Spyware / Malware / Virus Removal

Computer running slower , Will receive black screens on some videos [S

23 min read

Looking for the outcome? Ask AI

jeffce

Post #16April 7, 2012, 3:23 PM UTC

Hi,

Let's see if this can clean it up…

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Files
C:\Microgaming\Casino\32Red\install.exe	
C:\Microgaming\Casino\Ladbrokes\install.exe	
C:\Microgaming\Poker\32RedMPP\install.exe	
C:\Microgaming\Poker\BetwaypokerMPP\install.exe	
C:\Microgaming\Poker\LadbrokesMPP\install.exe	
C:\Microgaming\Poker\NordicBetMPP\install.exe	
C:\Microgaming\Poker\stanjamesgibMPP\install.exe	
C:\Microgaming\Poker\unibetpokerMPP\install.exe	
C:\Users\ONewbieO\Downloads\setup.exe	
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

———-

ONewbieO

Post #17April 7, 2012, 3:37 PM UTC

A file cant seem to be created , i forgot what was it already . I did OTL Twice and the first time it said some kind of file cannot be created . There must be a log file for that but i'm not sure where to get it .

Anyway , here are the results of the FIX OTL log .

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
File\Folder C:\Microgaming\Casino\32Red\install.exe not found.
File\Folder C:\Microgaming\Casino\Ladbrokes\install.exe not found.
File\Folder C:\Microgaming\Poker\32RedMPP\install.exe not found.
File\Folder C:\Microgaming\Poker\BetwaypokerMPP\install.exe not found.
File\Folder C:\Microgaming\Poker\LadbrokesMPP\install.exe not found.
File\Folder C:\Microgaming\Poker\NordicBetMPP\install.exe not found.
File\Folder C:\Microgaming\Poker\stanjamesgibMPP\install.exe not found.
File\Folder C:\Microgaming\Poker\unibetpokerMPP\install.exe not found.
File\Folder C:\Users\ONewbieO\Downloads\setup.exe not found.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\ONewbieO\Downloads\cmd.bat deleted successfully.
C:\Users\ONewbieO\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: ONewbieO
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49152 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 13313014 bytes
->Flash cache emptied: 453 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 13.00 mb

HOSTS file reset successfully

OTL by OldTimer - Version 3.2.39.2 log created on 04072012_233129

Files\Folders moved on Reboot…
File\Folder C:\Users\ONewbieO\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot…

ONewbieO

Post #18April 7, 2012, 3:42 PM UTC last edited April 7, 2012, 3:43 PM UTC

OTL Log file

OTL logfile created on: 7/4/2012 11:38:22 PM - Run 3
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\ONewbieO\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

3.92 Gb Total Physical Memory | 1.88 Gb Available Physical Memory | 48.13% Memory free
7.83 Gb Paging File | 5.43 Gb Available in Paging File | 69.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.62 Gb Total Space | 379.22 Gb Free Space | 89.94% Space Free | Partition Type: NTFS
Drive D: | 29.30 Gb Total Space | 26.62 Gb Free Space | 90.87% Space Free | Partition Type: NTFS

Computer Name: ALVINPC | User Name: ONewbieO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\ONewbieO\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe (PC Pitstop LLC)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Online Armor\oaui.exe (Emsi Software GmbH)
PRC - C:\Program Files (x86)\Online Armor\oasrv.exe (Emsi Software GmbH)
PRC - C:\Program Files (x86)\Online Armor\OAReg.exe (Emsi Software GmbH)
PRC - C:\Program Files (x86)\Online Armor\oahlp.exe (Emsi Software GmbH)
PRC - C:\Program Files (x86)\Online Armor\oacat.exe (Emsi Software GmbH)
PRC - C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe ()
PRC - C:\Windows\Webcam\S6000\S6000Mnt.exe (Alcor)
PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
PRC - C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)

