What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Win32.pornpopup

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I had a problem with this earlier in the year which I thought had been cleared up but it has still carried on appearing in Spybot. I would appreciate any help, below is the OTL log, only one was opened, the only one I have named extras is from july.

OTL logfile created on: 08/10/2010 22:10:18 - Run 3
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Rebecca\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 48.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 55.66 Gb Total Space | 5.78 Gb Free Space | 10.38% Space Free | Partition Type: NTFS
Drive D: | 54.66 Gb Total Space | 39.75 Gb Free Space | 72.73% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: REBECCAS
Current User Name: Rebecca
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Rebecca\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Rebecca\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
PRC - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Rebecca\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\vbscript.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\wmiutils.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbemcomn.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\wbemdisp.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\wbemsvc.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\wbemprox.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\sxs.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\RpcRtRemote.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\ntdsapi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\linkinfo.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\fastprox.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (EhttpSrv) – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV:64bit: - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (clr_optimization_v4.0.30319_64) – C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (SBSDWSCService) – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (Microsoft Office Groove Audit Service) – C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (EPSON_EB_RPCV4_01) EPSON V5 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (epfwwfpr) – C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (eamon) – C:\Windows\SysNative\drivers\eamon.sys (ESET)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (BthAvrcp) – C:\Windows\SysNative\drivers\BthAvrcp.sys (CSR, plc)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (AgereSoftModem) – C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (pccsmcfd) – C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics, Inc.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 40 8A C6 A5 A8 35 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: [removed]:1.6.1
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.3
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/26 19:04:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/04/04 16:05:54 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/09/16 19:07:26 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/09/16 19:07:26 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009/10/22 19:40:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/04/04 16:05:55 | 000,000,000 | —D | M]

[2009/10/22 19:29:24 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Extensions
[2010/10/08 19:31:01 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions
[2010/09/11 22:14:46 | 000,000,000 | —D | M] (WOT) – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2009/10/22 20:09:03 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/09/11 22:14:46 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\[removed]
[2009/12/05 16:57:08 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\[removed]
[2009/11/25 19:43:45 | 000,002,171 | —- | M] () – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\searchplugins\bing.xml
[2009/11/25 20:07:24 | 000,000,938 | —- | M] () – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\searchplugins\facebook.xml
[2010/09/27 15:18:11 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/07/08 21:58:13 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/27 15:18:11 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/20 17:45:10 | 000,001,538 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/20 17:45:10 | 000,000,947 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/20 17:45:10 | 000,000,769 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/20 17:45:10 | 000,001,135 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EADM\Core.exe File not found
O4 - HKCU..\Run: [EPSON Stylus SX200 Series] C:\Windows\SysWow64\spool\DRIVERS\x64\3\E_IATIEFE.EXE File not found
O4 - HKCU..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\SysWow64\StikyNot.exe File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - Startup: C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk = C:\Program Files (x86)\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://www.tescophoto.com/wpp/tesco/app/ImageUploader5.cab (Image Uploader Control)
O16 - DPF: {6F0892F7-0D44-41C3-BF07-7599873FAA04} https://go.girlguiding.org.uk/crystalreport…tiveXViewer.cab (Crystal ActiveX Report Viewer Control 11.5)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/10/04 18:04:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2010/09/30 16:34:58 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\ks.sys
[2010/09/29 14:25:35 | 000,000,000 | —D | C] – C:\Users\Rebecca\Desktop\head shots
[2010/09/27 15:18:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2010/09/27 15:18:10 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2010/09/27 15:18:10 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2010/09/27 15:18:10 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2010/09/24 19:45:59 | 000,000,000 | —D | C] – C:\Users\Rebecca\Desktop\usb
[2010/09/15 16:17:40 | 002,441,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iertutil.dll
[1 C:\Users\Rebecca\Desktop\*.tmp files -> C:\Users\Rebecca\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/10/08 22:11:06 | 004,194,304 | -HS- | M] () – C:\Users\Rebecca\NTUSER.DAT
[2010/10/08 22:08:03 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/08 22:08:03 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/08 21:29:01 | 000,000,914 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2009438789-1772559375-2410452326-1001UA.job
[2010/10/08 21:11:01 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/08 19:29:00 | 000,000,862 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2009438789-1772559375-2410452326-1001Core.job
[2010/10/08 19:25:50 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/08 19:25:50 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/08 19:18:22 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/10/08 19:18:11 | 2312,110,080 | -HS- | M] () – C:\hiberfil.sys
[2010/10/08 15:40:41 | 012,924,721 | -H– | M] () – C:\Users\Rebecca\AppData\Local\IconCache.db
[2010/10/06 22:20:27 | 000,013,870 | —- | M] () – C:\Users\Rebecca\Desktop\personal statement.docx
[2010/10/06 18:51:01 | 000,867,328 | —- | M] () – C:\Users\Rebecca\Desktop\recruitment posterx2.pub
[2010/10/06 15:25:37 | 000,015,125 | —- | M] () – C:\Users\Rebecca\Desktop\Emergency contacts.docx
[2010/10/04 21:25:45 | 000,017,573 | —- | M] () – C:\Users\Rebecca\Desktop\Aileen Wuornos.docx
[2010/10/04 21:11:25 | 000,015,807 | —- | M] () – C:\Users\Rebecca\Desktop\How important were presidential and supreme court attitudes when considering the lack of progress for African American civil rights.docx
[2010/10/03 19:50:36 | 000,214,915 | —- | M] () – C:\Users\Rebecca\Desktop\six young men context.docx
[2010/10/01 18:40:51 | 000,105,748 | —- | M] () – C:\Users\Rebecca\Desktop\Ted Hughes.docx
[2010/09/28 22:13:50 | 000,015,184 | —- | M] () – C:\Users\Rebecca\Desktop\Consider Shelleys presentation of family and alienation.docx
[2010/09/27 21:43:09 | 000,022,720 | —- | M] () – C:\Users\Rebecca\Desktop\forensic.xlsx
[2010/09/23 21:29:47 | 000,002,411 | —- | M] () – C:\Users\Rebecca\Desktop\Google Chrome.lnk
[2010/09/22 19:49:10 | 000,014,562 | —- | M] () – C:\Users\Rebecca\Desktop\Jesse Owens.docx
[2010/09/20 21:17:27 | 000,013,812 | —- | M] () – C:\Users\Rebecca\Desktop\the souths black population by 1900.docx
[2010/09/12 15:51:53 | 000,577,024 | —- | M] () – C:\Users\Rebecca\Desktop\recruitment poster.pub
[2010/09/10 21:40:15 | 000,720,488 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/09/10 21:40:15 | 000,623,784 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/09/10 21:40:15 | 000,109,736 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/09/10 21:02:17 | 002,808,020 | —- | M] () – C:\Users\Rebecca\Desktop\DSCF0589.JPG
[1 C:\Users\Rebecca\Desktop\*.tmp files -> C:\Users\Rebecca\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/06 18:18:05 | 000,867,328 | —- | C] () – C:\Users\Rebecca\Desktop\recruitment posterx2.pub
[2010/10/03 20:38:52 | 000,017,573 | —- | C] () – C:\Users\Rebecca\Desktop\Aileen Wuornos.docx
[2010/10/03 19:50:35 | 000,214,915 | —- | C] () – C:\Users\Rebecca\Desktop\six young men context.docx
[2010/10/01 18:33:15 | 000,105,748 | —- | C] () – C:\Users\Rebecca\Desktop\Ted Hughes.docx
[2010/10/01 15:58:25 | 000,015,807 | —- | C] () – C:\Users\Rebecca\Desktop\How important were presidential and supreme court attitudes when considering the lack of progress for African American civil rights.docx
[2010/09/30 18:08:11 | 000,013,870 | —- | C] () – C:\Users\Rebecca\Desktop\personal statement.docx
[2010/09/29 21:12:00 | 000,015,125 | —- | C] () – C:\Users\Rebecca\Desktop\Emergency contacts.docx
[2010/09/27 21:11:42 | 000,022,720 | —- | C] () – C:\Users\Rebecca\Desktop\forensic.xlsx
[2010/09/23 20:09:16 | 000,015,184 | —- | C] () – C:\Users\Rebecca\Desktop\Consider Shelleys presentation of family and alienation.docx
[2010/09/22 19:24:23 | 000,014,562 | —- | C] () – C:\Users\Rebecca\Desktop\Jesse Owens.docx
[2010/09/16 16:50:49 | 000,013,812 | —- | C] () – C:\Users\Rebecca\Desktop\the souths black population by 1900.docx
[2010/09/10 21:46:11 | 002,882,001 | —- | C] () – C:\Users\Rebecca\Desktop\DSCF0386.JPG
[2010/09/10 21:02:13 | 002,808,020 | —- | C] () – C:\Users\Rebecca\Desktop\DSCF0589.JPG
[2010/04/04 20:20:53 | 000,722,802 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/04/02 16:15:10 | 000,000,097 | —- | C] () – C:\Windows\SysWow64\PICSDK.ini
[2010/04/02 16:08:31 | 000,000,025 | —- | C] () – C:\Windows\CDE SX200DEFGIPS.ini
[2009/12/05 21:59:39 | 000,000,604 | -H– | C] () – C:\Program Files (x86)\STST Notifier
[2009/10/27 16:53:09 | 000,000,059 | —- | C] () – C:\Windows\cdplayer.ini
[2009/10/25 19:26:24 | 000,036,352 | —- | C] () – C:\Users\Rebecca\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 22:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2010/02/13 21:12:50 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Audacity
[2010/04/02 20:40:21 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\EPSON
[2010/04/04 20:22:43 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Nokia
[2010/04/04 16:25:02 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\PC Suite
[2010/10/07 15:44:57 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Spotify
[2009/10/27 17:09:52 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Xilisoft Corporation
[2010/08/28 15:32:52 | 000,032,620 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/07/14 02:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2009/10/23 04:04:54 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2010/10/08 19:18:11 | 2312,110,080 | -HS- | M] () – C:\hiberfil.sys
[2010/10/08 19:18:14 | 3082,817,536 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 06:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 06:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 06:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 06:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 21:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 12:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 05:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini
[2009/12/05 21:59:39 | 000,000,604 | -H– | M] () – C:\Program Files (x86)\STST Notifier

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/10/22 19:23:17 | 000,000,221 | -HS- | M] () – C:\Users\Rebecca\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >
Post #2
Posted Image


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.



Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • [external image: Posted Image]
  • Then click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.


Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste".
Post #3
Hi, My computer seems to be running ok at the moment, just everytime I use spybot the popup appears. Below is the malwarebytes log, it didn't give me an option to remove anything as it said it did not detect any malware Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4794 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 11/10/2010 16:29:03 mbam-log-2010-10-11 (16-29-03).txt Scan type: Quick scan Objects scanned: 142567 Time elapsed: 4 minute(s), 44 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #5
Hi, I installed and updated a new copy of spybot. The old copy was detecting win32.pornpopup but the new copy is not. I'll keep an eye on it, Thanks for your help! :)
Post #7
Hi,
Sorry about this but I did a spybot check again this morning and the popup has reappeared! Do you think it could just be a problem with spybot?
I have done an OTL scan again and below is the log.
Thanks in anticipation

OTL logfile created on: 13/10/2010 17:05:46 - Run 4
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Rebecca\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 56.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 55.66 Gb Total Space | 6.25 Gb Free Space | 11.23% Space Free | Partition Type: NTFS
Drive D: | 54.66 Gb Total Space | 39.75 Gb Free Space | 72.73% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: REBECCAS
Current User Name: Rebecca
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Rebecca\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Users\Rebecca\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
PRC - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Rebecca\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (EhttpSrv) – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV:64bit: - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (clr_optimization_v4.0.30319_64) – C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (SBSDWSCService) – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (Microsoft Office Groove Audit Service) – C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (EPSON_EB_RPCV4_01) EPSON V5 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV:64bit: - (ZTEusbser6k) – C:\Windows\SysNative\DRIVERS\ZTEusbser6k.sys File not found
DRV:64bit: - (ZTEusbnmea) – C:\Windows\SysNative\DRIVERS\ZTEusbnmea.sys File not found
DRV:64bit: - (ZTEusbmdm6k) – C:\Windows\SysNative\DRIVERS\ZTEusbmdm6k.sys File not found
DRV:64bit: - (massfilter) – C:\Windows\SysNative\drivers\massfilter.sys File not found
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (epfwwfpr) – C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (eamon) – C:\Windows\SysNative\drivers\eamon.sys (ESET)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (BthAvrcp) – C:\Windows\SysNative\drivers\BthAvrcp.sys (CSR, plc)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (AgereSoftModem) – C:\Windows\SysNative\drivers\agrsm64.sys (LSI Corp)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (pccsmcfd) – C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics, Inc.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 40 8A C6 A5 A8 35 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: [removed]:1.6.1
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.3
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [removed]:1.0.7

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/26 19:04:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/04/04 16:05:54 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/09/16 19:07:26 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/09/16 19:07:26 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009/10/22 19:40:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/04/04 16:05:55 | 000,000,000 | —D | M]

[2009/10/22 19:29:24 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Extensions
[2010/10/13 16:18:49 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions
[2010/09/11 22:14:46 | 000,000,000 | —D | M] (WOT) – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2009/10/22 20:09:03 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/09/11 22:14:46 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\[removed]
[2009/12/05 16:57:08 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\[removed]
[2010/10/11 14:45:35 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\extensions\[removed]
[2009/11/25 19:43:45 | 000,002,171 | —- | M] () – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\searchplugins\bing.xml
[2009/11/25 20:07:24 | 000,000,938 | —- | M] () – C:\Users\Rebecca\AppData\Roaming\Mozilla\Firefox\Profiles\8xcxc1e5.default\searchplugins\facebook.xml
[2010/09/27 15:18:11 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/07/08 21:58:13 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/27 15:18:11 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/20 17:45:10 | 000,001,538 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/20 17:45:10 | 000,000,947 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/20 17:45:10 | 000,000,769 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/20 17:45:10 | 000,001,135 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EADM\Core.exe File not found
O4 - HKCU..\Run: [EPSON Stylus SX200 Series] C:\Windows\SysWow64\spool\DRIVERS\x64\3\E_IATIEFE.EXE File not found
O4 - HKCU..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\SysWow64\StikyNot.exe File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk = C:\Program Files (x86)\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://www.tescophoto.com/wpp/tesco/app/ImageUploader5.cab (Image Uploader Control)
O16 - DPF: {6F0892F7-0D44-41C3-BF07-7599873FAA04} https://go.girlguiding.org.uk/crystalreport…tiveXViewer.cab (Crystal ActiveX Report Viewer Control 11.5)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.VP60 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/10/12 15:09:45 | 000,000,000 | —D | C] – C:\Users\Rebecca\AppData\Roaming\Ashampoo
[2010/10/12 15:09:37 | 000,000,000 | —D | C] – C:\Users\Rebecca\AppData\Local\ashampoo
[2010/10/12 15:09:36 | 000,000,000 | —D | C] – C:\ProgramData\ashampoo
[2010/10/12 15:09:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\Ashampoo
[2010/10/11 20:29:18 | 000,000,000 | —D | C] – C:\Users\Rebecca\AppData\Local\Apple
[2010/10/11 20:28:35 | 000,000,000 | —D | C] – C:\Users\Rebecca\AppData\Local\Apple Computer
[2010/10/11 16:12:56 | 000,000,000 | —D | C] – C:\Users\Rebecca\AppData\Roaming\Program Files (x86)
[2010/10/11 15:39:13 | 000,000,000 | —D | C] – C:\Windows\SysWow64\SupportAppCB
[2010/10/04 18:04:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2010/09/30 16:34:58 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\ks.sys
[2010/09/29 14:25:35 | 000,000,000 | —D | C] – C:\Users\Rebecca\Desktop\head shots
[2010/09/27 15:18:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2010/09/27 15:18:10 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2010/09/27 15:18:10 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2010/09/27 15:18:10 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2010/09/24 19:45:59 | 000,000,000 | —D | C] – C:\Users\Rebecca\Desktop\usb
[2010/09/15 16:17:40 | 002,441,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iertutil.dll
[1 C:\Users\Rebecca\Desktop\*.tmp files -> C:\Users\Rebecca\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/10/13 17:08:43 | 004,194,304 | -HS- | M] () – C:\Users\Rebecca\NTUSER.DAT
[2010/10/13 17:08:01 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/13 16:29:11 | 000,000,914 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2009438789-1772559375-2410452326-1001UA.job
[2010/10/13 16:03:40 | 000,729,402 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/10/13 16:03:40 | 000,616,008 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/10/13 16:03:40 | 000,106,388 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/10/13 15:58:11 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/13 15:58:11 | 000,013,440 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/13 15:49:37 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/13 15:49:28 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/10/13 15:49:23 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/13 15:49:16 | 2312,110,080 | -HS- | M] () – C:\hiberfil.sys
[2010/10/12 22:26:44 | 012,993,768 | -H– | M] () – C:\Users\Rebecca\AppData\Local\IconCache.db
[2010/10/12 21:41:58 | 000,012,515 | —- | M] () – C:\Users\Rebecca\Desktop\How is Prior presented in the first 4 chapters of the Ghost Road.docx
[2010/10/12 17:05:11 | 000,001,286 | —- | M] () – C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/10/12 17:05:11 | 000,001,262 | —- | M] () – C:\Users\Rebecca\Desktop\Spybot - Search & Destroy.lnk
[2010/10/12 15:09:36 | 000,001,219 | —- | M] () – C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Ashampoo Burning Studio 6 FREE.lnk
[2010/10/12 15:09:36 | 000,001,195 | —- | M] () – C:\Users\Public\Desktop\Ashampoo Burning Studio 6 FREE.lnk
[2010/10/11 16:22:47 | 000,001,013 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/11 15:43:45 | 000,007,070 | —- | M] () – C:\NetworkCfg.xml
[2010/10/11 15:24:20 | 000,003,651 | —- | M] () – C:\Users\Rebecca\Desktop\Guide.png
[2010/10/11 14:54:03 | 004,152,896 | —- | M] () – C:\Users\Rebecca\Desktop\Bill Withers - Lean On Me2.mp3
[2010/10/11 14:47:19 | 004,292,472 | —- | M] () – C:\Users\Rebecca\Desktop\Bill Withers - Lean On Me [with lyrics].mp3
[2010/10/08 19:29:00 | 000,000,862 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2009438789-1772559375-2410452326-1001Core.job
[2010/10/06 22:20:27 | 000,013,870 | —- | M] () – C:\Users\Rebecca\Desktop\personal statement.docx
[2010/10/06 18:51:01 | 000,867,328 | —- | M] () – C:\Users\Rebecca\Desktop\recruitment posterx2.pub
[2010/10/06 15:25:37 | 000,015,125 | —- | M] () – C:\Users\Rebecca\Desktop\Emergency contacts.docx
[2010/10/04 21:25:45 | 000,017,573 | —- | M] () – C:\Users\Rebecca\Desktop\Aileen Wuornos.docx
[2010/10/04 21:11:25 | 000,015,807 | —- | M] () – C:\Users\Rebecca\Desktop\How important were presidential and supreme court attitudes when considering the lack of progress for African American civil rights.docx
[2010/10/03 19:50:36 | 000,214,915 | —- | M] () – C:\Users\Rebecca\Desktop\six young men context.docx
[2010/10/01 18:40:51 | 000,105,748 | —- | M] () – C:\Users\Rebecca\Desktop\Ted Hughes.docx
[2010/09/28 22:13:50 | 000,015,184 | —- | M] () – C:\Users\Rebecca\Desktop\Consider Shelleys presentation of family and alienation.docx
[2010/09/27 21:43:09 | 000,022,720 | —- | M] () – C:\Users\Rebecca\Desktop\forensic.xlsx
[2010/09/23 21:29:47 | 000,002,411 | —- | M] () – C:\Users\Rebecca\Desktop\Google Chrome.lnk
[2010/09/22 19:49:10 | 000,014,562 | —- | M] () – C:\Users\Rebecca\Desktop\Jesse Owens.docx
[2010/09/20 21:17:27 | 000,013,812 | —- | M] () – C:\Users\Rebecca\Desktop\the souths black population by 1900.docx
[1 C:\Users\Rebecca\Desktop\*.tmp files -> C:\Users\Rebecca\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/12 17:05:11 | 000,001,286 | —- | C] () – C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2010/10/12 17:05:11 | 000,001,262 | —- | C] () – C:\Users\Rebecca\Desktop\Spybot - Search & Destroy.lnk
[2010/10/12 16:28:41 | 000,012,515 | —- | C] () – C:\Users\Rebecca\Desktop\How is Prior presented in the first 4 chapters of the Ghost Road.docx
[2010/10/12 15:09:36 | 000,001,219 | —- | C] () – C:\Users\Rebecca\Application Data\Microsoft\Internet Explorer\Quick Launch\Ashampoo Burning Studio 6 FREE.lnk
[2010/10/12 15:09:36 | 000,001,195 | —- | C] () – C:\Users\Public\Desktop\Ashampoo Burning Studio 6 FREE.lnk
[2010/10/11 15:44:26 | 000,007,070 | —- | C] () – C:\NetworkCfg.xml
[2010/10/11 15:24:17 | 000,003,651 | —- | C] () – C:\Users\Rebecca\Desktop\Guide.png
[2010/10/11 14:54:00 | 004,152,896 | —- | C] () – C:\Users\Rebecca\Desktop\Bill Withers - Lean On Me2.mp3
[2010/10/11 14:47:08 | 004,292,472 | —- | C] () – C:\Users\Rebecca\Desktop\Bill Withers - Lean On Me [with lyrics].mp3
[2010/10/06 18:18:05 | 000,867,328 | —- | C] () – C:\Users\Rebecca\Desktop\recruitment posterx2.pub
[2010/10/03 20:38:52 | 000,017,573 | —- | C] () – C:\Users\Rebecca\Desktop\Aileen Wuornos.docx
[2010/10/03 19:50:35 | 000,214,915 | —- | C] () – C:\Users\Rebecca\Desktop\six young men context.docx
[2010/10/01 18:33:15 | 000,105,748 | —- | C] () – C:\Users\Rebecca\Desktop\Ted Hughes.docx
[2010/10/01 15:58:25 | 000,015,807 | —- | C] () – C:\Users\Rebecca\Desktop\How important were presidential and supreme court attitudes when considering the lack of progress for African American civil rights.docx
[2010/09/30 18:08:11 | 000,013,870 | —- | C] () – C:\Users\Rebecca\Desktop\personal statement.docx
[2010/09/29 21:12:00 | 000,015,125 | —- | C] () – C:\Users\Rebecca\Desktop\Emergency contacts.docx
[2010/09/27 21:11:42 | 000,022,720 | —- | C] () – C:\Users\Rebecca\Desktop\forensic.xlsx
[2010/09/23 20:09:16 | 000,015,184 | —- | C] () – C:\Users\Rebecca\Desktop\Consider Shelleys presentation of family and alienation.docx
[2010/09/22 19:24:23 | 000,014,562 | —- | C] () – C:\Users\Rebecca\Desktop\Jesse Owens.docx
[2010/09/16 16:50:49 | 000,013,812 | —- | C] () – C:\Users\Rebecca\Desktop\the souths black population by 1900.docx
[2010/04/04 20:20:53 | 000,722,802 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/04/02 16:15:10 | 000,000,097 | —- | C] () – C:\Windows\SysWow64\PICSDK.ini
[2010/04/02 16:08:31 | 000,000,025 | —- | C] () – C:\Windows\CDE SX200DEFGIPS.ini
[2009/12/05 21:59:39 | 000,000,604 | -H– | C] () – C:\Program Files (x86)\STST Notifier
[2009/10/27 16:53:09 | 000,000,059 | —- | C] () – C:\Windows\cdplayer.ini
[2009/10/25 19:26:24 | 000,036,352 | —- | C] () – C:\Users\Rebecca\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 22:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2010/10/12 15:09:45 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Ashampoo
[2010/10/11 15:05:20 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Audacity
[2010/04/02 20:40:21 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\EPSON
[2010/04/04 20:22:43 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Nokia
[2010/04/04 16:25:02 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\PC Suite
[2010/10/11 16:12:56 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Program Files (x86)
[2010/10/13 16:03:24 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Spotify
[2009/10/27 17:09:52 | 000,000,000 | —D | M] – C:\Users\Rebecca\AppData\Roaming\Xilisoft Corporation
[2010/08/28 15:32:52 | 000,032,620 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/07/14 02:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2009/10/23 04:04:54 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2010/10/13 15:49:16 | 2312,110,080 | -HS- | M] () – C:\hiberfil.sys
[2010/10/11 15:43:45 | 000,007,070 | —- | M] () – C:\NetworkCfg.xml
[2010/10/13 15:49:20 | 3082,817,536 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 06:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 06:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 06:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 06:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 21:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 12:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 05:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini
[2009/12/05 21:59:39 | 000,000,604 | -H– | M] () – C:\Program Files (x86)\STST Notifier

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/10/22 19:23:17 | 000,000,221 | -HS- | M] () – C:\Users\Rebecca\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >
Post #8
Click "Start"> "Run"> type in Regedit tap Enter Key

Make sure "My Computer" is highlighted

Click "Edit"> "Find"
Type in Pornpopup tap Enter Key.
Right Click on the file if found and select "Delete"

Tap the "F3" Key to find the next entry of the file. Continue using the "F3" Key until it's finished searching.

Close Regedit.


Empty Recycle Bin

Reboot and let me know how it's running.
Post #10
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :regfind
porn
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #11
Hi, this is the log SystemLook 04.09.10 by jpshortstuff Log created at 15:36 on 14/10/2010 by Rebecca Administrator - Elevation successful WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. ========== regfind ========== Searching for "porn" No data found. -= EOF =- Thanks for all your persistence with this - I'll be glad to get rid of the popup!
Post #14
I'd suggest running ATF cleaner daily. Note: You don't need to add the prefetch item in ATF other than the first time you run it. You're more than welcome. Glad we were able to help Peace be with you :wavey:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI