What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

IT Blonde-I simply don't know? [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hey harleighq,

First please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
*pcts*
:folderfind
*PC Tools*
:Regfind
PC Tools
  • Click the Look button to start the scan. This scan may take a few minutes so be patient.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Please rerun the OTL scan again and post in your next reply
Post #17
Hey Mithros, surprised to see you doing this on the weekend! Am gonna start feeling special , errr just not the special bus kinda special… 8 )

SystemLook 30.07.11 by jpshortstuff
Log created at 19:36 on 11/02/2012 by Raiph
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== filefind ==========

Searching for "*pcts*"
C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe –a—- 366840 bytes [02:42 23/01/2011] [21:02 15/03/2010] A1089AC7683826E6C7C9FAB9723DD80F
C:\Program Files (x86)\PC Tools Security\PCTSDInj64.sys –a—- 56480 bytes [02:42 23/01/2011] [19:49 01/09/2010] 15EC00AB66CDC085DF9707963F3118B0
C:\Program Files (x86)\PC Tools Security\pctsGui.exe –a—- 1589208 bytes [02:42 23/01/2011] [21:49 01/12/2010] 69F5C5105CCCBEF036E993B66E47F951
C:\Program Files (x86)\PC Tools Security\pctsGuiCore.dll –a—- 2961368 bytes [02:42 23/01/2011] [19:43 03/12/2010] 037F0635ED8A0D0511AD12AD0AF2F484
C:\Program Files (x86)\PC Tools Security\pctsSvc.exe –a—- 1150936 bytes [02:42 23/01/2011] [13:57 19/11/2010] ED6C2EFEB47524BFF4D5E5109FB1A2BB
C:\Program Files (x86)\PC Tools Security\avengine\PCTScanCloud.dll –a—- 396248 bytes [02:42 23/01/2011] [19:24 18/08/2010] 78056C9104C258CC47286D69CD8762DE
C:\Program Files (x86)\PC Tools Security\NetworkLayer\PCTSecUtility.dll –a—- 105432 bytes [02:42 23/01/2011] [00:58 11/08/2010] 13AED826A12B46E02880A539A2723CF1
C:\Program Files (x86)\PC Tools Security\NetworkLayer\PCTSecUtility64.dll –a—- 122328 bytes [02:42 23/01/2011] [00:58 11/08/2010] 851F1911C21A0BF45B22841A68418AAF

========== folderfind ==========

Searching for "*PC Tools*"
C:\Program Files (x86)\PC Tools Security d—— [02:42 23/01/2011]

========== Regfind ==========

Searching for "PC Tools"
[HKEY_CURRENT_USER\Software\Microsoft\IntelliPoint\AppSpecific\unins000.exe]
"Path"="C:\Program Files (x86)\PC Tools Security\unins000.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\730270d1_0]
@="{0.0.0.00000000}.{82b54604-0f48-4773-9ad9-326eda7a720f}|\Device\HarddiskVolume2\Program Files (x86)\PC Tools Security\pctsGui.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\8b10a225_0]
@="{0.0.0.00000000}.{85e8a1a0-c917-4a4c-beee-c4da57b098b2}|\Device\HarddiskVolume2\Program Files (x86)\PC Tools Security\pctsGui.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Doctor]
"DisplayIcon"="C:\Program Files (x86)\PC Tools Security\pctsGui.exe,1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Doctor]
"Publisher"="PC Tools"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Doctor]
"InstallLocation"="C:\Program Files (x86)\PC Tools Security\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Doctor]
"QuietUninstallString"="C:\Program Files (x86)\PC Tools Security\unins000.exe /SILENT /LOG"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Doctor]
"UninstallString"="C:\Program Files (x86)\PC Tools Security\unins000.exe /LOG"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spyware Doctor]
"UninstallName"="1:Spyware Doctor;16:PC Tools AntiVirus Free;17:Spyware Doctor with AntiVirus;273:PC Tools Internet Security"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PCTDS\0000]
"DeviceDesc"="PC Tools Data Store"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PCTEFA\0000]
"DeviceDesc"="PC Tools Extended File Attributes"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pctDS]
"DisplayName"="PC Tools Data Store"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pctEFA]
"DisplayName"="PC Tools Extended File Attributes"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sdAuxService]
"ImagePath"="C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sdAuxService]
"DisplayName"="PC Tools Auxiliary Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sdAuxService]
"Description"="Provides auxiliary PC Tools Security services. If this service is disabled spyware protection will be reduced."
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sdCoreService]
"ImagePath"="C:\Program Files (x86)\PC Tools Security\pctsSvc.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sdCoreService]
"DisplayName"="PC Tools Security Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_PCTDS\0000]
"DeviceDesc"="PC Tools Data Store"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_PCTEFA\0000]
"DeviceDesc"="PC Tools Extended File Attributes"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\pctDS]
"DisplayName"="PC Tools Data Store"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\pctEFA]
"DisplayName"="PC Tools Extended File Attributes"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\sdAuxService]
"ImagePath"="C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\sdAuxService]
"DisplayName"="PC Tools Auxiliary Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\sdAuxService]
"Description"="Provides auxiliary PC Tools Security services. If this service is disabled spyware protection will be reduced."
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\sdCoreService]
"ImagePath"="C:\Program Files (x86)\PC Tools Security\pctsSvc.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\sdCoreService]
"DisplayName"="PC Tools Security Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCTDS\0000]
"DeviceDesc"="PC Tools Data Store"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCTEFA\0000]
"DeviceDesc"="PC Tools Extended File Attributes"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pctDS]
"DisplayName"="PC Tools Data Store"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\pctEFA]
"DisplayName"="PC Tools Extended File Attributes"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sdAuxService]
"ImagePath"="C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sdAuxService]
"DisplayName"="PC Tools Auxiliary Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sdAuxService]
"Description"="Provides auxiliary PC Tools Security services. If this service is disabled spyware protection will be reduced."
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sdCoreService]
"ImagePath"="C:\Program Files (x86)\PC Tools Security\pctsSvc.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sdCoreService]
"DisplayName"="PC Tools Security Service"
[HKEY_USERS\S-1-5-21-2579811591-267507758-3394695187-1000\Software\Microsoft\IntelliPoint\AppSpecific\unins000.exe]
"Path"="C:\Program Files (x86)\PC Tools Security\unins000.exe"
[HKEY_USERS\S-1-5-21-2579811591-267507758-3394695187-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\730270d1_0]
@="{0.0.0.00000000}.{82b54604-0f48-4773-9ad9-326eda7a720f}|\Device\HarddiskVolume2\Program Files (x86)\PC Tools Security\pctsGui.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-2579811591-267507758-3394695187-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\8b10a225_0]
@="{0.0.0.00000000}.{85e8a1a0-c917-4a4c-beee-c4da57b098b2}|\Device\HarddiskVolume2\Program Files (x86)\PC Tools Security\pctsGui.exe%b{00000000-0000-0000-0000-000000000000}"

-= EOF =-

OTL SCAN Run

OTL logfile created on: 2/11/2012 7:46:55 PM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Raiph\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 1.72 Gb Available Physical Memory | 43.18% Memory free
7.98 Gb Paging File | 5.24 Gb Available in Paging File | 65.62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.41 Gb Total Space | 518.22 Gb Free Space | 55.64% Space Free | Partition Type: NTFS
Drive D: | 3.19 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: RAIPH-PC | User Name: Raiph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Raiph\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
PRC - C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe (PC Tools)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Ventrilo\Ventrilo.exe (Flagship Industries, Inc.)
PRC - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\SkinuxCmp.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\SkinuxCommon.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\SkinuxBase.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\SkinuxXML2.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\SkinuxIm.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\SkinuxProc.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\SkinuxFF.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\MEshim.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\areaifdll.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\ESCom.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\KFx.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\Atlas.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\kpries40.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\keml40.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\DibLibIP.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\LocCamBack.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\LocUpdateCheck.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\ESSkin.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\ESEmail.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\VistaAdapter.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\VistaPrintOnline.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\AppCore.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\VistaControls.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\Pcd.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\IStorageMediaStore.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\VistaCDBackup.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\UpdateChecker.esx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\DXRawFormatHandler.esx ()
MOD - C:\Program Files (x86)\Google\Google Desktop Search\gzlib.dll ()
MOD - \\?\C:\ProgramData\Microsoft\Windows\DRM\Cache\Indiv_SID_S-1-5-21-2579811591-267507758-3394695187-1000\Indiv01.key ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\AddIn\VistaPCD.cyx ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\AddIn\VPCD.dll ()
MOD - C:\Program Files (x86)\Kodak\Kodak EasyShare software\AddIn\LocVistaPCD.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Creative Media Toolbox 6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\MT6Licensing.exe (Creative Labs)
SRV - (Creative ALchemy AL6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (sdCoreService) – C:\Program Files (x86)\PC Tools Security\pctsSvc.exe (PC Tools)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (sdAuxService) – C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe (PC Tools)
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (Lbd) – C:\Windows\SysNative\drivers\Lbd.sys (Lavasoft AB)
DRV:64bit: - (PCTCore) – C:\Windows\SysNative\drivers\PCTCore64.sys (PC Tools)
DRV:64bit: - (pctEFA) – C:\Windows\SysNative\drivers\pctEFA64.sys (PC Tools)
DRV:64bit: - (ha20x22k) – C:\Windows\SysNative\drivers\ha20x22k.sys (Creative Technology Ltd)
DRV:64bit: - (ha20x2k) – C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) – C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) – C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) – C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) – C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) – C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) – C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) – C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) – C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) – C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) – C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) – C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (pctDS) – C:\Windows\SysNative\drivers\pctDS64.sys (PC Tools)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (LGBusEnum) – C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) – C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl (CyberLink Corp.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (CLBUDFR) – C:\Windows\SysWow64\drivers\CLBUDFR.sys (CyberLink Corporation.)
DRV - (CLBStor) – C:\Windows\SysWow64\drivers\CLBStor.sys (Cyberlink Co.,Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DB 95 7B 71 70 7B CA 01 [binary data]
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1167
FF - prefs.js..extensions.enabledItems: avg@igeared:6.010.006.004
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4cc0d5fe&v;=6.010.006.004&i;=23&tp;=ab&iy;=b&ychte;=ca&lng;=en-US&q;="


FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.0.198: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.0.198: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.0.198: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.0.198: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.0.198: c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/12/10 20:03:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/09/01 19:53:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/09/01 19:53:22 | 000,000,000 | —D | M]

[2010/05/02 13:59:03 | 000,000,000 | —D | M] (No name found) – C:\Users\Raiph\AppData\Roaming\mozilla\Extensions
[2010/05/01 00:13:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Raiph\AppData\Roaming\mozilla\Extensions\[removed]
[2012/01/26 14:06:19 | 000,000,000 | —D | M] (No name found) – C:\Users\Raiph\AppData\Roaming\mozilla\Firefox\Profiles\s816f9mm.default\extensions
[2010/07/21 22:55:40 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Raiph\AppData\Roaming\mozilla\Firefox\Profiles\s816f9mm.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/03/31 16:00:04 | 000,000,000 | —D | M] (Vuze Remote Community Toolbar) – C:\Users\Raiph\AppData\Roaming\mozilla\Firefox\Profiles\s816f9mm.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2012/01/26 14:06:21 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\Raiph\AppData\Roaming\mozilla\Firefox\Profiles\s816f9mm.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/03/31 16:00:05 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\Raiph\AppData\Roaming\mozilla\Firefox\Profiles\s816f9mm.default\extensions\[removed]

========== Chrome ==========

CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Raiph\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.4_0\
CHR - Extension: Vuze Remote = C:\Users\Raiph\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpijjmpahflnipadmlpgbjmagmjchkk\2.0.0.53_0\

O1 HOSTS File: ([2009/12/12 14:35:03 | 000,362,891 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 12469 more lines…
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll File not found
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll File not found
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files (x86)\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKCU..\Run: [PlayNC Launcher] File not found
O4 - HKLM..\RunOnceEx: [] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{817CDA6B-57E2-4D04-B9E9-E61D66470278}: DhcpNameServer = 192.168.1.254 [removed]
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOBCA7~1\GO36F4~1.DLL) -C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/03/13 02:53:34 | 000,000,052 | R— | M] () - D:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{28e7e6a1-df8b-11de-b493-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{28e7e6a1-df8b-11de-b493-806e6f6e6963}\Shell\AutoRun\command - "" = D:\AionLauncher.exe /Close
O33 - MountPoints2\{4eca89c0-024a-11df-9cf7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4eca89c0-024a-11df-9cf7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\LAUNCH.EXE – [2007/02/19 14:37:28 | 000,045,056 | R— | M] (Eastman Kodak)
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/11 10:32:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\GuffinsEI
[2012/02/10 13:34:29 | 000,000,000 | —D | C] – C:\_OTL
[2012/02/07 21:25:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012/02/07 21:05:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/07 21:05:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/02/07 21:04:27 | 009,502,424 | —- | C] (Malwarebytes Corporation ) – C:\Users\Raiph\Desktop\mbam-setup-1.60.1.1000.exe
[2012/02/06 09:27:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RIFT
[2012/02/06 09:27:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\RIFT Game
[2012/02/02 21:37:12 | 000,000,000 | —D | C] – C:\ProgramData\ATI
[2012/02/02 21:37:11 | 000,000,000 | —D | C] – C:\Program Files (x86)\AMD APP
[2012/02/02 21:36:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012/02/02 21:09:34 | 000,000,000 | —D | C] – C:\Users\Raiph\Cryptic Studios
[2012/02/02 20:25:49 | 000,000,000 | —D | C] – C:\Users\Raiph\AppData\Local\PMB Files
[2012/02/02 20:25:48 | 000,000,000 | —D | C] – C:\ProgramData\PMB Files
[2012/02/02 20:25:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Pando Networks
[2012/01/26 14:06:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\uTorrentBar
[2012/01/26 14:06:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\uTorrent
[2012/01/26 14:04:48 | 000,000,000 | —D | C] – C:\Users\Raiph\AppData\Roaming\uTorrent
[2012/01/26 11:31:40 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Raiph\Desktop\OTL.exe
[2012/01/15 11:41:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/01/15 11:41:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2012/01/15 11:40:36 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2012/01/15 11:40:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour
[2012/01/15 11:35:00 | 000,000,000 | —D | C] – C:\Users\Raiph\AppData\Local\Apple Computer
[2012/01/15 11:34:59 | 000,000,000 | —D | C] – C:\Users\Raiph\AppData\Roaming\Apple Computer
[2012/01/15 11:34:11 | 000,000,000 | —D | C] – C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/01/15 11:33:19 | 000,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2012/01/15 11:32:03 | 000,000,000 | —D | C] – C:\Users\Raiph\AppData\Local\Apple
[2012/01/15 11:32:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\Apple Software Update
[2012/01/15 11:31:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2012/01/15 11:31:29 | 000,000,000 | —D | C] – C:\ProgramData\Apple
[2012/01/15 11:31:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Apple
[2010/07/07 11:36:44 | 000,014,336 | —- | C] ( ) – C:\Windows\SysWow64\a3d.dll
[2010/07/07 11:10:22 | 000,012,800 | —- | C] ( ) – C:\Windows\SysWow64\killapps.exe

========== Files - Modified Within 30 Days ==========

[2012/02/11 19:36:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/11 19:35:49 | 000,139,264 | —- | M] () – C:\Users\Raiph\Desktop\SystemLook.exe
[2012/02/11 14:53:00 | 000,000,880 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2012/02/11 14:36:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/11 08:32:18 | 000,015,024 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/11 08:32:18 | 000,015,024 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/11 08:31:01 | 000,112,100 | —- | M] () – C:\logfile
[2012/02/11 08:25:14 | 000,000,410 | —- | M] () – C:\Windows\tasks\Final Media Player Update Checker.job
[2012/02/11 08:25:08 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/02/11 08:24:57 | 3214,237,696 | -HS- | M] () – C:\hiberfil.sys
[2012/02/11 06:55:20 | 000,062,308 | —- | M] () – C:\Windows\SysNative\BMXStateBkp-{00000001-00000000-00000000-00001102-0000000B-00431102}.rfx
[2012/02/11 06:55:20 | 000,062,308 | —- | M] () – C:\Windows\SysNative\BMXState-{00000001-00000000-00000000-00001102-0000000B-00431102}.rfx
[2012/02/11 06:55:20 | 000,000,820 | —- | M] () – C:\Windows\SysNative\DVCState-{00000001-00000000-00000000-00001102-0000000B-00431102}.rfx
[2012/02/07 21:05:31 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/07 21:04:52 | 009,502,424 | —- | M] (Malwarebytes Corporation ) – C:\Users\Raiph\Desktop\mbam-setup-1.60.1.1000.exe
[2012/02/06 09:27:35 | 000,001,931 | —- | M] () – C:\Users\Public\Desktop\Play RIFT.lnk
[2012/02/02 21:35:32 | 001,885,232 | —- | M] () – C:\Windows\SysNative\drivers\Cat.DB
[2012/02/02 21:14:04 | 000,000,913 | —- | M] () – C:\Users\Raiph\Desktop\Star Trek Online.lnk
[2012/02/02 09:49:24 | 000,000,547 | —- | M] () – C:\Users\Raiph\Documents\aionmemo_37c1ac6b.dat
[2012/01/30 20:02:49 | 000,000,400 | —- | M] () – C:\Windows\tasks\EasyShare Registration Task.job
[2012/01/26 14:06:03 | 000,000,967 | —- | M] () – C:\Users\Raiph\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/01/26 14:06:03 | 000,000,943 | —- | M] () – C:\Users\Public\Desktop\µTorrent.lnk
[2012/01/26 11:31:46 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Raiph\Desktop\OTL.exe
[2012/01/15 12:40:07 | 000,002,014 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/01/15 11:41:26 | 000,001,845 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/01/15 09:25:56 | 000,001,994 | —- | M] () – C:\Users\Raiph\Desktop\Kindle.lnk
[2012/01/15 08:54:19 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2012/01/15 00:12:27 | 456,431,408 | —- | M] () – C:\Windows\MEMORY.DMP

========== Files Created - No Company Name ==========

[2012/02/11 19:35:49 | 000,139,264 | —- | C] () – C:\Users\Raiph\Desktop\SystemLook.exe
[2012/02/07 21:05:31 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/06 09:27:35 | 000,001,931 | —- | C] () – C:\Users\Public\Desktop\Play RIFT.lnk
[2012/02/02 21:14:04 | 000,000,913 | —- | C] () – C:\Users\Raiph\Desktop\Star Trek Online.lnk
[2012/01/26 14:06:03 | 000,000,967 | —- | C] () – C:\Users\Raiph\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/01/26 14:06:03 | 000,000,943 | —- | C] () – C:\Users\Public\Desktop\µTorrent.lnk
[2012/01/15 12:40:07 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/01/15 12:40:07 | 000,002,014 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/01/15 11:41:26 | 000,001,845 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/01/15 11:32:02 | 000,002,519 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2011/12/05 22:04:00 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OpenVideo.dll
[2011/12/05 22:03:52 | 000,054,784 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2011/12/05 19:35:10 | 000,204,960 | —- | C] () – C:\Windows\SysWow64\ativvsvl.dat
[2011/12/05 19:35:10 | 000,157,152 | —- | C] () – C:\Windows\SysWow64\ativvsva.dat
[2011/09/12 16:06:16 | 000,003,917 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/09/01 19:51:48 | 000,221,395 | —- | C] () – C:\Windows\hpoins19.dat.temp
[2011/09/01 19:51:48 | 000,013,898 | —- | C] () – C:\Windows\hpomdl19.dat.temp
[2011/09/01 19:25:39 | 000,023,142 | —- | C] () – C:\Windows\hpqins15.dat.temp
[2011/08/04 09:51:19 | 000,164,864 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2011/08/04 09:51:19 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2011/06/28 11:15:48 | 000,175,616 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2011/05/13 20:43:13 | 000,000,000 | —- | C] () – C:\Users\Raiph\AppData\Local\{0277DC3A-16F0-4E26-9FEF-59466B60F204}
[2011/04/25 21:33:11 | 000,000,064 | —- | C] () – C:\Windows\SysWow64\rp_stats.dat
[2011/04/25 21:33:11 | 000,000,044 | —- | C] () – C:\Windows\SysWow64\rp_rules.dat
[2010/07/07 12:23:10 | 000,017,868 | —- | C] () – C:\Windows\SysWow64\instwdm.ini
[2010/07/07 12:23:06 | 000,000,054 | —- | C] () – C:\Windows\SysWow64\ctzapxx.ini
[2010/07/07 11:33:04 | 000,002,560 | —- | C] () – C:\Windows\SysWow64\CtxfiRes.dll
[2010/07/07 11:21:00 | 000,384,647 | —- | C] () – C:\Windows\SysWow64\ctdnlstr.dat
[2010/07/07 11:21:00 | 000,051,787 | —- | C] () – C:\Windows\SysWow64\ctdlang.dat
[2010/07/07 11:10:30 | 000,007,680 | —- | C] () – C:\Windows\SysWow64\enlocstr.exe
[2010/05/02 13:58:52 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/04/15 09:48:23 | 000,730,638 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/03/05 17:15:31 | 000,022,752 | —- | C] () – C:\Windows\hpqins15.dat
[2010/02/26 16:10:50 | 000,221,118 | —- | C] () – C:\Windows\hpoins19.dat
[2010/02/26 16:10:50 | 000,013,898 | —- | C] () – C:\Windows\hpomdl19.dat
[2010/01/03 13:10:32 | 000,000,017 | —- | C] () – C:\Users\Raiph\AppData\Local\resmon.resmoncfg
[2010/01/03 12:59:17 | 000,000,268 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/12/02 15:12:19 | 000,000,000 | —- | C] () – C:\Windows\lgfwup.ini
[2009/12/02 15:03:02 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2009/12/02 15:00:13 | 000,003,972 | —- | C] () – C:\Windows\SysWow64\drivers\PciBus.sys
[2009/07/13 22:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 19:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 19:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 17:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 14:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/07/01 01:12:32 | 000,000,285 | —- | C] () – C:\Windows\SysWow64\kill.ini
[2009/06/10 14:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat

========== Custom Scans ==========


< :Reg >

< [-HKEY_CURRENT_USER\Software\PCTools] >

< [-HKEY_LOCAL_MACHINE\SOFTWARE\PCTools] >

< [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Tools Spyware Doctor] >

< >

< :Files >

< c:\Program Files\Common Files\PC Tools >

< c:\Program Files\PC Tools Spyware Doctor >

< c:\Documents and Settings\All Users\Application Data\PC Tools >

< c:\Documents and Settings\All Users\Start Menu\Programs\PC Tools Spyware Dcotor >

< >

< :Commands >

< [purity] >

< [emptytemp] >

< [start explorer] >

< [Reboot] >

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 167 bytes -> C:\ProgramData\Temp:DFC5A2B2

< End of report >


Thanks Mithros!!

<3 Harleigh
Post #18
Hey harleighq,

There are alot of remnants of the Spyware Doctor installation lets try this first:
Download and install the Revo Uninstaller
•Double click the new Revo Uninstaller icon on your desktop to start the program
•Scroll through the listed programs and Right Click on the program you wish to uninstall (PC Tools, then Spyware Doctor)
•From the pop out menu choose Uninstall
•Click Yes to the confirmation dialogue
•In the next window select the Advanced mode
•Click Next to start uninstalling the program
•Answer Yes to confirm the uninstall
•When the program has completed the four steps, click Next to allow the program to search for leftovers
•Once complete, click Next, then Finish
•Repeat the above steps for any other programs you wish to remove.

If successful please post another OTL log if not simply post back and let me know we will try to remove through a script with OTL.
Post #19
Hiya Mithros, I followed all the above steps and think I was successful. I have a quick question. Is this it? was this my problem all along? If so I am ever so grateful? <3 Harleigh
Post #20
Hey harleighq,

Yes I think the primary problem with your computer was that Spyware Doctor did not properly uninstall. I would like you run a quick cleanup and then make some recommendations for your computer

First lets clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
OK IT APPEARS THAT YOUR LOGS ARE NOW CLEAN :D SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!! :D

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:
  • Open Internet Explorer
  • Click on Tools > Internet Options
  • Press Security tab
  • Select Internet zone then place check next to Enable Protected Mode if not already done
  • Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
  • Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.
3. Use and Update your Anti-Virus Software - With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.
**Do not install more than one firewall program because they will conflict with each other**

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.
6. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.

For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.
7. WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?


Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.
Post #21 last edited
Hey Mithros, I havent yet completed that last run through…. but I must confess I am a bit anxious about letting you go <—possible co-depency issues 8 ). Thanks for all the TLC and patience. I was completely in the dark. I confess to being a bit of a failure when I work on my computer myself,– I have a bit of a trigger finger and either start deleting everything or downloading everything, *blush*. Have a lovely weekend. *cheers* <3Harleigh

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI