Spyware / Malware / Virus Removal

Heavily Infected [Solved]

17 min read

Looking for the outcome? Ask AI

Brigow Topic Starter

Post #1July 28, 2012, 4:05 AM UTC

It seems obvious to me that I have caused (at least the initial) problem myself whilst surfing around and downloading. Currently, Adjuggler takes control and opens up a new window directing me to an unusual site(s). Also, when I click on a new tab, I get a layout of previously visited pages. Tried to "Print Screen" & paste but not allowed on this site. Spybot Search & Destroy discovers DealPly & Babylon Toolbar but does not remove them. Super AntiSpyware finds & cleans dozens of entries but they reappear. Also have something called bProtect.xml appearing many times and dozens of entries for HotFixInstallerUI.dll on external hard drive. Computer is extremely slow. Look forward to hearing from you for my next step.

Satchfan

Post #2July 28, 2012, 7:29 AM UTC

Hello Brigow and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Download and run OTL

download OTL to your desktop.
double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
click Scan all users.
under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /rp /s
DRIVES
CREATERESTOREPOINT
click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
you may need two posts to fit them both in.

===================================================

Run aswMBR

download aswMBR.exe to your desktop.
double click the aswMBR.exe to run it
if asked, accept the AVAST virus definition download
click the "Scan" button to start scan
on completion of the scan click Save log, save it to your desktop and post in your next reply

Logs to include with next post:

OTL.txt
Extras.txt
aswMBR log

Thanks

Satchfan

Brigow

Post #3July 29, 2012, 12:36 AM UTC

Hi, Satchfan
Thanks for offering to help out with my problem.

Here are the three logs as requested:-

OTL logfile created on: 29/07/2012 8:45:06 AM - Run 2
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Documents and Settings\User\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.97 Gb Total Physical Memory | 0.99 Gb Available Physical Memory | 50.54% Memory free
3.81 Gb Paging File | 2.81 Gb Available in Paging File | 73.76% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.57 Gb Total Space | 5.75 Gb Free Space | 8.26% Space Free | Partition Type: NTFS
Drive D: | 396.19 Gb Total Space | 288.42 Gb Free Space | 72.80% Space Free | Partition Type: NTFS
Drive G: | 1863.01 Gb Total Space | 1225.17 Gb Free Space | 65.76% Space Free | Partition Type: NTFS
Drive H: | 1006.73 Mb Total Space | 1004.58 Mb Free Space | 99.79% Space Free | Partition Type: FAT

Computer Name: USER-84F12D431F | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
PRC - [2012/07/27 16:49:13 | 000,913,888 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/07/05 22:07:00 | 000,161,704 | —- | M] (Oracle Corporation) – C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/05/25 04:39:22 | 027,112,840 | —- | M] (Dropbox, Inc.) – C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2012/05/04 15:43:20 | 001,561,768 | —- | M] (Ask) – C:\Program Files\Ask.com\Updater\Updater.exe
PRC - [2012/03/26 17:08:12 | 000,931,200 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2012/01/24 16:24:26 | 002,416,480 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2011/11/28 00:19:04 | 001,229,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgfws.exe
PRC - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/09/08 19:53:26 | 000,743,264 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/08/15 05:21:40 | 000,337,760 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2010/10/27 18:24:42 | 000,645,952 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2010/08/05 08:46:02 | 000,583,640 | —- | M] (PC Tools) – C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
PRC - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) – C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/01/04 20:25:02 | 000,094,208 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
PRC - [2010/01/04 20:24:24 | 000,077,824 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
PRC - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
PRC - [2009/08/04 17:29:52 | 000,346,320 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
PRC - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
PRC - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2008/04/14 10:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe

========== Modules (No Company Name) ==========

MOD - [2012/07/27 16:49:06 | 002,003,424 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/07/27 12:50:16 | 009,465,032 | —- | M] () – C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll
MOD - [2012/07/10 17:22:12 | 002,004,472 | —- | M] () – c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
MOD - [2012/07/10 13:21:10 | 000,132,704 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll
MOD - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
MOD - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2009/08/16 17:06:02 | 000,141,312 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2009/07/30 18:15:32 | 000,503,202 | —- | M] () – C:\Program Files\DeviceVM\Browser Configuration Utility\sqlite3.dll
MOD - [2009/03/13 11:30:44 | 000,109,096 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\ycc.dll
MOD - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
MOD - [2007/05/22 14:53:10 | 000,006,656 | —- | M] () – C:\Program Files\WinAVI Video Converter\SimpleExt.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - [2012/07/27 16:49:12 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/07/27 12:50:19 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/11 10:45:52 | 004,419,392 | —- | M] () [Auto | Running] – c:\program files\common files\akamai/netsession_win_4f7fccd.dll – (Akamai)
SRV - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe – (vToolbarUpdater11.2.0)
SRV - [2012/07/05 22:07:00 | 000,161,704 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2012/07/03 13:46:44 | 000,655,944 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgfws.exe – (avgfws)
SRV - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) [Auto | Running] – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE – (!SASCORE)
SRV - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) [Auto | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe – (TuneUp.UtilitiesSvc)
SRV - [2010/08/05 08:46:02 | 000,583,640 | —- | M] (PC Tools) [Auto | Running] – C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe – (PCToolsSSDMonitorSvc)
SRV - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) [Auto | Running] – C:\Program Files\Nero\Update\NASvc.exe – (NAUpdate)
SRV - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) [Auto | Running] – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe – (BCUService)
SRV - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () [Auto | Running] – C:\Program Files\Gigabyte\EasySaver\essvr.exe – (ES lite Service)
SRV - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe – (BcmSqlStartupSvc)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\Drivers\SYMEVENT.SYS – (SymEvent)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys – (SiwvidStart)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\DOCUME~1\User\LOCALS~1\Temp\catchme.sys – (catchme)
DRV - [2012/07/29 08:06:58 | 000,029,904 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F4356499-1D65-44CA-BD72-FAE499BB3729}\MpKslafaa4c45.sys – (MpKslafaa4c45)
DRV - [2012/07/29 07:52:02 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\gdrv.sys – (gdrv)
DRV - [2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\system32\drivers\mbam.sys – (MBAMProtector)
DRV - [2012/04/28 18:32:29 | 000,023,456 | —- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\DrvAgent32.sys – (DrvAgent32)
DRV - [2011/10/07 05:23:48 | 000,230,608 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2011/10/04 05:21:42 | 000,016,720 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2011/09/13 05:30:10 | 000,032,592 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2011/08/08 21:15:34 | 000,067,664 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2011/08/08 21:15:33 | 000,012,880 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS – (SASDIFSV)
DRV - [2011/08/08 05:08:58 | 000,040,016 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/07/13 17:09:26 | 000,037,920 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2011/07/11 00:14:38 | 000,295,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2011/07/11 00:14:28 | 000,024,272 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2011/07/11 00:14:28 | 000,023,120 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\AVGIDSEH.sys – (AVGIDSEH)
DRV - [2011/07/11 00:14:26 | 000,134,608 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2011/06/02 11:08:34 | 000,011,336 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Program Files\SystemRequirementsLab\cpudrv.sys – (cpudrv)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwfd)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwdx)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCapMP)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCap)
DRV - [2010/10/07 13:34:32 | 000,010,064 | —- | M] (TuneUp Software) [Kernel | On_Demand | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys – (TuneUpUtilitiesDrv)
DRV - [2010/07/20 23:56:52 | 001,691,480 | —- | M] (Creative) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Ambfilt.sys – (Ambfilt)
DRV - [2010/07/20 23:45:12 | 001,395,800 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Monfilt.sys – (Monfilt)
DRV - [2010/07/20 23:37:38 | 006,086,760 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService)
DRV - [2010/07/05 05:51:26 | 000,004,096 | —- | M] () [Kernel | Unavailable | Unknown] – C:\Program Files\Unlocker\UnlockerDriver5.sys – (UnlockerDriver5)
DRV - [2010/03/17 16:42:46 | 000,016,512 | —- | M] (Adaptec) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\ASPI32.SYS – (Aspi32)
DRV - [2010/03/10 07:18:20 | 000,024,216 | —- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ivusb.sys – (ivusb)
DRV - [2009/04/08 02:32:48 | 000,116,224 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\IntcHdmi.sys – (IntcHdmiAddService)
DRV - [2009/03/25 16:29:52 | 000,130,432 | R— | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2007/12/26 01:47:30 | 000,272,128 | —- | M] (NETGEAR Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wg111v2.sys – (RTLWUSB)
DRV - [2006/12/14 09:41:48 | 000,011,984 | —- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ElbyDelay.sys – (ElbyDelay)
DRV - [2006/07/19 11:29:08 | 000,027,136 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidKE.Sys – (LHidKe)
DRV - [2006/07/19 11:28:56 | 000,071,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouKE.Sys – (LMouKE)
DRV - [2006/07/19 11:28:04 | 000,036,736 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidUsbK.sys – (LHidUsbK)
DRV - [2006/07/19 11:27:46 | 000,055,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042MOU.SYS – (L8042mou)
DRV - [2006/07/19 11:27:26 | 000,013,568 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042Kbd.SYS – (L8042Kbd)
DRV - [2005/04/07 09:46:50 | 000,034,240 | R— | M] (ADS) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\adsexpb.sys – (ADSEXPB)
DRV - [2001/11/07 04:40:00 | 000,018,240 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\DbgMsg.sys – (DbgMsg)
DRV - [2001/11/07 01:09:10 | 001,347,462 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\ntice.sys – (NTice)
DRV - [2001/11/07 01:09:10 | 000,119,658 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\siwvid.sys – (Siwvid)
DRV - [2001/11/07 01:09:10 | 000,022,900 | —- | M] () [Kernel | Disabled | Stopped] – C:\WINDOWS\System32\drivers\siwsym.sys – (Siwsym)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\5.1\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…0006cf0492d34df
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{35E94AFB-4389-4368-9873-C47FEDA4A4CD}: "URL" = http://websearch.ask.com/redirect?client=i…D1-3E38D2A6EEB6
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://www.mystart.com/search_w.php?type=w…s}&ei;=UTF-8
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{3E4F07C0-6409-450b-BFB6-1E4BFADA60C4}: "URL" = http://au.search.yahoo.com/search?p={searc…&type;=STDVM
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{7B5DDA27-94B5-42d6-9EF2-9B992ACB29CB}: "URL" = http://www.bing.com/search?q={searchTerms}…BR2&pc;=SPLH
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={ADE1B36…mp;d=2012-02-16 10:43:32&v;=10.0.0.7&sap;=dsp&q;={searchTerms}
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{9BB19242-F155-4688-800F-CD0B5CAD340B}: "URL" = http://www.google.com/cse?cx=partner-pub-3…88%3A4067623346
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher…0327&lng;=en
IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@ei.TotalRecipeSearch_14.com/Plugin: File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/02/17 07:12:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/27 16:49:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/17 08:32:09 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1266764D-FC4F-4FA7-B63B-884D53B1680F}: C:\Documents and Settings\User\Application Data\NetAssistant\ [2011/04/21 09:37:29 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension [2012/07/10 17:22:20 | 000,000,000 | —D | M]

[2010/04/01 16:33:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2012/07/27 15:02:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions
[2012/07/12 14:52:59 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/07/23 18:26:01 | 000,000,000 | —D | M] (Flash and Video Download) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2012/06/27 18:13:17 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2012/07/27 15:00:30 | 000,000,000 | —D | M] ("Savings Sidekick") – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/05/12 09:52:17 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/06/28 16:33:44 | 000,000,000 | —D | M] (DoNotTrackPlus) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/09 16:20:27 | 000,000,000 | —D | M] (VideoFileDownload - Download YouTube Videos) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2011/08/06 13:58:30 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/27 15:02:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\staged
[2012/07/28 17:49:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\vppgx98u.default-1343368773312\extensions
[2012/07/28 17:50:03 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\vppgx98u.default-1343368773312\extensions\[removed]
[2012/07/26 10:38:12 | 000,002,349 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\706l0eqd.default-1343368655062\searchplugins\bProtect.xml
[2012/07/17 08:32:12 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/07/17 08:32:12 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/02/16 12:37:36 | 000,000,000 | —D | M] (QuickStores-Toolbar) – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2012/07/27 16:49:13 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/08/03 15:07:42 | 000,373,104 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll
[2012/07/10 13:20:58 | 000,003,767 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/26 10:38:12 | 000,002,349 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2007/07/26 12:05:16 | 000,001,329 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml
[2011/03/24 15:11:50 | 000,002,046 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrchvsl.xml
[2012/01/17 16:45:41 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2010/12/09 07:21:24 | 000,002,224 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\webblog.xml

O1 HOSTS File: ([2012/07/26 16:54:29 | 000,442,725 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15234 more lines…
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\5.1\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\5.1\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BCU] C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [KHALMNPR.EXE] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-1409082233-117609710-839522115-1003..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O4 - HKLM..\RunOnce: [HideIPEasyunstall] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Guage.lnk = File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1409082233-117609710-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1409082233-117609710-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1409082233-117609710-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O7 - HKU\S-1-5-21-1409082233-117609710-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1409082233-117609710-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab; video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload; selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load; all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8EA6C079-3333-4797-9BAC-AF0FD534706A}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C85F8EC6-C08E-404C-9D39-C29A7821E0FD}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - AppInit_DLLs: (c:\docume~1\alluse~1\applic~1\bprotectorforwindows\2.1.419.7\protector.dll) - c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/01 11:50:36 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2007/11/07 12:49:32 | 000,000,090 | —- | M] () - H:\AUTORUN.INF – [ FAT ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2020/12/01 12:20:44 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\iolo
[2012/07/29 08:41:04 | 000,597,504 | —- | C] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 21:48:07 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2012/07/28 17:49:45 | 000,000,000 | —D | C] – C:\Program Files\Ask.com
[2012/07/28 17:49:41 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\AskToolbar
[2012/07/28 17:39:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Ask
[2012/07/28 17:38:10 | 000,000,000 | —D | C] – C:\Program Files\Oracle
[2012/07/28 17:37:45 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Oracle
[2012/07/28 17:37:36 | 000,227,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:10:23 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.techniclauncher
[2012/07/28 16:29:44 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums_files
[2012/07/28 11:30:41 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\RK_Quarantine
[2012/07/27 17:16:37 | 000,000,000 | —D | C] – C:\Program Files\SpeedyPC Software
[2012/07/27 17:06:16 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\SpeedyPC Software
[2012/07/27 17:06:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SpeedyPC Software
[2012/07/27 08:04:52 | 000,000,000 | —D | C] – C:\Program Files\MALWAREBYTES ANTI-MALWARE
[2012/07/26 11:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Curiolab
[2012/07/26 10:37:46 | 000,000,000 | —D | C] – C:\Program Files\Adjugglercookie Removal Tool (1)
[2012/07/25 20:33:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2012/07/25 20:29:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Ad-Aware Antivirus
[2012/07/25 19:58:08 | 000,356,352 | —- | C] (eSellerate Inc.) – C:\WINDOWS\eSellerateEngine.dll
[2012/07/25 19:58:08 | 000,081,920 | —- | C] (eSellerate Inc.) – C:\WINDOWS\eSellerateControl350.dll
[2012/07/25 19:58:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Adjugglercookie Removal Tool
[2012/07/25 19:58:06 | 000,000,000 | —D | C] – C:\Program Files\Adjugglercookie Removal Tool
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Samsung
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Program Files\Clarus
[2012/07/17 08:32:09 | 000,476,976 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/17 08:32:09 | 000,143,872 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/17 08:30:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2012/07/15 16:22:24 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Start Menu\Programs\HiJackThis
[2012/07/15 16:22:23 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/07/11 12:57:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack
[2012/07/10 17:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IBUpdaterService
[2012/07/10 17:25:00 | 000,000,000 | —D | C] – C:\WINDOWS\System32\searchplugins
[2012/07/10 17:23:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Savings Sidekick
[2012/07/10 17:22:41 | 000,000,000 | —D | C] – C:\Program Files\Uninstall Information
[2012/07/10 17:22:32 | 000,000,000 | —D | C] – C:\Program Files\Savings Sidekick
[2012/07/10 17:22:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\bProtectorForWindows
[2012/07/09 16:20:25 | 000,000,000 | —D | C] – C:\Program Files\TorrentSearch
[2012/07/09 16:20:04 | 000,000,000 | —D | C] – C:\Program Files\intellidownload
[2012/07/04 08:15:43 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.minecraft
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/29 08:50:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/07/29 08:49:00 | 000,000,232 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/29 08:31:01 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/29 08:15:07 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2012/07/29 08:01:54 | 000,000,384 | -H– | M] () – C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2012/07/29 07:55:50 | 102,391,247 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/07/29 07:54:01 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/07/29 07:52:03 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/29 07:52:02 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) – C:\WINDOWS\gdrv.sys
[2012/07/29 07:51:43 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/07/28 21:28:58 | 000,001,173 | —- | M] () – C:\Documents and Settings\User\Application Data\vso_ts_preview.xml
[2012/07/28 21:21:02 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{C8C75372-1D1B-46C1-9F1F-54092919BFB9}.job
[2012/07/28 20:42:00 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2012/07/28 18:23:17 | 000,000,578 | —- | M] () – C:\WINDOWS\MyHeritage.INI
[2012/07/28 17:59:02 | 000,000,442 | —- | M] () – C:\WINDOWS\tasks\RMSmartUpdate.job
[2012/07/28 17:43:01 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task d65ac325-5579-4715-8347-077e3adbb021.job
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:05:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/07/28 16:29:45 | 000,254,426 | —- | M] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 15:01:11 | 000,000,262 | —- | M] () – C:\WINDOWS\tasks\RegClean Pro_DEFAULT.job
[2012/07/28 11:30:28 | 001,552,384 | —- | M] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/28 10:16:06 | 000,449,806 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012/07/28 08:38:27 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/07/28 08:38:09 | 000,000,394 | —- | M] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/27 12:50:17 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/07/27 12:50:17 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/07/26 17:03:28 | 000,001,881 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/26 17:03:27 | 000,000,963 | —- | M] () – C:\Documents and Settings\User\Desktop\Spybot - Search & Destroy.lnk
[2012/07/26 16:54:29 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/07/26 10:44:01 | 000,002,451 | —- | M] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/26 10:38:34 | 000,000,721 | —- | M] () – C:\user.js
[2012/07/25 19:58:12 | 000,001,892 | —- | M] () – C:\Documents and Settings\User\Desktop\Adjugglercookie Removal Tool.lnk
[2012/07/25 18:26:00 | 000,001,469 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/25 18:26:00 | 000,000,591 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Guage.lnk
[2012/07/25 16:26:12 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\AdvancedDriverUpdater_UPDATES.job
[2012/07/25 09:53:17 | 000,000,270 | —- | M] () – C:\WINDOWS\tasks\RegClean Pro_UPDATES.job
[2012/07/24 10:00:00 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task 7def67da-e3dc-406f-9a56-e69b0f68c8af.job
[2012/07/22 09:27:55 | 000,000,254 | —- | M] () – C:\WINDOWS\tasks\RegClean Pro.job
[2012/07/20 15:12:46 | 000,846,855 | —- | M] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/20 10:45:45 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120726-165429.backup
[2012/07/17 08:31:57 | 000,476,976 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/16 16:57:06 | 004,661,166 | —- | M] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 17:26:23 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120720-104545.backup
[2012/07/15 12:23:49 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | M] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 15:47:27 | 000,000,802 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/14 14:14:10 | 000,001,373 | —- | M] () – C:\WINDOWS\wininit.ini
[2012/07/14 13:18:39 | 000,442,053 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120715-172623.backup
[2012/07/13 17:23:02 | 000,001,151 | —- | M] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/12 10:53:44 | 000,304,416 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/07/06 08:46:34 | 000,172,098 | —- | M] () – C:\torrent.exe
[2012/07/05 22:07:08 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/05 22:06:48 | 000,227,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/05 22:06:20 | 000,687,544 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/28 17:49:56 | 000,000,232 | —- | C] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/07/28 16:29:43 | 000,254,426 | —- | C] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:12 | 001,552,384 | —- | C] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/27 17:16:41 | 000,000,394 | —- | C] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/26 17:03:27 | 000,001,881 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/25 20:45:01 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2012/07/25 19:58:12 | 000,001,892 | —- | C] () – C:\Documents and Settings\User\Desktop\Adjugglercookie Removal Tool.lnk
[2012/07/25 18:26:00 | 000,001,469 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/25 18:26:00 | 000,000,591 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Guage.lnk
[2012/07/20 15:12:46 | 000,846,855 | —- | C] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/16 16:57:06 | 004,661,166 | —- | C] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 16:22:24 | 000,002,451 | —- | C] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/15 12:23:19 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | C] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 16:21:01 | 000,000,304 | —- | C] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/07/14 14:13:58 | 000,001,373 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/07/13 17:23:02 | 000,001,151 | —- | C] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/13 17:21:23 | 000,645,632 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2012/07/13 17:21:23 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2012/07/13 17:21:23 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\xvid.ax
[2012/07/06 08:46:34 | 000,172,098 | —- | C] () – C:\torrent.exe
[2012/04/19 22:08:24 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1409082233-117609710-839522115-1003-0.dat
[2012/04/16 22:58:49 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/03/04 13:29:22 | 000,002,396 | —- | C] () – C:\WINDOWS\System32\ASOROSet.bin
[2012/02/15 16:00:14 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/27 12:31:10 | 000,000,520 | —- | C] () – C:\WINDOWS\Viewer.INI
[2011/12/17 14:20:38 | 000,000,000 | —- | C] () – C:\WINDOWS\muveeapp.INI
[2011/12/08 18:40:31 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\KRSBridgeControls.dll
[2011/12/08 18:40:31 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\JeanieInterface.dll
[2011/12/08 18:40:31 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\KRSSockets.dll
[2011/12/08 18:40:31 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\FuzzBox.dll
[2011/12/08 18:40:31 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\BrowseForDirectory.dll
[2011/11/29 22:12:25 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2011/11/29 22:09:35 | 000,000,578 | —- | C] () – C:\WINDOWS\MyHeritage.INI
[2011/11/29 22:07:18 | 000,454,656 | —- | C] () – C:\WINDOWS\System32\PaintX.dll
[2011/11/22 19:21:10 | 000,002,816 | —- | C] () – C:\Documents and Settings\All Users\Application Data\un.png
[2011/11/22 19:15:59 | 000,000,316 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/11/22 19:15:59 | 000,000,022 | —- | C] () – C:\Documents and Settings\User\Application Data\UserFlag.ini
[2011/09/08 17:59:41 | 000,037,336 | —- | C] () – C:\WINDOWS\System32\CleanMFT32.exe
[2011/09/07 17:03:45 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/01 15:37:35 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\AVERM.dll
[2011/09/01 15:37:34 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\AVEQT.dll
[2011/06/28 12:29:04 | 002,097,152 | —- | C] () – C:\Documents and Settings\User\My Volume N
[2011/04/21 19:28:31 | 000,000,022 | -HS- | C] () – C:\Documents and Settings\User\Application Data\Sys2662.Config.Repository.bin
[2011/04/15 12:55:52 | 000,069,432 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/04/14 10:21:38 | 000,304,416 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/08 13:36:49 | 000,001,769 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2011/03/06 15:55:42 | 000,004,096 | —- | C] ( ) – C:\WINDOWS\System32\IGFXDEVLib.dll
[2011/03/06 15:55:41 | 000,000,151 | —- | C] () – C:\WINDOWS\System32\GfxUI.exe.config
[2011/02/18 19:11:28 | 000,000,593 | —- | C] () – C:\Documents and Settings\User\Application Data\AutoGK.ini
[2011/02/10 07:29:06 | 000,000,043 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/01/10 17:01:08 | 000,000,805 | —- | C] () – C:\WINDOWS\ScanSpyware.INI
[2010/12/30 20:17:43 | 000,000,107 | —- | C] () – C:\WINDOWS\IfoEdit.INI
[2010/12/19 12:09:23 | 000,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2010/12/19 12:09:23 | 000,048,984 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2010/04/05 12:20:52 | 000,000,084 | —- | C] () – C:\Documents and Settings\User\default.pls
[2010/04/02 14:04:29 | 000,166,400 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/02 12:18:22 | 000,001,173 | —- | C] () – C:\Documents and Settings\User\Application Data\vso_ts_preview.xml
[2010/04/02 12:18:12 | 000,007,887 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.cat
[2010/04/02 12:18:12 | 000,001,144 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.inf

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2012/07/06 08:46:34 | 000,172,098 | —- | M] () – C:\torrent.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]

< MD5 for: EXPLORER.EXE >
[2008/04/14 10:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/14 10:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 10:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/14 10:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/14 10:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/14 10:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/14 10:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/14 10:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/14 10:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/14 10:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/07/03 13:46:42 | 000,217,672 | —- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/14 10:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/14 10:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/14 10:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: ST3500418AS
Partitions: 2
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 - Fixed\thard disk media
Interface type: USB
Media Type: Fixed\thard disk media
Model: Samsung STORY Station USB Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 - Removable media other than\tfloppy
Interface type: USB
Media Type: Removable media other than\tfloppy
Model: Flash Udisk 2.0 USB Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 70.00GB
Starting Offset: 32256
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Extended Partition
Bootable: False
BootPartition: False
PrimaryPartition: False
Size: 396.00GB
Starting Offset: 74701992960
Hidden sectors: 0

DeviceID: Disk #1, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 1,863.00GB
Starting Offset: 32768
Hidden sectors: 0

DeviceID: Disk #2, Partition #0
PartitionType: 16-bit FAT
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 1.00GB
Starting Offset: 0
Hidden sectors: 0

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 -> Junction
[C:\WINDOWS\assembly\GAC_32\Update\1.1.3.0__318d21d4b0463a3b] -> C:\WINDOWS\WinSxS\x86_Update_318d21d4b0463a3b_1.1.3.0_x-ww_46a5f7d3 -> Junction
[C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e -> Junction
[C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 -> Junction

========== Alternate Data Streams ==========

@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C265C458
@Alternate Data Stream - 175 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1

< End of report >

OTL Extras logfile created on: 28/07/2012 4:18:29 PM - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Documents and Settings\User\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.97 Gb Total Physical Memory | 0.74 Gb Available Physical Memory | 37.79% Memory free
3.81 Gb Paging File | 2.70 Gb Available in Paging File | 70.71% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.57 Gb Total Space | 6.38 Gb Free Space | 9.17% Space Free | Partition Type: NTFS
Drive D: | 396.19 Gb Total Space | 288.66 Gb Free Space | 72.86% Space Free | Partition Type: NTFS
Drive F: | 1.86 Gb Total Space | 1.08 Gb Free Space | 58.22% Space Free | Partition Type: FAT
Drive G: | 1863.01 Gb Total Space | 1225.18 Gb Free Space | 65.76% Space Free | Partition Type: NTFS
Drive H: | 1006.73 Mb Total Space | 1004.59 Mb Free Space | 99.79% Space Free | Partition Type: FAT

Computer Name: USER-84F12D431F | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"5353:TCP" = 5353:TCP:*:Enabled:appletv

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth – (Google)
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe" = C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth – (Google)
"C:\Program Files\Gigabyte\EasySaver\UpdExe.exe" = C:\Program Files\Gigabyte\EasySaver\UpdExe.exe:*:Disabled:Exe File – (GIGABYTE)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\MultiProxy\MProxy.exe" = C:\Program Files\MultiProxy\MProxy.exe:*:Enabled:MultiProxy personal proxy server – (MishkinSoft, http://www.multiproxy.org)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player – ()
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit – (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit – (Orbitdownloader.com)
"C:\Program Files\Regensoft\Downloader App\DownloaderApp.exe" = C:\Program Files\Regensoft\Downloader App\DownloaderApp.exe:*:Enabled:Downloader App – (Regensoft)
"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\Documents and Settings\User\Local Settings\Application Data\Akamai\netsession_win.exe" = C:\Documents and Settings\User\Local Settings\Application Data\Akamai\netsession_win.exe:*:Enabled:Akamai NetSession Interface – (Akamai Technologies, Inc)
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgnsx.exe" = C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgdiagex.exe" = C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostics 2012 – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgemcx.exe" = C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Personal E-mail Scanner – (AVG Technologies CZ, s.r.o.)
"C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox – (Dropbox, Inc.)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{07300F01-89CA-4CF8-92BD-2A605EB83C95}" = EasySaver B9.0610.1
"{0E13CAA3-B5FC-48C0-AA4A-26F5CD0C371C}" = Garmin Lifetime Updater
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{0FD155A3-DF78-43ee-84B0-3CC86BA962F2}_is1" = Sothink Video Converter
"{10B5900B-1217-458E-B3DA-E0A2E4A01033}" = Nero 8 Essentials
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4500_series" = Canon iP4500 series
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{1266764D-FC4F-4FA7-B63B-884D53B1680F}" = NetAssistant
"{14FA6DD9-92ED-493D-A937-81A78870E08A}_is1" = Free Video Joiner 1.1
"{1965C9BB-9114-4A50-AEC7-E62414BB117B}" = EASEUS Data Recovery Wizard Professional 4.3.6
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 3.5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback
"{23BE4DF2-293D-4077-82F4-1FD8C269277C}" = TuneUp Utilities Language Pack (en-US)
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java™ 6 Update 33
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40007E5C-19C8-4A25-AD70-A99D77D0A7DA}" = Active Boot Disk
"{4044436C-3A01-4ECA-8FC9-AC8F3F838EDC}" = Audials TV
"{40A3E5DB-5EF8-4F04-BF3E-7AB87C4AE85A}_is1" = DriverIdentifier 3.9
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B1DB25E-772B-45A6-8DA9-D263C88F7DA0}" = muvee autoProducer 3.1 - CE
"{4B2BD769-C7F5-4275-BCEB-658FC56ED3EE}" = File Renamer
"{4EFC72DA-2314-4E5D-AC8E-1C954CDB8BBF}" = AVG 2012
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1" = Data Lifeguard Diagnostic for Windows 1.24
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5B363E1D-8C36-4458-BAE4-D5081999E094}" = Browser Configuration Utility
"{5E1A9498-6B12-11D5-A550-00010242F47C}" = NuMega SoftICE Driver Suite 2.6
"{604CD5A1-4520-4844-B064-A3D884B77E91}" = SpeedyPC Pro
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6D12EC75-E7D3-4EAD-AB10-E1F3AFF94AA6}" = AVG 2012
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7AA92D13-8B7A-48B9-B18D-645564FAD258}" = Nero Vision Xtra
"{7EEB72E4-2150-49F8-BC51-B63AF7B9E2F2}" = GEAR driver installer 4.019
"{805FF8E4-2CC8-4981-8DD6-1EDF5A30F6CF}" = YouTube Downloader Toolbar v5.1
"{821D6F49-1B20-4809-8C73-286CFC52B1B1}" = Samsung Auto Backup
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87F25562-0C85-4B4A-9D47-9FA591F88401}" = sureanalysis version 3.14
"{8C52A46C-7961-4A81-AB4B-92CF65CB4772}_is1" = Sothink Web Video Downloader
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406}" = iLivid
"{8D2C1E44-7685-4D05-8342-B0DC6422FA47}" = Ulead Straight-to-Disc SDK
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{900C2AB5-3F37-4F84-B58C-893FA5F42D7D}_is1" = WiseFixer 3.2
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9ECE13D2-C028-44CB-8A96-A65196E7BBE7}_is1" = Convert AVI to MP4
"{9F185C48-595B-401A-A1D6-AAB324890DC4}" = GiPo@MoveOnBoot 1.9.5
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A819907C-5912-4471-91D7-D94885A2C40B}" = AVG 2012
"{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}" = PixiePack Codec Pack
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AAF4238F-7C29-451D-9925-C753271A5728}" = Microsoft Visual C++ Run Time Lib Setup
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{AF21F061-F04B-42B4-B6C3-784A080F782A}" = dirLock
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C13A22F5-B0FF-44E9-982B-821578CE5E98}" = Tunebite
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{C5DA59CF-2BB8-48D5-8E5B-17F2E0F0FEE4}" = System Requirements Lab for Intel
"{C65AA5AE-8B80-46B6-ADFC-BBF1EFF2AD98}_is1" = EPUB to MOBI
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CAAB0192-5704-469F-A0BE-2D842D70E93B}_is1" = Sothink FLV Player
"{CC568376-DDDE-45F4-AC88-C39184455B8D}_is1" = Bigasoft MKV Converter 3.3.14.4128
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Professional
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3C57A35-DE0D-475D-9F5E-D1D2DB80C3CF}" = Bridge Baron 19 eSellerate Download Version
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.0.9.322
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E6CFBFB5-9232-410C-B353-AF6E614B2681}" = LightScribe System Software 1.10.16.1
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EE7B9A8D-19F0-450D-8E94-3E391E6044CD}" = KhalSetup
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F5E68E00-90A1-4486-8CDF-F4694B62E33A}" = Audials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"5513-1208-7298-9440" = JDownloader 0.9
"Acoustica MP3 To Wave Converter PLUS" = Acoustica MP3 To Wave Converter PLUS
"Adjugglercookie Removal Tool_is1" = Adjugglercookie Removal Tool
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Driver Updater_is1" = Advanced Driver Updater
"Aiseesoft Total Video Converter_is1" = Aiseesoft Total Video Converter
"Akamai" = Akamai NetSession Interface Service
"Allok Video Joiner_is1" = Allok Video Joiner 3.3.1116
"am-jigsawpuzzlegoldenedition" = Jigsaw Puzzle Golden Edition
"Anvsoft DVD Menu Template Package 1" = Menu Template Package 1 Ver 1.10
"AutoGK" = Auto Gordian Knot 2.55
"AutoHideIP" = Auto Hide IP
"AVG" = AVG 2012
"AviSynth" = AviSynth 2.5
"AVS Audio Converter_is1" = AVS Audio Converter 7
"AVS Audio Editor_is1" = AVS Audio Editor version 4.2
"AVS Screen Capture_is1" = AVS Screen Capture version 1.1.2
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS Video Editor_is1" = AVS Video Editor 5
"AVS Video Recorder_is1" = AVS Video Recorder 2.4
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 7_is1" = AVS Video Converter 8
"Best Removal Tool_is1" = Best Removal Tool
"Boilsoft Video Joiner_is1" = Boilsoft Video Joiner 5.32
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner
"Driver Checker_is1" = Driver Checker v2.7.4
"DriverAgent.exe" = DriverAgent by eSupport.com
"DVD Shrink Pro_is1" = DVD Shrink Pro
"DVD43_is1" = DVD43 v4.6.0
"DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5_is1" = DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0
"DVDFab 8 Qt_is1" = DVDFab 8.1.3.8 (09/12/2011) Qt
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"eSupport UndeletePlus_is1" = eSupport UndeletePlus 3.0.2.1214
"Exterminate It!" = Exterminate It!
"Family Tree Builder" = MyHeritage Family Tree Builder
"Free Studio_is1" = Free Studio version 5.2.1
"Free Video Dub_is1" = Free Video Dub version 1.8.12.804
"Free YouTube Download_is1" = Free YouTube Download version 3.0.18.1123
"GetBot" = GetBot
"HideIPEasy" = Hide IP Easy
"ie8" = Windows Internet Explorer 8
"iLivid" = iLivid
"IrfanView" = IrfanView (remove only)
"jv16 PowerTools 2011" = jv16 PowerTools 2011
"KaraokeDX" = Karaoke for DirectX (remove only)
"Kernel for Windows Data Recovery_is1" = Kernel for Windows Data Recovery ver 11.01.01
"KeyFinder_is1" = Magical Jelly Bean KeyFinder
"KLiteCodecPack_is1" = K-Lite Codec Pack 8.9.5 (Full)
"Legacy 7.5" = Legacy 7.5
"Magic FLAC to MP3 Converter_is1" = Magic FLAC to MP3 Converter 3.71
"Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Momento" = Momento 5.5.5
"Mozilla Firefox 14.0.1 (x86 en-US)" = Mozilla Firefox 14.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Network Stumbler" = Network Stumbler 0.4.0 (remove only)
"NTFS Undelete_is1" = NTFS Undelete 3.0.2.830
"ophcrack" = ophcrack 3.4.0
"Orbit_is1" = Orbit Downloader
"Oxelon Media Converter_is1" = Oxelon Media Converter 1.1
"Photo DVD Maker Professional" = Photo DVD Maker Professional 8.05
"PROR" = Microsoft Office Professional 2007
"RealAlt_is1" = Real Alternative 2.0.2
"RegClean Pro_is1" = RegClean Pro
"Registry Mechanic_is1" = Registry Mechanic 10.0
"Savings Sidekick" = Savings Sidekick
"Security Task Manager" = Security Task Manager 1.7f
"Spell Checker For OE 2.1" = Spell Checker For OE 2.1
"Tune Up Utilities" = Tune Up Utilities 2011
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"Unlocker" = Unlocker 1.9.1
"uTorrent" = µTorrent
"uTorrentBar Toolbar" = uTorrentBar Toolbar
"vfd-ob" = VideoFileDownload
"Video Cutter_is1" = Video Cutter 1.0
"Videora iPod Converter" = Videora iPod Converter 6
"VLC media player" = VLC media player 1.1.11
"VobSub" = VobSub v2.23 (Remove Only)
"What's Running_is1" = What's Running 2.2
"WinAVI Video Converter_is1" = WinAVI Video Converter
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR archiver
"WinX DVD Ripper Platinum_is1" = WinX DVD Ripper Platinum 5.11.1
"WinX Free DVD Ripper_is1" = WinX Free DVD Ripper 4.5.14
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
"XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only)
"Xvid Video Codec 1.3.2" = Xvid Video Codec
"YouTube Converter Pro_is1" = YouTube Converter Pro
"YouTube Downloader App" = YouTube Downloader App 3.00

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
"NetAssistant" = NetAssistant for Firefox

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 27/07/2012 8:08:18 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3006
Description = Unable to read the performance counter strings of the 009 language
ID. The Win32 status returned by the call is the first DWORD in Data section.

Error - 27/07/2012 8:08:19 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service ASP.NET (ASP.NET)
failed. The Error code is the first DWORD in Data section.

Error - 27/07/2012 8:10:14 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service ASP.NET_2.0.50727
(ASP.NET_2.0.50727) failed. The Error code is the first DWORD in Data section.

Error - 27/07/2012 8:10:17 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service aspnet_state
(ASP.NET State Service) failed. The Error code is the first DWORD in Data section.

Error - 27/07/2012 8:10:18 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3006
Description = Unable to read the performance counter strings of the 009 language
ID. The Win32 status returned by the call is the first DWORD in Data section.

Error - 27/07/2012 8:10:18 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service ASP.NET (ASP.NET)
failed. The Error code is the first DWORD in Data section.

Error - 27/07/2012 8:12:13 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service ASP.NET_2.0.50727
(ASP.NET_2.0.50727) failed. The Error code is the first DWORD in Data section.

Error - 27/07/2012 8:12:16 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service aspnet_state
(ASP.NET State Service) failed. The Error code is the first DWORD in Data section.

Error - 27/07/2012 8:12:17 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3006
Description = Unable to read the performance counter strings of the 009 language
ID. The Win32 status returned by the call is the first DWORD in Data section.

Error - 27/07/2012 8:12:17 PM | Computer Name = USER-84F12D431F | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service ASP.NET (ASP.NET)
failed. The Error code is the first DWORD in Data section.

[ System Events ]
Error - 3/04/2012 6:15:46 PM | Computer Name = USER-84F12D431F | Source = Service Control Manager | ID = 7024
Description = The Windows Search service terminated with service-specific error
2147749155 (0x80040D23).

Error - 3/04/2012 6:17:10 PM | Computer Name = USER-84F12D431F | Source = Service Control Manager | ID = 7022
Description = The Windows Image Acquisition (WIA) service hung on starting.

Error - 4/04/2012 8:00:27 PM | Computer Name = USER-84F12D431F | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070002: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0
SP2 Security Update for Windows 2000, Windows Server 2003, and Windows XP x86 (KB979909).

Error - 4/04/2012 8:00:27 PM | Computer Name = USER-84F12D431F | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070002: Microsoft .NET Framework 3.5 SP1 Update for Windows Server
2003 and Windows XP x86 (KB982168).

Error - 4/04/2012 8:00:27 PM | Computer Name = USER-84F12D431F | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070002: Security Update for Microsoft .NET Framework 2.0 SP2 on
Windows Server 2003 and Windows XP x86 (KB2656352).

Error - 4/04/2012 8:00:27 PM | Computer Name = USER-84F12D431F | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070002: Security Update for Microsoft .NET Framework 2.0 SP2 on
Windows Server 2003 and Windows XP x86 (KB2572073).

Error - 4/04/2012 8:00:27 PM | Computer Name = USER-84F12D431F | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Security Update for Microsoft .NET Framework 2.0 SP2 on
Windows Server 2003 and Windows XP x86 (KB2633880).

Error - 4/04/2012 8:00:37 PM | Computer Name = USER-84F12D431F | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Security Update for .NET Framework 2.0 SP2 and 3.5 SP1 on
Windows Server 2003 and Windows XP x86 (KB2518864).

Error - 5/04/2012 5:55:05 PM | Computer Name = USER-84F12D431F | Source = Service Control Manager | ID = 7024
Description = The Windows Search service terminated with service-specific error
2147749155 (0x80040D23).

Error - 5/04/2012 5:56:36 PM | Computer Name = USER-84F12D431F | Source = Service Control Manager | ID = 7022
Description = The Windows Image Acquisition (WIA) service hung on starting.

[ TuneUp Events ]
Error - 29/06/2011 6:08:57 PM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 30/06/2011 1:25:04 AM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 1/07/2011 1:25:01 AM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 1/07/2011 8:16:30 PM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 1/07/2011 8:18:21 PM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 2/07/2011 1:25:04 AM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 2/07/2011 5:54:21 PM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 2/07/2011 5:56:06 PM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/07/2011 1:25:00 AM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

Error - 3/07/2011 9:49:27 PM | Computer Name = USER-84F12D431F | Source = TuneUp Program Statistics | ID = 131840
Description =

< End of report >

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-07-29 09:06:32
—————————–
09:06:32.156 OS Version: Windows 5.1.2600 Service Pack 3
09:06:32.156 Number of processors: 2 586 0x170A
09:06:32.156 ComputerName: USER-84F12D431F UserName: User
09:06:33.718 Initialize success
09:14:18.640 AVAST engine defs: 12072801
09:21:11.500 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
09:21:11.500 Disk 0 Vendor: ST3500418AS CC38 Size: 476940MB BusType: 3
09:21:11.515 Disk 0 MBR read successfully
09:21:11.515 Disk 0 MBR scan
09:21:11.609 Disk 0 Windows XP default MBR code
09:21:11.609 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 71241 MB offset 63
09:21:11.640 Disk 0 Partition - 00 05 Extended 405696 MB offset 145902330
09:21:11.656 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 405696 MB offset 145902393
09:21:11.671 Disk 0 scanning sectors +976768065
09:21:11.750 Disk 0 scanning C:\WINDOWS\system32\drivers
09:22:09.078 Service scanning
09:22:37.968 Service MpKslafaa4c45 C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F4356499-1D65-44CA-BD72-FAE499BB3729}\MpKslafaa4c45.sys **LOCKED** 32
09:23:01.484 Modules scanning
09:23:05.671 Disk 0 trace - called modules:
09:23:05.687
09:23:08.578 AVAST engine scan C:\WINDOWS
09:23:25.906 AVAST engine scan C:\WINDOWS\system32
09:29:02.750 AVAST engine scan C:\WINDOWS\system32\drivers
09:29:29.640 AVAST engine scan C:\Documents and Settings\User
09:41:04.781 AVAST engine scan C:\Documents and Settings\All Users
09:44:13.984 Scan finished successfully
10:33:13.656 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\User\Desktop\MBR.dat"
10:33:13.656 The log file has been saved successfully to "C:\Documents and Settings\User\Desktop\aswMBR.txt"

Satchfan

Post #4July 29, 2012, 2:59 PM UTC last edited July 29, 2012, 3:04 PM UTC

There are quite a few instructions here due to the mess that is on your computer. Just go through them one at a time at your own pace and I’ll wait for your reply.

P2P - I see you have P2P software, (uTorrent), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Start, Settings, Control Panel, Add or Remove Programs

Should you decide to keep it, please don’t use it until we have finished up here.

======================================================

Ask Toolbar

Uninstall Ask Toolbar if it was not installed on purpose.

See here for more info.

If you choose to follow my recommendation then please uninstall the following programs if present:

Ask Toolbar or anything related to Ask

======================================================

Registry cleaners

I see you are using a “Registry Cleaner”, RegClean Pro and Registry Mechanic. It's not recommended to use registry cleaners/boosters.

The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results". Unless you have a particular problem that requires a registry edit to correct it, (and you are expert in the registry), I would suggest you leave the registry alone.

I strongly advise you to get rid of both of those and any other cleaner/optimizer/booster/tuneup/tweak type utilities that you have on this or any other computer.

One of the malware experts, miekiemoes, has an excellent write-up here
Another excellent article by Bill Castner is located here

======================================================

Running multiple antivirus programs

You can not run two real-time antiviruses at the same time. Although many have different methods of searching for and recognising threats, they will all be 'fighting' in memory to kick each other out, rendering them all ineffective.

Uninstall either AVG or Microsoft Security Essentials.

click Start, Settings, Control Panel, Add or remove programs
scroll down the list and look for any AVG OR Microsoft Security Essentials entry:
click on it and then on Remove.

Run AVG removal tool

If you chose to uninstall AVG there will still be some remnants of it on your computer even after the uninstall so please download AVG Removal Tool from here.

===================================================

Uninstall iLivid

click Start, Settings, Control Panel, Add or remove programs.
click on iLivid and then Uninstall.

===================================================

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL MOD - [2012/07/10 17:22:12 | 002,004,472 | —- | M] () – c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…0006cf0492d34df IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{35E94AFB-4389-4368-9873-C47FEDA4A4CD}: "URL" = http://websearch.ask.com/redirect?client=i…D1-3E38D2A6EEB6 IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://www.mystart.com/search_w.php?type=w…s}&ei;=UTF-8 IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{3E4F07C0-6409-450b-BFB6-1E4BFADA60C4}: "URL" = http://au.search.yahoo.com/search?p={searc…&type;=STDVM IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{7B5DDA27-94B5-42d6-9EF2-9B992ACB29CB}: "URL" = http://www.bing.com/search?q={searchTerms}…BR2&pc;=SPLH IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{9BB19242-F155-4688-800F-CD0B5CAD340B}: "URL" = http://www.google.com/cse?cx=partner-pub-3…88%3A4067623346 IE - HKU\S-1-5-21-1409082233-117609710-839522115-1003\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher…0327&lng;=en FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@ei.TotalRecipeSearch_14.com/Plugin: File not found FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: File not found FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: File not found FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: File not found FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension [2012/07/10 17:22:20 | 000,000,000 | —D | M] [2012/07/27 15:00:30 | 000,000,000 | —D | M] ("Savings Sidekick") – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed] [2012/02/16 12:37:36 | 000,000,000 | —D | M] (QuickStores-Toolbar) – C:\Program Files\Mozilla Firefox\extensions\[removed] [2012/07/26 10:38:12 | 000,002,349 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2007/07/26 12:05:16 | 000,001,329 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml [2011/03/24 15:11:50 | 000,002,046 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrchvsl.xml O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found. O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found. O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll () O3 - HKLM\..\Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - No CLSID value found. O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O20 - AppInit_DLLs: (c:\docume~1\alluse~1\applic~1\bprotectorforwindows\2.1.419.7\protector.dll) - c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll () @Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C265C458 @Alternate Data Stream - 175 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

===================================================

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, as they may otherwise interfere with our tools. See here for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

🖼Click to load external image (Posted Image)

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

🖼Click to load external image (Posted Image)

Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Logs to include in the next post:

OTL fix log
New OTL log
ComboFix.txt

Satchfan

Brigow

Post #5July 30, 2012, 3:15 AM UTC

Hi Satchfan,

Below are the logs as requested.

At first attempt to Click/Fix OTL, Malwarebytes locked the computer. I tried a couple of times with the same result.
Subsequently I uninstalled Malwarebytes & OTL then ran OK.

Hope this was OK

Thanks, Brigow

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Releasing module c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
Registry key HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{35E94AFB-4389-4368-9873-C47FEDA4A4CD}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{35E94AFB-4389-4368-9873-C47FEDA4A4CD}\ not found.
Registry key HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}\ not found.
Registry key HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{3E4F07C0-6409-450b-BFB6-1E4BFADA60C4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3E4F07C0-6409-450b-BFB6-1E4BFADA60C4}\ not found.
Registry key HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{7B5DDA27-94B5-42d6-9EF2-9B992ACB29CB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7B5DDA27-94B5-42d6-9EF2-9B992ACB29CB}\ not found.
Registry key HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{9BB19242-F155-4688-800F-CD0B5CAD340B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB19242-F155-4688-800F-CD0B5CAD340B}\ not found.
Registry key HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@ei.TotalRecipeSearch_14.com/Plugin\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@oberon-media.com/ONCAdapter\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension not found.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]\skin folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]\locale\en-US folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]\locale folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]\defaults\preferences folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]\defaults folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]\chrome\content folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]\chrome folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed] folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[removed]\chrome folder moved successfully.
C:\Program Files\Mozilla Firefox\extensions\[removed] folder moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchvsl.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\ deleted successfully.
C:\Program Files\uTorrentBar\tbuTo1.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7}\ deleted successfully.
C:\Program Files\Orbitdownloader\GrabPro.dll moved successfully.
Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.
Starting removal of ActiveX control {33564D57-0000-0010-8000-00AA00389B71}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33564D57-0000-0010-8000-00AA00389B71}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33564D57-0000-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\docume~1\alluse~1\applic~1\bprotectorforwindows\2.1.419.7\protector.dll deleted successfully.
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:C265C458 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 59854 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: User
->Temp folder emptied: 86005796 bytes
->Temporary Internet Files folder emptied: 6496949 bytes
->Java cache emptied: 492891 bytes
->FireFox cache emptied: 160086431 bytes
->Flash cache emptied: 1329 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2162283 bytes
%systemroot%\System32 .tmp files removed: 5137937 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 158287 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 39483632919 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 37,903.00 mb

OTL by OldTimer - Version 3.2.55.0 log created on 07302012_114453

Files\Folders moved on Reboot…
File move failed. c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll scheduled to be moved on reboot.

PendingFileRenameOperations files…
[2012/07/10 17:22:12 | 002,004,472 | —- | M] () c:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\protector.dll : Unable to obtain MD5

Registry entries deleted on Reboot…
Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0F4A166-B8D4-48b8-9D63-80849FE137CB} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48b8-9D63-80849FE137CB}\ not found.

________________________________________________________________________________
_________________

OTL logfile created on: 30/07/2012 12:46:38 PM - Run 3
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Documents and Settings\User\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.97 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.67% Memory free
3.81 Gb Paging File | 3.11 Gb Available in Paging File | 81.59% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.57 Gb Total Space | 38.07 Gb Free Space | 54.73% Space Free | Partition Type: NTFS
Drive D: | 396.19 Gb Total Space | 283.98 Gb Free Space | 71.68% Space Free | Partition Type: NTFS
Drive G: | 1863.01 Gb Total Space | 1219.49 Gb Free Space | 65.46% Space Free | Partition Type: NTFS

Computer Name: USER-84F12D431F | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
PRC - [2012/07/27 16:49:13 | 000,913,888 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/07/05 22:07:00 | 000,161,704 | —- | M] (Oracle Corporation) – C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
PRC - [2012/05/25 04:39:22 | 027,112,840 | —- | M] (Dropbox, Inc.) – C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2012/01/24 16:24:26 | 002,416,480 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2011/11/28 00:19:04 | 001,229,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgfws.exe
PRC - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/09/08 19:53:26 | 000,743,264 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/08/15 05:21:40 | 000,337,760 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2010/10/27 18:24:42 | 000,645,952 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) – C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/01/04 20:25:02 | 000,094,208 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
PRC - [2010/01/04 20:24:24 | 000,077,824 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
PRC - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
PRC - [2009/08/04 17:29:52 | 000,346,320 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
PRC - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
PRC - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2008/04/14 10:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe

========== Modules (No Company Name) ==========

MOD - [2012/07/27 16:49:06 | 002,003,424 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/07/27 12:50:16 | 009,465,032 | —- | M] () – C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll
MOD - [2012/07/10 13:21:10 | 000,132,704 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll
MOD - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
MOD - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012/02/20 21:29:04 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 21:28:42 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/07/30 18:15:32 | 000,503,202 | —- | M] () – C:\Program Files\DeviceVM\Browser Configuration Utility\sqlite3.dll
MOD - [2009/03/13 11:30:44 | 000,109,096 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\ycc.dll
MOD - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - [2012/07/27 16:49:12 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/07/27 12:50:19 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/11 10:45:52 | 004,419,392 | —- | M] () [Auto | Running] – c:\program files\common files\akamai/netsession_win_4f7fccd.dll – (Akamai)
SRV - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe – (vToolbarUpdater11.2.0)
SRV - [2012/07/05 22:07:00 | 000,161,704 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2012/03/26 17:03:40 | 000,011,552 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgfws.exe – (avgfws)
SRV - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) [Auto | Running] – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE – (!SASCORE)
SRV - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) [Auto | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe – (TuneUp.UtilitiesSvc)
SRV - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) [Auto | Running] – C:\Program Files\Nero\Update\NASvc.exe – (NAUpdate)
SRV - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) [Auto | Running] – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe – (BCUService)
SRV - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () [Auto | Running] – C:\Program Files\Gigabyte\EasySaver\essvr.exe – (ES lite Service)
SRV - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe – (BcmSqlStartupSvc)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\Drivers\SYMEVENT.SYS – (SymEvent)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys – (SiwvidStart)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | On_Demand | Unknown] – C:\DOCUME~1\User\LOCALS~1\Temp\mbr.sys – (mbr)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Running] – C:\ComboFix\catchme.sys – (catchme)
DRV - [2012/07/30 12:21:46 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\gdrv.sys – (gdrv)
DRV - [2012/04/28 18:32:29 | 000,023,456 | —- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\DrvAgent32.sys – (DrvAgent32)
DRV - [2011/10/07 05:23:48 | 000,230,608 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2011/10/04 05:21:42 | 000,016,720 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2011/09/13 05:30:10 | 000,032,592 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2011/08/08 21:15:34 | 000,067,664 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2011/08/08 21:15:33 | 000,012,880 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS – (SASDIFSV)
DRV - [2011/08/08 05:08:58 | 000,040,016 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/07/13 17:09:26 | 000,037,920 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2011/07/11 00:14:38 | 000,295,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2011/07/11 00:14:28 | 000,024,272 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2011/07/11 00:14:28 | 000,023,120 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\AVGIDSEH.sys – (AVGIDSEH)
DRV - [2011/07/11 00:14:26 | 000,134,608 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2011/06/02 11:08:34 | 000,011,336 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Program Files\SystemRequirementsLab\cpudrv.sys – (cpudrv)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwfd)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwdx)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCapMP)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCap)
DRV - [2010/10/07 13:34:32 | 000,010,064 | —- | M] (TuneUp Software) [Kernel | On_Demand | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys – (TuneUpUtilitiesDrv)
DRV - [2010/07/20 23:56:52 | 001,691,480 | —- | M] (Creative) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Ambfilt.sys – (Ambfilt)
DRV - [2010/07/20 23:45:12 | 001,395,800 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Monfilt.sys – (Monfilt)
DRV - [2010/07/20 23:37:38 | 006,086,760 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService)
DRV - [2010/03/17 16:42:46 | 000,016,512 | —- | M] (Adaptec) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\ASPI32.SYS – (Aspi32)
DRV - [2010/03/10 07:18:20 | 000,024,216 | —- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ivusb.sys – (ivusb)
DRV - [2009/04/08 02:32:48 | 000,116,224 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\IntcHdmi.sys – (IntcHdmiAddService)
DRV - [2009/03/25 16:29:52 | 000,130,432 | R— | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2007/12/26 01:47:30 | 000,272,128 | —- | M] (NETGEAR Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wg111v2.sys – (RTLWUSB)
DRV - [2006/12/14 09:41:48 | 000,011,984 | —- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ElbyDelay.sys – (ElbyDelay)
DRV - [2006/07/19 11:29:08 | 000,027,136 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidKE.Sys – (LHidKe)
DRV - [2006/07/19 11:28:56 | 000,071,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouKE.Sys – (LMouKE)
DRV - [2006/07/19 11:28:04 | 000,036,736 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidUsbK.sys – (LHidUsbK)
DRV - [2006/07/19 11:27:46 | 000,055,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042MOU.SYS – (L8042mou)
DRV - [2006/07/19 11:27:26 | 000,013,568 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042Kbd.SYS – (L8042Kbd)
DRV - [2005/04/07 09:46:50 | 000,034,240 | R— | M] (ADS) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\adsexpb.sys – (ADSEXPB)
DRV - [2001/11/07 04:40:00 | 000,018,240 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\DbgMsg.sys – (DbgMsg)
DRV - [2001/11/07 01:09:10 | 001,347,462 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\ntice.sys – (NTice)
DRV - [2001/11/07 01:09:10 | 000,119,658 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\siwvid.sys – (Siwvid)
DRV - [2001/11/07 01:09:10 | 000,022,900 | —- | M] () [Kernel | Disabled | Stopped] – C:\WINDOWS\System32\drivers\siwsym.sys – (Siwsym)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…0006cf0492d34df
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={ADE1B36…mp;d=2012-02-16 10:43:32&v;=10.0.0.7&sap;=dsp&q;={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=;

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/02/17 07:12:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/27 16:49:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/17 08:32:09 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1266764D-FC4F-4FA7-B63B-884D53B1680F}: C:\Documents and Settings\User\Application Data\NetAssistant\ [2011/04/21 09:37:29 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension [2012/07/10 17:22:20 | 000,000,000 | —D | M]

[2010/04/01 16:33:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2012/07/27 15:02:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions
[2012/07/12 14:52:59 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/07/23 18:26:01 | 000,000,000 | —D | M] (Flash and Video Download) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2012/06/27 18:13:17 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2012/05/12 09:52:17 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/06/28 16:33:44 | 000,000,000 | —D | M] (DoNotTrackPlus) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/09 16:20:27 | 000,000,000 | —D | M] (VideoFileDownload - Download YouTube Videos) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2011/08/06 13:58:30 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/27 15:02:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\staged
[2012/07/30 08:50:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\vppgx98u.default-1343368773312\extensions
[2012/07/26 10:38:12 | 000,002,349 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\706l0eqd.default-1343368655062\searchplugins\bProtect.xml
[2012/07/17 08:32:12 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/07/17 08:32:12 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/07/27 16:49:13 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/08/03 15:07:42 | 000,373,104 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll
[2012/07/10 13:20:58 | 000,003,767 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/01/17 16:45:41 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2010/12/09 07:21:24 | 000,002,224 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\webblog.xml

O1 HOSTS File: ([2012/07/30 12:21:54 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BCU] C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [KHALMNPR.EXE] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab; video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload; selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load; all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8EA6C079-3333-4797-9BAC-AF0FD534706A}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C85F8EC6-C08E-404C-9D39-C29A7821E0FD}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/01 11:50:36 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2020/12/01 12:20:44 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\iolo
[2012/07/30 12:19:54 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2012/07/30 12:14:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/07/30 12:14:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/07/30 12:14:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/07/30 12:14:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/07/30 12:14:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Favorites
[2012/07/30 11:53:42 | 004,721,417 | R— | C] (Swearware) – C:\Documents and Settings\User\Desktop\ComboFix.exe
[2012/07/30 09:19:23 | 000,000,000 | —D | C] – C:\_OTL
[2012/07/30 08:53:42 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2012/07/29 09:05:02 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\User\Desktop\aswMBR.exe
[2012/07/29 08:41:04 | 000,597,504 | —- | C] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 17:38:10 | 000,000,000 | —D | C] – C:\Program Files\Oracle
[2012/07/28 17:37:45 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Oracle
[2012/07/28 17:37:36 | 000,227,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:10:23 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.techniclauncher
[2012/07/28 16:29:44 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums_files
[2012/07/28 11:30:41 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\RK_Quarantine
[2012/07/27 17:16:37 | 000,000,000 | —D | C] – C:\Program Files\SpeedyPC Software
[2012/07/27 17:06:16 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\SpeedyPC Software
[2012/07/27 17:06:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SpeedyPC Software
[2012/07/27 08:04:52 | 000,000,000 | —D | C] – C:\Program Files\MALWAREBYTES ANTI-MALWARE
[2012/07/26 11:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Curiolab
[2012/07/26 10:37:46 | 000,000,000 | —D | C] – C:\Program Files\Adjugglercookie Removal Tool (1)
[2012/07/25 20:33:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2012/07/25 20:29:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Ad-Aware Antivirus
[2012/07/25 19:58:08 | 000,356,352 | —- | C] (eSellerate Inc.) – C:\WINDOWS\eSellerateEngine.dll
[2012/07/25 19:58:08 | 000,081,920 | —- | C] (eSellerate Inc.) – C:\WINDOWS\eSellerateControl350.dll
[2012/07/25 19:58:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Adjugglercookie Removal Tool
[2012/07/25 19:58:06 | 000,000,000 | —D | C] – C:\Program Files\Adjugglercookie Removal Tool
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Samsung
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Program Files\Clarus
[2012/07/17 08:32:09 | 000,476,976 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/17 08:32:09 | 000,143,872 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/17 08:30:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2012/07/15 16:22:24 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Start Menu\Programs\HiJackThis
[2012/07/15 16:22:23 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/07/11 12:57:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack
[2012/07/10 17:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IBUpdaterService
[2012/07/10 17:25:00 | 000,000,000 | —D | C] – C:\WINDOWS\System32\searchplugins
[2012/07/10 17:23:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Savings Sidekick
[2012/07/10 17:22:41 | 000,000,000 | —D | C] – C:\Program Files\Uninstall Information
[2012/07/10 17:22:32 | 000,000,000 | —D | C] – C:\Program Files\Savings Sidekick
[2012/07/10 17:22:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\bProtectorForWindows
[2012/07/09 16:20:25 | 000,000,000 | —D | C] – C:\Program Files\TorrentSearch
[2012/07/09 16:20:04 | 000,000,000 | —D | C] – C:\Program Files\intellidownload
[2012/07/04 08:15:43 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.minecraft
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/30 12:50:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/07/30 12:31:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/30 12:23:18 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/07/30 12:21:54 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/07/30 12:21:46 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) – C:\WINDOWS\gdrv.sys
[2012/07/30 12:21:40 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/30 12:21:38 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/07/30 12:01:36 | 000,001,397 | —- | M] () – C:\Documents and Settings\User\Desktop\clipbrd.lnk
[2012/07/30 11:54:15 | 004,721,417 | R— | M] (Swearware) – C:\Documents and Settings\User\Desktop\ComboFix.exe
[2012/07/30 09:10:21 | 102,478,968 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/07/30 09:05:02 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif
[2012/07/30 07:54:09 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/07/29 22:17:52 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{C8C75372-1D1B-46C1-9F1F-54092919BFB9}.job
[2012/07/29 15:42:46 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2012/07/29 14:15:30 | 000,451,737 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012/07/29 10:33:13 | 000,000,512 | —- | M] () – C:\Documents and Settings\User\Desktop\MBR.dat
[2012/07/29 09:05:47 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\User\Desktop\aswMBR.exe
[2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 18:23:17 | 000,000,578 | —- | M] () – C:\WINDOWS\MyHeritage.INI
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:05:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/07/28 16:29:45 | 000,254,426 | —- | M] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:28 | 001,552,384 | —- | M] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/28 08:38:09 | 000,000,394 | —- | M] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/27 12:50:17 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/07/27 12:50:17 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/07/26 17:03:28 | 000,001,881 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/26 17:03:27 | 000,000,963 | —- | M] () – C:\Documents and Settings\User\Desktop\Spybot - Search & Destroy.lnk
[2012/07/26 10:44:01 | 000,002,451 | —- | M] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/26 10:38:34 | 000,000,721 | —- | M] () – C:\user.js
[2012/07/25 19:58:12 | 000,001,892 | —- | M] () – C:\Documents and Settings\User\Desktop\Adjugglercookie Removal Tool.lnk
[2012/07/25 18:26:00 | 000,001,469 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/25 16:26:12 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\AdvancedDriverUpdater_UPDATES.job
[2012/07/20 15:12:46 | 000,846,855 | —- | M] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/20 10:45:45 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120726-165429.backup
[2012/07/17 08:31:57 | 000,476,976 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/16 16:57:06 | 004,661,166 | —- | M] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 17:26:23 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120720-104545.backup
[2012/07/15 12:23:49 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | M] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 14:14:10 | 000,001,373 | —- | M] () – C:\WINDOWS\wininit.ini
[2012/07/14 13:18:39 | 000,442,053 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120715-172623.backup
[2012/07/13 17:23:02 | 000,001,151 | —- | M] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/12 10:53:44 | 000,304,416 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/07/06 08:46:34 | 000,172,098 | —- | M] () – C:\torrent.exe
[2012/07/05 22:07:08 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/05 22:06:48 | 000,227,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/05 22:06:20 | 000,687,544 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/30 12:14:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/07/30 12:14:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/07/30 12:14:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/07/30 12:14:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/07/30 12:14:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/07/30 12:00:24 | 000,001,397 | —- | C] () – C:\Documents and Settings\User\Desktop\clipbrd.lnk
[2012/07/29 10:33:13 | 000,000,512 | —- | C] () – C:\Documents and Settings\User\Desktop\MBR.dat
[2012/07/28 16:29:43 | 000,254,426 | —- | C] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:12 | 001,552,384 | —- | C] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/27 17:16:41 | 000,000,394 | —- | C] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/26 17:03:27 | 000,001,881 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/25 19:58:12 | 000,001,892 | —- | C] () – C:\Documents and Settings\User\Desktop\Adjugglercookie Removal Tool.lnk
[2012/07/25 18:26:00 | 000,001,469 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/20 15:12:46 | 000,846,855 | —- | C] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/16 16:57:06 | 004,661,166 | —- | C] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 16:22:24 | 000,002,451 | —- | C] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/15 12:23:19 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | C] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 16:21:01 | 000,000,304 | —- | C] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/07/14 14:13:58 | 000,001,373 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/07/13 17:23:02 | 000,001,151 | —- | C] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/13 17:21:23 | 000,645,632 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2012/07/13 17:21:23 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2012/07/13 17:21:23 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\xvid.ax
[2012/07/06 08:46:34 | 000,172,098 | —- | C] () – C:\torrent.exe
[2012/04/19 22:08:24 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1409082233-117609710-839522115-1003-0.dat
[2012/04/16 22:58:49 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/03/04 13:29:22 | 000,002,396 | —- | C] () – C:\WINDOWS\System32\ASOROSet.bin
[2012/02/15 16:00:14 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/27 12:31:10 | 000,000,520 | —- | C] () – C:\WINDOWS\Viewer.INI
[2011/12/17 14:20:38 | 000,000,000 | —- | C] () – C:\WINDOWS\muveeapp.INI
[2011/12/08 18:40:31 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\KRSBridgeControls.dll
[2011/12/08 18:40:31 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\JeanieInterface.dll
[2011/12/08 18:40:31 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\KRSSockets.dll
[2011/12/08 18:40:31 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\FuzzBox.dll
[2011/12/08 18:40:31 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\BrowseForDirectory.dll
[2011/11/29 22:12:25 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2011/11/29 22:09:35 | 000,000,578 | —- | C] () – C:\WINDOWS\MyHeritage.INI
[2011/11/29 22:07:18 | 000,454,656 | —- | C] () – C:\WINDOWS\System32\PaintX.dll
[2011/11/22 19:21:10 | 000,002,816 | —- | C] () – C:\Documents and Settings\All Users\Application Data\un.png
[2011/11/22 19:15:59 | 000,000,316 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/11/22 19:15:59 | 000,000,022 | —- | C] () – C:\Documents and Settings\User\Application Data\UserFlag.ini
[2011/09/07 17:03:45 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/01 15:37:35 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\AVERM.dll
[2011/09/01 15:37:34 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\AVEQT.dll
[2011/06/28 12:29:04 | 002,097,152 | —- | C] () – C:\Documents and Settings\User\My Volume N
[2011/04/21 19:28:31 | 000,000,022 | -HS- | C] () – C:\Documents and Settings\User\Application Data\Sys2662.Config.Repository.bin
[2011/04/15 12:55:52 | 000,069,432 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/04/14 10:21:38 | 000,304,416 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/08 13:36:49 | 000,001,769 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2011/03/06 15:55:42 | 000,004,096 | —- | C] ( ) – C:\WINDOWS\System32\IGFXDEVLib.dll
[2011/03/06 15:55:41 | 000,000,151 | —- | C] () – C:\WINDOWS\System32\GfxUI.exe.config
[2011/02/18 19:11:28 | 000,000,593 | —- | C] () – C:\Documents and Settings\User\Application Data\AutoGK.ini
[2011/02/10 07:29:06 | 000,000,043 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/01/10 17:01:08 | 000,000,805 | —- | C] () – C:\WINDOWS\ScanSpyware.INI
[2010/12/30 20:17:43 | 000,000,107 | —- | C] () – C:\WINDOWS\IfoEdit.INI
[2010/12/19 12:09:23 | 000,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2010/12/19 12:09:23 | 000,048,984 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2010/04/05 12:20:52 | 000,000,084 | —- | C] () – C:\Documents and Settings\User\default.pls
[2010/04/02 14:04:29 | 000,166,400 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/02 12:18:12 | 000,007,887 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.cat
[2010/04/02 12:18:12 | 000,001,144 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.inf

< End of report >

________________________________________________________________________________
____________________

ComboFix 12-07-29.02 - User 30/07/2012 12:15:47.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2012.1251 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\User\Application Data\vso_ts_preview.xml
c:\program files\intellidownload\gunzip.exe
c:\windows\ST6UNST.000
c:\windows\system32\avgfwdx.dll
c:\windows\system32\Cache
c:\windows\system32\Cache\1068fee9d9ca4b7b.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\65c2a5d7cd9bef90.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\a5006ca06b817b35.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\Cache\e687a02b01c7708f.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\Cache\fd2846f386b731b7.fb
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\roboot.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-06-28 to 2012-07-30 )))))))))))))))))))))))))))))))
.
.
2020-12-01 02:20 . 2020-12-01 02:20 ——– d—–w- c:\documents and settings\LocalService\Application Data\iolo
2012-07-29 23:19 . 2012-07-29 23:19 ——– d—–w- C:\_OTL
2012-07-29 22:48 . 2012-07-29 22:48 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C014ACEC-7709-46A9-9AE2-1CB5A89FE2D8}\offreg.dll
2012-07-29 22:02 . 2012-06-29 08:44 6891424 ——w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C014ACEC-7709-46A9-9AE2-1CB5A89FE2D8}\mpengine.dll
2012-07-28 07:38 . 2012-07-28 07:38 ——– d—–w- c:\program files\Oracle
2012-07-28 07:37 . 2012-07-28 07:37 ——– d—–w- c:\documents and settings\User\Application Data\Oracle
2012-07-28 07:10 . 2012-07-28 07:10 ——– d—–w- c:\documents and settings\User\Application Data\.techniclauncher
2012-07-27 07:16 . 2012-07-27 07:16 ——– d—–w- c:\program files\SpeedyPC Software
2012-07-27 07:06 . 2012-07-27 07:06 ——– d—–w- c:\documents and settings\User\Application Data\SpeedyPC Software
2012-07-27 07:06 . 2012-07-28 22:02 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software
2012-07-26 22:04 . 2012-07-30 01:35 ——– d—–w- c:\program files\MALWAREBYTES ANTI-MALWARE
2012-07-26 01:22 . 2012-07-26 01:22 ——– d—–w- c:\documents and settings\User\Application Data\Curiolab
2012-07-26 00:37 . 2012-07-27 04:52 ——– d—–w- c:\program files\Adjugglercookie Removal Tool (1)
2012-07-25 10:33 . 2012-07-26 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2012-07-25 10:29 . 2012-07-25 10:29 ——– d—–w- c:\documents and settings\User\Application Data\Ad-Aware Antivirus
2012-07-25 09:58 . 2011-02-17 08:26 81920 —-a-w- c:\windows\eSellerateControl350.dll
2012-07-25 09:58 . 2011-02-17 08:26 356352 —-a-w- c:\windows\eSellerateEngine.dll
2012-07-25 09:58 . 2012-07-25 10:19 ——– d—–w- c:\program files\Adjugglercookie Removal Tool
2012-07-25 08:26 . 2012-07-25 08:26 ——– d—–w- c:\program files\Clarus
2012-07-16 22:32 . 2012-07-16 22:31 476976 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-07-16 22:32 . 2012-07-05 12:07 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-07-16 22:30 . 2012-07-16 22:30 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2012-07-15 06:22 . 2012-07-15 06:22 388096 —-a-r- c:\documents and settings\User\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-07-15 06:22 . 2012-07-15 06:22 ——– d—–w- c:\program files\Trend Micro
2012-07-13 07:21 . 2011-05-30 13:42 240640 —-a-w- c:\windows\system32\xvidvfw.dll
2012-07-13 07:21 . 2011-05-23 09:52 153088 —-a-w- c:\windows\system32\xvid.ax
2012-07-13 07:21 . 2011-05-23 07:46 645632 —-a-w- c:\windows\system32\xvidcore.dll
2012-07-11 21:25 . 2012-07-11 21:26 ——– d—–w- c:\program files\GUM4E.tmp
2012-07-11 00:51 . 2012-07-11 00:51 ——– d—–w- c:\windows\system32\wbem\searchplugins
2012-07-10 07:37 . 2012-07-10 07:37 ——– d—–w- c:\documents and settings\All Users\Application Data\IBUpdaterService
2012-07-10 07:25 . 2012-07-10 07:25 ——– d—–w- c:\windows\system32\searchplugins
2012-07-10 07:23 . 2012-07-10 07:23 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Savings Sidekick
2012-07-10 07:22 . 2012-07-10 07:23 ——– d—–w- c:\program files\Savings Sidekick
2012-07-10 07:22 . 2012-07-10 07:22 ——– d—–w- c:\documents and settings\All Users\Application Data\bProtectorForWindows
2012-07-09 06:20 . 2012-07-09 06:20 ——– d—–w- c:\program files\TorrentSearch
2012-07-09 06:20 . 2012-07-30 02:19 ——– d—–w- c:\program files\intellidownload
2012-07-05 22:46 . 2012-07-05 22:46 172098 —-a-w- C:\torrent.exe
2012-07-03 22:15 . 2012-07-06 00:02 ——– d—–w- c:\documents and settings\User\Application Data\.minecraft
2012-07-01 11:27 . 2012-07-01 11:27 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-07-01 11:27 . 2012-07-01 11:27 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-30 02:21 . 2010-04-01 02:30 17488 -c–a-w- c:\windows\gdrv.sys
2012-07-27 02:50 . 2012-04-01 23:00 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-27 02:50 . 2011-06-10 22:31 70344 -c–a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-05 12:06 . 2010-05-21 03:18 687544 -c–a-w- c:\windows\system32\deployJava1.dll
2012-06-28 05:46 . 2012-06-28 05:46 1409 —-a-w- c:\windows\QTFont.for
2012-06-13 13:19 . 2004-08-04 12:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-06-09 17:21 . 2002-10-15 22:54 178688 —-a-w- c:\windows\system32\unrar.dll
2012-06-05 15:50 . 2008-04-14 00:12 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 12:00 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 05:19 . 2009-08-06 09:24 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 05:19 . 2010-04-01 01:48 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 05:19 . 2010-04-01 01:48 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 05:19 . 2010-04-01 01:48 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 05:19 . 2009-08-06 09:24 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 05:19 . 2010-04-01 01:48 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 05:19 . 2010-04-01 01:48 35864 -c–a-w- c:\windows\system32\wups.dll
2012-06-02 05:19 . 2009-08-06 09:24 45080 -c–a-w- c:\windows\system32\wups2.dll
2012-06-02 05:19 . 2009-08-06 09:24 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 05:19 . 2004-08-04 12:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 05:19 . 2009-08-06 09:24 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 05:19 . 2010-04-01 01:48 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 05:19 . 2010-04-01 01:48 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 05:18 . 2010-04-01 22:43 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-06-02 05:18 . 2010-04-01 22:43 214256 —-a-w- c:\windows\system32\muweb.dll
2012-06-02 05:18 . 2010-04-01 22:43 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2004-08-04 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2004-08-04 12:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-05-11 14:42 . 2004-08-04 12:00 43520 ——w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42 . 2004-08-04 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-04 12:00 385024 ——w- c:\windows\system32\html.iec
2012-05-04 13:16 . 2004-08-04 12:00 2148352 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2004-08-03 22:59 2026496 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2010-04-01 01:47 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-27 06:49 . 2011-03-25 23:33 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-10 03:21 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]
"KHALMNPR.EXE"="KHALMNPR.EXE" [2006-07-19 94208]
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-08-04 346320]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-10 1107552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-23 129536]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-23 164352]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 94208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-18 36960]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-26 434080]
.
c:\documents and settings\User\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\User\Application Data\Dropbox\bin\Dropbox.exe [2012-5-25 27112840]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Samsung Auto Backup Guage.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFGuage.exe [N/A]
Samsung Auto Backup Real-Time Daemon.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe [2012-7-25 77824]
Samsung Auto Backup Scheduler.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFTimerD.exe [2012-7-25 94208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSecurityTab"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSecurityTab"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-08 113024]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 04:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
backup=c:\windows\pss\Logitech SetPoint.lnk0A831A0E.startup
backupExtension=0A831A0E.startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Orbit.lnk]
backup=c:\windows\pss\Orbit.lnk0A831D3B.startup
backupExtension=0A831D3B.startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-01 23:07 843712 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-05-30 10:06 59280 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2012-02-23 02:38 140800 —-a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 06:07 2260480 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"LightScribe Control Panel"=c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
"RegistryMechanic"=c:\program files\Registry Mechanic\RegMech.exe /H
"uTorrent"="c:\program files\uTorrent\uTorrent.exe"
"Akamai NetSession Interface"=c:\documents and settings\User\Local Settings\Application Data\Akamai\netsession_win.exe
"SUPERAntiSpyware"=c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"Persistence"=c:\windows\system32\igfxpers.exe
"CanonSolutionMenu"=c:\program files\Canon\SolutionMenu\CNSLMAIN.exe /logon
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"dvd43"=c:\program files\dvd43\dvd43_tray.exe
"CanonMyPrinter"=c:\program files\Canon\MyPrinter\BJMyPrt.exe /logon
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" -hide -runkey
"Logitech Hardware Abstraction Layer"="c:\program files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Gigabyte\\EasySaver\\UpdExe.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\MultiProxy\\MProxy.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Regensoft\\Downloader App\\DownloaderApp.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\User\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:appletv
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [11/07/2011 12:14 AM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [11/07/2011 12:13 AM 32592]
R0 Siwvid;Siwvid;c:\windows\system32\drivers\siwvid.sys [7/11/2001 1:09 AM 119658]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11/07/2011 12:13 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11/07/2011 12:14 AM 295248]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [5/01/2010 7:56 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/01/2010 7:56 AM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [3/07/2010 5:44 PM 116608]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/08/2004 10:00 PM 14336]
R2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [23/11/2011 1:36 AM 2391832]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [12/10/2011 5:25 AM 4433248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2/08/2011 5:09 AM 192776]
R2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [1/04/2010 12:12 PM 219360]
R2 DbgMsg;Debug Message;c:\windows\system32\drivers\DbgMsg.sys [7/11/2001 4:40 AM 18240]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [1/04/2010 12:12 PM 68136]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [4/05/2010 11:07 AM 503080]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [27/10/2010 6:23 PM 1483072]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [10/07/2012 1:21 PM 935008]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [23/05/2011 12:03 AM 30944]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [11/07/2011 12:14 AM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [11/07/2011 12:14 AM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [11/07/2011 12:14 AM 16720]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [1/04/2010 12:17 PM 116224]
R3 RRNetCapMP;RRNetCapMP;c:\windows\system32\drivers\rrnetcap.sys [16/11/2010 10:26 AM 31848]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [7/10/2010 1:34 PM 10064]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22/06/2010 6:31 PM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2/04/2012 9:00 AM 250056]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/04/2010 12:15 PM 1691480]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [23/05/2011 12:03 AM 30944]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [2/06/2011 11:08 AM 11336]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [28/04/2012 6:32 PM 23456]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [22/06/2010 6:31 PM 136176]
S3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\drivers\ivusb.sys [10/03/2010 7:18 AM 24216]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/05/2012 8:25 AM 113120]
S3 NTice;NTice;c:\windows\system32\drivers\ntice.sys [7/11/2001 1:09 AM 1347462]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [2/04/2010 12:18 PM 47360]
S3 RRNetCap;RRNetCap Service;c:\windows\system32\drivers\rrnetcap.sys [16/11/2010 10:26 AM 31848]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [26/12/2007 1:47 AM 272128]
S3 SiwvidStart;SiwvidStart;\??\c:\program files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys –> c:\program files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys [?]
S4 Siwsym;Siwsym;c:\windows\system32\drivers\siwsym.sys [7/11/2001 1:09 AM 22900]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-09-19 10:46 451872 -c–a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 09:02 114688 —-a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 02:50]
.
2012-07-25 c:\windows\Tasks\AdvancedDriverUpdater_UPDATES.job
- c:\program files\Advanced Driver Updater\adu.exe [2012-05-07 02:14]
.
2012-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]
.
2012-03-02 c:\windows\Tasks\defrag.job
- c:\windows\system32\defrag.exe [2004-08-04 00:12]
.
2012-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 08:31]
.
2012-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 08:31]
.
2012-07-27 c:\windows\Tasks\SpeedyPC Pro.job
- c:\program files\SpeedyPC Software\SpeedyPC\SpeedyPC.exe [2011-10-09 01:19]
.
2012-07-29 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2010-04-14 05:31]
.
2012-07-29 c:\windows\Tasks\User_Feed_Synchronization-{C8C75372-1D1B-46C1-9F1F-54092919BFB9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 17:31]
.
.
——- Supplementary Scan ——-
.
uStart Page =
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: &Download; by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab; video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload; selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load; all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\documents and settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 10.0.0.138
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\706l0eqd.default-1343368655062\
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
MSConfigStartUp-Malwarebytes' Anti-Malware - c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
AddRemove-eSupport UndeletePlus_is1 - f:\esupport undeleteplus\unins000.exe
AddRemove-vfd-ob - c:\program files\OApps\vfd-ob_uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-30 12:23
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_4f7fccd.dll"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{08211550-CA01-C31F-B8B2-33F80314E406}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"pamekcoejigfjhjbncmepabligdoilec"=hex:6b,61,64,67,6a,67,6a,68,68,64,70,6c,66,
6b,6f,61,6b,6f,63,6b,66,6e,00,00
"oaoeakfoakogokknhkkekpimblenie"=hex:6a,61,6a,67,67,67,6c,70,70,69,65,67,61,67,
6a,62,6b,6d,63,6c,00,f4
.
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
"value"="?\09\05\09\0c\15\0b?"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1144)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3836)
c:\windows\system32\WININET.dll
c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2012-07-30 12:25:47 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-30 02:25
ComboFix2.txt 2011-09-06 02:59
ComboFix3.txt 2011-08-29 00:14
ComboFix4.txt 2011-08-09 06:55
.
Pre-Run: 40,983,445,504 bytes free
Post-Run: 40,849,510,400 bytes free
.
- - End Of File - - 1B6701766AA81879EB5379031520594D

Satchfan

Post #6July 30, 2012, 6:53 AM UTC last edited August 1, 2012, 8:49 AM UTC

I see you have chosen to ignore my advice about running 2 antiviruses. This will leave you open to infection.

Open ComboFix

Please do the following:

close any open browsers.
close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
open notepad and copy/paste the text in the codebox below into it:

Folder:: c:\program files\Savings Sidekick c:\documents and settings\All Users\Application Data\bProtectorForWindows

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

save it to your Desktop.
double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
a Notepad document should open automatically called checkup.txt; please post the contents of that document.

================================================

Run Malwarebytes’ Anti-Malware

Please re-install it. If you no longer have it, you can download it from here:

start Malwarebytes-Anti-Malware and update it, (“Update” tab}
once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
when the scan is complete, click OK, then Show Results to view the results.
be sure that everything is checked, and click Remove Selected.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Logs to include with the next post:

ComboFix.txt
checkup.txt
Mbam.txt

Can you tell me if there are any outstanding problems.

Satchfan

Brigow

Post #7July 30, 2012, 7:13 AM UTC

Hi Satchfan, re:-"I see you have chosen to ignore my advice about running 2 antiviruses. This will leave you open to infection." Before I proceed, I thought that I took your advice by uninstalling Microsoft Security essentials. If there is something else you would like me to remove, please advise. Thanks, Brigow

Satchfan

Post #8July 30, 2012, 7:27 AM UTC

According to the last logs they are both still there. As part of the last set of instructions there is a security check which wwill show up what is installed so leave it for now and we'll beal with that afterwards. Thanks Satchfan

Brigow

Post #9July 30, 2012, 8:40 AM UTC

Hi again,
we must be in the same time zone…………..the responses are so quick!

Here is the info…………..

___________________________________________________________

ComboFix 12-07-30.01 - User 30/07/2012 17:58:37.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2012.1347 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt
AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: AVG Firewall *Enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\bProtectorForWindows
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\bProtect.exe
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\bProtect.settings
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\component_442.decrpt
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\crashReports\5005fc8f0_201a307.dmp
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\crashReports\5005fc8f0_201a307.gz
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\crashReports\500fb3810_201a307.dmp
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\crashReports\500fb3810_201a307.gz
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\chrome.manifest
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-10.0.2.dll
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-11.0.dll
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-3.6.dll
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-3.6.xpt
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-5.0.dll
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-6.0.2.dll
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-7.0.1.dll
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-8.0.1.dll
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\components\bprotector-9.0.1.dll
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\content\bprotector.js
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\content\overlay.xul
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension\install.rdf
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\00
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\01
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\02
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\10
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\11
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\12
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\20
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\21
c:\documents and settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\traking_settings\22
c:\program files\Savings Sidekick
c:\program files\Savings Sidekick\Savings Sidekick.exe
c:\program files\Savings Sidekick\Savings Sidekick.ico
c:\program files\Savings Sidekick\Savings Sidekick.ini
c:\program files\Savings Sidekick\Savings SidekickGui.exe
c:\program files\Savings Sidekick\Savings SidekickInstaller.log
c:\program files\Savings Sidekick\Uninstall.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-06-28 to 2012-07-30 )))))))))))))))))))))))))))))))
.
.
2020-12-01 02:20 . 2020-12-01 02:20 ——– d—–w- c:\documents and settings\LocalService\Application Data\iolo
2012-07-29 23:19 . 2012-07-29 23:19 ——– d—–w- C:\_OTL
2012-07-29 22:48 . 2012-07-29 22:48 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C014ACEC-7709-46A9-9AE2-1CB5A89FE2D8}\offreg.dll
2012-07-29 22:02 . 2012-06-29 08:44 6891424 ——w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C014ACEC-7709-46A9-9AE2-1CB5A89FE2D8}\mpengine.dll
2012-07-28 07:38 . 2012-07-28 07:38 ——– d—–w- c:\program files\Oracle
2012-07-28 07:37 . 2012-07-28 07:37 ——– d—–w- c:\documents and settings\User\Application Data\Oracle
2012-07-28 07:10 . 2012-07-28 07:10 ——– d—–w- c:\documents and settings\User\Application Data\.techniclauncher
2012-07-27 07:16 . 2012-07-27 07:16 ——– d—–w- c:\program files\SpeedyPC Software
2012-07-27 07:06 . 2012-07-27 07:06 ——– d—–w- c:\documents and settings\User\Application Data\SpeedyPC Software
2012-07-27 07:06 . 2012-07-28 22:02 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software
2012-07-26 22:04 . 2012-07-30 01:35 ——– d—–w- c:\program files\MALWAREBYTES ANTI-MALWARE
2012-07-26 01:22 . 2012-07-26 01:22 ——– d—–w- c:\documents and settings\User\Application Data\Curiolab
2012-07-26 00:37 . 2012-07-27 04:52 ——– d—–w- c:\program files\Adjugglercookie Removal Tool (1)
2012-07-25 10:33 . 2012-07-26 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2012-07-25 10:29 . 2012-07-25 10:29 ——– d—–w- c:\documents and settings\User\Application Data\Ad-Aware Antivirus
2012-07-25 09:58 . 2011-02-17 08:26 81920 —-a-w- c:\windows\eSellerateControl350.dll
2012-07-25 09:58 . 2011-02-17 08:26 356352 —-a-w- c:\windows\eSellerateEngine.dll
2012-07-25 09:58 . 2012-07-25 10:19 ——– d—–w- c:\program files\Adjugglercookie Removal Tool
2012-07-25 08:26 . 2012-07-25 08:26 ——– d—–w- c:\program files\Clarus
2012-07-16 22:32 . 2012-07-16 22:31 476976 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-07-16 22:32 . 2012-07-05 12:07 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-07-16 22:30 . 2012-07-16 22:30 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2012-07-15 06:22 . 2012-07-15 06:22 388096 —-a-r- c:\documents and settings\User\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-07-15 06:22 . 2012-07-15 06:22 ——– d—–w- c:\program files\Trend Micro
2012-07-13 07:21 . 2011-05-30 13:42 240640 —-a-w- c:\windows\system32\xvidvfw.dll
2012-07-13 07:21 . 2011-05-23 09:52 153088 —-a-w- c:\windows\system32\xvid.ax
2012-07-13 07:21 . 2011-05-23 07:46 645632 —-a-w- c:\windows\system32\xvidcore.dll
2012-07-11 21:25 . 2012-07-11 21:26 ——– d—–w- c:\program files\GUM4E.tmp
2012-07-11 00:51 . 2012-07-11 00:51 ——– d—–w- c:\windows\system32\wbem\searchplugins
2012-07-10 07:37 . 2012-07-10 07:37 ——– d—–w- c:\documents and settings\All Users\Application Data\IBUpdaterService
2012-07-10 07:25 . 2012-07-10 07:25 ——– d—–w- c:\windows\system32\searchplugins
2012-07-10 07:23 . 2012-07-10 07:23 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Savings Sidekick
2012-07-09 06:20 . 2012-07-09 06:20 ——– d—–w- c:\program files\TorrentSearch
2012-07-09 06:20 . 2012-07-30 02:19 ——– d—–w- c:\program files\intellidownload
2012-07-05 22:46 . 2012-07-05 22:46 172098 —-a-w- C:\torrent.exe
2012-07-03 22:15 . 2012-07-06 00:02 ——– d—–w- c:\documents and settings\User\Application Data\.minecraft
2012-07-01 11:27 . 2012-07-01 11:27 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-07-01 11:27 . 2012-07-01 11:27 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-30 02:21 . 2010-04-01 02:30 17488 -c–a-w- c:\windows\gdrv.sys
2012-07-27 02:50 . 2012-04-01 23:00 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-27 02:50 . 2011-06-10 22:31 70344 -c–a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-05 12:06 . 2010-05-21 03:18 687544 -c–a-w- c:\windows\system32\deployJava1.dll
2012-06-28 05:46 . 2012-06-28 05:46 1409 —-a-w- c:\windows\QTFont.for
2012-06-13 13:19 . 2004-08-04 12:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-06-09 17:21 . 2002-10-15 22:54 178688 —-a-w- c:\windows\system32\unrar.dll
2012-06-05 15:50 . 2008-04-14 00:12 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 12:00 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 05:19 . 2009-08-06 09:24 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 05:19 . 2010-04-01 01:48 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 05:19 . 2010-04-01 01:48 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 05:19 . 2010-04-01 01:48 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 05:19 . 2009-08-06 09:24 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 05:19 . 2010-04-01 01:48 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 05:19 . 2010-04-01 01:48 35864 -c–a-w- c:\windows\system32\wups.dll
2012-06-02 05:19 . 2009-08-06 09:24 45080 -c–a-w- c:\windows\system32\wups2.dll
2012-06-02 05:19 . 2009-08-06 09:24 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 05:19 . 2004-08-04 12:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 05:19 . 2009-08-06 09:24 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 05:19 . 2010-04-01 01:48 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 05:19 . 2010-04-01 01:48 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 05:18 . 2010-04-01 22:43 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-06-02 05:18 . 2010-04-01 22:43 214256 —-a-w- c:\windows\system32\muweb.dll
2012-06-02 05:18 . 2010-04-01 22:43 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2004-08-04 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2004-08-04 12:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-05-11 14:42 . 2004-08-04 12:00 43520 ——w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42 . 2004-08-04 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-04 12:00 385024 ——w- c:\windows\system32\html.iec
2012-05-04 13:16 . 2004-08-04 12:00 2148352 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2004-08-03 22:59 2026496 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2010-04-01 01:47 139656 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-27 06:49 . 2011-03-25 23:33 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-10 03:21 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\User\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Xvid"="c:\program files\Xvid\CheckUpdate.exe" [2011-01-17 8192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]
"KHALMNPR.EXE"="KHALMNPR.EXE" [2006-07-19 94208]
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-08-04 346320]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-10 1107552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-23 129536]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-23 164352]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 94208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-18 36960]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-26 434080]
.
c:\documents and settings\User\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\User\Application Data\Dropbox\bin\Dropbox.exe [2012-5-25 27112840]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Samsung Auto Backup Real-Time Daemon.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe [2012-7-25 77824]
Samsung Auto Backup Scheduler.lnk - c:\program files\Clarus\Samsung Auto Backup\ISFTimerD.exe [2012-7-25 94208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSecurityTab"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSecurityTab"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-08 113024]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 04:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
backup=c:\windows\pss\Logitech SetPoint.lnk0A831A0E.startup
backupExtension=0A831A0E.startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Orbit.lnk]
backup=c:\windows\pss\Orbit.lnk0A831D3B.startup
backupExtension=0A831D3B.startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-01 23:07 843712 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-05-30 10:06 59280 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2012-02-23 02:38 140800 —-a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 06:07 2260480 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"LightScribe Control Panel"=c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
"uTorrent"="c:\program files\uTorrent\uTorrent.exe"
"Akamai NetSession Interface"=c:\documents and settings\User\Local Settings\Application Data\Akamai\netsession_win.exe
"SUPERAntiSpyware"=c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"Persistence"=c:\windows\system32\igfxpers.exe
"CanonSolutionMenu"=c:\program files\Canon\SolutionMenu\CNSLMAIN.exe /logon
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"dvd43"=c:\program files\dvd43\dvd43_tray.exe
"CanonMyPrinter"=c:\program files\Canon\MyPrinter\BJMyPrt.exe /logon
"Logitech Hardware Abstraction Layer"="c:\program files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Gigabyte\\EasySaver\\UpdExe.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\MultiProxy\\MProxy.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Regensoft\\Downloader App\\DownloaderApp.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\User\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:appletv
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [11/07/2011 12:14 AM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [11/07/2011 12:13 AM 32592]
R0 Siwvid;Siwvid;c:\windows\system32\drivers\siwvid.sys [7/11/2001 1:09 AM 119658]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11/07/2011 12:13 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11/07/2011 12:14 AM 295248]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [5/01/2010 7:56 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/01/2010 7:56 AM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [3/07/2010 5:44 PM 116608]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/08/2004 10:00 PM 14336]
R2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [23/11/2011 1:36 AM 2391832]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [12/10/2011 5:25 AM 4433248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2/08/2011 5:09 AM 192776]
R2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [1/04/2010 12:12 PM 219360]
R2 DbgMsg;Debug Message;c:\windows\system32\drivers\DbgMsg.sys [7/11/2001 4:40 AM 18240]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [1/04/2010 12:12 PM 68136]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [4/05/2010 11:07 AM 503080]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [27/10/2010 6:23 PM 1483072]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [10/07/2012 1:21 PM 935008]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [23/05/2011 12:03 AM 30944]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [11/07/2011 12:14 AM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [11/07/2011 12:14 AM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [11/07/2011 12:14 AM 16720]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [1/04/2010 12:17 PM 116224]
R3 RRNetCapMP;RRNetCapMP;c:\windows\system32\drivers\rrnetcap.sys [16/11/2010 10:26 AM 31848]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [7/10/2010 1:34 PM 10064]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22/06/2010 6:31 PM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2/04/2012 9:00 AM 250056]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/04/2010 12:15 PM 1691480]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [23/05/2011 12:03 AM 30944]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [2/06/2011 11:08 AM 11336]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [28/04/2012 6:32 PM 23456]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [22/06/2010 6:31 PM 136176]
S3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\drivers\ivusb.sys [10/03/2010 7:18 AM 24216]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/05/2012 8:25 AM 113120]
S3 NTice;NTice;c:\windows\system32\drivers\ntice.sys [7/11/2001 1:09 AM 1347462]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [2/04/2010 12:18 PM 47360]
S3 RRNetCap;RRNetCap Service;c:\windows\system32\drivers\rrnetcap.sys [16/11/2010 10:26 AM 31848]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [26/12/2007 1:47 AM 272128]
S3 SiwvidStart;SiwvidStart;\??\c:\program files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys –> c:\program files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys [?]
S4 Siwsym;Siwsym;c:\windows\system32\drivers\siwsym.sys [7/11/2001 1:09 AM 22900]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-09-19 10:46 451872 -c–a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 09:02 114688 —-a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 02:50]
.
2012-07-25 c:\windows\Tasks\AdvancedDriverUpdater_UPDATES.job
- c:\program files\Advanced Driver Updater\adu.exe [2012-05-07 02:14]
.
2012-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]
.
2012-03-02 c:\windows\Tasks\defrag.job
- c:\windows\system32\defrag.exe [2004-08-04 00:12]
.
2012-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 08:31]
.
2012-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-22 08:31]
.
2012-07-27 c:\windows\Tasks\SpeedyPC Pro.job
- c:\program files\SpeedyPC Software\SpeedyPC\SpeedyPC.exe [2011-10-09 01:19]
.
2012-07-29 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2010-04-14 05:31]
.
2012-07-29 c:\windows\Tasks\User_Feed_Synchronization-{C8C75372-1D1B-46C1-9F1F-54092919BFB9}.job
- c:\windows\system32\msfeedssync.exe [2009-03-07 17:31]
.
.
——- Supplementary Scan ——-
.
uStart Page =
uInternet Settings,ProxyServer = http=;ftp=;https=;
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\documents and settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 10.0.0.138
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vppgx98u.default-1343368773312\
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
AddRemove-Savings Sidekick - c:\program files\Savings Sidekick\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-30 18:08
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_4f7fccd.dll"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1409082233-117609710-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{08211550-CA01-C31F-B8B2-33F80314E406}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"pamekcoejigfjhjbncmepabligdoilec"=hex:6b,61,64,67,6a,67,6a,68,68,64,70,6c,66,
6b,6f,61,6b,6f,63,6b,66,6e,00,00
"oaoeakfoakogokknhkkekpimblenie"=hex:6a,61,6a,67,67,67,6c,70,70,69,65,67,61,67,
6a,62,6b,6d,63,6c,00,f4
.
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
"value"="?\09\05\09\0c\15\0b?"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1144)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2012-07-30 18:09:51
ComboFix-quarantined-files.txt 2012-07-30 08:09
ComboFix2.txt 2012-07-30 07:45
ComboFix3.txt 2012-07-30 02:25
ComboFix4.txt 2011-09-06 02:59
ComboFix5.txt 2012-07-30 07:57
.
Pre-Run: 40,696,090,624 bytes free
Post-Run: 40,665,178,112 bytes free
.
- - End Of File - - 14E5B61DBA1A98C0FCA641B9494E183B
_______________________________________________________

Results of screen317's Security Check version 0.99.43
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
AVG Internet Security 2012
Microsoft Security Essentials
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
SUPERAntiSpyware Professional
TuneUp Utilities 2011
TuneUp Utilities Language Pack (en-US)
TuneUp Utilities 2011
CCleaner
JavaFX 2.1.1
Java™ 6 Update 33
Java™ 7 Update 5
Adobe Flash Player 11.3.300.268
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (14.0.1)
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 8%
````````````````````End of Log``````````````````````
____________________________________________________________

Malwarebytes Anti-Malware (PRO) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.30.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
User :: USER-84F12D431F [administrator]

Protection: Disabled

30/07/2012 6:26:04 PM
mbam-log-2012-07-30 (18-26-04).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 193662
Time elapsed: 3 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

____________________________________________________________

Regarding outstanding problems:-

I have not tried to do do too much in case I messed with your findings.
The only thing i have noticed is that IE usurps Firefox & I need to reset it.

Best Regards

Thanks Brigow

PS I guess we must be in the same time zone?

Satchfan

Post #10July 30, 2012, 12:50 PM UTC last edited July 30, 2012, 12:53 PM UTC

Hi Brigow

I guess we must be in the same time zone?

We’re on the opposite sides of the world – I’m in the UK.

Uninstall the following programs:

Microsoft Security Essentials
Java™ 6 Update 33

To remove them:

click on Start, Settings, Control Panel
double-click Add or Remove Programs (it may take time for the list to appear, so be patient)
scroll down the list and look for the above entries:
if they are present, click on the program name and then on Remove.

===================================================

Update Adobe Reader

Uninstall Adobe Reader 9 using Add or Remove Programs as instructed previously.

Install the latest versions using the link below:

Adobe Reader

===================================================

When you have completed these steps, please run Security Check again.

You can also go ahead and reset your Internet settings and let me know what happens.

Thanks

Satchfan

Brigow

Post #11July 31, 2012, 7:01 AM UTC

Hi again.
1. Cannot find Microsoft Security Essentials in "Add/Remove Programs", BUT I ran a search found an entry "Microsoft Security Client". I have not touched it
2. Deleted Java™ 6 Update 33….Also……………..Add/Remove displays Java ™ 7 Update 5, as well as JavaFX 2.1.1 Should these be left untouched.
3 Updated to Adobe Reader 9
4. Here is the security check log & I notice that Microsoft Security Essentials is still found??
________________________________________________________________________________
__________________

Results of screen317's Security Check version 0.99.43
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
AVG Internet Security 2012
Microsoft Security Essentials
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
SUPERAntiSpyware Professional
Malwarebytes Anti-Malware version 1.62.0.1300
TuneUp Utilities 2011
TuneUp Utilities Language Pack (en-US)
TuneUp Utilities 2011
CCleaner
JavaFX 2.1.1
Java™ 7 Update 5
Adobe Flash Player 11.3.300.268
Adobe Reader X (10.1.3)
Mozilla Firefox (14.0.1)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 9%
````````````````````End of Log``````````````````````

________________________________________________________________________________
____________________________________

Computer seems to be responding faster but when i click new tab I get a page laid out with boxes of previously visited pages.(Nine to a page)

Also my D drive and external hard drive are loaded with folders. The folders have about 30 alphanumerics for names. About 40m folders contain
searchplugin\bProtect & 7 folders contain another 25 folders with 4 digit numbers 1025-3082 (typically) Each of theses folders contain hotfixuninstallerUI.dll.

I cannot delete any of these files…..are they necessary?

The internet seems OK.

Regards Brigow

Satchfan

Post #12July 31, 2012, 7:22 AM UTC

my D drive and external hard drive are loaded with folders. The folders have about 30 alphanumerics for names. About 40m folders contain
searchplugin\bProtect & 7 folders contain another 25 folders with 4 digit numbers 1025-3082 (typically) Each of theses folders contain hotfixuninstallerUI.dll.

those are Microsoft .Net Framework files. I don't know a lot about this but I would say that something installed on that drive is reliant on the presence of .Bet Framework.

Please uninstall Microsoft Security Client through Add/remove programs then run SecurityCheck again.

Brigow

Post #13August 1, 2012, 12:21 AM UTC

Hi Satchfan,
Sorry I didn't contact you last night but I could not connect. Message said your database was down or overloaded (or something like that).

Anyway, I could not find Microsoft Security Client in Add/Remove so I deleted it from c:\programs.

re-ran Security Check bur Microsoft Security Essentials still appears

Here is the log:-

Results of screen317's Security Check version 0.99.43
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
AVG Internet Security 2012
Microsoft Security Essentials
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
SUPERAntiSpyware Professional
Malwarebytes Anti-Malware version 1.62.0.1300
TuneUp Utilities 2011
TuneUp Utilities Language Pack (en-US)
TuneUp Utilities 2011
CCleaner
JavaFX 2.1.1
Java™ 7 Update 5
Adobe Flash Player 11.3.300.268
Adobe Reader X (10.1.3)
Mozilla Firefox (14.0.1)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 10%
````````````````````End of Log``````````````````````
________________________________________________________________________________
______________

Outlook Express seems slow to open but cannot identify any other problem except the previously reported "new tab" with Firefox.
I tried uninstalling & re-installing but problem still exists.

Any other suggestions.

Regards
Brigow

Satchfan

Post #14August 1, 2012, 8:44 AM UTC

The firefox issue might be one for our Browsers, Internet and email forum if we can't solve it.

Run MiniToolBox

Note: Please make sure Firefox is closed before you run this.

Please download MiniToolBox, save it to your desktop and run it.

Place a checkmark in the following checkboxes:

Flush DNS
Report IE Proxy Settings
Reset IE Proxy Settings
Report FF Proxy Settings
Reset FF Proxy Settings
List Installed Programs
List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

========================================

Please re-run OTL and send a new log.

Thanks

Brigow

Post #15August 1, 2012, 11:48 AM UTC

OK Here are the two Logs:-

MiniToolBox by Farbar Version: 23-07-2012
Ran by [removed] (administrator) on 01-08-2012 at 21:31:35
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

=========================== Installed Programs ============================

µTorrent (Version: 3.1.3)
Acoustica MP3 To Wave Converter PLUS (Version: 2.5 b22)
Active Boot Disk (Version: 5.0.5)
Adobe AIR (Version: 1.0.4990)
Adobe AIR (Version: 1.0.8.4990)
Adobe Flash Player 11 ActiveX (Version: 11.3.300.268)
Adobe Flash Player 11 Plugin (Version: 11.3.300.268)
Adobe Reader X (10.1.3) (Version: 10.1.3)
Aiseesoft Total Video Converter
Akamai NetSession Interface Service
Allok Video Joiner 3.3.1116
Apple Application Support (Version: 2.1.9)
Apple Mobile Device Support (Version: 5.2.0.6)
Apple Software Update (Version: 2.1.3.127)
Audials (Version: 8.0.54100.0)
Audials TV (Version: 1.3.10803.300)
Auto Gordian Knot 2.55 (Version: 2.55)
Auto Hide IP (Version: 5.2.3.2)
AVG 2012 (Version: 12.0.1796)
AVG 2012 (Version: 12.0.1913)
AVG 2012 (Version: 12.0.2437)
AVG 2012 (Version: 2012.0.1913)
AviSynth 2.5
AVS Audio Converter 7
AVS Audio Editor version 4.2
AVS Screen Capture version 1.1.2
AVS Update Manager 1.0
AVS Video Converter 8
AVS Video Editor 5
AVS Video Recorder 2.4
AVS4YOU Software Navigator 1.4
Bigasoft MKV Converter 3.3.14.4128
Boilsoft Video Joiner 5.32
Bonjour (Version: 3.0.0.10)
Bridge Baron 19 eSellerate Download Version (Version: 19.00.02)
Browser Configuration Utility (Version: 1.1.11.0)
Business Contact Manager for Outlook 2007 SP2 (Version: 3.0.8619.1)
Canon iP4500 series
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
CCleaner (Version: 3.19)
CD-LabelPrint
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Convert AVI to MP4
ConvertXtoDVD 4.0.9.322 (Version: 4.0.9.322)
Data Lifeguard Diagnostic for Windows 1.24
dirLock (Version: 1.4.1)
Driver Checker v2.7.4 (Version: 2.7.4)
DriverAgent by eSupport.com
DriverIdentifier 3.9
Dropbox (Version: 1.4.7)
DVD Shrink Pro
DVD43 v4.6.0
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0
DVDFab 8.1.3.8 (09/12/2011) Qt
EASEUS Data Recovery Wizard Professional 4.3.6 (Version: 4.3.6)
EasySaver B9.0610.1 (Version: 1.00.0000)
EPUB to MOBI
File Renamer (Version: 1.Build 9)
Free Studio version 5.2.1
Free Video Dub version 1.8.12.804
Free Video Joiner 1.1
Free YouTube Download version 3.0.18.1123
Garmin Lifetime Updater (Version: 2.1.7)
GEAR driver installer 4.019 (Version: 4.019.1)
GetBot
GiPo@MoveOnBoot 1.9.5 (Version: 1.9.5)
Google Earth (Version: 6.1.0.5001)
Google Update Helper (Version: 1.3.21.115)
High-Definition Video Playback (Version: 7.1.13400.42.0)
HiJackThis (Version: 1.0.0)
Intel® Graphics Media Accelerator Driver (Version: 6.14.10.5402)
IrfanView (remove only) (Version: 4.28)
iTunes (Version: 10.6.3.25)
Java Auto Updater (Version: 2.1.6.0)
Java™ 7 Update 5 (Version: 7.0.50)
JavaFX 2.1.1 (Version: 2.1.1)
JDownloader 0.9 (Version: 0.9)
Jigsaw Puzzle Golden Edition
jv16 PowerTools 2011 (Version: )
K-Lite Codec Pack 8.9.5 (Full) (Version: 8.9.5)
Karaoke for DirectX (remove only)
Kernel for Windows Data Recovery ver 11.01.01
KhalSetup (Version: 1.00.0000)
Legacy 7.5 (Version: 7.5 )
LightScribe System Software 1.10.16.1 (Version: 1.10.16.1)
Logitech SetPoint (Version: 3.1)
Magic FLAC to MP3 Converter 3.71
Magic ISO Maker v5.5 (build 0281)
Magical Jelly Bean KeyFinder (Version: 2.0.8.2)
MagicDisc 2.7.106
Malwarebytes Anti-Malware version 1.62.0.1300 (Version: 1.62.0.1300)
Menu Template Package 1 Ver 1.10 (Version: 1.10)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30730)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30730)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30730)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2007 Primary Interop Assemblies (Version: 12.0.4518.1014)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Professional 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Small Business Connectivity Components (Version: 2.0.7024.0)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Software Update for Web Folders (English) 12 (Version: 12.0.6612.1000)
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (Version: 9.4.5000.00)
Microsoft SQL Server Native Client (Version: 9.00.5000.00)
Microsoft SQL Server Setup Support Files (English) (Version: 9.00.5000.00)
Microsoft SQL Server VSS Writer (Version: 9.00.5000.00)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ Run Time Lib Setup (Version: 1.0.0)
Microsoft Windows Media Video 9 VCM
MobileMe Control Panel (Version: 3.1.8.0)
Momento 5.5.5
Mozilla Firefox 14.0.1 (x86 en-US) (Version: 14.0.1)
Mozilla Maintenance Service (Version: 14.0.1)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 6.0 Parser (Version: 6.10.1129.0)
muvee autoProducer 3.1 - CE (Version: 3.10.050)
MyHeritage Family Tree Builder (Version: 6.0.0.5634)
Nero 10 Menu TemplatePack Basic (Version: 10.2.10000.0.0)
Nero 10 Movie ThemePack Basic (Version: 10.2.10000.0.0)
Nero 8 Essentials (Version: 8.10.366)
Nero Control Center 10 (Version: 10.2.10600.0.6)
Nero ControlCenter 10 Help (CHM) (Version: 10.5.10000)
Nero Core Components 10 (Version: 2.0.17400.8.2)
Nero Dolby Files 10 (Version: 2.0.12100.0.10)
Nero MediaHub 10 Help (CHM) (Version: 10.5.10000)
Nero Update (Version: 1.0.0018)
Nero Vision 10 Help (CHM) (Version: 10.5.10000)
Nero Vision Xtra (Version: 10.5.11300)
neroxml (Version: 1.0.0)
NetAssistant (Version: 3.6.5)
NetAssistant for Firefox (Version: 3.6.5)
Network Stumbler 0.4.0 (remove only)
NTFS Undelete 3.0.2.830
NuMega SoftICE Driver Suite 2.6 (Version: 2.6)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
ophcrack 3.4.0 (Version: 3.4.0)
Orbit Downloader
Oxelon Media Converter 1.1
PeerBlock 1.1 (r518) (Version: 1.1.0.518)
Photo DVD Maker Professional 8.05 (Version: 8.05)
PixiePack Codec Pack (Version: 1.1.1200.0)
PL-2303 USB-to-Serial (Version: 1.00.000)
PowerDVD
Real Alternative 2.0.2 (Version: 2.0.2)
REALTEK GbE & FE Ethernet PCI-E NIC Driver (Version: 1.30.0000)
REALTEK GbE & FE Ethernet PCI NIC Driver (Version: 1.23.0000)
Realtek High Definition Audio Driver (Version: 5.10.0.6146)
Safari (Version: 5.34.57.2)
Samsung Auto Backup (Version: 4.1.371.0)
Security Task Manager 1.7f (Version: 1.7f)
Sothink FLV Player (Version: 2.3)
Sothink Video Converter (Version: 3.4)
Sothink Web Video Downloader (Version: 1.2)
Spell Checker For OE 2.1
Spybot - Search & Destroy (Version: 1.6.2)
SUPERAntiSpyware Professional (Version: 4.33.0.1000)
sureanalysis version 3.14 (Version: 3.14.5)
System Requirements Lab for Intel (Version: 4.5.5.0)
Tune Up Utilities 2011 (Version: 2011)
Tunebite (Version: 7.2.13700.0)
TuneUp Utilities 2011 (Version: 10.0.2011.65)
TuneUp Utilities Language Pack (en-US) (Version: 10.0.2011.65)
Ulead Straight-to-Disc SDK (Version: 2.2)
Unlocker 1.9.1 (Version: 1.9.1)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687310) 32-Bit Edition
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
uTorrentBar Toolbar (Version: 6.2.6.0)
VCRedistSetup (Version: 1.0.0)
Video Cutter 1.0
Videora iPod Converter 6 (Version: 6)
VLC media player 1.1.11 (Version: 1.1.11)
VobSub v2.23 (Remove Only)
WebFldrs XP (Version: 9.50.7523)
What's Running 2.2 (Version: 2.2)
WinAVI Video Converter
Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series (Version: 9.00.2980)
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR archiver
WinX DVD Ripper Platinum 5.11.1
WinX Free DVD Ripper 4.5.14
WiseFixer 3.2 (Version: 3.2)
XviD MPEG4 Video Codec (remove only)
Xvid Video Codec (Version: 1.3.2)
YouTube Converter Pro
YouTube Downloader 3.5
YouTube Downloader App 3.00 (Version: 3.00)
YouTube Downloader Toolbar v5.1 (Version: 5.1)
========================= Minidump Files ==================================

No minidump file found

**** End of log ****
____________________________________________________________________________

OTL logfile created on: 1/08/2012 9:35:07 PM - Run 5
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Documents and Settings\User\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.97 Gb Total Physical Memory | 0.53 Gb Available Physical Memory | 27.14% Memory free
3.81 Gb Paging File | 2.61 Gb Available in Paging File | 68.53% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.57 Gb Total Space | 41.55 Gb Free Space | 59.73% Space Free | Partition Type: NTFS
Drive D: | 396.19 Gb Total Space | 283.99 Gb Free Space | 71.68% Space Free | Partition Type: NTFS
Drive F: | 1006.73 Mb Total Space | 937.81 Mb Free Space | 93.15% Space Free | Partition Type: FAT
Drive G: | 1863.01 Gb Total Space | 1225.43 Gb Free Space | 65.78% Space Free | Partition Type: NTFS

Computer Name: USER-84F12D431F | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
PRC - [2012/07/28 17:36:35 | 000,161,776 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/07/25 10:16:28 | 004,777,856 | —- | M] (SUPERAntiSpyware.com) – C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2012/07/14 10:17:11 | 000,913,888 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/07/03 13:46:42 | 000,973,488 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2012/05/25 04:39:22 | 027,112,840 | —- | M] (Dropbox, Inc.) – C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2012/01/24 16:24:26 | 002,416,480 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2011/11/28 00:19:04 | 001,229,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgfws.exe
PRC - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/09/08 19:53:26 | 000,743,264 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/08/15 05:21:40 | 000,337,760 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2010/10/27 18:24:42 | 000,645,952 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) – C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/01/04 20:25:02 | 000,094,208 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
PRC - [2010/01/04 20:24:24 | 000,077,824 | —- | M] (Clarus, Inc.) – C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
PRC - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
PRC - [2009/08/04 17:29:52 | 000,346,320 | —- | M] (DeviceVM, Inc.) – C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
PRC - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
PRC - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2008/04/14 10:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe

========== Modules (No Company Name) ==========

MOD - [2012/08/01 21:12:26 | 000,065,024 | —- | M] () – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2012/08/01 21:12:26 | 000,052,736 | —- | M] () – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2012/07/27 12:50:16 | 009,465,032 | —- | M] () – C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll
MOD - [2012/07/14 10:17:14 | 002,003,424 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/07/10 13:21:10 | 000,132,704 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll
MOD - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
MOD - [2012/07/10 13:21:03 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012/02/20 21:29:04 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 21:28:42 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/08/12 12:37:00 | 000,117,760 | —- | M] () – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2011/08/12 12:37:00 | 000,052,224 | —- | M] () – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2010/07/05 07:32:38 | 000,010,752 | —- | M] () – C:\Program Files\Unlocker\UnlockerCOM.dll
MOD - [2009/08/16 17:06:02 | 000,141,312 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2009/07/30 18:15:32 | 000,503,202 | —- | M] () – C:\Program Files\DeviceVM\Browser Configuration Utility\sqlite3.dll
MOD - [2009/03/13 11:30:44 | 000,109,096 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\ycc.dll
MOD - [2009/03/11 12:41:42 | 000,049,152 | —- | M] () – C:\Program Files\OxelonMedia\menuext.dll
MOD - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () – C:\Program Files\Gigabyte\EasySaver\essvr.exe
MOD - [2007/05/22 14:53:10 | 000,006,656 | —- | M] () – C:\Program Files\WinAVI Video Converter\SimpleExt.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – C:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - [2012/07/28 17:36:35 | 000,161,776 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2012/07/27 12:50:19 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/14 10:17:12 | 000,113,120 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/07/11 10:45:52 | 004,419,392 | —- | M] () [Auto | Running] – c:\program files\common files\akamai/netsession_win_4f7fccd.dll – (Akamai)
SRV - [2012/07/10 13:21:08 | 000,935,008 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe – (vToolbarUpdater11.2.0)
SRV - [2012/07/03 13:46:44 | 000,655,944 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2011/11/23 01:36:24 | 002,391,832 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgfws.exe – (avgfws)
SRV - [2011/10/12 05:25:22 | 004,433,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2011/08/18 09:09:39 | 000,116,608 | —- | M] (SUPERAntiSpyware.com) [Auto | Running] – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE – (!SASCORE)
SRV - [2011/08/02 05:09:08 | 000,192,776 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2010/10/27 18:23:16 | 001,483,072 | —- | M] (TuneUp Software) [Auto | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe – (TuneUp.UtilitiesSvc)
SRV - [2010/05/04 11:07:22 | 000,503,080 | —- | M] (Nero AG) [Auto | Running] – C:\Program Files\Nero\Update\NASvc.exe – (NAUpdate)
SRV - [2009/08/04 17:29:54 | 000,219,360 | —- | M] (DeviceVM, Inc.) [Auto | Running] – C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe – (BCUService)
SRV - [2009/03/02 14:06:16 | 000,068,136 | —- | M] () [Auto | Running] – C:\Program Files\Gigabyte\EasySaver\essvr.exe – (ES lite Service)
SRV - [2009/02/20 09:46:52 | 000,030,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe – (BcmSqlStartupSvc)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\Drivers\SYMEVENT.SYS – (SymEvent)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\NuMega\SoftICE Driver Suite\Common\Binsiwvid.sys – (SiwvidStart)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | Disabled | Stop_Pending] – C:\WINDOWS\system32\drivers\mbamswissarmy.sys – (MBAMSwissArmy)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\ComboFix\catchme.sys – (catchme)
DRV - [2012/08/01 21:04:57 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\gdrv.sys – (gdrv)
DRV - [2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\system32\drivers\mbam.sys – (MBAMProtector)
DRV - [2012/04/28 18:32:29 | 000,023,456 | —- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\DrvAgent32.sys – (DrvAgent32)
DRV - [2011/10/07 05:23:48 | 000,230,608 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2011/10/04 05:21:42 | 000,016,720 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2011/09/13 05:30:10 | 000,032,592 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2011/08/08 21:15:34 | 000,067,664 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2011/08/08 21:15:33 | 000,012,880 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS – (SASDIFSV)
DRV - [2011/08/08 05:08:58 | 000,040,016 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/07/13 17:09:26 | 000,037,920 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2011/07/11 00:14:38 | 000,295,248 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2011/07/11 00:14:28 | 000,024,272 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2011/07/11 00:14:28 | 000,023,120 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\AVGIDSEH.sys – (AVGIDSEH)
DRV - [2011/07/11 00:14:26 | 000,134,608 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2011/06/02 11:08:34 | 000,011,336 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Program Files\SystemRequirementsLab\cpudrv.sys – (cpudrv)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwfd)
DRV - [2011/05/23 00:03:20 | 000,030,944 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\avgfwdx.sys – (Avgfwdx)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCapMP)
DRV - [2010/11/16 10:26:18 | 000,031,848 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rrnetcap.sys – (RRNetCap)
DRV - [2010/10/07 13:34:32 | 000,010,064 | —- | M] (TuneUp Software) [Kernel | On_Demand | Running] – C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys – (TuneUpUtilitiesDrv)
DRV - [2010/07/20 23:56:52 | 001,691,480 | —- | M] (Creative) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Ambfilt.sys – (Ambfilt)
DRV - [2010/07/20 23:45:12 | 001,395,800 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Monfilt.sys – (Monfilt)
DRV - [2010/07/20 23:37:38 | 006,086,760 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService)
DRV - [2010/03/17 16:42:46 | 000,016,512 | —- | M] (Adaptec) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\ASPI32.SYS – (Aspi32)
DRV - [2010/03/10 07:18:20 | 000,024,216 | —- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ivusb.sys – (ivusb)
DRV - [2009/04/08 02:32:48 | 000,116,224 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\IntcHdmi.sys – (IntcHdmiAddService)
DRV - [2009/03/25 16:29:52 | 000,130,432 | R— | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2007/12/26 01:47:30 | 000,272,128 | —- | M] (NETGEAR Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wg111v2.sys – (RTLWUSB)
DRV - [2006/12/14 09:41:48 | 000,011,984 | —- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ElbyDelay.sys – (ElbyDelay)
DRV - [2006/07/19 11:29:08 | 000,027,136 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidKE.Sys – (LHidKe)
DRV - [2006/07/19 11:28:56 | 000,071,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouKE.Sys – (LMouKE)
DRV - [2006/07/19 11:28:04 | 000,036,736 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidUsbK.sys – (LHidUsbK)
DRV - [2006/07/19 11:27:46 | 000,055,936 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042MOU.SYS – (L8042mou)
DRV - [2006/07/19 11:27:26 | 000,013,568 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042Kbd.SYS – (L8042Kbd)
DRV - [2005/04/07 09:46:50 | 000,034,240 | R— | M] (ADS) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\adsexpb.sys – (ADSEXPB)
DRV - [2001/11/07 04:40:00 | 000,018,240 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\DbgMsg.sys – (DbgMsg)
DRV - [2001/11/07 01:09:10 | 001,347,462 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\ntice.sys – (NTice)
DRV - [2001/11/07 01:09:10 | 000,119,658 | —- | M] (Compuware Corporation - NuMega Lab) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\siwvid.sys – (Siwvid)
DRV - [2001/11/07 01:09:10 | 000,022,900 | —- | M] () [Kernel | Disabled | Stopped] – C:\WINDOWS\System32\drivers\siwsym.sys – (Siwsym)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}…0006cf0492d34df
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={ADE1B36…mp;d=2012-02-16 10:43:32&v;=10.0.0.7&sap;=dsp&q;={searchTerms}

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\WINDOWS\system32\npdeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/02/17 07:12:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/01 10:04:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/31 08:36:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1266764D-FC4F-4FA7-B63B-884D53B1680F}: C:\Documents and Settings\User\Application Data\NetAssistant\ [2011/04/21 09:37:29 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{b64982b1-d112-42b5-b1e4-d3867c4533f8}: C:\Documents and Settings\All Users\Application Data\bProtectorForWindows\2.1.419.7\FirefoxExtension

[2010/04/01 16:33:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2012/07/27 15:02:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions
[2012/07/12 14:52:59 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/07/23 18:26:01 | 000,000,000 | —D | M] (Flash and Video Download) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2012/06/27 18:13:17 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2012/05/12 09:52:17 | 000,000,000 | —D | M] (Разпознаване на устройство Logitech) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/06/28 16:33:44 | 000,000,000 | —D | M] (DoNotTrackPlus) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/09 16:20:27 | 000,000,000 | —D | M] (VideoFileDownload - Download YouTube Videos) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2011/08/06 13:58:30 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\[removed]
[2012/07/27 15:02:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\khw12ymo.default\extensions\staged
[2012/08/01 13:26:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\vppgx98u.default-1343368773312\extensions
[2012/08/01 10:04:02 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/07/14 10:17:47 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/08/03 15:07:42 | 000,373,104 | —- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll
[2012/07/10 13:20:58 | 000,003,767 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/14 10:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/14 10:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2010/12/09 07:21:24 | 000,002,224 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\webblog.xml

O1 HOSTS File: ([2012/07/30 18:08:07 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BCU] C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [KHALMNPR.EXE] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [Xvid] C:\Program Files\Xvid\CheckUpdate.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk = C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe (Clarus, Inc.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSecurityTab = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download; by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab; video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload; selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load; all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Documents and Settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_05)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8EA6C079-3333-4797-9BAC-AF0FD534706A}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C85F8EC6-C08E-404C-9D39-C29A7821E0FD}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/01 11:50:36 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2020/12/01 12:20:44 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\iolo
[2012/08/01 21:14:52 | 000,751,391 | —- | C] (Farbar) – C:\Documents and Settings\User\Desktop\MiniToolBox.exe
[2012/08/01 15:59:01 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2012/08/01 13:57:05 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\Spybot Report
[2012/08/01 10:30:02 | 000,000,000 | —D | C] – C:\Program Files\ACW
[2012/08/01 10:29:39 | 000,139,112 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\User\Desktop\322756.exe
[2012/08/01 10:04:06 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/08/01 08:33:14 | 016,814,136 | —- | C] (Mozilla) – C:\Documents and Settings\User\Desktop\Firefox Setup 14.0.1.exe
[2012/07/31 08:36:25 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2012/07/31 08:36:25 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2012/07/30 18:28:17 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/07/30 18:16:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/30 18:16:19 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/07/30 18:16:19 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/07/30 18:09:53 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2012/07/30 12:14:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/07/30 12:14:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/07/30 12:14:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/07/30 12:14:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/07/30 12:14:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Favorites
[2012/07/30 11:53:42 | 004,722,436 | R— | C] (Swearware) – C:\Documents and Settings\User\Desktop\ComboFix.exe
[2012/07/30 09:19:23 | 000,000,000 | —D | C] – C:\_OTL
[2012/07/29 09:05:02 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\User\Desktop\aswMBR.exe
[2012/07/29 08:41:04 | 000,597,504 | —- | C] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 17:38:10 | 000,000,000 | —D | C] – C:\Program Files\Oracle
[2012/07/28 17:37:45 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Oracle
[2012/07/28 17:37:36 | 000,227,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:52 | 000,174,064 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:10:23 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.techniclauncher
[2012/07/28 16:29:44 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums_files
[2012/07/28 11:30:41 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\RK_Quarantine
[2012/07/27 17:16:37 | 000,000,000 | —D | C] – C:\Program Files\SpeedyPC Software
[2012/07/27 17:06:16 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\SpeedyPC Software
[2012/07/27 17:06:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SpeedyPC Software
[2012/07/27 08:04:52 | 000,000,000 | —D | C] – C:\Program Files\MALWAREBYTES ANTI-MALWARE
[2012/07/26 11:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Curiolab
[2012/07/26 10:37:46 | 000,000,000 | —D | C] – C:\Program Files\Adjugglercookie Removal Tool (1)
[2012/07/25 20:33:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2012/07/25 20:29:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Ad-Aware Antivirus
[2012/07/25 19:58:06 | 000,000,000 | —D | C] – C:\Program Files\Adjugglercookie Removal Tool
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Samsung
[2012/07/25 18:26:00 | 000,000,000 | —D | C] – C:\Program Files\Clarus
[2012/07/17 08:32:09 | 000,772,544 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/17 08:32:09 | 000,143,872 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/17 08:30:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2012/07/15 16:22:24 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Start Menu\Programs\HiJackThis
[2012/07/15 16:22:23 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/07/11 12:57:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\K-Lite Codec Pack
[2012/07/10 17:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IBUpdaterService
[2012/07/10 17:25:00 | 000,000,000 | —D | C] – C:\WINDOWS\System32\searchplugins
[2012/07/10 17:23:12 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Savings Sidekick
[2012/07/10 17:22:41 | 000,000,000 | —D | C] – C:\Program Files\Uninstall Information
[2012/07/09 16:20:25 | 000,000,000 | —D | C] – C:\Program Files\TorrentSearch
[2012/07/09 16:20:04 | 000,000,000 | —D | C] – C:\Program Files\intellidownload
[2012/07/04 08:15:43 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\.minecraft
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/08/01 21:31:01 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/01 21:14:54 | 000,751,391 | —- | M] (Farbar) – C:\Documents and Settings\User\Desktop\MiniToolBox.exe
[2012/08/01 21:06:23 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/08/01 21:04:58 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/01 21:04:57 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) – C:\WINDOWS\gdrv.sys
[2012/08/01 21:04:49 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/08/01 20:50:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/01 17:43:00 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task 095a1f21-5d51-4f54-a43f-d360e4c3272e.job
[2012/08/01 14:56:45 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task b5db9f87-9988-4bbf-aa8f-9751deca6fe3.job
[2012/08/01 10:52:22 | 000,001,826 | —- | M] () – C:\FixitRegBackup.reg
[2012/08/01 10:29:39 | 000,139,112 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\User\Desktop\322756.exe
[2012/08/01 10:25:41 | 000,899,584 | —- | M] () – C:\Documents and Settings\User\Desktop\MicrosoftFixit50535.msi
[2012/08/01 10:04:10 | 000,000,742 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/08/01 10:04:10 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/01 08:35:21 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{C8C75372-1D1B-46C1-9F1F-54092919BFB9}.job
[2012/08/01 08:33:19 | 016,814,136 | —- | M] (Mozilla) – C:\Documents and Settings\User\Desktop\Firefox Setup 14.0.1.exe
[2012/08/01 07:43:58 | 102,660,437 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/07/31 08:36:53 | 000,001,734 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/07/30 18:16:20 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/30 18:11:45 | 000,881,494 | —- | M] () – C:\Documents and Settings\User\Desktop\SecurityCheck.exe
[2012/07/30 18:08:07 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/07/30 17:34:49 | 004,722,436 | R— | M] (Swearware) – C:\Documents and Settings\User\Desktop\ComboFix.exe
[2012/07/30 16:42:36 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2012/07/30 12:01:36 | 000,001,397 | —- | M] () – C:\Documents and Settings\User\Desktop\clipbrd.lnk
[2012/07/30 09:05:02 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif
[2012/07/30 07:54:09 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/07/29 14:15:30 | 000,451,737 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012/07/29 10:33:13 | 000,000,512 | —- | M] () – C:\Documents and Settings\User\Desktop\MBR.dat
[2012/07/29 09:05:47 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\User\Desktop\aswMBR.exe
[2012/07/29 08:41:10 | 000,597,504 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2012/07/28 18:23:17 | 000,000,578 | —- | M] () – C:\WINDOWS\MyHeritage.INI
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/07/28 17:36:34 | 000,174,064 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/07/28 17:05:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/07/28 16:29:45 | 000,254,426 | —- | M] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:28 | 001,552,384 | —- | M] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/28 08:38:09 | 000,000,394 | —- | M] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/27 12:50:17 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/07/27 12:50:17 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/07/26 17:03:28 | 000,001,881 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/26 17:03:27 | 000,000,963 | —- | M] () – C:\Documents and Settings\User\Desktop\Spybot - Search & Destroy.lnk
[2012/07/26 10:44:01 | 000,002,451 | —- | M] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/26 10:38:34 | 000,000,721 | —- | M] () – C:\user.js
[2012/07/25 18:26:00 | 000,001,469 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/20 15:12:46 | 000,846,855 | —- | M] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/20 10:45:45 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120726-165429.backup
[2012/07/16 16:57:06 | 004,661,166 | —- | M] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 17:26:23 | 000,442,725 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120720-104545.backup
[2012/07/15 12:23:49 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | M] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 14:14:10 | 000,001,373 | —- | M] () – C:\WINDOWS\wininit.ini
[2012/07/14 13:18:39 | 000,442,053 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20120715-172623.backup
[2012/07/13 17:23:02 | 000,001,151 | —- | M] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/12 10:53:44 | 000,304,416 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/07/06 08:46:34 | 000,172,098 | —- | M] () – C:\torrent.exe
[2012/07/05 22:07:08 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/07/05 22:06:48 | 000,227,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/07/05 22:06:30 | 000,772,544 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2012/07/05 22:06:20 | 000,687,544 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/08/01 14:56:47 | 000,000,508 | —- | C] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task 095a1f21-5d51-4f54-a43f-d360e4c3272e.job
[2012/08/01 14:56:45 | 000,000,508 | —- | C] () – C:\WINDOWS\tasks\SUPERAntiSpyware Scheduled Task b5db9f87-9988-4bbf-aa8f-9751deca6fe3.job
[2012/08/01 10:25:58 | 000,001,826 | —- | C] () – C:\FixitRegBackup.reg
[2012/08/01 10:25:39 | 000,899,584 | —- | C] () – C:\Documents and Settings\User\Desktop\MicrosoftFixit50535.msi
[2012/08/01 10:04:10 | 000,000,742 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/08/01 10:04:10 | 000,000,724 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/01 10:04:09 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/07/31 08:36:53 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/07/31 08:36:52 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2012/07/30 18:16:20 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/30 18:11:43 | 000,881,494 | —- | C] () – C:\Documents and Settings\User\Desktop\SecurityCheck.exe
[2012/07/30 12:14:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/07/30 12:14:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/07/30 12:14:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/07/30 12:14:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/07/30 12:14:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/07/30 12:00:24 | 000,001,397 | —- | C] () – C:\Documents and Settings\User\Desktop\clipbrd.lnk
[2012/07/29 10:33:13 | 000,000,512 | —- | C] () – C:\Documents and Settings\User\Desktop\MBR.dat
[2012/07/28 16:29:43 | 000,254,426 | —- | C] () – C:\Documents and Settings\User\My Documents\OTL Tutorial - How to use OldTimer ListIt - Geeks to Go Forums.htm
[2012/07/28 11:30:12 | 001,552,384 | —- | C] () – C:\Documents and Settings\User\Desktop\RogueKiller(1).exe
[2012/07/27 17:16:41 | 000,000,394 | —- | C] () – C:\WINDOWS\tasks\SpeedyPC Pro.job
[2012/07/26 17:03:27 | 000,001,881 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/07/25 18:26:00 | 000,001,469 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Samsung Auto Backup.lnk
[2012/07/25 18:26:00 | 000,000,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk
[2012/07/25 18:26:00 | 000,000,595 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk
[2012/07/20 15:12:46 | 000,846,855 | —- | C] () – C:\Documents and Settings\User\My Documents\Can you Find her flaw _.eml
[2012/07/16 16:57:06 | 004,661,166 | —- | C] () – C:\Documents and Settings\User\My Documents\BRITISH_99.WMV
[2012/07/15 16:22:24 | 000,002,451 | —- | C] () – C:\Documents and Settings\User\Desktop\HiJackThis.lnk
[2012/07/15 12:23:19 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\ophcrack.lnk
[2012/07/15 10:43:35 | 000,003,275 | —- | C] () – C:\Documents and Settings\User\My Documents\Airport Transfers.eml
[2012/07/14 16:21:01 | 000,000,304 | —- | C] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/07/14 14:13:58 | 000,001,373 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/07/13 17:23:02 | 000,001,151 | —- | C] () – C:\Documents and Settings\User\Desktop\Shortcut to YAAI.exe.lnk
[2012/07/13 17:21:23 | 000,645,632 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2012/07/13 17:21:23 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2012/07/13 17:21:23 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\xvid.ax
[2012/07/06 08:46:34 | 000,172,098 | —- | C] () – C:\torrent.exe
[2012/04/19 22:08:24 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1409082233-117609710-839522115-1003-0.dat
[2012/04/16 22:58:49 | 000,299,950 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/03/04 13:29:22 | 000,002,396 | —- | C] () – C:\WINDOWS\System32\ASOROSet.bin
[2012/02/15 16:00:14 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/27 12:31:10 | 000,000,520 | —- | C] () – C:\WINDOWS\Viewer.INI
[2011/12/17 14:20:38 | 000,000,000 | —- | C] () – C:\WINDOWS\muveeapp.INI
[2011/12/08 18:40:31 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\KRSBridgeControls.dll
[2011/12/08 18:40:31 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\JeanieInterface.dll
[2011/12/08 18:40:31 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\KRSSockets.dll
[2011/12/08 18:40:31 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\FuzzBox.dll
[2011/12/08 18:40:31 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\BrowseForDirectory.dll
[2011/11/29 22:12:25 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2011/11/29 22:09:35 | 000,000,578 | —- | C] () – C:\WINDOWS\MyHeritage.INI
[2011/11/29 22:07:18 | 000,454,656 | —- | C] () – C:\WINDOWS\System32\PaintX.dll
[2011/11/22 19:21:10 | 000,002,816 | —- | C] () – C:\Documents and Settings\All Users\Application Data\un.png
[2011/11/22 19:15:59 | 000,000,316 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/11/22 19:15:59 | 000,000,022 | —- | C] () – C:\Documents and Settings\User\Application Data\UserFlag.ini
[2011/09/07 17:03:45 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/09/01 15:37:35 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\AVERM.dll
[2011/09/01 15:37:34 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\AVEQT.dll
[2011/06/28 12:29:04 | 002,097,152 | —- | C] () – C:\Documents and Settings\User\My Volume N
[2011/04/21 19:28:31 | 000,000,022 | -HS- | C] () – C:\Documents and Settings\User\Application Data\Sys2662.Config.Repository.bin
[2011/04/15 12:55:52 | 000,069,432 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/04/14 10:21:38 | 000,304,416 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/08 13:36:49 | 000,001,769 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2011/03/06 15:55:42 | 000,004,096 | —- | C] ( ) – C:\WINDOWS\System32\IGFXDEVLib.dll
[2011/03/06 15:55:41 | 000,000,151 | —- | C] () – C:\WINDOWS\System32\GfxUI.exe.config
[2011/02/18 19:11:28 | 000,000,593 | —- | C] () – C:\Documents and Settings\User\Application Data\AutoGK.ini
[2011/02/10 07:29:06 | 000,000,043 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/01/10 17:01:08 | 000,000,805 | —- | C] () – C:\WINDOWS\ScanSpyware.INI
[2010/12/30 20:17:43 | 000,000,107 | —- | C] () – C:\WINDOWS\IfoEdit.INI
[2010/12/19 12:09:23 | 000,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2010/12/19 12:09:23 | 000,048,984 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2010/04/05 12:20:52 | 000,000,084 | —- | C] () – C:\Documents and Settings\User\default.pls
[2010/04/02 14:04:29 | 000,166,400 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/02 12:18:12 | 000,007,887 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.cat
[2010/04/02 12:18:12 | 000,001,144 | —- | C] () – C:\Documents and Settings\User\Application Data\pcouffin.inf

< End of report >

Thanks again
Brigow

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Heavily Infected [Solved]

✨ Ask AI

Ask AI