What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slow PC; Browser leaves stubs; CD drive not seen [Solved]

34 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello peteinmaine

Thank you for the logs.

Please do the following:

  • Please run the following scan


  • Note:Internet Explorer is preferred for this scan, although it will run with other browsers.
  • Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
  • Please disable your real time security programs before performing the scan.


  • Scan your system with Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use.
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.


  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option to "Remove Found Threats" is UN checked.
  • Push the "Start" button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]

Please post the ESET log in your next reply along with a new OTL scan log and let me know how the machine is running now.
Post #17 last edited
Hi JonTom,

6 hours later, here it is. wow.
I ran the scan on IE the first time, to completion in 2hr 17m. Before I was able to save the test file, IE crashed! :wacko:
The next run took 3h 31m. All told, about 5hr, 50 min. yipes. :o

I have noticed a very slight improvement in functionality, maybe. ;)

ESETScan log to follow:
###############################################################################



C:\Documents and Settings\All Users\Application Data\Fighters\SLOW-PCfighter\InstallCache\{7269CBA7-2A83-4CA4-9014-EC7FB0104CE1}\SLOW-PCfighter.msi a variant of Win32/SlowPCfighter application
C:\Documents and Settings\All Users\Documents\Applications\pw finder.exe Win32/Spy.Qeds.A trojan
C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\epicPlayGames.dll a variant of Win32/Adware.Gamevance.BR application
C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]\components\epicPlayGames.dll a variant of Win32/Adware.Gamevance.BR application
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\18\80d5412-1162218f Java/Exploit.CVE-2012-1723.AG trojan
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\2\7ec72f82-432d997e multiple threats
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\40\2ac7a868-6b612719 a variant of Java/Exploit.CVE-2012-4681.F trojan
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\43\6ebae6b-79008727 Java/Exploit.CVE-2012-1723.T trojan
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\52\32977bf4-3445d7ad a variant of Win32/Kryptik.ALBV trojan
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\7\787da407-138688e7 multiple threats
C:\Documents and Settings\Peter\My Documents\!!!CDR Backup-Disk\Utilities\SmileyCentralPFSetup2.1.50.8.exe a variant of Win32/Toolbar.MyWebSearch.O application
C:\Documents and Settings\Peter\My Documents\Downloads\BestVideoDownloaderSetup-CNET.exe multiple threats
C:\Program Files\Search Toolbar\SearchToolbarUpdater.exe Win32/Toolbar.Zugo application
C:\Program Files\smartdl\vfd.exe a variant of Win32/Adware.Facetheme.D application
C:\WINDOWS\Downloaded Installations\{610AA503-16B3-4D15-87DF-8E6B91402299}\PC MightyMax v9.msi a variant of Win32/Adware.PCMightyMax.A application
C:\_OTL\MovedFiles\09112012_172147\C_\torrent.exe Win32/BundleInstaller.A application
C:\_OTL\MovedFiles\09112012_172147\C_Program Files\OpenApp\bho_project.dll a variant of Win32/Adware.Facetheme.D application
F:\!!!-Backup Utilities\Audio\FreeRip MP3_freeripmp3.exe Win32/Adware.ADON application
F:\!!!-Backup Utilities\Video\Hamster Free Video Converter 1.0.0.43_hamsterfreevideoconverter.exe Win32/Toolbar.Zugo application
F:\!!!-Backup Utilities\Video\Windows Media Player Codecs 9.0 - instacodecs.exe a variant of Win32/InstallIQ application
Post #18
Hello peteinmaine

Thank you for the log.

ESET has detected some rather questionable entries that appear to be infected with adware. It has also detected an infected Java cache.


  • Please open OTL


  • Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.

    :OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:Files
C:\Program Files\Search Toolbar
C:\Documents and Settings\All Users\Documents\Applications\pw finder.exe
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\18\80d5412-1162218f
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\2\7ec72f82-432d997e
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\40\2ac7a868-6b612719
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\43\6ebae6b-79008727
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\52\32977bf4-3445d7ad
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\7\787da407-138688e7
C:\Documents and Settings\Peter\My Documents\!!!CDR Backup-Disk\Utilities\SmileyCentralPFSetup2.1.50.8.exe
C:\Documents and Settings\Peter\My Documents\Downloads\BestVideoDownloaderSetup-CNET.exe
C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\epicPlayGames.dll
C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]\components\epicPlayGames.dll
C:\Program Files\smartdl\vfd.exe
C:\Documents and Settings\All Users\Application Data\Fighters\SLOW-PCfighter\InstallCache\{7269CBA7-2A83-4CA4-9014-EC7FB0104CE1}\SLOW-PCfighter.msi
C:\WINDOWS\Downloaded Installations\{610AA503-16B3-4D15-87DF-8E6B91402299}\PC MightyMax v9.msi
F:\!!!-Backup Utilities\Video\Hamster Free Video Converter 1.0.0.43_hamsterfreevideoconverter.exe
F:\!!!-Backup Utilities\Audio\FreeRip MP3_freeripmp3.exe
F:\!!!-Backup Utilities\Video\Windows Media Player Codecs 9.0 - instacodecs.exe

:Commands
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]

  • Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
  • Allow the program to run unhindered.
  • Your machine will re-start itself. This is normal.
  • A log will be created after your machine reboots. Please post the contents of the log in your next reply.

Please post the OTL fix log and a new OTL scan log in your next reply.
Post #19
Hello JonTom,
Did you get to go to the Olympics while they were so close?

Please let me know when we can REinstitute that Pop-up blocker. & please instruct as to how. Thank you :notworthy:


OTL log to follow
[09142012_111826.log]

###############################################################################


All processes killed
========== OTL ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Program Files\Search Toolbar folder moved successfully.
C:\Documents and Settings\All Users\Documents\Applications\pw finder.exe moved successfully.
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\18\80d5412-1162218f moved successfully.
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\2\7ec72f82-432d997e moved successfully.
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\40\2ac7a868-6b612719 moved successfully.
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\43\6ebae6b-79008727 moved successfully.
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\52\32977bf4-3445d7ad moved successfully.
C:\Documents and Settings\Peter\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\7\787da407-138688e7 moved successfully.
C:\Documents and Settings\Peter\My Documents\!!!CDR Backup-Disk\Utilities\SmileyCentralPFSetup2.1.50.8.exe moved successfully.
C:\Documents and Settings\Peter\My Documents\Downloads\BestVideoDownloaderSetup-CNET.exe moved successfully.
C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\epicPlayGames.dll moved successfully.
C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]\components\epicPlayGames.dll moved successfully.
C:\Program Files\smartdl\vfd.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\Fighters\SLOW-PCfighter\InstallCache\{7269CBA7-2A83-4CA4-9014-EC7FB0104CE1}\SLOW-PCfighter.msi moved successfully.
C:\WINDOWS\Downloaded Installations\{610AA503-16B3-4D15-87DF-8E6B91402299}\PC MightyMax v9.msi moved successfully.
F:\!!!-Backup Utilities\Video\Hamster Free Video Converter 1.0.0.43_hamsterfreevideoconverter.exe moved successfully.
F:\!!!-Backup Utilities\Audio\FreeRip MP3_freeripmp3.exe moved successfully.
F:\!!!-Backup Utilities\Video\Windows Media Player Codecs 9.0 - instacodecs.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Kids
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Non-Admin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Peter
->Temp folder emptied: 156725 bytes
->Temporary Internet Files folder emptied: 21254860 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 169230732 bytes
->Google Chrome cache emptied: 70052532 bytes
->Flash cache emptied: 9870 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17740 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 34390903 bytes

Total Files Cleaned = 281.00 mb


[EMPTYFLASH]

User: All Users

User: Default User

User: Kids

User: LocalService

User: NetworkService

User: Non-Admin

User: Peter
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.61.3 log created on 09142012_111826

Files\Folders moved on Reboot…

PendingFileRenameOperations files…

Registry entries deleted on Reboot…
Post #20
Hello peteinmaine

No Olympics for me, too busy working ;)

lease let me know when we can REinstitute that Pop-up blocker. & please instruct as to how

Which pop up blocker are you talking about?

To be quite honest there is not much point putting any faith in a pop up blocker when you are running without a real time antivirus program.

Lets address that problem now:

  • Security programs


  • You are strongly advised to install an AV. Using your computer without one is just asking for trouble.
  • I have provided links to three trusted programs (just choose one).



Once you have installed the program of your choice, open it, update it, and run a full system scan.

Let me know if anything is detected and post a new OTL scan log in your next reply.
Post #21
Hello JonTom,

Olympics: A once in a lifetime opportunity :(

Avast: is on board [as you will see in the scan]

—————————
Note: I run Chrome.
After Avast was installed, I noticed that it had added an extension on my Chrome Browser. Since I like to run a "bare bones" app, I removed the extension [Not good :( ]
This morning I attempted to open / run Chrome. It crashed multiple times & would NOT run!
Solution: I re-installed Chrome. Now it runs, w/o the extension created by Avast.
—————————

OTL log to follow:

###############################################################################



OTL logfile created on: 9/15/2012 8:37:22 AM - Run 4
OTL by OldTimer - Version 3.2.61.3 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.49 Mb Total Physical Memory | 356.31 Mb Available Physical Memory | 69.66% Memory free
1.22 Gb Paging File | 0.99 Gb Available in Paging File | 80.94% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 11.63 Gb Free Space | 20.32% Space Free | Partition Type: NTFS
Drive E: | 967.22 Mb Total Space | 641.75 Mb Free Space | 66.35% Space Free | Partition Type: FAT
Drive F: | 298.09 Gb Total Space | 78.39 Gb Free Space | 26.30% Space Free | Partition Type: NTFS
Drive I: | 967.22 Mb Total Space | 825.38 Mb Free Space | 85.33% Space Free | Partition Type: FAT

Computer Name: PH | User Name: Peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/10 07:49:12 | 000,600,064 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
PRC - [2012/09/02 16:53:43 | 000,161,768 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/08/21 05:12:26 | 004,282,728 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/08/21 05:12:25 | 000,044,808 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/06/06 21:33:42 | 001,564,872 | —- | M] (Ask) – C:\Program Files\Ask.com\Updater\Updater.exe
PRC - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () – C:\Program Files\CDBurnerXP\NMSAccessU.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/14 06:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2005/08/29 16:10:34 | 000,019,968 | —- | M] (Antony Lewis) – C:\Program Files\WordWeb\wweb32.exe
PRC - [2005/06/22 03:38:24 | 000,184,320 | —- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) – C:\WINDOWS\system32\MSTMON_S.EXE
PRC - [2005/01/28 22:00:01 | 000,180,269 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2003/03/31 08:00:00 | 000,138,752 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\sndvol32.exe
PRC - [2003/01/13 10:08:56 | 000,818,688 | —- | M] (Webroot Software, Inc.) – C:\Program Files\Washer\washer.exe
PRC - [2002/08/02 08:38:32 | 000,020,480 | —- | M] () – C:\Program Files\NetWaiting\netwaiting.exe


========== Modules (No Company Name) ==========

MOD - [2012/09/14 16:10:04 | 001,810,432 | —- | M] () – C:\Program Files\AVAST Software\Avast\defs\12091401\algo.dll
MOD - [2012/08/21 05:12:20 | 000,247,224 | —- | M] () – C:\Program Files\AVAST Software\Avast\Setup\setiface.dll
MOD - [2012/05/25 04:25:00 | 000,921,600 | —- | M] () – C:\Program Files\Yahoo!\Messenger\yui.dll
MOD - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () – C:\Program Files\CDBurnerXP\NMSAccessU.exe
MOD - [2002/08/02 08:38:32 | 000,020,480 | —- | M] () – C:\Program Files\NetWaiting\netwaiting.exe


========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - File not found [On_Demand | Stopped] – %SystemRoot%\System32\appmgmts.dll – (AppMgmt)
SRV - [2012/09/02 16:53:43 | 000,161,768 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2012/08/21 05:12:25 | 000,044,808 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\AvastSvc.exe – (avast! Antivirus)
SRV - [2012/08/15 06:18:08 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () [Auto | Running] – C:\Program Files\CDBurnerXP\NMSAccessU.exe – (NMSAccess)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - [2012/09/11 18:23:39 | 000,040,776 | —- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mbamswissarmy.sys – (MBAMSwissArmy)
DRV - [2012/08/21 05:13:15 | 000,729,752 | —- | M] (AVAST Software) [File_System | System | Running] – C:\WINDOWS\System32\drivers\aswSnx.sys – (aswSnx)
DRV - [2012/08/21 05:13:15 | 000,355,632 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswSP.sys – (aswSP)
DRV - [2012/08/21 05:13:15 | 000,054,232 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2012/08/21 05:13:14 | 000,097,608 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\WINDOWS\System32\drivers\aswmon2.sys – (aswMon2)
DRV - [2012/08/21 05:13:14 | 000,035,928 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswRdr.sys – (AswRdr)
DRV - [2012/08/21 05:13:13 | 000,025,256 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aavmker4.sys – (Aavmker4)
DRV - [2012/08/21 05:13:13 | 000,021,256 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\WINDOWS\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2009/11/12 14:48:56 | 000,007,168 | —- | M] () [File_System | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\StarOpen.sys – (StarOpen)
DRV - [2008/04/14 01:15:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2005/04/07 17:18:34 | 000,003,840 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\BANTExt.sys – (BANTExt)
DRV - [2003/12/23 02:15:42 | 000,005,248 | —- | M] ( ) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\xmasscsi.sys – (xmasscsi)
DRV - [2003/12/21 17:24:22 | 000,140,800 | —- | M] ( ) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\xmasbus.sys – (xmasbus)
DRV - [2003/07/22 03:04:46 | 000,018,848 | —- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) [Kernel | Auto | Running] – C:\WINDOWS\system32\MLPTDR_Q.SYS – (MLPTDR_Q)
DRV - [2002/12/05 00:01:00 | 000,241,664 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvapu.sys – (nvnforce)
DRV - [2002/12/05 00:01:00 | 000,013,056 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvax.sys – (nvax)
DRV - [2002/11/27 07:52:00 | 000,080,896 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NVENET.sys – (NVENET)
DRV - [2002/11/13 03:10:00 | 000,020,224 | R— | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\nvidesm.sys – (nvidesm)
DRV - [2002/10/18 05:06:28 | 000,842,128 | —- | M] (Conexant) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\winachcf.sys – (Winachcf)
DRV - [2002/09/05 23:24:00 | 000,013,568 | R— | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\nv_agp.SYS – (nv_agp)
DRV - [2001/08/17 13:28:02 | 000,907,456 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HCF_MSFT.sys – (HCF_MSFT)
DRV - [2001/08/17 10:00:04 | 000,002,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\msmpu401.sys – (ms_mpu401)
DRV - [2001/08/13 13:59:36 | 000,011,387 | R— | M] (Agilent Technologies) [Kernel | Auto | Stopped] – C:\WINDOWS\system32\drivers\goldrush.sys – (GoldrushUSB)
DRV - [2000/10/25 08:27:24 | 000,003,000 | R— | M] () [Kernel | Auto | Running] – C:\WINDOWS\system32\SetupNT.sys – (SetupNT)
DRV - [1999/09/10 12:06:00 | 000,025,244 | —- | M] (Adaptec) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\ASPI32.SYS – (ASPI32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {8A64D544-98BB-C260-590A-335EB1FB0846}
IE - HKCU\..\SearchScopes\{0169E633-8781-F882-9BC7-7B014AE4DE4E}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{188C1581-6C74-42A6-9A73-5D018DFDA96E}: "URL" = http://websearch.ask.com/redirect?client=i…C8-4C7FD6259F88
IE - HKCU\..\SearchScopes\{6C59297E-BFFE-4E6A-0BF5-4187155432D8}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{8A64D544-98BB-C260-590A-335EB1FB0846}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{8D664689-231B-40C7-8EA3-870A3132D4DE}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT3106518
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2027: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2088: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1040: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{9051303c-7e41-4311-a783-d6fe5ef2832d}: C:\Program Files\FVD Suite\addons\Firefox [2011/12/01 08:46:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/09/14 21:27:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2012/06/24 22:18:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/27 13:01:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files\Object\facetheme
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2012/06/24 22:18:33 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]

[2011/11/15 19:23:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions
[2012/09/05 14:24:20 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions
[2012/05/20 06:35:50 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/06/08 21:05:11 | 000,000,000 | —D | M] ("FVD Suite Addon") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}
[2012/03/29 17:32:30 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/09/05 14:24:20 | 000,000,000 | —D | M] (VideoFileDownload - Download YouTube Videos) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2011/11/15 19:23:18 | 000,000,000 | —D | M] (EpicPlay Games) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2012/07/08 06:23:46 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2006/11/06 15:02:48 | 000,000,000 | —D | M] ("VideoDownloader") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2011/11/13 20:02:17 | 000,145,972 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2012/02/27 13:02:50 | 000,020,591 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2012/07/31 08:01:36 | 002,227,573 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{5FF97DB7-2EF7-4a7f-8E36-5214B5C5C65A}.xpi
[2011/11/13 20:02:29 | 000,031,532 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9ab67d74-ec41-4cb2-b417-df5d93ba1beb}.xpi
[2012/07/21 13:15:15 | 000,702,524 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2011/11/13 20:02:41 | 000,879,991 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{DCBD1271-D228-4082-9FBC-36D9B7660B03}.xpi
[2012/02/27 13:01:49 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/11/13 20:01:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/11/13 20:01:23 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/02/27 13:01:34 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/27 13:01:27 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/02/27 13:01:27 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://mail.yahoo.com/?.intl=us
CHR - default_search_provider: Yahoo! (Enabled)
CHR - default_search_provider: search_url = http://search.yahoo.com/search?ei={inputEn…p={searchTerms}
CHR - default_search_provider: suggest_url = http://ff.search.yahoo.com/gossip?output=f…d={searchTerms}
CHR - homepage: http://mail.yahoo.com/?.intl=us
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Disabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U7 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.10 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Fade to White Aero Skin (by Skarv) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oekemfmehiakocmomemagciajlikigkl\1.0_0\
CHR - Extension: Gmail = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2004/08/21 23:07:46 | 000,000,848 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (FVD Suite Toolbar) - {2B171655-A69C-5c18-B693-6CB5DC269D41} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (www.flashvideodownloader.org/fvd-suite/)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [KONICA MINOLTA magicolor 2400W STD] C:\WINDOWS\System32\MSTMON_S.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe ()
O4 - HKCU..\Run: [Washer] C:\Program Files\Washer\washer.exe (Webroot Software, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe (Antony Lewis)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O8 - Extra context menu item: &WordWeb;… - C:\WINDOWS\wweb32.dll (Antony Lewis)
O8 - Extra context menu item: &Yahoo;! Search - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Dictionary; - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Maps; - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} http://support.f-secure.com/ols/fscax.cab (F-Secure Online Scanner)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} http://download.microsoft.com/download/7/E…04/clearadj.cab (CTAdjust Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A67D86CB-7EF9-414A-BC85-AC3EEF166B61}: DhcpNameServer = 192.168.1.1 [removed] [removed]
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/26 15:00:20 | 000,000,032 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/14 21:28:36 | 000,021,256 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/09/14 21:28:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2012/09/14 21:28:35 | 000,355,632 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2012/09/14 21:28:34 | 000,035,928 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/09/14 21:28:33 | 000,729,752 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/09/14 21:28:33 | 000,054,232 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/09/14 21:28:32 | 000,097,608 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/09/14 21:28:32 | 000,089,624 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2012/09/14 21:28:32 | 000,025,256 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/09/14 21:27:18 | 000,041,224 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2012/09/14 21:27:16 | 000,227,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2012/09/14 21:26:36 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2012/09/14 21:26:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/09/13 09:32:42 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/09/11 18:19:36 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/09/11 18:19:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/11 18:19:24 | 000,022,856 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/09/11 18:19:23 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/09/11 17:21:47 | 000,000,000 | —D | C] – C:\_OTL
[2012/09/10 22:05:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\My Documents\Firefox-Downloads
[2012/09/10 07:49:09 | 000,600,064 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/09/09 22:25:35 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\uSeRiNiT_rkill_5.exe
[2012/09/09 22:24:59 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\WiNlOgOn_rkill_4.exe
[2012/09/09 22:23:46 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_3.scr
[2012/09/09 22:23:21 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_2.com
[2012/09/09 22:22:02 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_1.exe
[2012/09/08 23:05:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Start Menu\Programs\Window Washer
[2012/09/08 14:03:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Desktop\tdsskiller
[2012/09/05 17:56:48 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/09/05 17:56:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Start Menu\Programs\HiJackThis
[2012/09/05 17:34:35 | 000,000,000 | —D | C] – C:\Program Files\HijackThis
[2012/09/05 14:29:06 | 000,045,056 | —- | C] (Adaptec) – C:\WINDOWS\System32\WNASPI32.DLL
[2012/09/05 14:29:06 | 000,025,244 | —- | C] (Adaptec) – C:\WINDOWS\System32\drivers\ASPI32.SYS
[2012/09/05 14:29:06 | 000,005,600 | —- | C] (Adaptec) – C:\WINDOWS\System\WINASPI.DLL
[2012/09/05 14:29:06 | 000,004,672 | —- | C] (Adaptec) – C:\WINDOWS\System\WOWPOST.EXE
[2012/09/05 14:27:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\My Documents\FORCEASPI
[2012/09/05 14:22:16 | 000,000,000 | —D | C] – C:\Program Files\smartdl
[2012/09/02 16:57:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/09/02 16:55:48 | 000,246,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/09/02 16:55:15 | 000,174,056 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/09/02 16:55:15 | 000,093,672 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/09/02 16:55:13 | 000,174,056 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe

========== Files - Modified Within 30 Days ==========

[2012/09/15 08:43:02 | 000,000,234 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/09/15 08:17:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/09/15 08:04:02 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-2000478354-839522115-1004UA.job
[2012/09/15 07:18:12 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/09/15 07:18:01 | 000,000,316 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/09/15 07:17:59 | 000,002,625 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2012/09/15 06:57:06 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/09/15 06:56:19 | 000,019,116 | —- | M] () – C:\WINDOWS\MSTMON_S.INI
[2012/09/15 06:56:07 | 000,003,725 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012/09/15 06:54:37 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/09/15 06:04:18 | 000,002,284 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Google Chrome.lnk
[2012/09/15 06:04:18 | 000,002,262 | —- | M] () – C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/09/15 05:39:48 | 014,445,568 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2012/09/15 05:39:47 | 005,657,600 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2012/09/14 09:38:19 | 000,047,616 | —- | M] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/14 09:04:02 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-2000478354-839522115-1004Core.job
[2012/09/11 18:23:39 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/09/11 18:22:11 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/10 07:49:12 | 000,600,064 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/09/09 22:25:40 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\uSeRiNiT_rkill_5.exe
[2012/09/09 22:25:04 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\WiNlOgOn_rkill_4.exe
[2012/09/09 22:23:50 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_3.scr
[2012/09/09 22:23:26 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_2.com
[2012/09/09 22:22:09 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_1.exe
[2012/09/09 08:47:02 | 004,742,953 | —- | M] () – C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2012/09/09 08:34:08 | 000,000,548 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MP4 Converted.lnk
[2012/09/08 23:05:44 | 000,000,606 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Window Washer.lnk
[2012/09/08 15:33:32 | 000,000,512 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MBR.dat
[2012/09/08 14:00:04 | 002,193,184 | —- | M] () – C:\Documents and Settings\Peter\Desktop\tdsskiller.zip
[2012/09/08 13:52:15 | 000,000,054 | —- | M] () – C:\Documents and Settings\Peter\defogger_reenable
[2012/09/08 13:50:03 | 000,050,477 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Defogger.exe
[2012/09/08 08:47:36 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Peter\Desktop\aswMBR.exe
[2012/09/07 17:04:46 | 000,022,856 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/09/05 17:57:32 | 000,002,447 | —- | M] () – C:\Documents and Settings\Peter\Desktop\HiJackThis.lnk
[2012/09/05 16:38:36 | 000,097,762 | —- | M] () – C:\Documents and Settings\Peter\Desktop\tumblr_ljn81n3gbW1qg0vxuo1_500.jpg
[2012/09/05 14:52:53 | 000,000,640 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Burn4Free.lnk
[2012/09/02 16:53:48 | 000,093,672 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/09/02 16:53:32 | 000,246,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/09/02 16:53:32 | 000,174,056 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/09/02 16:53:32 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/09/02 16:53:31 | 000,174,056 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/09/02 16:53:29 | 000,821,736 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2012/09/02 16:53:29 | 000,746,984 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2012/08/30 02:59:31 | 000,435,688 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/08/30 02:59:31 | 000,068,584 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/08/29 11:55:12 | 083,023,306 | —- | M] () – C:\Documents and Settings\All Users\Application Data\nud0repor.pad
[2012/08/21 05:13:15 | 000,729,752 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/08/21 05:13:15 | 000,355,632 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2012/08/21 05:13:15 | 000,054,232 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/08/21 05:13:14 | 000,097,608 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/08/21 05:13:14 | 000,089,624 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2012/08/21 05:13:14 | 000,035,928 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/08/21 05:13:13 | 000,025,256 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/08/21 05:13:13 | 000,021,256 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/08/21 05:12:33 | 000,041,224 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2012/08/21 05:12:23 | 000,227,648 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2012/08/20 09:19:20 | 000,000,224 | —- | M] () – C:\WINDOWS\TOPO.INI
[2012/08/20 09:17:23 | 002,755,398 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Kinsmans.BMP
[2012/08/17 05:30:40 | 000,565,504 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/08/16 22:36:02 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/08/16 21:47:11 | 000,007,117 | —- | M] () – C:\Documents and Settings\Peter\My Documents\www.rochesterschools.com_Personnel_Postings_Secondary_Math_Teacher.pdf

========== Files Created - No Company Name ==========

[2012/09/14 21:28:36 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/09/14 21:28:32 | 000,000,316 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/09/11 18:19:26 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/09 12:32:27 | 000,000,548 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MP4 Converted.lnk
[2012/09/09 08:46:43 | 004,742,953 | —- | C] () – C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2012/09/08 23:05:44 | 000,000,606 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Window Washer.lnk
[2012/09/08 13:59:56 | 002,193,184 | —- | C] () – C:\Documents and Settings\Peter\Desktop\tdsskiller.zip
[2012/09/08 13:52:04 | 000,000,054 | —- | C] () – C:\Documents and Settings\Peter\defogger_reenable
[2012/09/08 13:49:59 | 000,050,477 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Defogger.exe
[2012/09/08 09:06:22 | 000,000,512 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MBR.dat
[2012/09/05 17:56:48 | 000,002,447 | —- | C] () – C:\Documents and Settings\Peter\Desktop\HiJackThis.lnk
[2012/09/05 16:29:27 | 000,097,762 | —- | C] () – C:\Documents and Settings\Peter\Desktop\tumblr_ljn81n3gbW1qg0vxuo1_500.jpg
[2012/08/29 11:32:06 | 083,023,306 | —- | C] () – C:\Documents and Settings\All Users\Application Data\nud0repor.pad
[2012/08/20 09:17:23 | 002,755,398 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Kinsmans.BMP
[2012/08/16 21:47:10 | 000,007,117 | —- | C] () – C:\Documents and Settings\Peter\My Documents\www.rochesterschools.com_Personnel_Postings_Secondary_Math_Teacher.pdf
[2011/11/22 15:07:34 | 000,000,275 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\HamsterVideoConverterSettings.cfg
[2010/12/01 22:06:37 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2005/09/20 06:50:23 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2004/09/20 09:23:08 | 000,000,000 | —- | C] () – C:\Documents and Settings\Peter\Application Data\dm.ini
[2004/06/27 14:22:27 | 000,047,616 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf:SummaryInformation

< End of report >
Post #22
Hello peteinmaine

Thank you for the log.

Note: I run Chrome.
After Avast was installed, I noticed that it had added an extension on my Chrome Browser. Since I like to run a "bare bones" app, I removed the extension [Not good sad.gif ]
This morning I attempted to open / run Chrome. It crashed multiple times & would NOT run!
Solution: I re-installed Chrome. Now it runs, w/o the extension created by Avast.

Thanks for the extra information. If you like to run "bare bones" as you call it, uninstall Ask Toolbar. You don't really need it.

Did you run an AVAST scan? Did it detect anything?

Before we send you on your way please open Firefox and browse normally for a while. Let me know if everything appears to be normal with the browser in your next reply.
Post #23 last edited
Hi JonTom,

———————————————————————————————————————
If you like to run "bare bones" as you call it, uninstall Ask Toolbar. You don't really need it.

No I do NOT need it. Yet, nowhere do I SEE it. Now that you mention that YOU see it, I have searched::
1- Tools > Extensions : Not here
2- Tools > Task manager: Not here
3- Settings > Manage Search Engines > Default Search Engines: Removed Ask

That was the ONLY place I could find Ask. In my "pull down" area, I see no "Ask" toolbar. [Nor did I or Do I ever want one.]

If I have failed to remove what I cannot see, please advise. Thanks.
———————————————————————————————————————

Did you run an AVAST scan? Did it detect anything?

It appeared to me, that as part of the install, Avast ran a scan [or at least that is what I read.] It failed to find anything.
I have NOT run an additional "manual" scan using Avast.. Perhaps I should? Please advise.

———————————————————————————————————————

Before we send you on your way please open Firefox and browse normally for a while. Let me know if everything appears to be normal.
Firefox hasn't run "normal" for a very LONG time & STILL does not. It is PAINfully SLOW to start & JUST as painfully slow to run. However, I HAVE & DO use FF every day for just email. Then I drop out of it. Many times, it continues to leave behind those "stubs" ["Firefox" & Plug-in container" as seen in my Task Manager > Processes] for 5 seconds up to & beyond 1 minute, depending on how long I have been using FF. i.e. the longer I have used FF, the longer those stubs hang around :(

———————————————————————————————————————

Now additionally, with Avast running, this poor old machine is just taxed. Chrome has now slowed down measurably :( Very frustrating. :wacko:

———————————————————————————————————————

Before we send you on your way
I judge by your remark, that at this point, all that CAN be done HAS been done, yes? If not, any additional info / maintenance will be appreciated. please advise.

So far, thank YOU so MUCH for your assistance!! :thumbup:
Post #24
Hello peteinmaine

If I have failed to remove what I cannot see, please advise

Certainly :) Please see below:

  • Please un-install the following


    • Click on "Start" then on "Control Panel" and then on "Add or remove programs".
    • Click on "remove a program". A list of currently installed programs will be displayed.
    • Find the "Ask Toolbar" program, click on it once and then click on the "uninstall" button.
    • If you are prompted to re-boot your computer to complete the uninstall please do so.
    • Repeat for "Ask Toolbar Updater".

    I have NOT run an additional "manual" scan using Avast.. Perhaps I should? Please advise

    Since the quick scan did not find anything I believe there is nothing to worry about at this time. In terms of general system maintenance you should be running a full manual scan around once per week.

    Now additionally, with Avast running, this poor old machine is just taxed

    Security programs do draw heavily on system resources but you need to have one. There are some things we can try to lighten the load on your system but if they do not noticeably help you may want to comsider additional RAM or an upgrade to a newer system.

    at this point, all that CAN be done HAS been done, yes?

    Your latest OTL log (and your most recent AVAST scan) appear to be malware free. As for your continued issues with Firefox, they do not appear to be being caused by malware at this time. For additional browser support please create a new thread in our Browsers, Internet and email forum.


    The following may help with your system performance issues:

  • Defragment your hard drive



  • StartupLight


    • You may wish to try StartupLite. Simply download this tool to your desktop and run it.
    • It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup.
    • This will result in fewer programs running when you boot your system, and should improve performance.
    • You can find it here: http://www.malwarebytes.org/startuplite.php


    More information can be found in the link below:

    http://www.bleepingcomputer.com/forums/ind…st&p=487112


    Lets remove our tools in the steps below:
  • Re-enable your drivers


    • To re-enable your Emulation drivers, double click on DeFogger to run the tool.
    • The application window will appear.
    • Click the Re-enable button to re-enable your CD Emulation drivers.
    • Click Yes to continue
    • A 'Finished!' message will appear.
    • Click OK
    • DeFogger will now ask to reboot the machine - click OK
    IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.
    Your Emulation drivers are now re-enabled.

  • Please Uninstall Combofix


    • Click on "Start" and then on "Run".
    • Now type combofix /uninstall in the run box and click "OK". Please note the space between the "x" and the "/Uninstall", it needs to be there.

  • Please perform the following cleanup procedure


    • Double click on the OTL.exe icon on your desktop to run the program.
    • Once OTL has opened, click on the "CleanUp!" button.
    • Follow any prompts that you receive.

  • Removal of Tools


    • You no longer need aswMBR, RKill or TDSSKiller. Please delete them from your machine.


    Once you have completed the above steps you should be good to go! If you have any further questions, please feel free to ask.

  • Finally, please take the time to read through the information provided below:

    Enhance your System Security

    • For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.

    • IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system. When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
    • Once complete, remember to re-engage your resident security before going online.

    Web Browsers and Browser Security

    Firefox
    • You can download Firefox from here.

    No-Script
    • If you use Firefox as your default browser, No-Script can provide additional security by preventing malicious scripts from being executed on your system.
    • You can download No-Script by clicking here.

    Internet Explorer
    • The newest version of Internet Explorer is available from here.
    • Please Note: IE9 is not configured to run on XP machines.

    SpywareBlaster
    • If you use Internet Explorer as your default browser, SpywareBlaster would be a valuable addition to your online security.
    • SpywareBlaster prevents malicious ActiveX objects from being downloaded onto your system.
    • You can download SpywareBlaster by clicking here.

    Web of Trust
    • When using search engines, Web of Trust provides you with an easy way of telling the good sites from the bad and is compatible with both Firefox and Internet Explorer.
    • Coloured symbols are displayed next to search results, giving you more confidence in the links you choose to click on: Green (To go), Yellow (Caution) and Red (Stop).
    • You can download Web of Trust by clicking here.

    Keep your Software Updated
    • Outdated software can sometimes have vulnerabilities that are exploitable by malware.
    • Check if there are available updates for your installed software with Secunia's Online Software Inspector by clicking here.

    Passwords
    • Learn how to create strong passwords by clicking here and test the strength of the passwords you already use by clicking here.

    General Reading

    Learn How To Combat Malware
    • Would you like to learn how to fight back against malware and help others? Enroll at the What The Tech (Formerly Tom Coyotes) Malware Classroom by clicking here.
Post #25 last edited
Hello JonTom,

I believe there are two issues which still remain:

Note 1- Somewhere in our process [possibly DeFogger] pop-ups have been allowed to pop up. And on one of my posts, I had asked when & how we can again DIS-able them. The question remains. Please assist.

Note 2- There seems to be some process which now sets a check box in my Windows Explorer:
(Pull down) Tools > Folder Options > View >[check box] Hide file extensions for known file types. I UN-check this box, because I WANT to see the file extensions! Yet with every boot, once again that box is CHECKED! :( I am interested to know the source, so that I may UN-check this box and LEAVE it unchecked! (very annoying! :wacko: ) Please advise.

As we complete this process, you have [with your last post as well as with all the problem solving], provided a host of important steps and tools in order to improve the working of my machine. Although I have yet to implement the latest steps, I appreciate your efforts and assistance so MUCH! :D THANK you! :clap:
Post #26
Hello peteinmaine


Note 1- Somewhere in our process [possibly DeFogger] pop-ups have been allowed to pop up.

And on one of my posts, I had asked when & how we can again DIS-able them. The question remains. Please assist.

I asked you which pop up blocker you were referring to in a previous post but you did not asnswer my question. Defogger has nothing to do with popups whatsoever. It is a program designed to temporarily disable CD emulation drivers that can sometimes interfere with anti rootkit scans.

What do the popups actually say? Please provide as much information as you can.


I am interested to know the source, so that I may UN-check this box and LEAVE it unchecked! (very annoying! wacko.gif ) Please advise.

I have not heard of that problem before. Lets try it this way:


  • Please make all file extensions Visible:


  • Click "Start" Go to My Computer-> Tools-> Folder Options-> View tab:
  • Choose to "Show hidden files and folders".
  • Uncheck "Hide extensions for known file types".
  • Close the window with "OK".

Let me know exactly what the popups say in your next reply and whether your file extensions are now visible.
Post #27
Hello JonTom,

I will have to apologize for previously using "code" tags when I THOUGHT I was using "quote" tags. My error.
With this post, I have corrected. :)

What do the popups actually say? Please provide as much information as you can.

The Pop-ups to which I refer, ONLY occur with Firefox. Please see attached Pop-up from FF.

Click "Start" Go to My Computer-> Tools-> Folder Options-> View tab:
Choose to "Show hidden files and folders".
Uncheck "Hide extensions for known file types".
Close the window with "OK".


This motion has been done repeatedly. That is, I perform this operation. The next time the machine is booted, then "Hide extensions for known file types". is UN-checked :(

Attachments:

Post #28
Hello peteinmaine

Thank you for the attachment.

Lets take another look to see what we can find:

Please re-scan with aswMBR and also with OTL.

I would also like to see the log created from the following tool:

  • MBRCheck


  • Please download MBRCheck by clicking here and save it to your desktop.
  • Be sure to disable your security programs.
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt).
  • A window will open on your desktop.
  • If an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter.
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file in your next reply.

Please post the required logs in your next reply.
Post #29
Ho JonTom,

> I ran MBRCheck. My machine hung. Yet, it also had produced the log file needed. I have posted this.

> The pop-up which I had included with the last post, is the ONLY pop-up that comes up. And that pop-up only occurs when I attempt to read Yahoo mail.

>

Click "Start" Go to My Computer-> Tools-> Folder Options-> View tab:
Choose to "Show hidden files and folders".
Uncheck "Hide extensions for known file types".
Close the window with "OK".

Ans: Upon re-checking the "Hide extensions for known file types" check box, it appears this problem no longer exists. You & I might debate if it EVER existed. Yet, I believe there is no longer any reason to re-visit this.


MBRCheck.Log file to follow:


###############################################################################

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000037d

Kernel Drivers (total 132):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EF000 \WINDOWS\system32\hal.dll
0xF8B36000 \WINDOWS\system32\KDCOM.DLL
0xF8A46000 \WINDOWS\system32\BOOTVID.dll
0xF85E7000 ACPI.sys
0xF8B38000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF85D6000 pci.sys
0xF8636000 isapnp.sys
0xF8BFE000 pciide.sys
0xF88B6000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF8646000 MountMgr.sys
0xF85B7000 ftdisk.sys
0xF88BE000 PartMgr.sys
0xF8656000 VolSnap.sys
0xF859F000 atapi.sys
0xF88C6000 nvidesm.sys
0xF8587000 \WINDOWS\system32\drivers\SCSIPORT.SYS
0xF8666000 disk.sys
0xF8676000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF8567000 fltmgr.sys
0xF8555000 sr.sys
0xF8686000 PxHelp20.sys
0xF853E000 KSecDD.sys
0xF84B1000 Ntfs.sys
0xF8484000 NDIS.sys
0xF8A4A000 nv_agp.sys
0xF846A000 Mup.sys
0xF79D1000 \SystemRoot\System32\DRIVERS\amdk7.sys
0xF8A2E000 \SystemRoot\System32\DRIVERS\usbohci.sys
0xF772F000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF8A36000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF771B000 \SystemRoot\System32\DRIVERS\NVENET.sys
0xF8AEE000 \SystemRoot\system32\drivers\nvax.sys
0xF7658000 \SystemRoot\System32\DRIVERS\winachcf.sys
0xF8A3E000 \SystemRoot\System32\Drivers\Modem.SYS
0xF79C1000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF79B1000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF79A1000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF7635000 \SystemRoot\System32\DRIVERS\ks.sys
0xF88DE000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF7466000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
0xF7452000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF88E6000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF7991000 \SystemRoot\System32\DRIVERS\serial.sys
0xF8AFA000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF743E000 \SystemRoot\System32\DRIVERS\parport.sys
0xF7981000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF88EE000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF8B16000 \SystemRoot\System32\DRIVERS\gameenum.sys
0xF8CA0000 \SystemRoot\system32\drivers\msmpu401.sys
0xF741A000 \SystemRoot\system32\drivers\portcls.sys
0xF86C6000 \SystemRoot\system32\drivers\drmk.sys
0xF8CA1000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF86D6000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF8AFE000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF7403000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF86E6000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF86F6000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF88F6000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF73F2000 \SystemRoot\System32\DRIVERS\psched.sys
0xF8706000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF88FE000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF8906000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF8716000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF890E000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF8B90000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF7394000 \SystemRoot\System32\DRIVERS\update.sys
0xF8B12000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF8726000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF8B92000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF8736000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7359000 \SystemRoot\system32\drivers\nvapu.sys
0xF7290000 \SystemRoot\system32\drivers\nvmcp.sys
0xF8746000 \SystemRoot\system32\drivers\nvarm.sys
0xF8425000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF8916000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF8BB8000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8CCE000 \SystemRoot\System32\Drivers\Null.SYS
0xF8BBA000 \SystemRoot\System32\Drivers\Beep.SYS
0xF8926000 \SystemRoot\System32\drivers\vga.sys
0xF8BBC000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8BBE000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF892E000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF8936000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF8419000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xF615D000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xF6104000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xF8796000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xF60B4000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF893E000 \SystemRoot\System32\Drivers\AswRdr.SYS
0xF776F000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xF6092000 \SystemRoot\System32\drivers\afd.sys
0xF87A6000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF6067000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xF5FF7000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF87E6000 \SystemRoot\System32\Drivers\Fips.SYS
0xF5FD1000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF87F6000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF8CED000 \SystemRoot\System32\Drivers\BANTExt.sys
0xF5F7C000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF5EC7000 \SystemRoot\System32\Drivers\aswSnx.SYS
0xF897E000 \SystemRoot\System32\DRIVERS\USBSTOR.SYS
0xF60F4000 \SystemRoot\System32\Drivers\ASPI32.SYS
0xF8826000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xF8B2E000 \SystemRoot\System32\DRIVERS\hidusb.sys
0xF8876000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
0xF89DE000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xF8421000 \SystemRoot\System32\DRIVERS\mouhid.sys
0xEC2E8000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF2156000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0xF1FAE000 \SystemRoot\System32\Drivers\dump_nvidesm.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0xF1E9A000 \SystemRoot\System32\drivers\Dxapi.sys
0xF1F8E000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF2102000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF426000 \SystemRoot\System32\ATMFD.DLL
0xF0813000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xECEC8000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xEBE0C000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xF24DE000 \??\C:\WINDOWS\system32\MLPTDR_Q.sys
0xF8BC6000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEBDA7000 \SystemRoot\system32\drivers\wdmaud.sys
0xF79F1000 \SystemRoot\system32\drivers\sysaudio.sys
0xEBC09000 \SystemRoot\System32\DRIVERS\srv.sys
0xEBDD8000 \SystemRoot\System32\DRIVERS\mdmxsdk.sys
0xEC73F000 \SystemRoot\system32\SetupNT.sys
0xF21E6000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xEC41A000 \SystemRoot\System32\Drivers\HTTP.sys
0xEBDC8000 \SystemRoot\System32\DRIVERS\asyncmac.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 42):
0 System Idle Process
4 System
592 C:\WINDOWS\system32\smss.exe
640 csrss.exe
664 C:\WINDOWS\system32\winlogon.exe
708 C:\WINDOWS\system32\services.exe
720 C:\WINDOWS\system32\lsass.exe
876 C:\WINDOWS\system32\svchost.exe
952 svchost.exe
1048 C:\WINDOWS\system32\svchost.exe
1116 svchost.exe
1324 svchost.exe
1420 C:\Program Files\AVAST Software\Avast\AvastSvc.exe
1484 C:\WINDOWS\system32\spoolsv.exe
1976 C:\Program Files\Bonjour\mDNSResponder.exe
2032 C:\Program Files\Java\jre7\bin\jqs.exe
308 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
440 C:\Program Files\CDBurnerXP\NMSAccessU.exe
480 C:\WINDOWS\system32\nvsvc32.exe
580 C:\WINDOWS\system32\svchost.exe
856 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
1600 C:\WINDOWS\explorer.exe
1780 C:\WINDOWS\system32\rundll32.exe
1792 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
1800 C:\WINDOWS\system32\MSTMON_S.EXE
1872 C:\Program Files\Ask.com\Updater\Updater.exe
1888 C:\Program Files\Common Files\Java\Java Update\jusched.exe
176 C:\Program Files\AVAST Software\Avast\AvastUI.exe
184 C:\WINDOWS\system32\ctfmon.exe
272 C:\Program Files\NetWaiting\netwaiting.exe
384 C:\Program Files\Washer\washer.exe
352 C:\Program Files\WordWeb\wweb32.exe
2628 C:\WINDOWS\system32\taskmgr.exe
2948 C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
2988 C:\WINDOWS\system32\sndvol32.exe
3568 alg.exe
53912 C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
54204 C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
54212 C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
54640 C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
55004 C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
52540 C:\Documents and Settings\Peter\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\F: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: Maxtor 6Y060L0, Rev: YAR4
PhysicalDrive1 Model Number: WDC WD3200AAJB-00WGA, Rev: 00.0

Size Device Name MBR Status
——————————————–
57 GB \\.\PhysicalDrive0
Post #30
Hello peteinmaine

Upon re-checking the "Hide extensions for known file types" check box, it appears this problem no longer exists

I'm glad you got it sorted :)

The MBRCheck log is incomplete. Please post the remainder of the log along with the new aswMBR and OTL logs as requested.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI