What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

"Choose program to open comes up" constantly, google may be

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
AVG has picked up some malware - which I have deleted, and Malware bytes shows a clean scan, but I cant seem to open anything unless I open it as an administrator. whatever I try to open - i get the choose a file to open with .. message. I think my wife may have accepted one of those bogus WIN 7 security warning messages. What to do? Many many thanks mkinaz
Post #2
Hi there lets have a look see - and see if I can locate the miscreant


Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

[external image: Posted Image]
Click the "Scan" button to start scan


[external image: Posted Image]
On completion of the scan click save log, save it to your desktop and post in your next reply

THEN

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click on Minimal Output at the top
  • Click on Scan all users
  • Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
  • Double click inside the Custom Scan box at the bottom
  • A window will appear saying "Click Ok to load a custom scan from a file or Cancel to cancel"
  • Click the Ok button and navigate to the file scan.txt which we just saved to your desktop
  • Select scan.txt and click Open. Writing will now appear under the Custom Scan box
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic
Post #3
Hello and thank you EssexBoy Here is as far as the aswMBR program got -… aswMBR version 0.9.4 Copyright© 2011 AVAST Software Run date: 2011-04-01 16:33:41 —————————– 16:33:41.362 OS Version: Windows 6.1.7600 16:33:41.362 Number of processors: 2 586 0x170A 16:33:41.363 ComputerName: KAREN8730WKS UserName: Karen 16:33:42.768 Initialze error I am running Windows 7 Ultimate Shall i continue as instructed below? Mark
Post #4
Hello,
I could not get the scan.txt link to open to a file - it opened to a "geeks to go page… http://www.geekstogo.com/forum/app=downloa…__showfile__395 ?

But I did run the OTL - and here are the txt files:

OTL logfile created on: 4/1/2011 4:44:01 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Karen\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 231.87 Gb Total Space | 156.47 Gb Free Space | 67.48% Space Free | Partition Type: NTFS
Drive D: | 1.00 Gb Total Space | 0.98 Gb Free Space | 97.59% Space Free | Partition Type: FAT32

Computer Name: KAREN8730WKS | User Name: Karen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/01 16:43:16 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Karen\Downloads\OTL.exe
PRC - [2011/03/25 14:52:11 | 000,912,344 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/03/25 13:17:46 | 003,984,384 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgui.exe
PRC - [2011/01/30 16:00:37 | 000,016,824 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe
PRC - [2011/01/07 01:22:44 | 001,084,256 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/01/06 15:23:18 | 006,128,720 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2010/12/05 16:26:40 | 000,654,176 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/05 16:26:12 | 000,650,592 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2010/10/22 04:56:58 | 000,845,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2009/10/30 22:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2009/08/18 02:36:36 | 000,348,160 | —- | M] (AMD) – C:\Windows\System32\atieclxx.exe
PRC - [2009/08/18 02:36:08 | 000,176,128 | —- | M] (AMD) – C:\Windows\System32\atiesrxx.exe
PRC - [2009/07/13 18:14:42 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2009/03/09 22:47:48 | 000,492,904 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
PRC - [2009/03/09 22:47:47 | 000,447,848 | —- | M] (DisplayLink Corp.) – C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe
PRC - [2008/08/26 19:02:24 | 000,014,336 | —- | M] (Agere Systems) – C:\Program Files\LSI SoftModem\agrsmsvc.exe
PRC - [2008/06/12 12:21:06 | 001,164,536 | —- | M] (AuthenTec, Inc.) – c:\Program Files\Fingerprint Sensor\AtService.exe
PRC - [2008/05/28 13:27:52 | 000,090,112 | —- | M] (Andrea Electronics Corporation) – C:\Windows\System32\AEADISRV.EXE
PRC - [2008/04/30 17:06:32 | 000,036,864 | —- | M] (CMS ProductsE Inc.) – C:\Program Files\CMS Products\BounceBack Professional\BBWatcherService.exe
PRC - [2006/10/23 05:50:35 | 000,046,640 | —- | M] (AOL LLC) – C:\Program Files\Common Files\aol\acs\AOLacsd.exe


