What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

searchnu.com/406

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
A friend of mine has asked that I fix her laptop. When I took a look at it there appears to be a few things wrong, first she wanted to remove the screen saver which I just turned off. The second was that when she would go online her browser would lead her to www.searchnu.com/406. I have no clue as to how to fix this and a google search on the topic has lead me here. I would appreciate any help you can provide. Thanks you, Jon
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post











  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    C:\Windows\assembly\tmp\U\*.* /s
    CREATERESTOREPOINT

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
Post #4
OTL logfile created on: 7/12/2012 2:38:09 AM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\masha\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 1.72 Gb Available Physical Memory | 57.58% Memory free
6.18 Gb Paging File | 4.91 Gb Available in Paging File | 79.43% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 184.84 Gb Total Space | 120.16 Gb Free Space | 65.00% Space Free | Partition Type: NTFS

Computer Name: MASHASBABY2 | User Name: masha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Users\masha\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
PRC - C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
PRC - C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe (NETGEAR)
PRC - C:\Program Files\NETGEAR Genie\bin\genie_tray.exe ()
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
PRC - C:\Program Files\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\ssonsvr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\SiteSafety.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Resource.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Internet.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DiagnoseDll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DiagnosePlugin.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Map.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\NetcardApi.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\SVTUtils.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_FirmwareUpdate.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\Genie.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_TrafficMeter.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Airprint.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\airprintdll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DragonNetTool.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Wireless.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Statistics.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtGui4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtCore4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtNetwork4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\genie_tray.exe ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtXml4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\WSetupApiPlugin.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qico4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qgif4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\WSetupDll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\libgcc_s_dw2-1.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\mingwm10.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\System32\igfxTMM.dll ()


========== Win32 Services (SafeList) ==========

SRV - (KeyIso32) – C:\Windows\system32\clusapi32.exe File not found
SRV - (CLTNetCnService) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (vToolbarUpdater11.1.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe ()
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (NETGEARGenieDaemon) – C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe (NETGEAR)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (AdvancedSystemCareService) – C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (MotoHelper.exe) – C:\Program Files\Motorola\Moto Helper Service\MotoHelper.exe (Motorola)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (TNaviSrv) – C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (ConfigFree Service) – C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (TOSHIBA SMART Log Service) – C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (Swupdtmr) – c:\Toshiba\IVP\swupdate\swupdtmr.exe ()
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (pinger) – C:\Toshiba\IVP\ISM\pinger.exe ()
SRV - (AgereModemAudio) – C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)


========== Driver Services (SafeList) ==========

DRV - (Tosrfcom) – File not found
DRV - (PnSson) – File not found
DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (motmodem) – system32\DRIVERS\motmodem.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\Windows\System32\drivers\avgidsfilterx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (ctxusbm) – C:\Windows\System32\drivers\ctxusbm.sys (Citrix Systems, Inc.)
DRV - (MotDev) – C:\Windows\System32\drivers\motodrv.sys (Motorola Inc)
DRV - (USB_RNDIS_VISTA) – C:\Windows\System32\drivers\usb8023.sys (Microsoft Corporation)
DRV - (tos_sps32) – C:\Windows\System32\drivers\tos_sps32.sys (TOSHIBA Corporation)
DRV - (NETw3v32) Intel® – C:\Windows\System32\drivers\NETw3v32.sys (Intel Corporation)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (UVCFTR) – C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (TVALZ) – C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (FwLnk) – C:\Windows\System32\drivers\FwLnk.sys (TOSHIBA Corporation)
DRV - (KR10I) – C:\Windows\System32\drivers\KR10I.sys (TOSHIBA CORPORATION)
DRV - (KR10N) – C:\Windows\System32\drivers\KR10N.sys (TOSHIBA CORPORATION)
DRV - (tosrfec) – C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (Cdralw2k) – C:\Windows\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) – C:\Windows\System32\drivers\cdr4_xp.sys (Sonic Solutions)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms…000001f3c3d0554
IE - HKCU\..\SearchScopes\{622B8144-A01E-44C2-9ADC-93FFF20ECE30}: "URL" = http://websearch.ask.com/redirect?client=i…9F-7B6770CF4CB6
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={0E06B5B…mp;d=2012-06-13 18:00:37&v=11.1.0.7&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb119/?searc…VoWIo8&i=26
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:54707

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Radio TV 1.1 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2856425&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.order.2: "Search the web (Babylon)"
FF - prefs.js..browser.search.param.yahoo-fr: "w3i&type=W3i_DS,157,0_0,Search,20111149,6902,0,24,0"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
FF - prefs.js..extensions.enabledItems: {34EFA911-B536-4C08-BECE-CD5E55C875B0}:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {060a0a36-13dc-407d-b055-5a9accd8e083}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:3.11.3.15590
FF - prefs.js..extensions.enabledItems: {CF26A516-B70F-40C6-924B-B5C48E08E047}:1.9.1
FF - prefs.js..extensions.netassistant.keyword.url: "http://click.w3i.com/?Programid=132&Elementname=Keyword&Applicationid={8D5D3439-3F40-4B70-8B62-79B483BF826B}&Version=3.6.5&Vintage=20111149&Defaultbrowserid=24&Productid=2138&Vendorid=3852&Offerid=6894&searchterm="
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B5fbbb4e1-bbff-4a8a-b040-92d50ea6d8be%7D&mid=9df011e0ebb647d096f7d15775dc3005-b3d1ca92a5785fc32b23de92492aadb4224effeb&ds=AVG&v=11.1.0.7&lang=en&pr=fr&d=2012-06-13%2018%3A00%3A37&sap=ku&q="
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/10/04 20:05:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/07/11 14:34:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/11 14:34:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.7\ [2012/06/13 18:00:54 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/27 21:12:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/14 13:08:46 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{CF26A516-B70F-40C6-924B-B5C48E08E047}: C:\Users\masha\AppData\Local\{CF26A516-B70F-40C6-924B-B5C48E08E047}
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{B4775D38-C4B3-4DA3-9DB1-FA3097BC1CCD}: C:\Users\masha\AppData\Local\{B4775D38-C4B3-4DA3-9DB1-FA3097BC1CCD} [2011/05/06 19:14:19 | 000,000,000 | —D | M]