========== Modules (No Company Name) ==========

MOD - C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\pdf.dll ()
MOD - C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\avutil-51.dll ()
MOD - C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\avformat-53.dll ()
MOD - C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\avcodec-53.dll ()
MOD - C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\gcswf32.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b9942cb07813f553f6d6374dd4541362\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bd3685e578c22d17625390d847973de0\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\008fbb2e42b3c2569ff58d651575ff29\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\33eae86e0a5d9bcc4d0e4e469e2ac36a\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\b7409080f31b0a702281b68c37bac326\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\68345d6b57fe33c9a94fe6a72ab5e85e\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c0c7b3ff43f1b29cad7dde24bdbd5b79\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\2c958d61dd28474ec780db9d18d266ae\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\6757251401cd9c17d5e608db6e5f964a\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\1c5b741f270fccb3b527b4fc3a8431f3\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\57e066d0b97757dbd26d59302c3d701a\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e5b31f3bb6508df0dc7c20ddc72f3191\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\b53dffac744d13ee946b0ff35fc32936\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\35de7085545a1fb86ec40d2da9865258\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\4ccd2bbe37da506b69dd689f06d749a2\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\4c2b00c9c2f2109037cd39d7b7a81633\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SRV:64bit: - (EvtEng) Intel® – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) Intel® – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMPPALR3) – C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation)
SRV:64bit: - (BTHSSecurityMgr) Intel® Centrino® Wireless Bluetooth® – C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel® Corporation)
SRV:64bit: - (Intel® PROSet Monitoring Service) Intel® – C:\Windows\SysNative\IPROSetMonitor.exe (Intel Corporation)
SRV:64bit: - (CxAudMsg) – C:\Windows\SysNative\CxAudMsg64.exe (Conexant Systems Inc.)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (TPHDEXLGSVC) – C:\Windows\SysNative\TPHDEXLG64.exe (Lenovo.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SvcOnlineArmor) – C:\Program Files (x86)\Online Armor\oasrv.exe (Emsi Software GmbH)
SRV - (OAcat) – C:\Program Files (x86)\Online Armor\oacat.exe (Emsi Software GmbH)
SRV - (Bluetooth OBEX Service) – C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
SRV - (Bluetooth Media Service) – C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
SRV - (Bluetooth Device Monitor) – C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (avipbb) – C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) – C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (iBtFltCoex) – C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) – C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (OAnet) – C:\Windows\SysNative\drivers\OAnet.sys (Emsisoft)
DRV:64bit: - (fbfmon) – C:\Windows\SysNative\drivers\fbfmon.sys (Lenovo)
DRV:64bit: - (BPntDrv) – C:\Windows\SysNative\drivers\BPntDrv.sys (Lenovo)
DRV:64bit: - (LHDmgr) – C:\Windows\SysNative\drivers\LhdX64.sys (Lenovo.)
DRV:64bit: - (ACPIVPC) – C:\Windows\SysNative\drivers\AcpiVpc.sys (Lenovo Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (avkmgr) – C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (S6000KNT) – C:\Windows\SysNative\drivers\S6000KNT.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (CnxtHdAudService) – C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (e1cexpress) Intel® – C:\Windows\SysNative\drivers\e1c62x64.sys (Intel Corporation)
DRV:64bit: - (NETwNs64) ___ Intel® – C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (AMPPALP) Intel® Centrino® – C:\Windows\SysNative\drivers\AmpPal.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (AMPPAL) Intel® Centrino® – C:\Windows\SysNative\drivers\AmpPal.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (intelkmd) – C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (btmaux) – C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation)
DRV:64bit: - (wdkmd) – C:\Windows\SysNative\drivers\WDKMD.sys (Intel Corporation)
DRV:64bit: - (nusb3xhc) – C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) – C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (clwvd) – C:\Windows\SysNative\drivers\clwvd.sys (CyberLink Corporation)
DRV:64bit: - (SmartDefragDriver) – C:\Windows\SysNative\drivers\SmartDefragDriver.sys ()
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel® – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (Shockprf) – C:\Windows\SysNative\drivers\ApsX64.sys (Lenovo.)
DRV:64bit: - (TPDIGIMN) – C:\Windows\SysNative\drivers\ApsHM64.sys (Lenovo.)
DRV:64bit: - (wsvd) – C:\Windows\SysNative\drivers\wsvd.sys (CyberLink)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (TPM) – C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (oahlpXX) – C:\Windows\SysWOW64\drivers\oahlp64.sys ()
DRV - (OADevice) – C:\Windows\SysWOW64\drivers\OADriver.sys ()
DRV - (OAmon) – C:\Windows\SysWOW64\drivers\OAmon.sys (Emsisoft)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://startsear.ch/?aff=1&src=sp&…q={searchTerms}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br…N&bmod=LENN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://startsear.ch/?aff=1&src=sp&…q={searchTerms}
IE - HKCU\..\SearchScopes\{78049031-5A2B-4D32-988A-6418444B6E0A}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7LENN
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Users\ONewbieO\AppData\Local\Roblox\Versions\version-7344c3428f1546a4\\NPRobloxProxy.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ONewbieO\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ONewbieO\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\ONewbieO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/03/12 19:30:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/03/12 19:31:00 | 000,000,000 | —D | M] (No name found) – C:\Users\ONewbieO\AppData\Roaming\Mozilla\Extensions
[2012/03/12 19:33:02 | 000,000,000 | —D | M] (No name found) – C:\Users\ONewbieO\AppData\Roaming\Mozilla\Firefox\Profiles\x6t7q09q.default\extensions
[2012/03/12 19:30:50 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
() (No name found) – C:\USERS\ONEWBIEO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\X6T7Q09Q.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012/02/16 22:40:42 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/02/16 18:42:53 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/02/16 18:42:53 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chr
o
me&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\18.0.1025.151\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\ONewbieO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Roblox Launcher Plugin (Enabled) = C:\Users\ONewbieO\AppData\Local\Roblox\Versions\version-7344c3428f1546a4\\NPRobloxProxy.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AdBlock = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.25_0\
CHR - Extension: Gmail = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/04/07 23:31:37 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files (x86)\Online Armor\oaui.exe (Emsi Software GmbH)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SynLenovoGestureMgr] C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Synaptics)
O4:64bit: - HKLM..\Run: [TpShocks] C:\Windows\SysNative\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Info Center] C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe (PC Pitstop LLC)
O4 - HKLM..\Run: [Intelligent Touchpad] C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe ()
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [S6000Mnt] C:\Windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)
O4 - Startup: C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCPitstop Utility)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{642A322F-8D66-4551-BA4F-177A97B18F81}: DhcpNameServer = 192.168.1.1 192.168.1.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/07 11:36:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2012/04/07 09:06:54 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/04/07 06:08:39 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Roaming\Avira
[2012/04/07 06:03:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012/04/07 06:03:09 | 000,132,320 | —- | C] (Avira GmbH) – C:\Windows\SysNative\drivers\avipbb.sys
[2012/04/07 06:03:09 | 000,097,312 | —- | C] (Avira GmbH) – C:\Windows\SysNative\drivers\avgntflt.sys
[2012/04/07 06:03:09 | 000,027,760 | —- | C] (Avira GmbH) – C:\Windows\SysNative\drivers\avkmgr.sys
[2012/04/07 06:03:09 | 000,000,000 | —D | C] – C:\ProgramData\Avira
[2012/04/07 06:03:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\Avira
[2012/04/07 05:48:41 | 000,000,000 | —D | C] – C:\_OTL
[2012/04/07 05:46:57 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012/04/07 05:46:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/04/07 05:46:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2012/04/02 04:45:04 | 000,000,000 | —D | C] – C:\ProgramData\PCPitstop
[2012/04/02 04:45:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\PCPitstop
[2012/04/01 03:55:15 | 005,559,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/04/01 03:55:14 | 003,968,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2012/04/01 03:55:14 | 003,913,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2012/04/01 03:51:09 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2012/04/01 03:50:08 | 000,515,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\timedate.cpl
[2012/04/01 03:50:08 | 000,509,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntshrui.dll
[2012/04/01 03:50:07 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\timedate.cpl
[2012/03/31 18:03:05 | 000,418,464 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/03/14 08:18:23 | 001,544,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2012/03/14 08:17:31 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdrmemptylst.exe
[2012/03/14 08:17:30 | 001,031,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcore.dll
[2012/03/14 08:17:30 | 000,826,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rdpcore.dll
[2012/03/14 08:17:30 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorekmts.dll
[2012/03/14 08:17:30 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpwsx.dll
[2012/03/12 20:00:48 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012/03/12 20:00:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\VS Revo Group
[2012/03/12 19:30:58 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Roaming\Mozilla
[2012/03/12 19:30:58 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\Mozilla
[2012/03/12 19:30:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/03/12 14:19:43 | 000,070,304 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/03/12 00:42:34 | 000,031,576 | —- | C] (IObit) – C:\Windows\SysNative\SmartDefragBootTime.exe
[2012/03/12 00:42:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag 2
[2012/03/12 00:36:52 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2012/03/11 19:32:52 | 000,000,000 | —D | C] – C:\Windows\Sun
[2012/03/11 16:17:14 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2012/03/11 16:16:10 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2012/03/11 16:16:10 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2012/03/11 16:16:10 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2012/03/11 16:16:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java

========== Files - Modified Within 30 Days ==========

[2012/04/07 23:36:05 | 000,110,629 | —- | M] () – C:\Windows\SysNative\fastboot.set
[2012/04/07 23:34:52 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/07 23:34:45 | 3153,268,736 | -HS- | M] () – C:\hiberfil.sys
[2012/04/07 23:31:37 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2012/04/07 22:44:05 | 000,000,920 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4176799644-1864613857-429760169-1001UA.job
[2012/04/07 20:30:39 | 000,031,472 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/07 20:30:39 | 000,031,472 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/07 09:06:55 | 000,002,338 | —- | M] () – C:\Users\ONewbieO\Desktop\Google Chrome.lnk
[2012/04/07 06:03:24 | 000,002,077 | —- | M] () – C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/04/07 05:46:35 | 000,001,115 | —- | M] () – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/04/07 05:46:27 | 000,000,935 | —- | M] () – C:\Users\ONewbieO\Desktop\NTREGOPT.lnk
[2012/04/07 05:46:27 | 000,000,916 | —- | M] () – C:\Users\ONewbieO\Desktop\ERUNT.lnk
[2012/04/07 04:53:00 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4176799644-1864613857-429760169-1001Core.job
[2012/04/07 01:44:00 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4176799644-1864613857-429760169-1001Core1cd0f6544831698.job
[2012/04/06 11:35:29 | 000,000,512 | —- | M] () – C:\Users\ONewbieO\Desktop\MBR.dat
[2012/04/01 03:55:04 | 000,765,178 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/04/01 03:55:04 | 000,652,360 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/04/01 03:55:04 | 000,121,292 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/04/01 03:54:56 | 000,765,178 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/04/01 00:59:57 | 000,418,464 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/04/01 00:59:57 | 000,070,304 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/04/01 00:59:57 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/03/31 00:14:21 | 000,133,177 | —- | M] () – C:\Users\ONewbieO\Desktop\E-Filing for YA 2012.png
[2012/03/14 12:27:08 | 000,319,336 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/03/12 20:00:48 | 000,001,275 | —- | M] () – C:\Users\ONewbieO\Desktop\Revo Uninstaller.lnk
[2012/03/12 19:30:53 | 000,001,141 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/03/12 18:44:33 | 000,175,819 | —- | M] () – C:\Users\ONewbieO\Desktop\Moneybookers Deposit.png
[2012/03/12 00:42:33 | 000,001,181 | —- | M] () – C:\Users\Public\Desktop\Smart Defrag 2.lnk
[2012/03/12 00:39:33 | 000,068,606 | —- | M] () – C:\Users\ONewbieO\Desktop\cc_20120312_003921.reg
[2012/03/12 00:36:58 | 000,000,833 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/03/11 16:16:04 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deployJava1.dll
[2012/03/11 16:16:04 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2012/03/11 16:16:04 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2012/03/11 16:16:04 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe

========== Files Created - No Company Name ==========

[2012/04/07 09:06:55 | 000,002,338 | —- | C] () – C:\Users\ONewbieO\Desktop\Google Chrome.lnk
[2012/04/07 06:03:24 | 000,002,077 | —- | C] () – C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/04/07 05:46:35 | 000,001,115 | —- | C] () – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/04/07 05:46:27 | 000,000,935 | —- | C] () – C:\Users\ONewbieO\Desktop\NTREGOPT.lnk
[2012/04/07 05:46:27 | 000,000,916 | —- | C] () – C:\Users\ONewbieO\Desktop\ERUNT.lnk
[2012/04/06 11:35:29 | 000,000,512 | —- | C] () – C:\Users\ONewbieO\Desktop\MBR.dat
[2012/04/01 01:39:48 | 000,000,920 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4176799644-1864613857-429760169-1001UA.job
[2012/04/01 01:39:47 | 000,000,868 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4176799644-1864613857-429760169-1001Core1cd0f6544831698.job
[2012/03/31 18:03:06 | 000,000,830 | —- | C] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/03/31 00:14:21 | 000,133,177 | —- | C] () – C:\Users\ONewbieO\Desktop\E-Filing for YA 2012.png
[2012/03/12 20:00:48 | 000,001,275 | —- | C] () – C:\Users\ONewbieO\Desktop\Revo Uninstaller.lnk
[2012/03/12 19:30:53 | 000,001,153 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/03/12 19:30:53 | 000,001,141 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/03/12 18:44:33 | 000,175,819 | —- | C] () – C:\Users\ONewbieO\Desktop\Moneybookers Deposit.png
[2012/03/12 11:24:18 | 000,000,868 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4176799644-1864613857-429760169-1001Core.job
[2012/03/12 00:42:34 | 000,017,720 | —- | C] () – C:\Windows\SysNative\drivers\SmartDefragDriver.sys
[2012/03/12 00:42:33 | 000,001,181 | —- | C] () – C:\Users\Public\Desktop\Smart Defrag 2.lnk
[2012/03/12 00:39:25 | 000,068,606 | —- | C] () – C:\Users\ONewbieO\Desktop\cc_20120312_003921.reg
[2012/03/12 00:36:58 | 000,000,833 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/11/12 02:19:50 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2011/11/12 01:46:07 | 000,007,605 | —- | C] () – C:\Users\ONewbieO\AppData\Local\Resmon.ResmonCfg
[2011/11/12 01:04:05 | 000,059,176 | —- | C] () – C:\Windows\SysWow64\drivers\OADriver.sys
[2011/11/12 01:04:05 | 000,056,648 | —- | C] () – C:\Windows\SysWow64\drivers\oahlp64.sys
[2011/11/12 00:16:37 | 000,000,000 | —- | C] () – C:\Windows\firstboot.dat
[2011/09/23 14:39:32 | 000,765,178 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/09/23 14:35:57 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/09/23 14:28:30 | 000,015,190 | —- | C] () – C:\Windows\S6000Twn.ini
[2011/09/23 14:27:06 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblup.dat
[2011/08/15 14:41:49 | 000,066,856 | —- | C] () – C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/07/25 09:26:57 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/07/25 09:26:52 | 000,216,876 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/07/25 09:26:49 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/07/25 09:26:19 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/06/01 13:06:38 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll

< End of report >

ONewbieO

Post #19April 7, 2012, 4:11 PM UTC last edited April 7, 2012, 4:12 PM UTC

Received this when i restarted lappy . ERU for Windows NT Unable to create file C:/Windows/ERDNT/AutoBackup/8-4-2012/ERDNT.INF Registry backup will continue , but no restore information for the ERDNT program will be saved . This means that later restoration of the registry can only be done manually , by using another OS to copy back the files . This is followed by lots of Error saving file and asking me to continue with next file . i clicked on all of them .

ONewbieO

Post #20April 7, 2012, 4:33 PM UTC last edited April 7, 2012, 4:34 PM UTC

Update on the whole scenario of the problem now . 1 . Black Screen definitely disappeared . Didnt see them anymore . 2 . The software which i downloaded prior to fixing my last machine with ping.exe problem . Avira Antivirus , Online Armour . These 2 programs seems to affect the usage of my flash in chrome. Its causing it to malfunction . If i disable it , videos that are being watched will work smoothly . But if i enable it , the lags will come along sometimes . Other than that , machine works fine right now .

jeffce

Post #21April 7, 2012, 5:48 PM UTC

Black Screen definitely disappeared . Didnt see them anymore .

———-

You could always try another antivirus programs like either of these following two…just be sure to uninstall Avira. I recommend either of these…
Microsoft Security Essentials
Avast

As for Online Armor I think it is a good firewall, but if you are using a wireless router, I would just use the Windows Firewall. The wireless router acts as a firewall itself.

————–

When you first ran OTL there should have been a log named Extras.txt created. Could you post that please.

ONewbieO

Post #22April 7, 2012, 5:51 PM UTC

No such logs found . As long as Online Armour is disabled , everything runs smoothly

ONewbieO

Post #23April 7, 2012, 8:14 PM UTC last edited April 7, 2012, 8:14 PM UTC

Like to ask a question before we proceed further . So far , i have 2 users on my laptop . One is a guest account , one is equipped with administrator abilities . I've been using the one with administrator abilities to perform the scans so far . Is that good enough ? Or do i need to load up via safe mode to do whatever is necessary ?

jeffce

Post #24April 7, 2012, 11:26 PM UTC

Hi,

No such logs found .

Ok please do the following…
Please open OTL.

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, click the None button near the top (it may looked greyed out)
In the Extra Registry section change it to All
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open 2 notepad windows, OTL.Txt and Extra.txt. Please post the Extra.txt.
———–

As for your other question we should be just fine.

ONewbieO

Post #25April 8, 2012, 5:08 AM UTC

Here's the extra.txt file

OTL Extras logfile created on: 8/4/2012 1:07:10 PM - Run 4
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\ONewbieO\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

3.92 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 49.64% Memory free
7.83 Gb Paging File | 5.35 Gb Available in Paging File | 68.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.62 Gb Total Space | 378.24 Gb Free Space | 89.71% Space Free | Partition Type: NTFS
Drive D: | 29.30 Gb Total Space | 26.62 Gb Free Space | 90.87% Space Free | Partition Type: NTFS

Computer Name: ALVINPC | User Name: ONewbieO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Extra Registry (All) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm[@ = chm.file] – C:\Windows\hh.exe (Microsoft Corporation)
.cpl[@ = cplfile] – C:\Windows\SysNative\control.exe (Microsoft Corporation)
.hlp[@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.hta[@ = htafile] – C:\Windows\SysWOW64\mshta.exe (Microsoft Corporation)
.html[@ = ChromeHTML] – C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
.inf[@ = inffile] – C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)
.ini[@ = inifile] – C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
.js[@ = JSFile] – C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
.jse[@ = JSEFile] – C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
.reg[@ = regfile] – C:\Windows\regedit.exe (Microsoft Corporation)
.txt[@ = txtfile] – C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)
.vbe[@ = VBEFile] – C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
.vbs[@ = VBSFile] – C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
.wsf[@ = WSFFile] – C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
.wsh[@ = WSHFile] – C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.bat [@ = batfile] – "%1" %*
.chm [@ = chm.file] – C:\Windows\hh.exe (Microsoft Corporation)
.cmd [@ = cmdfile] – "%1" %*
.com [@ = comfile] – "%1" %*
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.exe [@ = exefile] – "%1" %*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] – C:\Windows\SysWOW64\mshta.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
.inf [@ = inffile] – C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] – C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – C:\Windows\SysWow64\rundll32.exe (Microsoft Corporation)
.js [@ = JSFile] – C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] – C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)
.pif [@ = piffile] – "%1" %*
.reg [@ = regfile] – C:\Windows\SysWow64\regedit.exe (Microsoft Corporation)
.scr [@ = scrfile] – "%1" /S
.txt [@ = txtfile] – C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] – C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] – C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] – C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] – C:\Windows\SysWow64\WScript.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] – "%1" %*
batfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] – "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)
cmdfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] – "%1" %*
cmdfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] – C:\Windows\SysWOW64\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
inffile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile – C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] – C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] – C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile – C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] – C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] – C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile – %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)
regfile [open] – regedit.exe "%1" (Microsoft Corporation)
regfile [merge] – Reg Error: Key error.
regfile [print] – %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
txtfile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] – %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbefile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbefile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
vbsfile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbsfile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbsfile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wsffile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
wsffile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
wsffile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wshfile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] – "%1" %*
batfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] – "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)
cmdfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] – "%1" %*
cmdfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] – C:\Windows\SysWOW64\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
inffile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile – C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] – C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] – C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile – C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] – C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] – C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile – %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)
regfile [open] – regedit.exe "%1" (Microsoft Corporation)
regfile [merge] – Reg Error: Key error.
regfile [print] – %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
txtfile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] – %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbefile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbefile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
vbsfile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbsfile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbsfile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wsffile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
wsffile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
wsffile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wshfile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{006B5C65-3938-4246-B182-994A7E415EDE}" = Intel® PROSet/Wireless Software for Bluetooth® Technology
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{206BD2C5-DE08-4577-A0D7-D441A79D5A3A}" = Windows Live Remote Client Resources
"{28EF7372-9087-4AC3-9B9F-D9751FCDF830}" = Intel® Wireless Display
"{372C8537-5B83-CEAF-F159-2884E3B770FC}" = WMV9/VC-1 Video Playback
"{3C41721F-AF0F-4086-AA1C-4C7F29076228}" = Intel® PROSet/Wireless WiFi Software
"{44663264-E108-4938-BF9E-A767315072C9}" = Intel® Network Connections 16.3.48.0
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A0E106D2-4815-4B7A-BAA7-7E21B530CFB4}" = Intel® PROSet/Wireless for Bluetooth® 3.0 + High Speed
"{AE91E0F3-C49A-4EF4-8B98-A07BD409EB90}" = Windows Live Remote Service Resources
"{C49C683A-A87F-7A87-5FC1-7B09D5B48C8E}" = ccc-utility64
"{CB2C84FB-93EB-1252-9252-4412E3DE0EB0}" = ATI Catalyst Install Manager
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"ATI Uninstaller" = ATI Uninstaller
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"EB9B45DC947C2D941CA61B992509A71D738AE888" = Windows Driver Package - Lenovo (ACPIVPC) System (01/28/2011 6.1.0.1)
"Lenovo EE Boot Optimizer" = Lenovo EE Boot Optimizer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"ProInst" = Intel PROSet Wireless
"PROSetDX" = Intel® Network Connections 16.3.48.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000F2A10-9CDF-47BF-9CF2-9AC87567B433}" = Windows Live Photo Common
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"{03241D8D-2217-42F7-9FCB-6A68D141C14D}" = Windows Live 软件包
"{0741B337-5C69-D752-DB23-B334B399EE8B}" = CCC Help Chinese Standard
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{14CD5B9D-DC7A-5D39-73BB-44AAB9CC039D}" = CCC Help Spanish
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1B9E8374-76F4-F9E3-06E7-576246E53F5C}" = CCC Help Japanese
"{1DDD2892-2941-B5CA-EF5F-BADA6558E072}" = CCC Help French
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FE655AE-28A5-ADC0-95BF-1B3281BA0CEA}" = CCC Help Dutch
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21B49B4A-BBC3-4A09-9C68-6C3CC0B1EA01}" = Windows Live Messenger
"{2582910D-DAF5-FD3B-55AA-8CD83A2E9DA2}" = Catalyst Control Center Localization All
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{317D56AC-0DB3-48F5-929A-42032DAC9AD7}" = Windows Live Writer
"{31DF7760-99AC-57DC-D3F0-A27B173D45BD}" = CCC Help Thai
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{368BEC2C-B7A2-4762-9213-2D8465D533CA}" = Windows Live UX Platform Language Pack
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{40F4FF7A-B214-4453-B973-080B09CED019}" = Absolute Reminder
"{4422AE2E-8B62-0991-91E5-6235D8126162}" = CCC Help Polish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{588CE0C0-860B-49A8-AFCF-3C69465B345F}" = Windows Live Mesh
"{5B46CEC7-DAD0-46A2-BCD6-B46A3CFD9B61}" = Intel® Wireless Display
"{5DA56A9E-00EE-C7D7-A861-CBC4A2D06D58}" = CCC Help Greek
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{622DE1BE-9EDE-49D3-B349-29D64760342A}" = 適用遠端連線的 Windows Live Mesh ActiveX 控制項
"{63AE67AA-1AB1-4565-B4EF-ABBC5C841E8D}" = Windows Live Messenger
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6BFA19E3-1349-6CC1-6D57-A451DCF0D2C2}" = Catalyst Control Center Graphics Previews Common
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7115EEBC-DA7B-434C-B81C-EA5B26EA9A94}" = Windows Live Writer Resources
"{71777A0C-8493-A630-9A64-A8D4970159C6}" = CCC Help Danish
"{753F0A72-59C3-41CE-A36A-F2DF2079275C}" = Windows Live Mail
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B982EBD-D017-4527-BF1A-FC489EC6B100}" = Windows Live 照片库
"{7E2E66F7-B155-CCE7-44A5-2884A7A7624E}" = PX Profile Update
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83C53BA3-A7C3-2EAF-C306-84C0AE74DA14}" = CCC Help Italian
"{8467b556-b091-4b48-ac95-c32808a4d3aa}" = iNetBet Casino
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{903EDF14-4E28-4463-AA5E-4AEE71C0263B}" = Windows Live Movie Maker
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{96A066E6-5709-1DAF-35A7-B8A6226E61ED}" = Catalyst Control Center
"{9901F803-DB1B-2AEC-CA0D-BF4CD77FC5EE}" = Catalyst Control Center Profiles Mobile
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{AD3E3284-2AF3-544A-9FEC-CB7889605903}" = CCC Help Korean
"{B18B1D52-DB0C-050F-5A66-4454B355F6D8}" = CCC Help Swedish
"{B4659186-0D91-A85E-AF28-3F878EA19A9D}" = CCC Help Hungarian
"{B50C8836-5C29-D8AB-930F-59FC0D8A8FAA}" = Catalyst Control Center InstallProxy
"{B90CDE7A-845D-89D5-A694-EE1A1FA6581D}" = CCC Help Russian
"{C0790CB6-B34A-9A3C-B4A2-D7397F9DF872}" = CCC Help Turkish
"{C2B3CD38-D00C-7865-4208-44DC1505354A}" = CCC Help English
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C86295D9-A56F-6212-4C0B-47F4832351F8}" = CCC Help Finnish
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D00556A3-11D8-CB29-4913-6E714901052B}" = CCC Help Portuguese
"{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D4448DA8-2947-7169-1C1D-54F75556C783}" = CCC Help German
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = Lenovo PowerDVD 10
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}" = UserGuide
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Display Audio Driver
"{F1FF16B9-457A-C9E9-84CE-E3581478AF32}" = CCC Help Norwegian
"{F493761C-E465-4B9E-9FC1-A312F161DE0A}" = Active Protection System
"{F992409C-9D10-4AE2-BAEB-B5409AD3785E}" = 用于远程连接的 Windows Live Mesh ActiveX 控件(简体中文)
"{FBC823AA-854B-C5FA-B8A6-DD95E592682E}" = CCC Help Chinese Traditional
"{FC9B811E-39BC-4813-9E29-B83CCF700010}" = Lenovo EasyCamera
"{FCC5D014-047B-B826-A072-8EC730C6E20B}" = CCC Help Czech
"{FDB0A81A-1173-4B15-BEA4-89FEA0474F17}" = Intelligent Touchpad
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"1180-6883-2514-0226-redbet-PROD" = redbet
"32red" = 32Red Casino
"888poker" = 888poker
"Adobe AIR" = Adobe AIR
"Avira AntiVir Desktop" = Avira Free Antivirus
"Bet24 Poker_is1" = Bet24 Poker 1.0.0
"Betfair Poker JPC_is1" = Betfair Poker JPC 1.0.0
"Betsafe Poker_is1" = Betsafe Poker
"Betsson Poker_is1" = Betsson Poker
"bwin Poker JPC_is1" = bwin Poker JPC 1.0.0
"CasinoRedKings" = CasinoRedKings
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"HollywoodPoker.com_is1" = HollywoodPoker.com
"Info Center_is1" = Info Center 1.0.0.10
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = Lenovo PowerDVD 10
"InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}" = UserGuide
"InterPoker(EUR)" = InterPoker(EUR)
"ladbrokes (Poker)" = Ladbrokes Poker
"ladbrokesviper" = Ladbrokes Casino
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000
"Mozilla Firefox 10.0.2 (x86 en-US)" = Mozilla Firefox 10.0.2 (x86 en-US)
"nordicbet (Poker)" = NordicBet
"OnlineArmor_is1" = Online Armor 5.1
"Paf Spade Poker JPC_is1" = Paf Spade Poker JPC 1.0.0
"PokerStars" = PokerStars
"ProInst" = Intel PROSet Wireless
"RedKings Poker JPC_is1" = RedKings Poker JPC 1.0.0
"Revo Uninstaller" = Revo Uninstaller 1.93
"Smart Defrag 2_is1" = Smart Defrag 2
"Smart Live Poker JPC_is1" = Smart Live Poker JPC 1.0.0
"unibetpoker (Poker)" = Unibet
"Veetle TV" = Veetle TV
"Virgin Poker" = Virgin Poker
"vShare.tv plugin" = vShare.tv plugin 1.3
"WinLiveSuite" = Windows Live 程式集

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for ONewbieO
"Betfred Poker" = Betfred Poker
"Google Chrome" = Google Chrome
"Gutshot Poker" = Gutshot Poker
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 16/3/2012 4:00:59 AM | Computer Name = AlvinPC | Source = ATIeRecord | ID = 16398
Description = ATI EEU failed to post message to CCC

Error - 16/3/2012 4:00:59 AM | Computer Name = AlvinPC | Source = ATIeRecord | ID = 16398
Description = ATI EEU failed to post message to CCC

Error - 16/3/2012 4:02:55 AM | Computer Name = AlvinPC | Source = WinMgmt | ID = 10
Description =

Error - 16/3/2012 5:52:42 AM | Computer Name = AlvinPC | Source = WinMgmt | ID = 10
Description =

Error - 19/3/2012 1:27:01 PM | Computer Name = AlvinPC | Source = ATIeRecord | ID = 16398
Description = ATI EEU failed to post message to CCC

Error - 19/3/2012 1:27:01 PM | Computer Name = AlvinPC | Source = ATIeRecord | ID = 16398
Description = ATI EEU failed to post message to CCC

Error - 19/3/2012 1:27:01 PM | Computer Name = AlvinPC | Source = ATIeRecord | ID = 16398
Description = ATI EEU failed to post message to CCC

Error - 19/3/2012 1:27:01 PM | Computer Name = AlvinPC | Source = ATIeRecord | ID = 16398
Description = ATI EEU failed to post message to CCC

Error - 19/3/2012 2:04:48 PM | Computer Name = AlvinPC | Source = WinMgmt | ID = 10
Description =

Error - 19/3/2012 4:40:02 PM | Computer Name = AlvinPC | Source = ATIeRecord | ID = 16398
Description = ATI EEU failed to post message to CCC

[ System Events ]
Error - 6/4/2012 5:50:34 PM | Computer Name = AlvinPC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = There was an error while attempting to read the local hosts file.

Error - 6/4/2012 5:50:56 PM | Computer Name = AlvinPC | Source = Service Control Manager | ID = 7034
Description = The AMD External Events Utility service terminated unexpectedly.
It has done this 1 time(s).

Error - 6/4/2012 5:51:51 PM | Computer Name = AlvinPC | Source = DCOM | ID = 10010
Description =

Error - 6/4/2012 5:58:38 PM | Computer Name = AlvinPC | Source = DCOM | ID = 10010
Description =

Error - 6/4/2012 8:35:34 PM | Computer Name = AlvinPC | Source = DCOM | ID = 10010
Description =

Error - 7/4/2012 8:22:15 AM | Computer Name = AlvinPC | Source = DCOM | ID = 10010
Description =

Error - 7/4/2012 11:31:08 AM | Computer Name = AlvinPC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = There was an error while attempting to read the local hosts file.

Error - 7/4/2012 11:31:31 AM | Computer Name = AlvinPC | Source = Service Control Manager | ID = 7031
Description = The RPC Endpoint Mapper service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 120000 milliseconds:
Restart the service.

Error - 7/4/2012 11:31:31 AM | Computer Name = AlvinPC | Source = Service Control Manager | ID = 7031
Description = The Remote Procedure Call (RPC) service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Reboot the machine.

Error - 7/4/2012 11:45:14 AM | Computer Name = AlvinPC | Source = DCOM | ID = 10010
Description =

< End of report >

jeffce

Post #26April 8, 2012, 1:03 PM UTC

Hi,

Providing there are no more malware related problems…

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN

SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!!

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
———-

Clean up with OTL:

Right-click and Run as Administrator OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

———-

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted using right-click > delete so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:

Open Internet Explorer
Click on Tools > Internet Options
Press Security tab
Select Internet zone then place check next to Enable Protected Mode if not already done
Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

6. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

ONewbieO

Post #27April 8, 2012, 1:12 PM UTC

Point Number 1 , 2 can be followed promptly . Point Number 3 Question : I'm using Avira Antivirus . Hope that is good enough ? The update file was corrupted and since this repair work was being done , i have uninstalled it and downloaded a fresh copy . Point Number 4 Question : I have Online Armour . But the main question is in using Online Armour . I used to use it without any problems . In fact , one of the first things i have done since i got this new lappy was to download Online Armour and Avira Antivirus Plus Malware Bytes at that time as it was still fresh in my memory after i repaired one of my older machines . Right now , Online Armour is crashing with my google chromes videos , if i enable it , the videos will lag . Even though the logs are clean now , the youtube videos seems to be the same as before . Running smooth without Online Armour that is . However , the streaming videos are not running that smoothly now . Which baffles me to be honest . I wonder if there is any fix to this situation . Point Number 5 can be done daily . Not a problem with that . Point Number 6 Question : I need to give it a try and the tutorial first before i can ask you anything on that . By asking you whats a MVPS HOSTS defeats the purpose as i have not read the tutorial . Will look up Point Number 7 and 8 as well .

jeffce

Post #28April 8, 2012, 1:29 PM UTC

Hi,

Point Number 3 Question : I'm using Avira Antivirus . Hope that is good enough ? The update file was corrupted and since this repair work was being done , i have uninstalled it and downloaded a fresh copy .

Yes that is just fine.

I am going to look into the problem with Online Armour. It may be that it is just blocking some part of Google Chrome for some reason. Do you have the same problems in other browsers?

ONewbieO

Post #29April 8, 2012, 1:41 PM UTC

Hi again . I currently have 3 browsers on my lappy .

I have Internet Explorer , Firefox and google chrome .

Just tried watching A tennis stream from a legit site and have the following to report .

Internet Explorer - Ok with an occasional lag .

Firefox - Ok with an occasional lag .

Google chrome - Lagging furiously . Screen doesnt even show the ball properly .

Hi,

Point Number 3 Question : I'm using Avira Antivirus . Hope that is good enough ? The update file was corrupted and since this repair work was being done , i have uninstalled it and downloaded a fresh copy .
Yes that is just fine.

I am going to look into the problem with Online Armour. It may be that it is just blocking some part of Google Chrome for some reason. Do you have the same problems in other browsers?

ONewbieO

Post #30April 8, 2012, 1:46 PM UTC

Final Question i believe . I don't get how MVPS thingy works . Could you explain ? Do i need to do anything on my side either than just downloading it ?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Computer running slower , Will receive black screens on some videos [S

✨ Ask AI

Ask AI