========== Modules (SafeList) ==========

MOD - [2011/04/01 16:43:16 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Karen\Downloads\OTL.exe
MOD - [2010/08/20 22:21:32 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/01/06 15:23:18 | 006,128,720 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\avgwdsvc.exe – (avgwd)
SRV - [2010/04/13 09:38:01 | 001,343,400 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2009/08/18 02:36:08 | 000,176,128 | —- | M] (AMD) [Auto | Running] – C:\Windows\System32\atiesrxx.exe – (AMD External Events Utility)
SRV - [2009/08/07 12:43:04 | 000,045,816 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/07/13 18:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 18:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/03/09 22:47:47 | 000,447,848 | —- | M] (DisplayLink Corp.) [Auto | Running] – C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe – (DisplayLinkService)
SRV - [2008/08/26 19:02:24 | 000,014,336 | —- | M] (Agere Systems) [Auto | Running] – C:\Program Files\LSI SoftModem\agrsmsvc.exe – (AgereModemAudio)
SRV - [2008/06/12 12:21:06 | 001,164,536 | —- | M] (AuthenTec, Inc.) [Auto | Running] – c:\Program Files\Fingerprint Sensor\AtService.exe – (ATService)
SRV - [2008/05/28 13:27:52 | 000,090,112 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\System32\AEADISRV.EXE – (AEADIFilters)
SRV - [2008/04/30 17:06:32 | 000,036,864 | —- | M] (CMS ProductsE Inc.) [Auto | Running] – C:\Program Files\CMS Products\BounceBack Professional\BBWatcherService.exe – (BBWatcherService)
SRV - [2006/10/23 05:50:35 | 000,046,640 | —- | M] (AOL LLC) [Auto | Running] – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe – (AOL ACS)


========== Driver Services (SafeList) ==========

DRV - [2010/12/08 04:12:38 | 000,251,728 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2010/11/12 13:19:38 | 000,299,984 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2010/09/13 15:27:54 | 000,025,680 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\AVGIDSEH.Sys – (AVGIDSEH)
DRV - [2010/09/07 03:48:56 | 000,034,384 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2010/09/07 03:48:50 | 000,026,064 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\avgrkx86.sys – (Avgrkx86)
DRV - [2010/08/03 15:24:18 | 000,021,072 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2010/08/03 15:24:16 | 000,123,472 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2010/08/03 15:24:12 | 000,030,288 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2010/02/26 20:34:18 | 000,025,656 | —- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\hpdskflt.sys – (hpdskflt)
DRV - [2010/02/26 20:33:56 | 000,033,848 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Accelerometer.sys – (Accelerometer)
DRV - [2010/01/13 16:36:40 | 006,755,840 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NETw5s32.sys – (NETw5s32) Intel®
DRV - [2009/08/18 03:48:06 | 004,994,560 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2009/07/13 18:19:10 | 000,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vmbus.sys – (vmbus)
DRV - [2009/07/13 18:19:10 | 000,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vmstorfl.sys – (storflt)
DRV - [2009/07/13 18:19:10 | 000,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\storvsc.sys – (storvsc)
DRV - [2009/07/13 17:18:07 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WSDPrint.sys – (WSDPrintDevice)
DRV - [2009/07/13 16:52:10 | 000,014,336 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\vwifimp.sys – (vwifimp)
DRV - [2009/07/13 16:51:11 | 000,034,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2009/07/13 16:28:47 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vms3cap.sys – (s3cap)
DRV - [2009/07/13 16:28:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\VMBusHID.sys – (VMBusHID)
DRV - [2009/07/13 16:12:52 | 000,030,720 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tpm.sys – (TPM)
DRV - [2009/06/18 15:33:44 | 004,233,728 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\NETw5v32.sys – (NETw5v32) Intel®
DRV - [2009/04/20 14:38:54 | 000,009,344 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\CPQBttn.sys – (HBtnKey)
DRV - [2009/03/09 22:48:20 | 000,367,728 | —- | M] (DisplayLink Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\dlkmd.sys – (dlkmd)
DRV - [2009/03/09 22:48:20 | 000,013,424 | —- | M] (DisplayLink Corp.) [Kernel | Boot | Stopped] – C:\Windows\system32\drivers\dlkmdldr.sys – (dlkmdldr)
DRV - [2008/11/21 21:53:40 | 001,204,128 | —- | M] (Agere Systems) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2008/11/21 09:53:44 | 000,220,288 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1y6032.sys – (e1yexpress) Intel®
DRV - [2008/11/05 23:20:24 | 000,048,128 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2008/10/11 15:56:00 | 000,045,056 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2008/07/29 15:41:36 | 000,038,400 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2008/06/12 14:40:50 | 000,477,696 | —- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ATSwpWDF.sys – (ATSwpWDF)
DRV - [2006/12/20 01:08:00 | 000,047,616 | —- | M] (RICOH Company, Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\rismc32.sys – (rismc32)
DRV - [2006/11/29 15:24:57 | 000,033,588 | —- | M] (America Online, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wanatw4.sys – (wanatw) WAN Miniport (ATW)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL LLC)


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F1 2D AD 46 DF C8 CB 01 [binary data]
IE - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.defaulturl: "http://search.aol.com/aolcom/search?invocationType=tb50ffTB50CLie7&query="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.sendperfectcards.com"
FF - prefs.js..extensions.enabledItems: {7affbfae-c4e2-4915-8c0f-00fa3ec610a1}:5.74.1.4793
FF - prefs.js..extensions.enabledItems: zoomext@starfield:1.1
FF - prefs.js..extensions.enabledItems: wbepaste@starfield:1.1
FF - prefs.js..extensions.enabledItems: {267F1BF5-F6F5-476A-89B2-866A2E781B91}:1.9.1
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p="

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/08/14 10:58:37 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/03/31 21:57:19 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/25 14:52:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/25 14:52:13 | 000,000,000 | —D | M]

[2010/01/01 16:24:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Karen\AppData\Roaming\Mozilla\Extensions
[2011/03/31 22:26:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Karen\AppData\Roaming\Mozilla\Firefox\Profiles\r33rjzp5.default\extensions
[2010/01/01 16:24:03 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Karen\AppData\Roaming\Mozilla\Firefox\Profiles\r33rjzp5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/01/01 18:43:32 | 000,000,000 | —D | M] ("AOL Toolbar") – C:\Users\Karen\AppData\Roaming\Mozilla\Firefox\Profiles\r33rjzp5.default\extensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1}
[2010/01/01 18:43:36 | 000,002,263 | —- | M] () – C:\Users\Karen\AppData\Roaming\Mozilla\Firefox\Profiles\r33rjzp5.default\searchplugins\aol-search.xml
[2011/03/31 21:04:38 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/02/09 09:55:40 | 000,000,000 | —D | M] (Starfield Zoom) – C:\Program Files\Mozilla Firefox\extensions\zoomext@starfield
[2011/03/31 21:57:19 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2010/02/09 09:55:40 | 000,000,000 | —D | M] (WBE Paste) – C:\PROGRAM FILES\STARFIELD\WEB-BASED EMAIL TOOLS
[2010/01/26 11:02:09 | 000,000,000 | —D | M] (XULRunner) – C:\USERS\KAREN\APPDATA\LOCAL\{267F1BF5-F6F5-476A-89B2-866A2E781B91}
[2008/06/17 23:43:04 | 000,086,016 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/11/20 13:34:44 | 000,218,624 | —- | M] (Starfield Technology, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npwbe.dll

O1 HOSTS File: ([2006/09/18 14:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AOL Toolbar Loader) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL LLC)
O3 - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\aol\1250461112\ee\aolsoftware.exe (AOL LLC)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\soundmax.exe (Analog Devices, Inc.)
O4 - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000..\Run: [ePaster] C:\Program Files\Email Ideas\Epaster\EmailIdeas ePaster.exe (EmailIdeas.com)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\Windows\System32\cmd.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Karen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BounceBack Launcher.lnk = C:\Program Files\CMS Products\BounceBack Professional\BBStartup.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1549388737-3676839149-1627991844-1000\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/31 22:14:13 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/03/31 22:14:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/31 22:14:09 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/03/31 21:57:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2011/03/31 21:55:48 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\AVG
[2011/03/31 21:15:32 | 000,000,000 | —D | C] – C:\Windows\Sun
[2011/03/27 08:16:49 | 000,000,000 | —D | C] – C:\Users\Karen\Documents\poWErhouseNETWORKinggrouptrifold
[2011/03/21 11:27:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/03/18 12:49:47 | 000,000,000 | —D | C] – C:\Users\Karen\Documents\3-25BoardAgenda
[2011/03/06 17:33:07 | 000,000,000 | —D | C] – C:\Users\Karen\Documents\P1160853

========== Files - Modified Within 30 Days ==========

[2011/04/01 12:33:00 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/04/01 09:52:04 | 000,624,178 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/04/01 09:52:04 | 000,106,522 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/04/01 09:51:55 | 000,009,728 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/01 09:51:55 | 000,009,728 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/01 09:50:48 | 110,570,922 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2011/04/01 09:44:20 | 2387,816,448 | -HS- | M] () – C:\hiberfil.sys
[2011/04/01 09:40:31 | 000,000,000 | —- | M] () – C:\Users\Karen\defogger_reenable
[2011/03/31 22:14:13 | 000,001,095 | —- | M] () – C:\Users\Karen\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/03/31 21:57:22 | 000,000,923 | —- | M] () – C:\Users\Public\Desktop\AVG 2011.lnk
[2011/03/31 21:46:15 | 000,001,790 | -HS- | M] () – C:\Users\Karen\AppData\Local\85c41t1n5cbla04i6352uvj1206w3hx3tpr218awhu85420
[2011/03/31 21:42:34 | 000,001,798 | -HS- | M] () – C:\ProgramData\85c41t1n5cbla04i6352uvj1206w3hx3tpr218awhu85420
[2011/03/31 09:56:27 | 017,844,046 | —- | M] () – C:\Users\Karen\Documents\EaglesCall3-31-11.wav
[2011/03/30 19:53:40 | 000,001,316 | -HS- | M] () – C:\Users\Karen\AppData\Local\152u4fdc2g
[2011/03/30 19:53:40 | 000,001,316 | -HS- | M] () – C:\ProgramData\152u4fdc2g
[2011/03/28 13:28:41 | 000,078,295 | —- | M] () – C:\Users\Karen\Documents\oliviawomackinvoice.pdf
[2011/03/27 08:16:49 | 000,048,462 | —- | M] () – C:\Users\Karen\Documents\poWErhouseNETWORKinggrouptrifold.zip
[2011/03/23 01:00:00 | 000,473,734 | —- | M] () – C:\Users\Karen\Documents\Mathnasuimcard8a.jpg
[2011/03/23 01:00:00 | 000,472,504 | —- | M] () – C:\Users\Karen\Documents\Mathnasuimcard8b.jpg
[2011/03/22 17:59:02 | 000,123,653 | —- | M] () – C:\Users\Karen\Documents\PortraitMenu.pdf
[2011/03/21 11:27:03 | 000,000,969 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/03/21 11:06:54 | 000,008,512 | -HS- | M] () – C:\Users\Karen\AppData\Local\uk18fi747v81qli728h37w8s1uvgd
[2011/03/21 11:06:54 | 000,008,512 | -HS- | M] () – C:\ProgramData\uk18fi747v81qli728h37w8s1uvgd
[2011/03/19 16:58:37 | 000,264,513 | —- | M] () – C:\Users\Karen\Documents\WENflyeremail.jpg
[2011/03/18 13:51:06 | 000,743,960 | —- | M] () – C:\Users\Karen\Desktop\KJs SOC Map.png
[2011/03/18 12:49:46 | 000,199,584 | —- | M] () – C:\Users\Karen\Documents\3-25BoardAgenda.zip
[2011/03/16 20:49:38 | 000,001,984 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/03/09 21:35:13 | 000,033,648 | —- | M] () – C:\Users\Karen\Documents\OwnersReportFEB2011.pdf
[2011/03/09 16:26:16 | 000,007,684 | —- | M] () – C:\Users\Karen\Documents\behr6.jpg
[2011/03/09 16:23:18 | 000,007,594 | —- | M] () – C:\Users\Karen\Documents\behr5.jpg
[2011/03/09 16:22:56 | 000,009,311 | —- | M] () – C:\Users\Karen\Documents\behr4.jpg
[2011/03/09 16:04:57 | 000,009,389 | —- | M] () – C:\Users\Karen\Documents\behr images3.jpg
[2011/03/09 16:04:42 | 000,010,654 | —- | M] () – C:\Users\Karen\Documents\behr images2.jpg
[2011/03/09 16:04:18 | 000,002,997 | —- | M] () – C:\Users\Karen\Documents\behr images.jpg
[2011/03/09 15:36:06 | 000,027,935 | —- | M] () – C:\Users\Karen\Documents\1292613241-30207709-tickets.pdf
[2011/03/07 11:10:07 | 000,007,697 | —- | M] () – C:\Users\Karen\Documents\mathnasiumimage3.jpg
[2011/03/07 11:08:51 | 000,008,513 | —- | M] () – C:\Users\Karen\Documents\mathnasiumimage2.jpg
[2011/03/07 11:08:26 | 000,007,912 | —- | M] () – C:\Users\Karen\Documents\mathnasiumcenter.jpg
[2011/03/07 11:08:02 | 000,010,667 | —- | M] () – C:\Users\Karen\Documents\mathimage7.jpg
[2011/03/07 11:06:34 | 000,008,719 | —- | M] () – C:\Users\Karen\Documents\mathimage6.jpg
[2011/03/07 11:05:52 | 000,010,772 | —- | M] () – C:\Users\Karen\Documents\mathimage5.jpg
[2011/03/07 11:02:34 | 000,012,216 | —- | M] () – C:\Users\Karen\Documents\mathimage4.jpg
[2011/03/07 11:01:58 | 000,009,997 | —- | M] () – C:\Users\Karen\Documents\mathimage3.jpg
[2011/03/07 11:01:14 | 000,009,946 | —- | M] () – C:\Users\Karen\Documents\mathimage2.jpg
[2011/03/07 11:00:55 | 000,010,891 | —- | M] () – C:\Users\Karen\Documents\Math image1.jpg
[2011/03/07 11:00:27 | 000,007,311 | —- | M] () – C:\Users\Karen\Documents\A+ Mathnasium image.jpg
[2011/03/06 17:33:05 | 000,063,919 | —- | M] () – C:\Users\Karen\Documents\P1160853.zip
[2011/03/06 12:12:47 | 000,184,634 | —- | M] () – C:\Users\Karen\Documents\CPK1.jpg
[2011/03/06 12:10:26 | 000,037,666 | —- | M] () – C:\Users\Karen\Documents\funfetti mix.jpg
[2011/03/06 12:08:47 | 000,004,211 | —- | M] () – C:\Users\Karen\Documents\dough.jpg
[2011/03/06 11:57:36 | 000,048,801 | —- | M] () – C:\Users\Karen\Documents\arynnn.jpg
[2011/03/06 11:56:44 | 000,026,067 | —- | M] () – C:\Users\Karen\Documents\arynn.jpg
[2011/03/04 17:11:30 | 000,506,327 | —- | M] () – C:\Users\Karen\Documents\Big_Card_Faq.pdf

========== Files Created - No Company Name ==========

[2011/04/01 09:50:48 | 110,570,922 | —- | C] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2011/04/01 09:40:31 | 000,000,000 | —- | C] () – C:\Users\Karen\defogger_reenable
[2011/03/31 22:14:13 | 000,001,095 | —- | C] () – C:\Users\Karen\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/03/31 21:57:22 | 000,000,923 | —- | C] () – C:\Users\Public\Desktop\AVG 2011.lnk
[2011/03/31 21:42:02 | 000,001,798 | -HS- | C] () – C:\ProgramData\85c41t1n5cbla04i6352uvj1206w3hx3tpr218awhu85420
[2011/03/31 21:42:02 | 000,001,790 | -HS- | C] () – C:\Users\Karen\AppData\Local\85c41t1n5cbla04i6352uvj1206w3hx3tpr218awhu85420
[2011/03/31 09:54:11 | 017,844,046 | —- | C] () – C:\Users\Karen\Documents\EaglesCall3-31-11.wav
[2011/03/30 19:53:40 | 000,001,316 | -HS- | C] () – C:\Users\Karen\AppData\Local\152u4fdc2g
[2011/03/30 19:53:40 | 000,001,316 | -HS- | C] () – C:\ProgramData\152u4fdc2g
[2011/03/28 13:28:39 | 000,078,295 | —- | C] () – C:\Users\Karen\Documents\oliviawomackinvoice.pdf
[2011/03/27 08:16:48 | 000,048,462 | —- | C] () – C:\Users\Karen\Documents\poWErhouseNETWORKinggrouptrifold.zip
[2011/03/24 21:11:13 | 000,473,734 | —- | C] () – C:\Users\Karen\Documents\Mathnasuimcard8a.jpg
[2011/03/24 21:11:13 | 000,472,504 | —- | C] () – C:\Users\Karen\Documents\Mathnasuimcard8b.jpg
[2011/03/22 17:59:00 | 000,123,653 | —- | C] () – C:\Users\Karen\Documents\PortraitMenu.pdf
[2011/03/21 11:27:03 | 000,000,969 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/03/21 11:02:46 | 000,008,512 | -HS- | C] () – C:\Users\Karen\AppData\Local\uk18fi747v81qli728h37w8s1uvgd
[2011/03/21 11:02:46 | 000,008,512 | -HS- | C] () – C:\ProgramData\uk18fi747v81qli728h37w8s1uvgd
[2011/03/18 12:49:44 | 000,199,584 | —- | C] () – C:\Users\Karen\Documents\3-25BoardAgenda.zip
[2011/03/15 19:15:34 | 000,264,513 | —- | C] () – C:\Users\Karen\Documents\WENflyeremail.jpg
[2011/03/09 21:35:12 | 000,033,648 | —- | C] () – C:\Users\Karen\Documents\OwnersReportFEB2011.pdf
[2011/03/09 16:26:15 | 000,007,684 | —- | C] () – C:\Users\Karen\Documents\behr6.jpg
[2011/03/09 16:23:17 | 000,007,594 | —- | C] () – C:\Users\Karen\Documents\behr5.jpg
[2011/03/09 16:22:56 | 000,009,311 | —- | C] () – C:\Users\Karen\Documents\behr4.jpg
[2011/03/09 16:04:57 | 000,009,389 | —- | C] () – C:\Users\Karen\Documents\behr images3.jpg
[2011/03/09 16:04:41 | 000,010,654 | —- | C] () – C:\Users\Karen\Documents\behr images2.jpg
[2011/03/09 16:04:16 | 000,002,997 | —- | C] () – C:\Users\Karen\Documents\behr images.jpg
[2011/03/09 15:36:06 | 000,027,935 | —- | C] () – C:\Users\Karen\Documents\1292613241-30207709-tickets.pdf
[2011/03/07 11:10:06 | 000,007,697 | —- | C] () – C:\Users\Karen\Documents\mathnasiumimage3.jpg
[2011/03/07 11:08:50 | 000,008,513 | —- | C] () – C:\Users\Karen\Documents\mathnasiumimage2.jpg
[2011/03/07 11:08:25 | 000,007,912 | —- | C] () – C:\Users\Karen\Documents\mathnasiumcenter.jpg
[2011/03/07 11:08:02 | 000,010,667 | —- | C] () – C:\Users\Karen\Documents\mathimage7.jpg
[2011/03/07 11:06:34 | 000,008,719 | —- | C] () – C:\Users\Karen\Documents\mathimage6.jpg
[2011/03/07 11:05:52 | 000,010,772 | —- | C] () – C:\Users\Karen\Documents\mathimage5.jpg
[2011/03/07 11:02:34 | 000,012,216 | —- | C] () – C:\Users\Karen\Documents\mathimage4.jpg
[2011/03/07 11:01:57 | 000,009,997 | —- | C] () – C:\Users\Karen\Documents\mathimage3.jpg
[2011/03/07 11:01:14 | 000,009,946 | —- | C] () – C:\Users\Karen\Documents\mathimage2.jpg
[2011/03/07 11:00:55 | 000,010,891 | —- | C] () – C:\Users\Karen\Documents\Math image1.jpg
[2011/03/07 11:00:26 | 000,007,311 | —- | C] () – C:\Users\Karen\Documents\A+ Mathnasium image.jpg
[2011/03/06 17:33:04 | 000,063,919 | —- | C] () – C:\Users\Karen\Documents\P1160853.zip
[2011/03/06 12:12:46 | 000,184,634 | —- | C] () – C:\Users\Karen\Documents\CPK1.jpg
[2011/03/06 12:10:26 | 000,037,666 | —- | C] () – C:\Users\Karen\Documents\funfetti mix.jpg
[2011/03/06 12:08:46 | 000,004,211 | —- | C] () – C:\Users\Karen\Documents\dough.jpg
[2011/03/06 11:57:35 | 000,048,801 | —- | C] () – C:\Users\Karen\Documents\arynnn.jpg
[2011/03/06 11:47:47 | 000,026,067 | —- | C] () – C:\Users\Karen\Documents\arynn.jpg
[2011/03/04 17:11:26 | 000,506,327 | —- | C] () – C:\Users\Karen\Documents\Big_Card_Faq.pdf
[2010/12/27 10:58:24 | 000,003,584 | —- | C] () – C:\Users\Karen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/14 10:49:32 | 000,231,189 | —- | C] () – C:\Windows\hpwins23.dat
[2010/05/20 22:29:27 | 000,000,000 | —- | C] () – C:\Users\Karen\AppData\Local\prvlcl.dat
[2010/01/26 11:02:10 | 000,000,000 | —- | C] () – C:\Users\Karen\AppData\Local\Txewotigiha.bin
[2010/01/26 11:02:09 | 000,000,120 | —- | C] () – C:\Users\Karen\AppData\Local\Csolo.dat
[2010/01/01 16:32:10 | 000,021,316 | —- | C] () – C:\Windows\System32\emptyregdb.dat
[2010/01/01 16:08:49 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2009/11/06 02:17:18 | 000,001,843 | —- | C] () – C:\Windows\hpwmdl23.dat
[2009/10/25 16:53:41 | 000,054,584 | —- | C] () – C:\Windows\System32\BBUninstall.exe
[2009/10/25 16:26:27 | 000,000,165 | —- | C] () – C:\Windows\QUICKEN.INI
[2009/09/27 14:05:54 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/16 15:09:16 | 000,000,335 | —- | C] () – C:\Windows\nsreg.dat
[2009/08/15 23:56:00 | 000,130,488 | —- | C] () – C:\Windows\hpoins21.dat
[2009/08/15 23:56:00 | 000,008,138 | —- | C] () – C:\Windows\hpomdl21.dat
[2009/08/15 21:23:59 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2009/07/13 21:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 21:33:53 | 000,410,008 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 19:05:48 | 000,624,178 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 19:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 19:05:48 | 000,106,522 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 19:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 19:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 19:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 17:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 16:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/18 19:29:04 | 000,197,654 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2009/06/10 14:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2009/02/18 17:55:22 | 000,294,912 | —- | C] () – C:\Windows\System32\ATIODE.exe
[2009/02/03 20:52:04 | 000,045,056 | —- | C] () – C:\Windows\System32\ATIODCLI.exe

========== LOP Check ==========

[2010/10/29 21:56:20 | 000,000,000 | —D | M] – C:\Users\Karen\AppData\Roaming\AVG10
[2010/06/14 20:03:31 | 000,000,000 | —D | M] – C:\Users\Karen\AppData\Roaming\Facebook
[2010/01/01 16:24:03 | 000,000,000 | —D | M] – C:\Users\Karen\AppData\Roaming\NeatScan To Office
[2010/01/01 16:24:03 | 000,000,000 | —D | M] – C:\Users\Karen\AppData\Roaming\ScanSoft
[2010/01/01 16:24:03 | 000,000,000 | —D | M] – C:\Users\Karen\AppData\Roaming\SplitTile
[2009/07/13 21:53:46 | 000,016,880 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C321E34

< End of report >


OTL Extras logfile created on: 4/1/2011 4:44:01 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Karen\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 231.87 Gb Total Space | 156.47 Gb Free Space | 67.48% Space Free | Partition Type: NTFS
Drive D: | 1.00 Gb Total Space | 0.98 Gb Free Space | 97.59% Space Free | Partition Type: FAT32

Computer Name: KAREN8730WKS | User Name: Karen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1549388737-3676839149-1627991844-1000\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02701F10-FD3D-31D2-7F6F-BC530229F8DB}" = ccc-core-static
"{0EF5BEA9-B9D3-46d7-8958-FB69A0BAEACC}" = Status
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{10DF8617-EE64-48C1-95BB-AD539313736D}" = EmailIdeas ePaster
"{1EC71BFB-01A3-4239-B6AF-B1AE656B15C0}" = TrayApp
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23425C47-30AD-6351-B33F-D80AC9855F35}" = Catalyst Control Center Core Implementation
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 17
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2E1B4B42-069F-4F53-9966-9B9B938D7FE5}" = HP Officejet 6500 E709 Series
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2FF8C687-DB7D-4adc-A5DC-57983EC25046}" = DeviceDiscovery
"{38DAE5F5-EC70-4aa5-801B-D11CA0A33B41}" = BPDSoftware
"{3B0F52AC-EF5C-4831-B221-06C782E41280}" = Quicken 2008
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E8DD348-4174-4fe8-8FDC-238AAFBD2488}" = HP Photosmart All-In-One Software 9.0
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{4C4B8FD4-169F-C6BD-3997-BE23C6EF6B3C}" = Catalyst Control Center Graphics Full Existing
"{53934D19-8B93-4A0A-BEB5-484F68F949B5}" = HP USB Docking Video
"{5561E29B-6CF6-41BB-8D52-8E2C7186C5DD}" = DisplayLink Core Software
"{57F60D52-630B-43C5-BD20-176F5CD4EED6}" = bpd_scan
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C853 Media Driver Ver.1.02.00.17
"{5C804423-4778-46A3-BD7A-BA6CB678043E}" = Catalyst Control Center Graphics Light
"{69D2AB07-7677-4B06-AD69-97DB81D0E326}" = Neat Mobile Scanner (Silver) Driver
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6CC080F1-2E00-41D5-BE47-A3BC784E9DFB}" = BPDSoftware_Ini
"{719C77D0-4985-9BDC-BC1E-8C289FB960BC}" = Catalyst Control Center Graphics Full New
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{92A51949-EE4C-466D-AAF0-99E74A49A63F}" = DocMgr
"{96B73EAF-7F91-5993-A531-C5300E2702E9}" = CCC Help English
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9EFCB34B-4DEC-6236-3055-3424A4A22CCC}" = Catalyst Control Center Graphics Previews Vista
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3276EED-22A1-4808-9AA3-88A451482E10}" = Catalyst Control Center - Branding
"{A3942004-F1ED-4099-B11F-E4AD507779E6}" = NeatScan To Office
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B3157109-D618-91D5-AE58-F2C62348CA9D}" = Catalyst Control Center InstallProxy
"{B3AEF776-7FFF-4C50-A402-9119E3849EE0}" = AVG 2011
"{BC878CA8-C42A-4602-9DE0-D6D2AA436009}" = Simplaz 123
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C23F7EB0-F535-473D-BC73-59B6CD8B98B2}" = Neat Mobile Scanner 2008 Driver
"{C5CFF65B-1E1E-489E-86E2-C2A3AF4C88D9}" = Web-Based Email Tools
"{C9E8FE8B-0060-1887-878A-E5F0FB6C11C4}" = Skins
"{D4E53304-1F6C-4111-9872-1BCD2CF5B642}" = AVG 2011
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{DC635845-46D3-404B-BCB1-FC4A91091AFA}" = SmartWebPrinting
"{DE13432E-F0C1-4842-A5BA-CC997DA72A70}" = 6500_E709_eDocs
"{E00D0356-B285-0752-C0BD-DAA059AC316D}" = ATI Catalyst Install Manager
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{EB4F7F66-05FA-C81E-0764-DD22E7A1BD8F}" = ccc-utility
"{EF0D2E55-6FE2-4e35-BE22-A742E85D84E3}" = PS_AIO_02_Software_min
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F226C1DA-66D7-4ABC-86B5-3F978A660EBF}" = AOL Mail and AIM Gadget
"{FECEF9D2-9D3D-449B-9EA4-CFA775C99464}" = AuthenTec Fingerprint System
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"AOL Emergency Connect Utility 1.0" = Uninstall AOL Emergency Connect Utility 1.0
"AOL Toolbar" = AOL Toolbar
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"AVG" = AVG 2011
"CCleaner" = CCleaner
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"CutePDF Writer Installation" = CutePDF Writer 2.8
"ENTERPRISER" = Microsoft Office Enterprise 2007
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Smart Web Printing" = HP Smart Web Printing 4.51
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Logitech Unifying" = Logitech Unifying Software 1.00
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"PROSet" = Intel® Network Connections Drivers
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Split and Tile Trial_is1" = Split and Tile Trial
"SpywareBlaster_is1" = SpywareBlaster 4.2
"ViewpointMediaPlayer" = Viewpoint Media Player

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1549388737-3676839149-1627991844-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{3964BECB-BE40-4F3E-914B-12C5F18D8AC2}" = BounceBack Professional
"Facebook Plug-In" = Facebook Plug-In
"GoToMeeting" = GoToMeeting 4.5.0.457

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >



Thanks- Mark.
Post #5
Once this is completed could you let me know if the problem persists

But first download this Programme to your desktop, right click and select install, nothing will appear to happen it will just do its job

THEN

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    [2010/01/26 11:02:09 | 000,000,000 | —D | M] (XULRunner) – C:\USERS\KAREN\APPDATA\LOCAL\{267F1BF5-F6F5-476A-89B2-866A2E781B91}
    O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
    [2011/03/31 21:46:15 | 000,001,790 | -HS- | M] () – C:\Users\Karen\AppData\Local\85c41t1n5cbla04i6352uvj1206w3hx3tpr218awhu85420
    [2011/03/31 21:42:34 | 000,001,798 | -HS- | M] () – C:\ProgramData\85c41t1n5cbla04i6352uvj1206w3hx3tpr218awhu85420
    [2011/03/30 19:53:40 | 000,001,316 | -HS- | M] () – C:\Users\Karen\AppData\Local\152u4fdc2g
    [2011/03/30 19:53:40 | 000,001,316 | -HS- | M] () – C:\ProgramData\152u4fdc2g
    [2011/03/21 11:06:54 | 000,008,512 | -HS- | M] () – C:\Users\Karen\AppData\Local\uk18fi747v81qli728h37w8s1uvgd
    [2011/03/21 11:06:54 | 000,008,512 | -HS- | M] () – C:\ProgramData\uk18fi747v81qli728h37w8s1uvgd
    [2011/03/30 19:53:40 | 000,001,316 | -HS- | C] () – C:\Users\Karen\AppData\Local\152u4fdc2g
    [2011/03/30 19:53:40 | 000,001,316 | -HS- | C] () – C:\ProgramData\152u4fdc2g
    [2011/03/31 21:42:02 | 000,001,798 | -HS- | C] () – C:\ProgramData\85c41t1n5cbla04i6352uvj1206w3hx3tpr218awhu85420
    [2011/03/31 21:42:02 | 000,001,790 | -HS- | C] () – C:\Users\Karen\AppData\Local\85c41t1n5cbla04i6352uvj1206w3hx3tpr218awhu85420
    [2011/03/21 11:02:46 | 000,008,512 | -HS- | C] () – C:\Users\Karen\AppData\Local\uk18fi747v81qli728h37w8s1uvgd
    [2011/03/21 11:02:46 | 000,008,512 | -HS- | C] () – C:\ProgramData\uk18fi747v81qli728h37w8s1uvgd
    [2010/01/26 11:02:10 | 000,000,000 | —- | C] () – C:\Users\Karen\AppData\Local\Txewotigiha.bin
    [2010/01/26 11:02:09 | 000,000,120 | —- | C] () – C:\Users\Karen\AppData\Local\Csolo.dat


    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI