RoboForm [2012/04/20 21:29:43 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Blackberry Desktop [2012/01/10 23:58:16 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\DAoC Portal [2010/12/28 01:26:01 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Downloaded Installations [2012/01/11 00:03:44 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Electronic Arts [2010/12/28 01:17:21 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Foxit Software [2011/04/29 11:08:59 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\gtk-2.0 [2011/06/23 14:55:30 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\HexWar Launcher [2011/12/04 10:58:12 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\IObit [2010/12/14 20:59:17 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Leadertech [2012/04/01 19:45:38 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\MyHeritage [2010/12/28 15:57:02 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Nitro PDF [2012/06/02 23:08:24 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Oracle [2011/08/07 21:35:27 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Out of the Park Developments [2011/05/20 18:02:58 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\Research In Motion [2011/04/21 20:23:43 \| 000,000,000 \| ---D \| M] -- C:\Documents and Settings\jhitchen\Application Data\RoboForm ========== Purity Check ========== ========== Custom Scans ========== < %USERPROFILE%\..\|smtmp;true;true;true /FP > < %temp%\smtmp\. /s > > < MD5 for: EXPLORER.DESIGNER.VB > [2009/12/21 10:28:26 \| 000,036,545 \| ---- \| M] () MD5=0BFA552D19A4A7F9130A71DFBBCB1407 -- C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.designer.vb [2009/12/21 10:28:26 \| 000,036,545 \| ---- \| M] () MD5=0BFA552D19A4A7F9130A71DFBBCB1407 -- C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.designer.vb < MD5 for: EXPLORER.EXE > [2008/04/13 19:12:19 \| 001,033,728 \| ---- \| M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe [2008/04/13 19:12:19 \| 001,033,728 \| ---- \| M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe [2008/04/13 19:12:19 \| 001,033,728 \| ---- \| M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2007/06/13 06:26:03 \| 001,033,216 \| ---- \| M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe [2007/06/13 05:23:07 \| 001,033,216 \| ---- \| M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [2004/08/04 00:56:50 \| 001,032,192 \| ---- \| M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe < MD5 for: EXPLORER.EXE.000 > [2004/08/04 00:56:50 \| 001,032,192 \| ---- \| M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe.000 < MD5 for: EXPLORER.EXE-02121B1A.PF > [2012/11/10 10:08:09 \| 000,045,248 \| ---- \| M] () MD5=B5D8B4813192279B515BF3E09D0F5D0F -- C:\WINDOWS\Prefetch\EXPLORER.EXE-02121B1A.pf < MD5 for: EXPLORER.RESX > [2009/12/21 10:28:26 \| 000,040,049 \| ---- \| M] () MD5=B16D2C77324DE7222CB0EA55C7B32784 -- C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.resx [2009/12/21 10:28:26 \| 000,040,049 \| ---- \| M] () MD5=B16D2C77324DE7222CB0EA55C7B32784 -- C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.resx < MD5 for: EXPLORER.SCF > [2001/08/23 07:00:00 \| 000,000,080 \| ---- \| M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 -- C:\WINDOWS\explorer.scf < MD5 for: EXPLORER.VB > [2009/12/21 10:28:26 \| 000,008,501 \| ---- \| M] () MD5=55808E7AF87B5C18B97707BEF8EBDDEA -- C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.vb [2009/12/21 10:28:26 \| 000,008,501 \| ---- \| M] () MD5=55808E7AF87B5C18B97707BEF8EBDDEA -- C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.vb < MD5 for: EXPLORER.VSTEMPLATE > [2009/12/21 10:28:26 \| 000,006,491 \| ---- \| M] () MD5=FB731348042E3356E2215A6747CE893C -- C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.vstemplate [2009/12/21 10:28:26 \| 000,006,491 \| ---- \| M] () MD5=FB731348042E3356E2215A6747CE893C -- C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.vstemplate < MD5 for: EXPLORER.ZIP > [2009/12/21 10:28:28 \| 000,024,306 \| ---- \| M] () MD5=1EFEA00EC1042E059C5602E46DA33421 -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ItemTemplates\VisualBasic\Windows Forms\1033\Explorer.zip [2006/03/06 22:48:08 \| 000,020,394 \| ---- \| M] () MD5=B469409C2B2A33C542190B720E11BD79 -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip < MD5 for: IEXPLORE.CHM > [2009/02/21 01:21:24 \| 000,529,818 \| ---- \| M] () MD5=1435F4731719DF5F57D17DC38196245D -- C:\WINDOWS\Help\iexplore.chm [2004/07/17 11:40:18 \| 000,204,810 \| ---- \| M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE -- C:\WINDOWS\ie7\iexplore.chm [2004/07/17 11:40:18 \| 000,204,810 \| ---- \| M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE -- C:\WINDOWS\ServicePackFiles\i386\iexplore.chm [2006/09/01 07:43:50 \| 000,503,758 \| ---- \| M] () MD5=652E46500C149D1DC948BF9CEA8C4933 -- C:\WINDOWS\ie8\iexplore.chm < MD5 for: IEXPLORE.EXE > [2009/06/29 02:25:31 \| 000,634,632 \| ---- \| M] (Microsoft Corporation) MD5=02E2754D3E566C11A4934825920C47DD -- C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\iexplore.exe [2009/04/25 00:27:50 \| 000,636,088 \| ---- \| M] (Microsoft Corporation) MD5=092A7F2B49A19ECCE5369D3CB2276148 -- C:\WINDOWS\ie7updates\KB972260-IE7\iexplore.exe [2009/06/29 03:35:10 \| 000,634,632 \| ---- \| M] (Microsoft Corporation) MD5=3CFC56F73D494FC1AA2B6E981DF15ACD -- C:\WINDOWS\ie7updates\KB982381-IE7\iexplore.exe [2008/04/13 19:12:22 \| 000,093,184 \| ---- \| M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 -- C:\WINDOWS\ServicePackFiles\i386\iexplore.exe [2009/02/27 23:54:41 \| 000,636,072 \| ---- \| M] (Microsoft Corporation) MD5=A251068640DDB69FD7805B57D89D7FF7 -- C:\WINDOWS\ie7updates\KB969897-IE7\iexplore.exe [2010/04/16 06:08:29 \| 000,634,648 \| ---- \| M] (Microsoft Corporation) MD5=B24A4E23A2FEDB6976EB04D334AD82B2 -- C:\WINDOWS\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe [2009/03/08 14:09:26 \| 000,638,816 \| ---- \| M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 \| 000,638,816 \| ---- \| M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\WINDOWS\ERDNT\cache\iexplore.exe [2009/03/08 14:09:26 \| 000,638,816 \| ---- \| M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\WINDOWS\system32\dllcache\iexplore.exe [2009/02/27 23:54:44 \| 000,636,088 \| ---- \| M] (Microsoft Corporation) MD5=BCD8E48709BE4A79606F0B6E8E9A6162 -- C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe [2009/04/25 00:27:39 \| 000,636,088 \| ---- \| M] (Microsoft Corporation) MD5=C0503FD8D163652735C1EE900672A75C -- C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe [2010/04/16 06:43:25 \| 000,634,656 \| ---- \| M] (Microsoft Corporation) MD5=C4BA5E36FB57F547117305BF1E0FE454 -- C:\WINDOWS\ie8\iexplore.exe [2007/08/13 17:43:56 \| 000,622,080 \| ---- \| M] (Microsoft Corporation) MD5=DE49B348A18369B4626FBA1D49B07FB4 -- C:\WINDOWS\ie7updates\KB963027-IE7\iexplore.exe [2004/08/04 00:56:52 \| 000,093,184 \| ---- \| M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 -- C:\WINDOWS\$NtServicePackUninstall$\iexplore.exe [2004/08/04 00:56:52 \| 000,093,184 \| ---- \| M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 -- C:\WINDOWS\ie7\iexplore.exe < MD5 for: IEXPLORE.EXE.000 > [2010/04/16 06:43:25 \| 000,634,656 \| ---- \| M] (Microsoft Corporation) MD5=C4BA5E36FB57F547117305BF1E0FE454 -- C:\WINDOWS\ie8\iexplore.exe.000 < MD5 for: IEXPLORE.EXE.MUI > [2009/03/08 14:21:44 \| 000,012,288 \| ---- \| M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 -- C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui [2009/03/08 14:21:44 \| 000,012,288 \| ---- \| M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 -- C:\Program Files\Internet Explorer\iexplore.exe.mui [2007/08/13 17:43:36 \| 000,573,440 \| ---- \| M] (Microsoft Corporation) MD5=B58D8A1C7EE0E922EC7D2616DA136FC3 -- C:\WINDOWS\ie8\iexplore.exe.mui < MD5 for: IEXPLORE.EXE-2D97EBE6.PF > [2012/11/10 10:23:57 \| 000,091,276 \| ---- \| M] () MD5=61F03D944D8591563F83E8B7AE73C0DB -- C:\WINDOWS\Prefetch\IEXPLORE.EXE-2D97EBE6.pf < MD5 for: IEXPLORE.HLP > [2001/08/23 07:00:00 \| 000,180,335 \| ---- \| M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 -- C:\WINDOWS\Help\iexplore.hlp < MD5 for: SERVICES > [2001/08/23 07:00:00 \| 000,007,116 \| ---- \| M] () MD5=95826940E657FE0567A8EC0F2A6AD11A -- C:\WINDOWS\system32\drivers\etc\services < MD5 for: SERVICES.EXE > [2009/02/06 06:06:24 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe [2008/04/13 19:12:34 \| 000,108,544 \| ---- \| M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe [2008/04/13 19:12:34 \| 000,108,544 \| ---- \| M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\ServicePackFiles\i386\services.exe [2009/02/06 12:14:03 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE -- C:\WINDOWS\$NtServicePackUninstall$\services.exe [2009/02/06 05:22:21 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD -- C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe [2009/02/06 06:11:05 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe [2009/02/06 06:11:05 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\ERDNT\cache\services.exe [2009/02/06 06:11:05 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe [2009/02/06 06:11:05 \| 000,110,592 \| ---- \| M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe [2004/08/04 00:56:56 \| 000,108,032 \| ---- \| M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 -- C:\WINDOWS\$NtUninstallKB956572_0$\services.exe < MD5 for: SERVICES.EXE.000 > [2004/08/04 00:56:56 \| 000,108,032 \| ---- \| M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 -- C:\WINDOWS\$NtServicePackUninstall$\services.exe.000 < MD5 for: SERVICES.H > [2011/03/31 14:36:18 \| 000,001,008 \| ---- \| M] () MD5=62DA1F2270CF73E0DA79DD0748D7E36B -- C:\Program Files\MySQL\MySQL Server 5.5\include\mysql\services.h < MD5 for: SERVICES.INI > [2011/04/26 23:06:08 \| 000,003,453 \| ---- \| M] () MD5=9972CC995D29D674065E8B2AEBB2F131 -- C:\Program Files\IObit\Advanced SystemCare 4\services.ini < MD5 for: SERVICES.LNK > [2011/08/20 14:26:07 \| 000,001,602 \| ---- \| M] () MD5=ED839B415989309AA476612E271F520B -- C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk < MD5 for: SERVICES.MSC > [2001/08/23 07:00:00 \| 000,033,464 \| ---- \| M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 -- C:\WINDOWS\system32\services.msc < MD5 for: WINLOGON.EXE > [2004/08/04 00:56:58 \| 000,502,272 \| ---- \| M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008/04/13 19:12:39 \| 000,507,904 \| ---- \| M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ERDNT\cache\winlogon.exe [2008/04/13 19:12:39 \| 000,507,904 \| ---- \| M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008/04/13 19:12:39 \| 000,507,904 \| ---- \| M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe < %SYSTEMDRIVE%\. > [2005/01/19 17:55:21 \| 000,000,000 \| ---- \| M] () -- C:\AUTOEXEC.BAT [2005/01/19 18:19:25 \| 000,000,211 \| ---- \| M] () -- C:\Boot.bak [2012/11/09 18:22:55 \| 000,000,327 \| RHS- \| M] () -- C:\boot.ini [2004/08/03 22:00:00 \| 000,260,272 \| RHS- \| M] () -- C:\cmldr [2005/01/19 17:55:21 \| 000,000,000 \| ---- \| M] () -- C:\CONFIG.SYS [2007/11/07 07:00:40 \| 000,017,734 \| ---- \| M] () -- C:\eula.1028.txt [2007/11/07 07:00:40 \| 000,017,734 \| ---- \| M] () -- C:\eula.1031.txt [2007/11/07 07:00:40 \| 000,010,134 \| ---- \| M] () -- C:\eula.1033.txt [2007/11/07 07:00:40 \| 000,017,734 \| ---- \| M] () -- C:\eula.1036.txt [2007/11/07 07:00:40 \| 000,017,734 \| ---- \| M] () -- C:\eula.1040.txt [2007/11/07 07:00:40 \| 000,000,118 \| ---- \| M] () -- C:\eula.1041.txt [2007/11/07 07:00:40 \| 000,017,734 \| ---- \| M] () -- C:\eula.1042.txt [2007/11/07 07:00:40 \| 000,017,734 \| ---- \| M] () -- C:\eula.2052.txt [2007/11/07 07:00:40 \| 000,017,734 \| ---- \| M] () -- C:\eula.3082.txt [2007/11/07 07:00:40 \| 000,001,110 \| ---- \| M] () -- C:\globdata.ini [2007/11/07 07:00:40 \| 000,000,843 \| ---- \| M] () -- C:\install.ini [2007/11/07 07:03:18 \| 000,076,304 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.1028.dll [2007/11/07 07:03:18 \| 000,096,272 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.1031.dll [2007/11/07 07:03:18 \| 000,091,152 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.1033.dll [2007/11/07 07:03:18 \| 000,097,296 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.1036.dll [2007/11/07 07:03:18 \| 000,095,248 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.1040.dll [2007/11/07 07:03:18 \| 000,081,424 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.1041.dll [2007/11/07 07:03:18 \| 000,079,888 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.1042.dll [2007/11/07 07:03:18 \| 000,075,792 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.2052.dll [2007/11/07 07:03:18 \| 000,096,272 \| ---- \| M] (Microsoft Corporation) -- C:\install.res.3082.dll [2005/01/19 17:55:21 \| 000,000,000 \| RHS- \| M] () -- C:\IO.SYS [2005/01/19 17:55:21 \| 000,000,000 \| RHS- \| M] () -- C:\MSDOS.SYS [2005/01/19 18:12:34 \| 000,047,564 \| RHS- \| M] () -- C:\NTDETECT.COM [2010/12/14 08:46:17 \| 000,250,048 \| RHS- \| M] () -- C:\ntldr [2012/11/10 10:12:50 \| 805,306,368 \| -HS- \| M] () -- C:\pagefile.sys [2008/12/22 12:08:27 \| 000,000,557 \| ---- \| M] () -- C:\Pltfrm2.ini [2007/11/07 07:00:40 \| 000,005,686 \| ---- \| M] () -- C:\vcredist.bmp [2007/11/07 07:09:22 \| 001,442,522 \| ---- \| M] () -- C:\VC_RED.cab [2007/11/07 07:12:28 \| 000,232,960 \| ---- \| M] () -- C:\VC_RED.MSI < %systemroot%\Fonts\.com > [2006/04/18 15:39:28 \| 000,026,040 \| ---- \| M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont [2006/06/29 14:53:56 \| 000,026,489 \| ---- \| M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont [2006/04/18 15:39:28 \| 000,029,779 \| ---- \| M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont [2006/06/29 14:58:52 \| 000,030,808 \| ---- \| M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\.dll > < %systemroot%\Fonts\.ini > [2005/01/19 17:54:57 \| 000,000,067 \| -HS- \| M] () -- C:\WINDOWS\Fonts\desktop.ini < %systemroot%\Fonts\.ini2 > < %systemroot%\Fonts\.exe > < %systemroot%\system32\spool\prtprocs\w32x86\.* > [2008/07/06 07:06:10 \| 000,089,088 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll [2007/04/09 13:23:54 \| 000,028,552 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll [2006/10/26 19:56:12 \| 000,033,104 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll [2008/07/06 05:50:03 \| 000,597,504 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe < %systemroot%\REPAIR\.bak1 > < %systemroot%\REPAIR\.ini > < %systemroot%\system32\.jpg > < %systemroot%\.jpg > < %systemroot%\.png > < %systemroot%\.scr > < %systemroot%\._sy > < %APPDATA%\Adobe\Update\.* > < %ALLUSERSPROFILE%\Favorites\. > < %APPDATA%\Microsoft\. > [2008/11/21 09:14:00 \| 000,001,538 \| -H-- \| M] () -- C:\Documents and Settings\jhitchen\Application Data\Microsoft\LastFlashConfig.WFC < %PROGRAMFILES%\. > < %APPDATA%\Update\. > < %systemroot%\. /mp /s > < %systemroot%\System32\config\.sav > [2005/01/19 11:27:10 \| 000,090,112 \| ---- \| M] () -- C:\WINDOWS\System32\config\default.sav [2005/01/19 11:27:10 \| 000,630,784 \| ---- \| M] () -- C:\WINDOWS\System32\config\software.sav [2005/01/19 11:27:10 \| 000,397,312 \| ---- \| M] () -- C:\WINDOWS\System32\config\system.sav < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\.lnk /x > [2010/12/14 09:00:32 \| 000,000,272 \| -HS- \| M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini < %systemroot%\system32\config\systemprofile\.dat /x > < %systemroot%\.config > < %systemroot%\system32\.db > < %PROGRAMFILES%\Internet Explorer\.dat > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\.lnk /x > [2008/11/05 11:34:56 \| 000,000,119 \| -HS- \| M] () -- C:\Documents and Settings\jhitchen\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini [2008/11/05 11:34:54 \| 000,000,079 \| ---- \| M] () -- C:\Documents and Settings\jhitchen\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf < %USERPROFILE%\Desktop\.exe > [2012/11/10 10:54:52 \| 000,602,112 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\jhitchen\Desktop\OTL.exe < %PROGRAMFILES%\Common Files\.* > < %systemroot%\.src > < %systemroot%\install\.* > < %systemroot%\system32\DLL\. > < %systemroot%\system32\HelpFiles\. > < %systemroot%\system32\rundll\. > < %systemroot%\winn32\. > < %systemroot%\Java\. > < %systemroot%\system32\test\. > < %systemroot%\system32\Rundll32\. > < %systemroot%\AppPatch\Custom\. > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > "NoAutoUpdate" = 0 "AUOptions" = 3 "ScheduledInstallDay" = 7 "ScheduledInstallTime" = 16 "NoAutoRebootWithLoggedOnUsers" = 1 "UseWUServer" = 1 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-12-14 17:04:14 ========== Alternate Data Streams ========== @Alternate Data Stream - 128 bytes -> C:\WINDOWS:nlsPreferences < End of report >

mowman View Member Profile	Nov 12 2012, 07:42 PM Post #3
SuperMember Group: Malware Team Posts: 2,644 Joined: 11-April 09 From: Stoke,England Member No.: 85,186 Operating System: vista home premium sp2	Hello, Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems. If you do not make a reply in 3 days, we will have to close your topic. You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page. Please take note of some guidelines for this fix: •Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix. •If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken. •Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself. •Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post Did you set this proxy? QUOTE IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:55515 Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools See this Link for programs that need to be disabled and instruction on how to disable them. Remember to re-enable them when we're done. Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt** in your next reply. If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections. NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion"* and no programs will run - please just reboot and that will resolve that error

mowman View Member Profile	Nov 14 2012, 04:47 AM Post #5
SuperMember Group: Malware Team Posts: 2,644 Joined: 11-April 09 From: Stoke,England Member No.: 85,186 Operating System: vista home premium sp2	Run OTL.exe Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL CODE :Services :Otl IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:55515 :Commands [emptytemp] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time ) Please download Malwarebytes Free from Here or Here Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select Perform quick scan, then click Scan. When the scan is complete, click OK, then Show Results to view the results. Be sure that everything is checked, and click Remove Selected . When completed, a log will open in Notepad. Please save it to a convenient location and post the results. Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot. Post the log please Next ESET Online Scanner I'd like us to scan your machine with ESET Online Scan Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time. Please don't go surfing while your resident protection is disabled! Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs. Hold down Control and click on the following link to open ESET OnlineScan in a new window. ESET OnlineScan Click the button. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps) Click on to download the ESET Smart Installer. Save it to your desktop. Double click on the icon on your desktop. Check Click the Start button. Accept any security warnings from your browser. Check Make sure that the option "Remove found threats" is not checked Push the Start button. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time. When the scan completes, push Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply. Push the Back button. Push Finish http://www.eset.com/onlinescan/ Also tell me how the computer is running now.

Makofan View Member Profile	Nov 16 2012, 10:53 PM Post #6
Authentic Member Group: Authentic Member Posts: 89 Joined: 9-December 05 Member No.: 45,810 Operating System: Windows XP	All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer\| /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Administrator.CTREE ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: jhitchen ->Temp folder emptied: 731 bytes ->Temporary Internet Files folder emptied: 1209047 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 237586321 bytes ->Flash cache emptied: 26987 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService ->Temp folder emptied: 896 bytes ->Temporary Internet Files folder emptied: 32902 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1291 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 294655 bytes Total Files Cleaned = 228.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 11162012_213031 Files\Folders moved on Reboot... PendingFileRenameOperations files... Registry entries deleted on Reboot... Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.11.16.11 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 jhitchen :: HELEN-LAPTOPXP [administrator] 11/16/2012 9:41:16 PM mbam-log-2012-11-16 (21-41-16).txt Scan type: Quick scan Scan options enabled: Memory \| Startup \| Registry \| File System \| Heuristics/Extra \| Heuristics/Shuriken \| PUP \| PUM Scan options disabled: P2P Objects scanned: 236804 Time elapsed: 7 minute(s), Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) C:\System Volume Information\_restore{6384A31F-AFC7-47E6-9F5D-3A707145970A}\RP223\A0029284.exe Win32/Adware.Bundlore application I can now download, install and surf the web with Chrome! Thank you very much, I am not sure what virus I had but I must have had one

mowman View Member Profile	Nov 17 2012, 07:01 PM Post #7
SuperMember Group: Malware Team Posts: 2,644 Joined: 11-April 09 From: Stoke,England Member No.: 85,186 Operating System: vista home premium sp2	You appear clean of infections,please do the following. ComboFix - Cleanup Time for some housekeeping Click Start...select Run from the menu. Copy and paste the following into the text entry box: Combofix /Uninstall Click the OK button. (See image below as reference.) Clean up with OTL: Double-click OTL.exe to start the program. Close all other programs apart from OTL as this step will require a reboot On the OTL main screen, press the CLEANUP button Say Yes to the prompt and then allow the program to reboot your computer. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 7 and save it to your desktop. Scroll down to where it says JDK 7 (JDK or JRE) Click the Download JRE button to the right Select the Windows platform from the dropdown menu. Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 7 with JavaFX 1 License Agreement". Click on Continue.The page will refresh. Click on the link to download Windows Offline Installation and save the file to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java. Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-7-windows-i586-p.exe to install the newest version. After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Temporary Files Window Click OK to leave the Java Control Panel. Here are some recommendations to help you stay clean. Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system. Visit Microsoft often to get the latest updates for your computer. http://www.update.microsoft.com/ Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must. Please read this article 'Safe Computing Practices'. So how did I get infected in the first place. please take a moment to read quietman7's excellent prevention tips in post 3 here Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection: Preventing Infections in the Future Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection: So How did I get infected? Miekies' prevention suggestions Hardening Windows Security - Part 1 & Part 2. Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology. Update Non-Microsoft Programs It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates. Thats it you are good to go.Safe surfing

mowman View Member Profile	Nov 19 2012, 07:47 PM Post #8
SuperMember Group: Malware Team Posts: 2,644 Joined: 11-April 09 From: Stoke,England Member No.: 85,186 Operating System: vista home premium sp2	Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a New Topic.

« Next Oldest · Virus, Spyware & Malware Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies	Topic Starter	Views	Last Action
Virus, Spyware & Malware Removal Internet Options	6	Steiner	2,955	19th November 2003 - 07:54 PM Last post by: cnm
Virus, Spyware & Malware Removal Internet Explorer Home Page Problem	7	alicets1979	2,332	1st April 2004 - 01:30 PM Last post by: Daemon
Virus, Spyware & Malware Removal Internet Explorer 12	23	tankengine	5,071	16th June 2004 - 03:55 PM Last post by: nellie2
Microsoft Windows™ Directory access denied	2	mtv75	1,004	18th February 2006 - 01:13 AM Last post by: mtv75
Virus, Spyware & Malware Removal Cant Use Internet Explorer	2	HIS_and_HERPIES	1,353	25th June 2004 - 04:13 AM Last post by: Daemon