[2012/03/31 22:50:49 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Extensions
[2009/02/09 22:24:53 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Extensions\[removed]
[2012/06/13 17:40:47 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions
[2012/05/14 20:50:14 | 000,000,000 | —D | M] (MeFeedia) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{154d932f-dc51-4a4f-9d52-b78b1419d3b4}
[2011/08/28 19:08:10 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2012/05/20 13:46:05 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/07/20 23:04:07 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{8f01f78a-66c2-4988-9468-acf7d05b9cdd}
[2012/03/31 22:50:41 | 000,000,000 | —D | M] (Searchqu Toolbar) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2012/06/13 17:40:47 | 000,000,000 | —D | M] (TelevisionFanatic) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/04/05 20:12:12 | 000,000,000 | —D | M] ("Codec-V") – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2011/03/31 19:16:10 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2011/11/11 22:05:03 | 000,000,000 | —D | M] (Babylon) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/03/30 20:16:48 | 000,000,000 | —D | M] (incredibar.com) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/03/31 09:27:30 | 000,000,000 | —D | M] (wxDfast) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/05/14 20:49:40 | 000,000,000 | —D | M] (RivalGaming) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/04/18 09:16:52 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/01/03 16:27:44 | 000,002,333 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\askcom.xml
[2011/02/09 23:59:36 | 000,001,919 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\bing-zugo.xml
[2010/12/18 11:30:17 | 000,001,832 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\bing.xml
[2010/12/30 18:21:50 | 000,000,927 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\conduit.xml
[2012/03/30 20:16:35 | 000,002,203 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\MyStart Search.xml
[2010/12/18 18:17:04 | 000,009,947 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\mywebsearch.xml
[2012/03/31 22:50:33 | 000,002,519 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\Search_Results.xml
[2012/06/14 13:11:18 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/07/11 14:34:29 | 000,000,000 | —D | M] (AVG Do Not Track) – C:\PROGRAM FILES\AVG\AVG2012\FIREFOX\DONOTTRACK
[2012/07/11 14:34:50 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG2012\FIREFOX4
[2012/06/13 18:00:54 | 000,000,000 | —D | M] (AVG Security Toolbar) – C:\PROGRAMDATA\AVG SECURE SEARCH\11.1.0.7
[2012/04/27 21:12:40 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/03/11 01:01:02 | 000,124,272 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\CCMSDK.dll
[2010/03/11 01:02:52 | 000,070,512 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\CgpCore.dll
[2010/03/11 01:01:48 | 000,091,504 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\confmgr.dll
[2010/03/11 01:01:24 | 000,022,384 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\ctxlogging.dll
[2012/04/18 09:04:08 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/03/11 01:40:56 | 000,423,248 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npicaN.dll
[2011/07/11 16:48:12 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2010/03/11 01:02:48 | 000,023,920 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
[2012/06/13 18:00:26 | 000,003,747 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2011/11/11 22:05:00 | 000,002,287 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/03/25 08:02:38 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/31 22:50:33 | 000,002,519 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012/03/25 08:02:38 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={0E06B5B…mp;d=2012-06-13 18:00:37&v=11.1.0.7&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://clients5.google.com/complete/search…outputEncoding}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\masha\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: RivalGaming Addon (Enabled) = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\adhmhclafdhfabmmglbcngpddpdeijgd\npRivalGamingGC.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: My Web Search Plugin Stub (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: MindSpark Toolbar Platform Plugin Stub (Enabled) = C:\Program Files\TelevisionFanatic\bar\1.bin\NP64Stub.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: RivalGaming = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\adhmhclafdhfabmmglbcngpddpdeijgd\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: AVG Safe Search = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2161_0\
CHR - Extension: Codec-V = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho\1.17.48_0\
CHR - Extension: AVG Do Not Track = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.0.0.2166_0\

O1 HOSTS File: ([2011/09/13 21:42:10 | 000,000,755 | –S- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (mefeediaTest) - {154d932f-dc51-4a4f-9d52-b78b1419d3b4} - C:\Program Files\mefeediatest\w3itemplateX.dll ()
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe (The Weather Channel Interactive, Inc.)
O4 - HKCU..\Run: [NETGEARGenie] C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3EDB808E-B228-4CF6-A4B2-230A7BD2C493}: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC1C1BDC-79EC-4890-A64C-93BAA279BAAE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FE322BF5-9FA0-41DB-824F-A3233C17305E}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll ()
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\masha\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\masha\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/01/19 18:21:19 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{1f6dbfef-e5a7-11dd-b78a-001e3338d9f6}\Shell\AutoRun\command - "" = D:\system\viewer\FlipVideoforPC.exe
O33 - MountPoints2\{1f6dbfef-e5a7-11dd-b78a-001e3338d9f6}\Shell\Flip Video for PC\command - "" = D:\system\viewer\FlipVideoforPC.exe
O33 - MountPoints2\{745bd0d0-e66c-11de-ad69-001e3338d9f6}\Shell - "" = AutoRun
O33 - MountPoints2\{745bd0d0-e66c-11de-ad69-001e3338d9f6}\Shell\AutoRun\command - "" = E:\PhotoManager.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\AutoRun\command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\explore\Command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\open\Command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{df8b47cd-6f80-11df-b8d7-001e3338d9f6}\Shell - "" = AutoRun
O33 - MountPoints2\{df8b47cd-6f80-11df-b8d7-001e3338d9f6}\Shell\AutoRun\command - "" = E:\PhotoManager.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/07/11 14:34:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/06/25 15:10:06 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Users\masha\Desktop\OTL.exe
[2012/06/13 18:02:46 | 000,000,000 | —D | C] – C:\Users\masha\AppData\Roaming\AVG2012
[2012/06/13 18:01:10 | 000,000,000 | —D | C] – C:\Users\masha\AppData\Local\AVG Secure Search
[2012/06/13 18:00:35 | 000,000,000 | —D | C] – C:\ProgramData\AVG Secure Search
[2012/06/13 18:00:30 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search
[2012/06/13 18:00:28 | 000,000,000 | —D | C] – C:\Program Files\AVG Secure Search
[2012/06/13 17:58:24 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2012/06/13 17:56:39 | 000,000,000 | -H-D | C] – C:\$AVG
[2012/06/13 17:56:38 | 000,000,000 | —D | C] – C:\ProgramData\AVG2012
[2012/06/13 17:56:38 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\AVG
[2012/06/13 17:54:02 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2012/06/13 17:44:37 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2012/06/13 17:42:28 | 000,000,000 | —D | C] – C:\Users\masha\AppData\Roaming\Malwarebytes
[2012/06/13 17:42:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/13 17:42:17 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/06/13 17:42:16 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/06/13 17:42:16 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/06/13 17:40:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/06/13 17:40:50 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2011/11/11 22:04:55 | 000,853,104 | —- | C] (Babylon Ltd.) – C:\Program Files\toolbar.exe
[21 C:\Users\masha\Documents\*.tmp files -> C:\Users\masha\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/12 02:37:50 | 000,617,702 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/07/12 02:37:49 | 000,108,772 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/07/12 02:35:13 | 101,381,943 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/07/12 02:30:59 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/12 02:30:58 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/12 02:30:58 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/12 02:30:40 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/12 02:30:17 | 3210,694,656 | -HS- | M] () – C:\hiberfil.sys
[2012/07/11 14:26:11 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/25 11:31:18 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\masha\Desktop\OTL.exe
[2012/06/20 23:53:14 | 000,000,370 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2012/06/19 19:17:43 | 000,048,428 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/06/17 10:23:38 | 000,001,933 | —- | M] () – C:\Users\masha\Desktop\CS Practice CS.lnk
[2012/06/17 10:23:38 | 000,001,931 | —- | M] () – C:\Users\masha\Desktop\File Explorer.lnk
[21 C:\Users\masha\Documents\*.tmp files -> C:\Users\masha\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/12 02:35:13 | 101,381,943 | —- | C] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/06/19 19:17:43 | 000,048,428 | —- | C] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/06/17 10:23:39 | 000,001,995 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MoffSoft Calculator 2.lnk
[2012/06/17 10:23:39 | 000,001,983 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prosystem fx Fixed Assets.lnk
[2012/06/17 10:23:39 | 000,001,979 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Powerpoint.lnk
[2012/06/17 10:23:39 | 000,001,977 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prosystem fx Products.lnk
[2012/06/17 10:23:39 | 000,001,977 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft publisher.lnk
[2012/06/17 10:23:39 | 000,001,977 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Transfer Explorer.lnk
[2012/06/17 10:23:39 | 000,001,975 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SurePrep Dashboard 2011.lnk
[2012/06/17 10:23:39 | 000,001,975 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SurePrep Dashboard 2010.lnk
[2012/06/17 10:23:39 | 000,001,975 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SurePrep Dashboard 2009.lnk
[2012/06/17 10:23:39 | 000,001,971 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prosystem Engagment.lnk
[2012/06/17 10:23:39 | 000,001,971 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Outlook.lnk
[2012/06/17 10:23:39 | 000,001,969 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Word.lnk
[2012/06/17 10:23:39 | 000,001,969 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneNote.lnk
[2012/06/17 10:23:39 | 000,001,969 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Excel.lnk
[2012/06/17 10:23:39 | 000,001,967 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Access.lnk
[2012/06/17 10:23:39 | 000,001,961 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk
[2012/06/17 10:23:39 | 000,001,959 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\W2 Mate 2011.lnk
[2012/06/17 10:23:39 | 000,001,959 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Peachtree 2011.lnk
[2012/06/17 10:23:39 | 000,001,955 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\QB Products.lnk
[2012/06/17 10:23:39 | 000,001,955 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PPC Library.lnk
[2012/06/17 10:23:39 | 000,001,951 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ViewChoice.lnk
[2012/06/17 10:23:39 | 000,001,947 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TValue5.lnk
[2012/06/17 10:23:39 | 000,001,947 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KeyPass.lnk
[2012/06/17 10:23:38 | 000,001,991 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Coaxis Problem Steps Recorder.lnk
[2012/06/17 10:23:38 | 000,001,981 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Checkpoint Tools for PPC.lnk
[2012/06/17 10:23:38 | 000,001,979 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Devices and Printers.lnk
[2012/06/17 10:23:38 | 000,001,969 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk
[2012/06/17 10:23:38 | 000,001,963 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CS Practice CS.lnk
[2012/06/17 10:23:38 | 000,001,957 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CS Products.lnk
[2012/06/17 10:23:38 | 000,001,955 | —- | C] () – C:\Users\masha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Billcom Sync.lnk
[2012/06/17 10:23:38 | 000,001,933 | —- | C] () – C:\Users\masha\Desktop\CS Practice CS.lnk
[2012/06/17 10:23:38 | 000,001,931 | —- | C] () – C:\Users\masha\Desktop\File Explorer.lnk
[2011/08/10 03:07:23 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2011/05/21 23:09:09 | 000,012,242 | -HS- | C] () – C:\Users\masha\AppData\Local\w70st7567b4372d
[2011/05/21 23:09:09 | 000,012,242 | -HS- | C] () – C:\ProgramData\w70st7567b4372d
[2011/05/21 23:08:44 | 000,002,628 | —- | C] () – C:\Users\masha\AppData\Roaming\C164.858
[2011/03/16 20:40:53 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2011/01/18 03:53:32 | 002,994,688 | —- | C] () – C:\Users\masha\openofficeorg33.msi
[2011/01/18 03:50:56 | 132,609,310 | —- | C] () – C:\Users\masha\openofficeorg1.cab
[2010/12/06 23:35:48 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/11/26 23:02:33 | 000,815,104 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/11/26 23:02:32 | 000,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/07/13 19:54:37 | 000,000,668 | —- | C] () – C:\Users\masha\AppData\Roaming\account{undefined_News}.oeaccount
[2009/07/13 19:54:30 | 000,000,747 | —- | C] () – C:\Users\masha\AppData\Roaming\account{[removed]}.oeaccount
[2009/03/27 17:06:03 | 000,026,340 | —- | C] () – C:\Users\masha\AppData\Roaming\UserTile.png
[2008/08/09 23:26:03 | 000,006,540 | —- | C] () – C:\Users\masha\AppData\Local\d3d9caps.dat
[2008/07/08 19:41:26 | 000,000,000 | —- | C] () – C:\Users\masha\AppData\Roaming\wklnhst.dat
[2008/06/18 11:47:11 | 000,011,264 | —- | C] () – C:\Users\masha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== LOP Check ==========

[2011/09/05 16:01:44 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Ashampoo
[2012/06/13 18:02:46 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\AVG2012
[2011/11/11 22:04:57 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Babylon
[2011/03/28 19:52:35 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\BF215B20FAABEEFC2C1269A3AA74F307
[2012/02/07 12:42:04 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\ICAClient
[2011/09/07 01:48:03 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\IObit
[2010/12/07 23:05:01 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\LimeWire
[2011/03/12 16:16:47 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\OpenOffice.org
[2009/03/27 17:06:03 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\PeerNetworking
[2009/04/07 13:30:46 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Publish Providers
[2009/04/07 15:00:07 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Sony
[2010/12/06 21:17:41 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Tific
[2010/12/06 21:27:24 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Titanium Gears
[2008/06/16 10:38:13 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\TOSHIBA
[2008/07/21 16:33:25 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Ulead Systems
[2009/03/28 11:46:52 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Wal-Mart
[2008/06/16 20:19:26 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\WinBatch
[2012/06/20 23:53:14 | 000,000,370 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2012/07/11 14:44:41 | 000,032,594 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/10/29 01:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 01:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 22:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 01:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\explorer.exe
[2009/04/11 01:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/27 21:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 21:24:24 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: SVCHOST.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2008/01/20 21:23:43 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\System32\svchost.exe
[2008/01/20 21:23:43 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/01/20 21:24:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\System32\userinit.exe
[2008/01/20 21:24:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | —- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/04/11 01:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\System32\winlogon.exe
[2009/04/11 01:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008/01/20 21:24:49 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:A2947BEA

< End of report >
Post #5
When you ran OTL, did it produce extras.txt,, please post this if so.



Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Otl
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms…000001f3c3d0554
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb119/?searc…VoWIo8&i=26
FF - prefs.js..browser.search.order.2: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2856425&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
[2012/03/31 22:50:41 | 000,000,000 | —D | M] (Searchqu Toolbar) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2011/11/11 22:05:03 | 000,000,000 | —D | M] (Babylon) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/03/30 20:16:48 | 000,000,000 | —D | M] (incredibar.com) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/03/30 20:16:35 | 000,002,203 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\MyStart Search.xml
[2010/12/18 18:17:04 | 000,009,947 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\mywebsearch.xml
[2012/03/31 22:50:33 | 000,002,519 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\Search_Results.xml
[2011/11/11 22:05:00 | 000,002,287 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/03/31 22:50:33 | 000,002,519 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml

O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll) - C:\Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
[2011/11/11 22:04:55 | 000,853,104 | —- | C] (Babylon Ltd.) – C:\Program Files\toolbar.exe
[2011/11/11 22:04:57 | 000,000,000 | —D | M] – C:\Users\masha\AppData\Roaming\Babylon
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:A2947BEA

:Commands
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Post #7
OTL logfile created on: 7/12/2012 10:54:41 AM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\masha\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 65.03% Memory free
6.18 Gb Paging File | 5.15 Gb Available in Paging File | 83.33% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 184.84 Gb Total Space | 120.18 Gb Free Space | 65.02% Space Free | Partition Type: NTFS

Computer Name: MASHASBABY2 | User Name: masha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Users\masha\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
PRC - C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe (NETGEAR)
PRC - C:\Program Files\NETGEAR Genie\bin\genie_tray.exe ()
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
PRC - C:\Program Files\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\ssonsvr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\SiteSafety.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5d8696f15e49aedf883dd945806a7049\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Resource.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Internet.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DiagnoseDll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DiagnosePlugin.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Map.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\NetcardApi.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\SVTUtils.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_FirmwareUpdate.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\Genie.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_TrafficMeter.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Airprint.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\airprintdll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DragonNetTool.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Wireless.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Statistics.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtGui4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtCore4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtNetwork4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\genie_tray.exe ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtXml4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\WSetupApiPlugin.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qico4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qgif4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\WSetupDll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\libgcc_s_dw2-1.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\mingwm10.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\ASCv4ExtMenu.dll ()
MOD - C:\Windows\System32\igfxTMM.dll ()


========== Win32 Services (SafeList) ==========

SRV - (KeyIso32) – C:\Windows\system32\clusapi32.exe File not found
SRV - (CLTNetCnService) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (vToolbarUpdater11.1.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe ()
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (NETGEARGenieDaemon) – C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe (NETGEAR)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (AdvancedSystemCareService) – C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (MotoHelper.exe) – C:\Program Files\Motorola\Moto Helper Service\MotoHelper.exe (Motorola)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (TNaviSrv) – C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (ConfigFree Service) – C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (TOSHIBA SMART Log Service) – C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (Swupdtmr) – c:\Toshiba\IVP\swupdate\swupdtmr.exe ()
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (pinger) – C:\Toshiba\IVP\ISM\pinger.exe ()
SRV - (AgereModemAudio) – C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)


========== Driver Services (SafeList) ==========

DRV - (Tosrfcom) – File not found
DRV - (PnSson) – File not found
DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (motmodem) – system32\DRIVERS\motmodem.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\Windows\System32\drivers\avgidsfilterx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (ctxusbm) – C:\Windows\System32\drivers\ctxusbm.sys (Citrix Systems, Inc.)
DRV - (MotDev) – C:\Windows\System32\drivers\motodrv.sys (Motorola Inc)
DRV - (USB_RNDIS_VISTA) – C:\Windows\System32\drivers\usb8023.sys (Microsoft Corporation)
DRV - (tos_sps32) – C:\Windows\System32\drivers\tos_sps32.sys (TOSHIBA Corporation)
DRV - (NETw3v32) Intel® – C:\Windows\System32\drivers\NETw3v32.sys (Intel Corporation)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (UVCFTR) – C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (TVALZ) – C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (FwLnk) – C:\Windows\System32\drivers\FwLnk.sys (TOSHIBA Corporation)
DRV - (KR10I) – C:\Windows\System32\drivers\KR10I.sys (TOSHIBA CORPORATION)
DRV - (KR10N) – C:\Windows\System32\drivers\KR10N.sys (TOSHIBA CORPORATION)
DRV - (tosrfec) – C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (Cdralw2k) – C:\Windows\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) – C:\Windows\System32\drivers\cdr4_xp.sys (Sonic Solutions)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\InprocServer32 File not found
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{622B8144-A01E-44C2-9ADC-93FFF20ECE30}: "URL" = http://websearch.ask.com/redirect?client=i…9F-7B6770CF4CB6
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={0E06B5B…mp;d=2012-06-13 18:00:37&v=11.1.0.7&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:54707

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Radio TV 1.1 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.order.2: ""
FF - prefs.js..browser.search.param.yahoo-fr: "w3i&type=W3i_DS,157,0_0,Search,20111149,6902,0,24,0"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {34EFA911-B536-4C08-BECE-CD5E55C875B0}:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {060a0a36-13dc-407d-b055-5a9accd8e083}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:3.11.3.15590
FF - prefs.js..extensions.enabledItems: {CF26A516-B70F-40C6-924B-B5C48E08E047}:1.9.1
FF - prefs.js..extensions.netassistant.keyword.url: "http://click.w3i.com/?Programid=132&Elementname=Keyword&Applicationid={8D5D3439-3F40-4B70-8B62-79B483BF826B}&Version=3.6.5&Vintage=20111149&Defaultbrowserid=24&Productid=2138&Vendorid=3852&Offerid=6894&searchterm="
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B5fbbb4e1-bbff-4a8a-b040-92d50ea6d8be%7D&mid=9df011e0ebb647d096f7d15775dc3005-b3d1ca92a5785fc32b23de92492aadb4224effeb&ds=AVG&v=11.1.0.7&lang=en&pr=fr&d=2012-06-13%2018%3A00%3A37&sap=ku&q="
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/10/04 20:05:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/07/11 14:34:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/11 14:34:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.7\ [2012/06/13 18:00:54 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/27 21:12:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/14 13:08:46 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{CF26A516-B70F-40C6-924B-B5C48E08E047}: C:\Users\masha\AppData\Local\{CF26A516-B70F-40C6-924B-B5C48E08E047}
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{B4775D38-C4B3-4DA3-9DB1-FA3097BC1CCD}: C:\Users\masha\AppData\Local\{B4775D38-C4B3-4DA3-9DB1-FA3097BC1CCD} [2011/05/06 19:14:19 | 000,000,000 | —D | M]

[2012/03/31 22:50:49 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Extensions
[2009/02/09 22:24:53 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Extensions\[removed]
[2012/07/12 10:42:18 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions
[2012/05/14 20:50:14 | 000,000,000 | —D | M] (MeFeedia) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{154d932f-dc51-4a4f-9d52-b78b1419d3b4}
[2011/08/28 19:08:10 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2012/05/20 13:46:05 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/07/20 23:04:07 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{8f01f78a-66c2-4988-9468-acf7d05b9cdd}
[2012/06/13 17:40:47 | 000,000,000 | —D | M] (TelevisionFanatic) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/04/05 20:12:12 | 000,000,000 | —D | M] ("Codec-V") – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2011/03/31 19:16:10 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/03/31 09:27:30 | 000,000,000 | —D | M] (wxDfast) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/05/14 20:49:40 | 000,000,000 | —D | M] (RivalGaming) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/04/18 09:16:52 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/01/03 16:27:44 | 000,002,333 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\askcom.xml
[2011/02/09 23:59:36 | 000,001,919 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\bing-zugo.xml
[2010/12/18 11:30:17 | 000,001,832 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\bing.xml
[2010/12/30 18:21:50 | 000,000,927 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\conduit.xml
[2012/06/14 13:11:18 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/07/11 14:34:29 | 000,000,000 | —D | M] (AVG Do Not Track) – C:\PROGRAM FILES\AVG\AVG2012\FIREFOX\DONOTTRACK
[2012/07/11 14:34:50 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG2012\FIREFOX4
[2012/06/13 18:00:54 | 000,000,000 | —D | M] (AVG Security Toolbar) – C:\PROGRAMDATA\AVG SECURE SEARCH\11.1.0.7
File not found (No name found) – C:\USERS\MASHA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UD0O3OR1.DEFAULT\EXTENSIONS\[removed]
File not found (No name found) – C:\USERS\MASHA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UD0O3OR1.DEFAULT\EXTENSIONS\[removed]
[2012/04/27 21:12:40 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/03/11 01:01:02 | 000,124,272 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\CCMSDK.dll
[2010/03/11 01:02:52 | 000,070,512 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\CgpCore.dll
[2010/03/11 01:01:48 | 000,091,504 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\confmgr.dll
[2010/03/11 01:01:24 | 000,022,384 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\ctxlogging.dll
[2012/04/18 09:04:08 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/03/11 01:40:56 | 000,423,248 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npicaN.dll
[2011/07/11 16:48:12 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2010/03/11 01:02:48 | 000,023,920 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
[2012/06/13 18:00:26 | 000,003,747 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/03/25 08:02:38 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/25 08:02:38 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={0E06B5B…mp;d=2012-06-13 18:00:37&v=11.1.0.7&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://clients5.google.com/complete/search…outputEncoding}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\masha\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: RivalGaming Addon (Enabled) = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\adhmhclafdhfabmmglbcngpddpdeijgd\npRivalGamingGC.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: My Web Search Plugin Stub (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: MindSpark Toolbar Platform Plugin Stub (Enabled) = C:\Program Files\TelevisionFanatic\bar\1.bin\NP64Stub.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: RivalGaming = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\adhmhclafdhfabmmglbcngpddpdeijgd\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: AVG Safe Search = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2161_0\
CHR - Extension: Codec-V = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho\1.17.48_0\
CHR - Extension: AVG Do Not Track = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.0.0.2166_0\

O1 HOSTS File: ([2011/09/13 21:42:10 | 000,000,755 | –S- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (mefeediaTest) - {154d932f-dc51-4a4f-9d52-b78b1419d3b4} - C:\Program Files\mefeediatest\w3itemplateX.dll ()
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe (The Weather Channel Interactive, Inc.)
O4 - HKCU..\Run: [NETGEARGenie] C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3EDB808E-B228-4CF6-A4B2-230A7BD2C493}: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC1C1BDC-79EC-4890-A64C-93BAA279BAAE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FE322BF5-9FA0-41DB-824F-A3233C17305E}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll ()
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - AppInit_DLLs: (c:\progra~1\google\google~1\goec62~1.dll) - c:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\masha\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\masha\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/01/19 18:21:19 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{1f6dbfef-e5a7-11dd-b78a-001e3338d9f6}\Shell\AutoRun\command - "" = D:\system\viewer\FlipVideoforPC.exe
O33 - MountPoints2\{1f6dbfef-e5a7-11dd-b78a-001e3338d9f6}\Shell\Flip Video for PC\command - "" = D:\system\viewer\FlipVideoforPC.exe
O33 - MountPoints2\{745bd0d0-e66c-11de-ad69-001e3338d9f6}\Shell - "" = AutoRun
O33 - MountPoints2\{745bd0d0-e66c-11de-ad69-001e3338d9f6}\Shell\AutoRun\command - "" = E:\PhotoManager.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\AutoRun\command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\explore\Command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\open\Command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{df8b47cd-6f80-11df-b8d7-001e3338d9f6}\Shell - "" = AutoRun
O33 - MountPoints2\{df8b47cd-6f80-11df-b8d7-001e3338d9f6}\Shell\AutoRun\command - "" = E:\PhotoManager.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/12 10:42:05 | 000,000,000 | —D | C] – C:\_OTL
[2012/07/11 14:34:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/06/25 15:10:06 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Users\masha\Desktop\OTL.exe
[2012/06/13 18:02:46 | 000,000,000 | —D | C] – C:\Users\masha\AppData\Roaming\AVG2012
[2012/06/13 18:01:10 | 000,000,000 | —D | C] – C:\Users\masha\AppData\Local\AVG Secure Search
[2012/06/13 18:00:35 | 000,000,000 | —D | C] – C:\ProgramData\AVG Secure Search
[2012/06/13 18:00:30 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search
[2012/06/13 18:00:28 | 000,000,000 | —D | C] – C:\Program Files\AVG Secure Search
[2012/06/13 17:58:24 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2012/06/13 17:56:39 | 000,000,000 | -H-D | C] – C:\$AVG
[2012/06/13 17:56:38 | 000,000,000 | —D | C] – C:\ProgramData\AVG2012
[2012/06/13 17:56:38 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\AVG
[2012/06/13 17:54:02 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2012/06/13 17:44:37 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2012/06/13 17:42:28 | 000,000,000 | —D | C] – C:\Users\masha\AppData\Roaming\Malwarebytes
[2012/06/13 17:42:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/13 17:42:17 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/06/13 17:42:16 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/06/13 17:42:16 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/06/13 17:40:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/06/13 17:40:50 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[21 C:\Users\masha\Documents\*.tmp files -> C:\Users\masha\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/12 10:56:56 | 000,617,702 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/07/12 10:56:56 | 000,108,772 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/07/12 10:49:27 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/12 10:49:23 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/12 10:49:22 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/12 10:49:00 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/12 10:48:49 | 3210,694,656 | -HS- | M] () – C:\hiberfil.sys
[2012/07/12 10:40:00 | 101,389,091 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/07/12 03:26:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/25 11:31:18 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\masha\Desktop\OTL.exe
[2012/06/20 23:53:14 | 000,000,370 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2012/06/19 19:17:43 | 000,048,428 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[21 C:\Users\masha\Documents\*.tmp files -> C:\Users\masha\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/12 10:40:00 | 101,389,091 | —- | C] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/06/19 19:17:43 | 000,048,428 | —- | C] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[2011/08/10 03:07:23 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2011/05/21 23:09:09 | 000,012,242 | -HS- | C] () – C:\Users\masha\AppData\Local\w70st7567b4372d
[2011/05/21 23:09:09 | 000,012,242 | -HS- | C] () – C:\ProgramData\w70st7567b4372d
[2011/05/21 23:08:44 | 000,002,628 | —- | C] () – C:\Users\masha\AppData\Roaming\C164.858
[2011/03/16 20:40:53 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2011/01/18 03:53:32 | 002,994,688 | —- | C] () – C:\Users\masha\openofficeorg33.msi
[2011/01/18 03:50:56 | 132,609,310 | —- | C] () – C:\Users\masha\openofficeorg1.cab
[2010/12/06 23:35:48 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/11/26 23:02:33 | 000,815,104 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/11/26 23:02:32 | 000,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/07/13 19:54:37 | 000,000,668 | —- | C] () – C:\Users\masha\AppData\Roaming\account{undefined_News}.oeaccount
[2009/07/13 19:54:30 | 000,000,747 | —- | C] () – C:\Users\masha\AppData\Roaming\account{[removed]}.oeaccount
[2009/03/27 17:06:03 | 000,026,340 | —- | C] () – C:\Users\masha\AppData\Roaming\UserTile.png
[2008/08/09 23:26:03 | 000,006,540 | —- | C] () – C:\Users\masha\AppData\Local\d3d9caps.dat
[2008/07/08 19:41:26 | 000,000,000 | —- | C] () – C:\Users\masha\AppData\Roaming\wklnhst.dat
[2008/06/18 11:47:11 | 000,011,264 | —- | C] () – C:\Users\masha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

< End of report >
Post #8
  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.







Next

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is not checked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/





Also tell me how the computer is running now.
Post #9
MalwareBites log, (I will do the ESET Online Scanner when I get home from work tonight). Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.12.08 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 masha :: MASHASBABY2 [administrator] 7/12/2012 12:38:51 PM mbam-log-2012-07-12 (12-38-51).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 237476 Time elapsed: 8 minute(s), 20 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Users\masha\Downloads\tvshows.exe (PUP.BundleOffers.IIQ) -> Quarantined and deleted successfully. (end)
Post #10
The computer is running well, once it finishes the boot processes. (I can be impatient at times). There were a few desktop shortcuts that disappeared but I have not noticed anything else wrong at this time.
Post #11
C:\ANDY\asc-setup.exe a variant of Win32/Toolbar.Widgi application C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarApp.dll a variant of Win32/Toolbar.Babylon application C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarEng.dll Win32/Toolbar.Babylon application C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarsrv.exe probably a variant of Win32/Toolbar.Babylon application C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll Win32/Toolbar.Babylon application C:\Program Files\Searchqu Toolbar\Datamngr\BrowserConnection.dll Win32/Toolbar.SearchSuite application C:\Program Files\Searchqu Toolbar\Datamngr\DnsBHO.dll Win32/Toolbar.SearchSuite application C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Default\gphejlpeemiechfepbhajiojanchdaah\contentscript.js Win32/TrojanDownloader.Tracur.F trojan C:\Users\masha\AppData\Roaming\BF215B20FAABEEFC2C1269A3AA74F307\enemies-names.txt Win32/Adware.AntimalwareDoctor.AE.Gen application C:\Users\masha\AppData\Roaming\BF215B20FAABEEFC2C1269A3AA74F307\local.ini Win32/Adware.AntimalwareDoctor.AE.Gen application C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{8f01f78a-66c2-4988-9468-acf7d05b9cdd}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{8f01f78a-66c2-4988-9468-acf7d05b9cdd}\chrome\xulcache.jar JS/Agent.NDJ trojan C:\Users\masha\Downloads\MovieSubtitlesSearcher.exe Win32/Toolbar.Babylon application C:\_OTL\MovedFiles\07122012_104205\C_Program Files\toolbar.exe Win32/Toolbar.Babylon application C:\_OTL\MovedFiles\07122012_104205\C_Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll Win32/Toolbar.Babylon application C:\_OTL\MovedFiles\07122012_104205\C_Program Files\Searchqu Toolbar\Datamngr\datamngr.dll Win32/Toolbar.SearchSuite application C:\_OTL\MovedFiles\07122012_104205\C_Program Files\Searchqu Toolbar\Datamngr\datamngrUI.exe a variant of Win32/Toolbar.SearchSuite application C:\_OTL\MovedFiles\07122012_104205\C_Program Files\Searchqu Toolbar\Datamngr\IEBHO.dll Win32/Toolbar.SearchSuite application
Post #12
Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:files
C:\ANDY\asc-setup.exe 
C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarApp.dll 
C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarEng.dll
C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarsrv.exe 
C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll 
C:\Program Files\Searchqu Toolbar\Datamngr\BrowserConnection.dll 
C:\Program Files\Searchqu Toolbar\Datamngr\DnsBHO.dll
C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Default\gphejlpeemiechfepbhajiojanchdaah\contentscript.js 
C:\Users\masha\AppData\Roaming\BF215B20FAABEEFC2C1269A3AA74F307\enemies-names.txt 
C:\Users\masha\AppData\Roaming\BF215B20FAABEEFC2C1269A3AA74F307\local.ini 
C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{8f01f78a-66c2-4988-9468-acf7d05b9cdd}\chrome.manifest 
C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{8f01f78a-66c2-4988-9468-acf7d05b9cdd}\chrome\xulcache.jar 
C:\Users\masha\Downloads\MovieSubtitlesSearcher.exe 

:Commands
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Post #13
OTL logfile created on: 7/16/2012 10:15:39 AM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\masha\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.99 Gb Total Physical Memory | 1.52 Gb Available Physical Memory | 50.84% Memory free
6.18 Gb Paging File | 4.91 Gb Available in Paging File | 79.52% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 184.84 Gb Total Space | 120.85 Gb Free Space | 65.38% Space Free | Partition Type: NTFS

Computer Name: MASHASBABY2 | User Name: masha | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Users\masha\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
PRC - C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe (NETGEAR)
PRC - C:\Program Files\NETGEAR Genie\bin\genie_tray.exe ()
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
PRC - C:\Program Files\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\ssonsvr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\SiteSafety.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5d8696f15e49aedf883dd945806a7049\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Resource.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Internet.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DiagnoseDll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DiagnosePlugin.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Map.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\NetcardApi.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\SVTUtils.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_FirmwareUpdate.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\Genie.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_TrafficMeter.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Airprint.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\airprintdll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\DragonNetTool.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Wireless.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Statistics.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtGui4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtCore4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtNetwork4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\genie_tray.exe ()
MOD - C:\Program Files\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\QtXml4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\WSetupApiPlugin.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qico4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\imageformats\qgif4.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\WSetupDll.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\libgcc_s_dw2-1.dll ()
MOD - C:\Program Files\NETGEAR Genie\bin\mingwm10.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\ASCv4ExtMenu.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\madexcept_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\madbasic_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\maddisAsm_.bpl ()
MOD - C:\Windows\System32\igfxTMM.dll ()


========== Win32 Services (SafeList) ==========

SRV - (KeyIso32) – C:\Windows\system32\clusapi32.exe File not found
SRV - (CLTNetCnService) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (vToolbarUpdater11.1.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe ()
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (NETGEARGenieDaemon) – C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe (NETGEAR)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (AdvancedSystemCareService) – C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (MotoHelper.exe) – C:\Program Files\Motorola\Moto Helper Service\MotoHelper.exe (Motorola)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (TNaviSrv) – C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (ConfigFree Service) – C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (TOSHIBA SMART Log Service) – C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (Swupdtmr) – c:\Toshiba\IVP\swupdate\swupdtmr.exe ()
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (pinger) – C:\Toshiba\IVP\ISM\pinger.exe ()
SRV - (AgereModemAudio) – C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)


========== Driver Services (SafeList) ==========

DRV - (Tosrfcom) – File not found
DRV - (PnSson) – File not found
DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (motmodem) – system32\DRIVERS\motmodem.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\Windows\System32\drivers\avgidsfilterx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (ctxusbm) – C:\Windows\System32\drivers\ctxusbm.sys (Citrix Systems, Inc.)
DRV - (MotDev) – C:\Windows\System32\drivers\motodrv.sys (Motorola Inc)
DRV - (USB_RNDIS_VISTA) – C:\Windows\System32\drivers\usb8023.sys (Microsoft Corporation)
DRV - (tos_sps32) – C:\Windows\System32\drivers\tos_sps32.sys (TOSHIBA Corporation)
DRV - (NETw3v32) Intel® – C:\Windows\System32\drivers\NETw3v32.sys (Intel Corporation)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation )
DRV - (UVCFTR) – C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (TVALZ) – C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (FwLnk) – C:\Windows\System32\drivers\FwLnk.sys (TOSHIBA Corporation)
DRV - (KR10I) – C:\Windows\System32\drivers\KR10I.sys (TOSHIBA CORPORATION)
DRV - (KR10N) – C:\Windows\System32\drivers\KR10N.sys (TOSHIBA CORPORATION)
DRV - (tosrfec) – C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (Cdralw2k) – C:\Windows\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) – C:\Windows\System32\drivers\cdr4_xp.sys (Sonic Solutions)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://home.microsoft.com/search/lobby/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\InprocServer32 File not found
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{622B8144-A01E-44C2-9ADC-93FFF20ECE30}: "URL" = http://websearch.ask.com/redirect?client=i…9F-7B6770CF4CB6
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={0E06B5B…mp;d=2012-06-13 18:00:37&v=11.1.0.7&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:54707

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Radio TV 1.1 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.order.2: ""
FF - prefs.js..browser.search.param.yahoo-fr: "w3i&type=W3i_DS,157,0_0,Search,20111149,6902,0,24,0"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {34EFA911-B536-4C08-BECE-CD5E55C875B0}:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {060a0a36-13dc-407d-b055-5a9accd8e083}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:3.11.3.15590
FF - prefs.js..extensions.enabledItems: {CF26A516-B70F-40C6-924B-B5C48E08E047}:1.9.1
FF - prefs.js..extensions.netassistant.keyword.url: "http://click.w3i.com/?Programid=132&Elementname=Keyword&Applicationid={8D5D3439-3F40-4B70-8B62-79B483BF826B}&Version=3.6.5&Vintage=20111149&Defaultbrowserid=24&Productid=2138&Vendorid=3852&Offerid=6894&searchterm="
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B5fbbb4e1-bbff-4a8a-b040-92d50ea6d8be%7D&mid=9df011e0ebb647d096f7d15775dc3005-b3d1ca92a5785fc32b23de92492aadb4224effeb&ds=AVG&v=11.1.0.7&lang=en&pr=fr&d=2012-06-13%2018%3A00%3A37&sap=ku&q="
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/10/04 20:05:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/07/11 14:34:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/11 14:34:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.7\ [2012/06/13 18:00:54 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/27 21:12:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/14 13:08:46 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{CF26A516-B70F-40C6-924B-B5C48E08E047}: C:\Users\masha\AppData\Local\{CF26A516-B70F-40C6-924B-B5C48E08E047}
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{B4775D38-C4B3-4DA3-9DB1-FA3097BC1CCD}: C:\Users\masha\AppData\Local\{B4775D38-C4B3-4DA3-9DB1-FA3097BC1CCD} [2011/05/06 19:14:19 | 000,000,000 | —D | M]

[2012/03/31 22:50:49 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Extensions
[2009/02/09 22:24:53 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Extensions\[removed]
[2012/07/14 09:26:33 | 000,000,000 | —D | M] (No name found) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions
[2012/05/14 20:50:14 | 000,000,000 | —D | M] (MeFeedia) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{154d932f-dc51-4a4f-9d52-b78b1419d3b4}
[2011/08/28 19:08:10 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2012/05/20 13:46:05 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/07/14 09:29:26 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\{8f01f78a-66c2-4988-9468-acf7d05b9cdd}
[2012/07/14 09:26:27 | 000,000,000 | —D | M] (TelevisionFanatic) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/07/14 09:26:33 | 000,000,000 | —D | M] ("Codec-V") – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2011/03/31 19:16:10 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/03/31 09:27:30 | 000,000,000 | —D | M] (wxDfast) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/05/14 20:49:40 | 000,000,000 | —D | M] (RivalGaming) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/04/18 09:16:52 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\extensions\[removed]
[2012/01/03 16:27:44 | 000,002,333 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\askcom.xml
[2011/02/09 23:59:36 | 000,001,919 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\bing-zugo.xml
[2010/12/18 11:30:17 | 000,001,832 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\bing.xml
[2010/12/30 18:21:50 | 000,000,927 | —- | M] () – C:\Users\masha\AppData\Roaming\Mozilla\Firefox\Profiles\ud0o3or1.default\searchplugins\conduit.xml
[2012/06/14 13:11:18 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/07/11 14:34:29 | 000,000,000 | —D | M] (AVG Do Not Track) – C:\PROGRAM FILES\AVG\AVG2012\FIREFOX\DONOTTRACK
[2012/07/11 14:34:50 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG2012\FIREFOX4
[2012/06/13 18:00:54 | 000,000,000 | —D | M] (AVG Security Toolbar) – C:\PROGRAMDATA\AVG SECURE SEARCH\11.1.0.7
[2012/04/27 21:12:40 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/03/11 01:01:02 | 000,124,272 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\CCMSDK.dll
[2010/03/11 01:02:52 | 000,070,512 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\CgpCore.dll
[2010/03/11 01:01:48 | 000,091,504 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\confmgr.dll
[2010/03/11 01:01:24 | 000,022,384 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\ctxlogging.dll
[2012/04/18 09:04:08 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/03/11 01:40:56 | 000,423,248 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npicaN.dll
[2011/07/11 16:48:12 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2010/03/11 01:02:48 | 000,023,920 | —- | M] (Citrix Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\TcpPServ.dll
[2012/06/13 18:00:26 | 000,003,747 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/03/25 08:02:38 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/25 08:02:38 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={0E06B5B…mp;d=2012-06-13 18:00:37&v=11.1.0.7&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://clients5.google.com/complete/search…outputEncoding}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\masha\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: RivalGaming Addon (Enabled) = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\adhmhclafdhfabmmglbcngpddpdeijgd\npRivalGamingGC.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: My Web Search Plugin Stub (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.5.5 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: MindSpark Toolbar Platform Plugin Stub (Enabled) = C:\Program Files\TelevisionFanatic\bar\1.bin\NP64Stub.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: RivalGaming = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\adhmhclafdhfabmmglbcngpddpdeijgd\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: AVG Safe Search = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2161_0\
CHR - Extension: Codec-V = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho\1.17.48_0\
CHR - Extension: AVG Do Not Track = C:\Users\masha\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.0.0.2166_0\

O1 HOSTS File: ([2011/09/13 21:42:10 | 000,000,755 | –S- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (mefeediaTest) - {154d932f-dc51-4a4f-9d52-b78b1419d3b4} - C:\Program Files\mefeediatest\w3itemplateX.dll ()
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe (The Weather Channel Interactive, Inc.)
O4 - HKCU..\Run: [NETGEARGenie] C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3EDB808E-B228-4CF6-A4B2-230A7BD2C493}: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC1C1BDC-79EC-4890-A64C-93BAA279BAAE}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FE322BF5-9FA0-41DB-824F-A3233C17305E}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll ()
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - AppInit_DLLs: (c:\progra~1\google\google~1\goec62~1.dll) - c:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\masha\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\masha\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/01/19 18:21:19 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{1f6dbfef-e5a7-11dd-b78a-001e3338d9f6}\Shell\AutoRun\command - "" = D:\system\viewer\FlipVideoforPC.exe
O33 - MountPoints2\{1f6dbfef-e5a7-11dd-b78a-001e3338d9f6}\Shell\Flip Video for PC\command - "" = D:\system\viewer\FlipVideoforPC.exe
O33 - MountPoints2\{745bd0d0-e66c-11de-ad69-001e3338d9f6}\Shell - "" = AutoRun
O33 - MountPoints2\{745bd0d0-e66c-11de-ad69-001e3338d9f6}\Shell\AutoRun\command - "" = E:\PhotoManager.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\AutoRun\command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\explore\Command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{d1383d32-91c4-11dd-8207-001e3338d9f6}\Shell\open\Command - "" = E:\EXPLORER.EXE
O33 - MountPoints2\{df8b47cd-6f80-11df-b8d7-001e3338d9f6}\Shell - "" = AutoRun
O33 - MountPoints2\{df8b47cd-6f80-11df-b8d7-001e3338d9f6}\Shell\AutoRun\command - "" = E:\PhotoManager.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/14 09:26:47 | 000,000,000 | —D | C] – C:\Users\masha\AppData\Local\TelevisionFanatic
[2012/07/13 13:10:23 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/07/13 13:09:12 | 002,322,184 | —- | C] (ESET) – C:\Users\masha\Desktop\esetsmartinstaller_enu.exe
[2012/07/12 10:42:05 | 000,000,000 | —D | C] – C:\_OTL
[2012/07/11 14:34:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/06/25 15:10:06 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Users\masha\Desktop\OTL.exe
[21 C:\Users\masha\Documents\*.tmp files -> C:\Users\masha\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/16 10:26:05 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/16 09:33:11 | 000,617,702 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/07/16 09:33:11 | 000,108,772 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/07/16 09:26:23 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/16 09:26:20 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/16 09:26:19 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/16 09:26:08 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/16 09:26:00 | 3210,694,656 | -HS- | M] () – C:\hiberfil.sys
[2012/07/14 09:45:40 | 101,479,373 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/07/13 13:09:17 | 002,322,184 | —- | M] (ESET) – C:\Users\masha\Desktop\esetsmartinstaller_enu.exe
[2012/07/12 12:37:49 | 000,000,917 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/06/25 11:31:18 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Users\masha\Desktop\OTL.exe
[2012/06/20 23:53:14 | 000,000,370 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2012/06/19 19:17:43 | 000,048,428 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[21 C:\Users\masha\Documents\*.tmp files -> C:\Users\masha\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/13 23:17:38 | 000,001,673 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/07/12 12:37:49 | 000,000,917 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011/08/10 03:07:23 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2011/05/21 23:09:09 | 000,012,242 | -HS- | C] () – C:\Users\masha\AppData\Local\w70st7567b4372d
[2011/05/21 23:09:09 | 000,012,242 | -HS- | C] () – C:\ProgramData\w70st7567b4372d
[2011/05/21 23:08:44 | 000,002,628 | —- | C] () – C:\Users\masha\AppData\Roaming\C164.858
[2011/03/16 20:40:53 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2011/01/18 03:53:32 | 002,994,688 | —- | C] () – C:\Users\masha\openofficeorg33.msi
[2011/01/18 03:50:56 | 132,609,310 | —- | C] () – C:\Users\masha\openofficeorg1.cab
[2010/12/06 23:35:48 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/11/26 23:02:33 | 000,815,104 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/11/26 23:02:32 | 000,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/07/13 19:54:37 | 000,000,668 | —- | C] () – C:\Users\masha\AppData\Roaming\account{undefined_News}.oeaccount
[2009/07/13 19:54:30 | 000,000,747 | —- | C] () – C:\Users\masha\AppData\Roaming\account{[removed]}.oeaccount
[2009/03/27 17:06:03 | 000,026,340 | —- | C] () – C:\Users\masha\AppData\Roaming\UserTile.png
[2008/08/09 23:26:03 | 000,006,540 | —- | C] () – C:\Users\masha\AppData\Local\d3d9caps.dat
[2008/07/08 19:41:26 | 000,000,000 | —- | C] () – C:\Users\masha\AppData\Roaming\wklnhst.dat
[2008/06/18 11:47:11 | 000,011,264 | —- | C] () – C:\Users\masha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

< End of report >
Post #14
You appear clean of infections,please do the following.




Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.








[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 7 and save it to your desktop.
  • Scroll down to where it says JDK 7 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 7 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.











Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI