What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slow. IE cannot display [Solved]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Post Merged


We look for post with 0 replies, so when you reply to your own topic, we assume you're being helped.

Please be patient, someone will assist you as soon as possible.



O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~2COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%system32Alg.exe,-112 (ALG) - Unknown owner - C:WindowsSystem32alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:Windowssystem32atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:Program FilesATI TechnologiesATI.ACEFuelFuel.Service.exe
O23 - Service: @%SystemRoot%system32efssvc.dll,-100 (EFS) - Unknown owner - C:WindowsSystem32lsass.exe (file missing)
O23 - Service: @%systemroot%system32fxsresm.dll,-118 (Fax) - Unknown owner - C:Windowssystem32fxssvc.exe (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:Program FilesNVIDIA CorporationNetworkAccessManagerbin32nSvcAppFlt.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:Program Files (x86)GoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:WindowsSystem32msdtc.exe (file missing)
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:Program Files (x86)Norton 360Engine20.1.0.24ccSvcHst.exe
O23 - Service: @%SystemRoot%System32netlogon.dll,-102 (Netlogon) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:Windowssystem32GameMon.des.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:Program FilesNVIDIA CorporationNetworkAccessManagerbin32nSvcIp.exe
O23 - Service: Overwolf Updater Service (OverwolfUpdaterService) - Overwolf Ltd - C:Program Files (x86)OverwolfOverwolfUpdater.exe
O23 - Service: @%systemroot%system32psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: @%systemroot%system32Locator.exe,-2 (RpcLocator) - Unknown owner - C:Windowssystem32locator.exe (file missing)
O23 - Service: @%SystemRoot%system32samsrv.dll,-1 (SamSs) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:ProgramDataSkypeToolbarsSkype C2C Servicec2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:Program Files (x86)SkypeUpdaterUpdater.exe
O23 - Service: @%SystemRoot%system32snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:WindowsSystem32snmptrap.exe (file missing)
O23 - Service: @%systemroot%system32spoolsv.exe,-1 (Spooler) - Unknown owner - C:WindowsSystem32spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%system32sppsvc.exe,-101 (sppsvc) - Unknown owner - C:Windowssystem32sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%system32ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:Windowssystem32UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%system32vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: @%SystemRoot%system32vds.exe,-100 (vds) - Unknown owner - C:WindowsSystem32vds.exe (file missing)
O23 - Service: @%systemroot%system32vssvc.exe,-102 (VSS) - Unknown owner - C:Windowssystem32vssvc.exe (file missing)
O23 - Service: @%SystemRoot%system32WatWatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:Windowssystem32WatWatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%system32wbengine.exe,-104 (wbengine) - Unknown owner - C:Windowssystem32wbengine.exe (file missing)
O23 - Service: @%Systemroot%system32wbemwmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:Windowssystem32wbemWmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%Windows Media Playerwmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:Program Files (x86)Windows Media Playerwmpnetwk.exe (file missing)

–
C:Windowssystem32wininit.exe
C:Windowssystem32lsm.exe
C:Windowssystem32svchost.exe -k DcomLaunch
C:Windowssystem32svchost.exe -k RPCSS
C:Windowssystem32atiesrxx.exe
C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted
C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted
C:Windowssystem32svchost.exe -k netsvcs
C:Windowssystem32svchost.exe -k LocalService
C:Windowssystem32svchost.exe -k NetworkService
C:Windowssystem32atieclxx.exe
C:WindowsSystem32spoolsv.exe
C:Windowssystem32svchost.exe -k LocalServiceNoNetwork
C:Program FilesATI TechnologiesATI.ACEFuelFuel.Service.exe
C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation
C:Program Files (x86)Norton 360Engine20.1.0.24ccSvcHst.exe
C:Program Files (x86)Microsoft Application Virtualization Clientsftvsa.exe
C:ProgramDataSkypeToolbarsSkype C2C Servicec2c_service.exe
C:Windowssystem32svchost.exe -k imgsvc
C:Program Files (x86)Microsoft Application Virtualization Clientsftlist.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerbin32nSvcAppFlt.exe
C:Program FilesNVIDIA CorporationNetworkAccessManagerbin32nSvcIp.exe
C:Windowssystem32taskhost.exe
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Program Files (x86)Common FilesMicrosoft SharedVirtualization HandlerCVHSVC.EXE
C:Program Files (x86)GoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program Files (x86)VIAVIAudioiVDeckVDeck.exe
C:Program Files (x86)ATI TechnologiesATI.ACECore-StaticMOM.exe
C:Program Files (x86)ATI TechnologiesATI.ACECore-StaticCCC.exe
C:Windowssystem32SearchIndexer.exe
C:Program FilesWindows Media Playerwmpnetwk.exe
C:WindowsMicrosoft.NetFramework64v3.0WPFPresentationFontCache.exe
C:UsersEvonneAppDataLocalAkamainetsession_win.exe
C:UsersEvonneAppDataLocalAkamainetsession_win.exe
C:WindowsSysWOW64MacromedFlashFlashUtil32_11_4_402_265_ActiveX.exe
C:Windowssystem32taskeng.exe
C:Program Files (x86)Internet Exploreriexplore.exe
C:Program Files (x86)Internet Exploreriexplore.exe
C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbarUser_32.exe
C:Windowssystem32SearchProtocolHost.exe
C:Windowssystem32SearchFilterHost.exe
C:Program Files (x86)Internet Exploreriexplore.exe
C:Windowssystem32DllHost.exe
C:Windowssystem32DllHost.exe
C:UsersEvonneAppDataLocalMicrosoftWindowsTemporary Internet FilesContent.IE55RUZO5SEdds.scr
C:Windowssystem32conhost.exe
C:Windowssystem32wbemwmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.cnn.com/
uDefault_Page_URL = hxxp://www.msn.com
mDefault_Page_URL = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride =
mWinlogon: Userinit=userinit.exe
BHO: Norton Identity Protection: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:Program Files (x86)Norton 360Engine20.1.0.24coIEPlg.dll
BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:Program Files (x86)Norton 360Engine20.1.0.24IPSIPSBHO.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbar_32.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbar_32.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:Program Files (x86)Norton 360Engine20.1.0.24coIEPlg.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [swg] "C:Program Files (x86)GoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe"
uRun: [msnmsgr] "C:Program Files (x86)Windows LiveMessengermsnmsgr.exe" /background
uRun: [Spotify] "C:UsersEvonneAppDataRoamingSpotifySpotify.exe" /uri spotify:autostart
uRun: [Akamai NetSession Interface] "C:UsersEvonneAppDataLocalAkamainetsession_win.exe"
uRun: [Skype] "C:Program Files (x86)SkypePhoneSkype.exe" /minimized /regrun
mRun: [HDAudDeck] C:Program Files (x86)VIAVIAudioiVDeckVDeck.exe -r
mRun: [APSDaemon] "C:Program Files (x86)Common FilesAppleApple Application SupportAPSDaemon.exe"
mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:Program Files (x86)AMD AVTbinkdbsync.exe" aml
mRun: [QuickTime Task] "C:Program Files (x86)QuickTimeQTTask.exe" -atboottime
mRun: [StartCCC] "C:Program Files (x86)ATI TechnologiesATI.ACECore-StaticCLIStart.exe" MSRun
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:Program Files (x86)Windows LiveWriterWriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:Program Files (x86)SkypeToolbarsInternet Explorerskypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~2COMMON~1SkypeSKYPE4~1.DLL
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbar_64.dll
BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:Program Files (x86)SkypeToolbarsInternet Explorer x64skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program Files (x86)GoogleGoogle ToolbarGoogleToolbar_64.dll
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;C:WindowsSystem32driversN360x641401000.018SymDS64.sys [2012-9-14 493216]
R0 SymEFA;Symantec Extended File Attributes;C:WindowsSystem32driversN360x641401000.018SymEFA64.sys [2012-9-14 1132192]
R1 ccSet_N360;Norton 360 Settings Manager;C:WindowsSystem32driversN360x641401000.018ccSetx64.sys [2012-9-14 168096]
R1 IDSVia64;IDSVia64;C:ProgramDataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}N360_20.1.0.24DefinitionsIPSDefs20120811.001IDSVia64.sys [2012-9-14 512672]
R1 SymIRON;Symantec Iron Driver;C:WindowsSystem32driversN360x641401000.018Ironx64.sys [2012-9-14 224416]
R1 SymNetS;Symantec Network Security WFP Driver;C:WindowsSystem32driversN360x641401000.018symnets.sys [2012-9-14 432800]
R2 AMD External Events Utility;AMD External Events Utility;C:WindowsSystem32atiesrxx.exe [2012-7-27 239616]
R2 AMD FUEL Service;AMD FUEL Service;C:Program FilesATI TechnologiesATI.ACEFuelFuel.Service.exe [2012-8-6 361984]
R2 AODDriver4.01;AODDriver4.01;C:Program FilesATI TechnologiesATI.ACEFuelamd64aoddriver2.sys [2012-3-5 53888]
R2 cvhsvc;Client Virtualization Handler;C:Program Files (x86)Common Filesmicrosoft sharedVirtualization HandlerCVHSVC.EXE [2012-1-4 822624]
R2 N360;Norton 360;C:Program Files (x86)Norton 360Engine20.1.0.24ccSvcHst.exe [2012-9-14 143928]
R2 sftlist;Application Virtualization Client;C:Program Files (x86)Microsoft Application Virtualization Clientsftlist.exe [2011-10-1 508776]
R2 Skype C2C Service;Skype C2C Service;C:ProgramDataSkypeToolbarsSkype C2C Servicec2c_service.exe [2012-8-13 3064000]
R3 amdiox64;AMD IO Driver;C:WindowsSystem32driversamdiox64.sys [2011-6-22 46136]
R3 amdkmdag;amdkmdag;C:WindowsSystem32driversatikmdag.sys [2012-7-28 10278912]
R3 amdkmdap;amdkmdap;C:WindowsSystem32driversatikmpag.sys [2012-7-27 368640]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:WindowsSystem32driversAtihdW76.sys [2012-5-14 96896]
R3 Sftfs;Sftfs;C:WindowsSystem32driversSftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:WindowsSystem32driversSftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:WindowsSystem32driversSftredirlh.sys [2011-10-1 25960]
R3 Sftvol;Sftvol;C:WindowsSystem32driversSftvollh.sys [2011-10-1 22376]
R3 sftvsa;Application Virtualization Service Agent;C:Program Files (x86)Microsoft Application Virtualization Clientsftvsa.exe [2011-10-1 219496]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:WindowsSystem32driversviahduaa.sys [2011-6-22 1327520]
S1 BHDrvx64;BHDrvx64;C:ProgramDataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}N360_20.1.0.24DefinitionsBASHDefs20120815.002BHDrvx64.sys [2012-9-14 1385120]
S2 AODDriver4.1;AODDriver4.1;C:Program FilesATI TechnologiesATI.ACEFuelamd64aoddriver2.sys [2012-3-5 53888]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:WindowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:WindowsMicrosoft.NETFramework64v4.0.30319mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:Program Files (x86)GoogleUpdateGoogleUpdate.exe [2011-9-7 136176]
S2 SkypeUpdate;Skype Updater;C:Program Files (x86)SkypeUpdaterUpdater.exe [2012-7-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-4-5 250568]
S3 gupdatem;Google Update Service (gupdatem);C:Program Files (x86)GoogleUpdateGoogleUpdate.exe [2011-9-7 136176]
S3 npggsvc;nProtect GameGuard Service;C:Windowssystem32GameMon.des -service –> C:Windowssystem32GameMon.des -service [?]
S3 osppsvc;Office Software Protection Platform;C:Program FilesCommon FilesMicrosoft SharedOfficeSoftwareProtectionPlatformOSPPSVC.EXE [2010-1-9 4925184]
S3 OverwolfUpdaterService;Overwolf Updater Service;C:Program Files (x86)OverwolfOverwolfUpdater.exe [2012-5-15 18360]
S3 RTL8167;Realtek 8167 NT Driver;C:WindowsSystem32driversRt64win7.sys [2009-6-10 187392]
S3 TsUsbFlt;TsUsbFlt;C:WindowsSystem32driversTsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:WindowsSystem32driversTsUsbGD.sys [2010-11-20 31232]
S3 WatAdminSvc;Windows Activation Technologies Service;C:WindowsSystem32WatWatAdminSvc.exe [2011-7-19 1255736]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:WindowsSystem32driversyk62x64.sys [2009-6-10 389120]
.
=============== Created Last 30 ================
.
2012-09-19 18:06:22 388096 —-a-r- C:UsersEvonneAppDataRoamingMicrosoftInstaller{45A66726-69BC-466B-A7A4-12FCBA4883D7}HiJackThis.exe
2012-09-19 18:06:22 ——– d—–w- C:Program Files (x86)Trend Micro
2012-09-14 19:37:58 177312 —-a-w- C:WindowsSystem32driversSYMEVENT64x86.SYS
2012-09-14 19:37:58 ——– d—–w- C:Program FilesSymantec
2012-09-14 19:37:58 ——– d—–w- C:Program FilesCommon FilesSymantec Shared
2012-09-14 19:37:28 776352 —-a-r- C:WindowsSystem32driversN360x641401000.018srtsp64.sys
2012-09-14 19:37:28 493216 —-a-r- C:WindowsSystem32driversN360x641401000.018SymDS64.sys
2012-09-14 19:37:28 432800 —-a-r- C:WindowsSystem32driversN360x641401000.018symnets.sys
2012-09-14 19:37:28 37496 —-a-r- C:WindowsSystem32driversN360x641401000.018srtspx64.sys
2012-09-14 19:37:28 23448 —-a-r- C:WindowsSystem32driversN360x641401000.018SymELAM.sys
2012-09-14 19:37:28 224416 —-a-r- C:WindowsSystem32driversN360x641401000.018Ironx64.sys
2012-09-14 19:37:28 168096 —-a-r- C:WindowsSystem32driversN360x641401000.018ccSetx64.sys
2012-09-14 19:37:28 1132192 —-a-r- C:WindowsSystem32driversN360x641401000.018SymEFA64.sys
2012-09-14 19:36:55 ——– d—–w- C:WindowsSystem32driversN360x641401000.018
2012-09-14 19:36:55 ——– d—–w- C:WindowsSystem32driversN360x64
2012-09-14 19:36:54 ——– d—–w- C:Program Files (x86)Norton 360
2012-09-14 16:32:00 9310152 —-a-w- C:PROGRA~3MicrosoftWindows DefenderDefinition Updates{353EF65E-2E18-46AD-866B-42229F09E872}mpengine.dll
2012-09-13 20:19:28 ——– d—–w- C:PROGRA~3Symantec
2012-09-13 20:19:01 ——– d—–w- C:Program Files (x86)NortonInstaller
2012-09-12 15:32:35 950128 —-a-w- C:WindowsSystem32driversndis.sys
2012-09-12 15:32:35 41472 —-a-w- C:WindowsSystem32driversRNDISMP.sys
2012-09-12 15:32:34 574464 —-a-w- C:WindowsSystem32d3d10level9.dll
2012-09-12 15:32:34 490496 —-a-w- C:WindowsSysWow64d3d10level9.dll
2012-09-12 15:32:32 376688 —-a-w- C:WindowsSystem32driversnetio.sys
2012-09-12 15:32:32 288624 —-a-w- C:WindowsSystem32driversFWPKCLNT.SYS
2012-09-12 15:32:32 1913200 —-a-w- C:WindowsSystem32driverstcpip.sys
2012-09-04 21:20:26 ——– d—–w- C:UsersEvonneAppDataLocalCrashRpt
2012-09-04 21:20:24 4687672 —-a-w- C:WindowsSysWow64GameMon.des
2012-09-04 21:20:06 ——– d—–w- C:Program FilesCommon FilesINCA Shared
2012-08-31 18:44:31 4278384 —-a-w- C:PROGRA~3MicrosofteHomePackagesMCEClientUXUpdateableMarkup-2markup.dll
2012-08-31 18:44:18 42776 —-a-w- C:PROGRA~3MicrosofteHomePackagesMCEClientUXdSM-2StartResources.dll
2012-08-29 16:07:25 ——– d—–w- C:Program Files (x86)AMD APP
2012-08-28 19:27:11 ——– d—–w- C:SEVENCORE
2012-08-28 19:21:25 ——– d—–w- C:PROGRA~3Overwolf
.
==================== Find3M ====================
.
2012-08-23 16:00:28 73416 —-a-w- C:WindowsSysWow64FlashPlayerCPLApp.cpl
2012-08-23 16:00:28 696520 —-a-w- C:WindowsSysWow64FlashPlayerApp.exe
2012-07-28 04:09:20 5538984 —-a-w- C:WindowsSysWow64atiumdag.dll
2012-07-28 04:07:44 10278912 —-a-w- C:WindowsSystem32driversatikmdag.sys
2012-07-28 03:43:12 70144 —-a-w- C:WindowsSystem32coinst_8.982.dll
2012-07-28 03:19:34 24935424 —-a-w- C:WindowsSystem32atio6axx.dll
2012-07-28 02:50:10 20546560 —-a-w- C:WindowsSysWow64atioglxx.dll
2012-07-28 02:47:40 187392 —-a-w- C:WindowsSystem32clinfo.exe
2012-07-28 02:47:24 75776 —-a-w- C:WindowsSystem32OpenVideo64.dll
2012-07-28 02:47:16 65024 —-a-w- C:WindowsSysWow64OpenVideo.dll
2012-07-28 02:47:10 63488 —-a-w- C:WindowsSystem32OVDecode64.dll
2012-07-28 02:47:06 56320 —-a-w- C:WindowsSysWow64OVDecode.dll
2012-07-28 02:46:56 16464896 —-a-w- C:WindowsSystem32amdocl64.dll
2012-07-28 02:46:06 13013504 —-a-w- C:WindowsSysWow64amdocl.dll
2012-07-28 02:15:50 163840 —-a-w- C:WindowsSystem32atiapfxx.exe
2012-07-28 02:15:42 931328 —-a-w- C:WindowsSysWow64aticfx32.dll
2012-07-28 02:13:56 1100288 —-a-w- C:WindowsSystem32aticfx64.dll
2012-07-28 02:10:40 442368 —-a-w- C:WindowsSystem32ATIDEMGX.dll
2012-07-28 02:10:34 534528 —-a-w- C:WindowsSystem32atieclxx.exe
2012-07-28 02:09:44 239616 —-a-w- C:WindowsSystem32atiesrxx.exe
2012-07-28 02:08:20 120320 —-a-w- C:WindowsSystem32atitmm64.dll
2012-07-28 02:08:04 21504 —-a-w- C:WindowsSystem32atimuixx.dll
2012-07-28 02:07:58 59392 —-a-w- C:WindowsSystem32atiedu64.dll
2012-07-28 02:07:52 43520 —-a-w- C:WindowsSysWow64ati2edxx.dll
2012-07-28 02:07:10 6430208 —-a-w- C:WindowsSysWow64atidxx32.dll
2012-07-28 01:51:12 7052288 —-a-w- C:WindowsSystem32atidxx64.dll
2012-07-28 01:41:32 4266496 —-a-w- C:WindowsSystem32atiumd6a.dll
2012-07-28 01:35:10 51200 —-a-w- C:WindowsSystem32aticalrt64.dll
2012-07-28 01:35:08 46080 —-a-w- C:WindowsSysWow64aticalrt.dll
2012-07-28 01:35:02 44544 —-a-w- C:WindowsSystem32aticalcl64.dll
2012-07-28 01:35:00 44032 —-a-w- C:WindowsSysWow64aticalcl.dll
2012-07-28 01:34:48 16034304 —-a-w- C:WindowsSystem32aticaldd64.dll
2012-07-28 01:32:32 4751872 —-a-w- C:WindowsSysWow64atiumdva.dll
2012-07-28 01:30:10 13605888 —-a-w- C:WindowsSysWow64aticaldd.dll
2012-07-28 01:25:52 6676480 —-a-w- C:WindowsSystem32atiumd64.dll
2012-07-28 01:15:32 540160 —-a-w- C:WindowsSystem32atiadlxx.dll
2012-07-28 01:15:22 368640 —-a-w- C:WindowsSysWow64atiadlxy.dll
2012-07-28 01:15:12 17920 —-a-w- C:WindowsSystem32atig6pxx.dll
2012-07-28 01:15:08 14848 —-a-w- C:WindowsSysWow64atiglpxx.dll
2012-07-28 01:15:08 14848 —-a-w- C:WindowsSystem32atiglpxx.dll
2012-07-28 01:15:04 41984 —-a-w- C:WindowsSystem32atig6txx.dll
2012-07-28 01:14:56 33280 —-a-w- C:WindowsSysWow64atigktxx.dll
2012-07-28 01:14:46 368640 —-a-w- C:WindowsSystem32driversatikmpag.sys
2012-07-28 01:13:54 129536 —-a-w- C:WindowsSystem32atiuxp64.dll
2012-07-28 01:13:48 109568 —-a-w- C:WindowsSysWow64atiuxpag.dll
2012-07-28 01:13:40 103936 —-a-w- C:WindowsSystem32atiu9p64.dll
2012-07-28 01:13:32 83456 —-a-w- C:WindowsSysWow64atiu9pag.dll
2012-07-28 01:12:54 53248 —-a-w- C:WindowsSystem32driversati2erec.dll
2012-07-28 01:08:42 56320 —-a-w- C:WindowsSystem32atimpc64.dll
2012-07-28 01:08:42 56320 —-a-w- C:WindowsSystem32amdpcom64.dll
2012-07-28 01:08:36 56832 —-a-w- C:WindowsSysWow64atimpc32.dll
2012-07-28 01:08:36 56832 —-a-w- C:WindowsSysWow64amdpcom32.dll
2012-07-18 18:15:06 3148800 —-a-w- C:WindowsSystem32win32k.sys
2012-07-04 22:13:27 59392 —-a-w- C:WindowsSystem32browcli.dll
2012-07-04 22:13:27 136704 —-a-w- C:WindowsSystem32browser.dll
2012-07-04 21:14:34 41984 —-a-w- C:WindowsSysWow64browcli.dll
2012-06-29 03:56:34 2312704 —-a-w- C:WindowsSystem32jscript9.dll
2012-06-29 03:49:11 1392128 —-a-w- C:WindowsSystem32wininet.dll
2012-06-29 03:48:07 1494528 —-a-w- C:WindowsSystem32inetcpl.cpl
2012-06-29 03:43:49 173056 —-a-w- C:WindowsSystem32ieUnatt.exe
2012-06-29 03:39:48 2382848 —-a-w- C:WindowsSystem32mshtml.tlb
2012-06-29 00:16:58 1800704 —-a-w- C:WindowsSysWow64jscript9.dll
2012-06-29 00:09:01 1129472 —-a-w- C:WindowsSysWow64wininet.dll
2012-06-29 00:08:59 1427968 —-a-w- C:WindowsSysWow64inetcpl.cpl
2012-06-29 00:04:43 142848 —-a-w- C:WindowsSysWow64ieUnatt.exe
2012-06-29 00:00:45 2382848 —-a-w- C:WindowsSysWow64mshtml.tlb
.
============= FINISH: 15:06:56.74 ===============

shall i bump this?
Post #2
:welcome:

Run DDS and post a new log please and also explain what your experiencing to make you think your infected

Download DDS from one of the links below to your desktop

Link 1
Link 2

  • Double click the tool to run it.
  • A black Screen will open, just read the contents and do nothing.
  • When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
  • Copy/Paste the contents of 'DDS.txt' into your post.
  • 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)
Post #3
. DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 Run by [removed] at 12:13:30 on 2012-09-26 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4095.2762 [GMT -4:00] . SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\Windows\system32\taskhost.exe C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\SysWOW64\cmd.exe C:\Users\Evonne\AppData\Local\Akamai\netsession_win.exe C:\Users\Evonne\AppData\Local\Akamai\netsession_win.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\wuauclt.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_265_ActiveX.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.cnn.com/ uDefault_Page_URL = hxxp://www.msn.com mDefault_Page_URL = hxxp://www.msn.com mStart Page = hxxp://www.msn.com uInternet Settings,ProxyOverride = mWinlogon: Userinit=userinit.exe BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background uRun: [Spotify] "C:\Users\Evonne\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart uRun: [Akamai NetSession Interface] "C:\Users\Evonne\AppData\Local\Akamai\netsession_win.exe" uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{B361A1BC-CDA8-4F02-AD96-E504C62A534F} : DhcpNameServer = 75.75.75.75 75.75.76.76 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO-X64: SkypeIEPluginBHO - No File TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File mRun-x64: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun . ============= SERVICES / DRIVERS =============== . R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?] R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-8-6 361984] R2 AODDriver4.01;AODDriver4.01;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-3-5 53888] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-8-13 3064000] R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys –> C:\Windows\system32\DRIVERS\amdiox64.sys [?] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys –> C:\Windows\system32\drivers\AtihdW76.sys [?] R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys –> C:\Windows\system32\DRIVERS\Sftfslh.sys [?] R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys –> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?] R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys –> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?] R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys –> C:\Windows\system32\DRIVERS\Sftvollh.sys [?] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\system32\drivers\viahduaa.sys –> C:\Windows\system32\drivers\viahduaa.sys [?] S2 AODDriver4.1;AODDriver4.1;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-3-5 53888] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-7 136176] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-5 250568] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-7 136176] S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service –> C:\Windows\system32\GameMon.des -service [?] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 OverwolfUpdaterService;Overwolf Updater Service;C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2012-5-15 18360] S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys –> C:\Windows\system32\drivers\TsUsbGD.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?] . =============== Created Last 30 ================ . 2012-09-25 15:56:43 9308616 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2BA0B841-B5AE-4C03-BA81-F4ADB57919BA}\mpengine.dll 2012-09-19 18:06:22 ——– d—–w- C:\Program Files (x86)\Trend Micro 2012-09-14 19:37:58 ——– d—–w- C:\Program Files\Symantec 2012-09-14 19:37:58 ——– d—–w- C:\Program Files\Common Files\Symantec Shared 2012-09-14 19:36:55 ——– d—–w- C:\Windows\System32\drivers\N360x64\1401000.018 2012-09-14 19:36:55 ——– d—–w- C:\Windows\System32\drivers\N360x64 2012-09-14 19:36:54 ——– d—–w- C:\Program Files (x86)\Norton 360 2012-09-13 20:19:28 ——– d—–w- C:\ProgramData\Symantec 2012-09-13 20:19:02 ——– d—–w- C:\Windows\System32\drivers\NSSx64\0307020.005 2012-09-13 20:19:02 ——– d—–w- C:\Windows\System32\drivers\NSSx64 2012-09-13 20:19:02 ——– d—–w- C:\Program Files (x86)\Norton Security Scan 2012-09-13 20:19:01 ——– d—–w- C:\Program Files (x86)\NortonInstaller 2012-09-12 15:32:35 950128 —-a-w- C:\Windows\System32\drivers\ndis.sys 2012-09-12 15:32:35 41472 —-a-w- C:\Windows\System32\drivers\RNDISMP.sys 2012-09-12 15:32:34 574464 —-a-w- C:\Windows\System32\d3d10level9.dll 2012-09-12 15:32:34 490496 —-a-w- C:\Windows\SysWow64\d3d10level9.dll 2012-09-12 15:32:32 376688 —-a-w- C:\Windows\System32\drivers\netio.sys 2012-09-12 15:32:32 288624 —-a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS 2012-09-12 15:32:32 1913200 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2012-09-04 21:20:26 ——– d—–w- C:\Users\Evonne\AppData\Local\CrashRpt 2012-09-04 21:20:24 4687672 —-a-w- C:\Windows\SysWow64\GameMon.des 2012-09-04 21:20:06 ——– d—–w- C:\Program Files\Common Files\INCA Shared 2012-08-31 18:44:31 4278384 —-a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2012-08-31 18:44:18 42776 —-a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2012-08-29 16:07:25 ——– d—–w- C:\Program Files (x86)\AMD APP 2012-08-28 19:21:25 ——– d—–w- C:\ProgramData\Overwolf . ==================== Find3M ==================== . 2012-08-24 10:31:32 2312704 —-a-w- C:\Windows\System32\jscript9.dll 2012-08-24 10:21:18 1392128 —-a-w- C:\Windows\System32\wininet.dll 2012-08-24 10:20:11 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-08-24 10:14:45 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2012-08-24 10:13:29 599040 —-a-w- C:\Windows\System32\vbscript.dll 2012-08-24 10:09:42 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-08-24 06:59:17 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-08-24 06:51:27 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-08-24 06:51:02 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-08-24 06:47:26 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-08-24 06:47:12 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll 2012-08-24 06:43:58 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-08-23 16:00:28 73416 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-08-23 16:00:28 696520 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-07-28 04:09:20 5538984 —-a-w- C:\Windows\SysWow64\atiumdag.dll 2012-07-28 04:07:44 10278912 —-a-w- C:\Windows\System32\drivers\atikmdag.sys 2012-07-28 03:43:12 70144 —-a-w- C:\Windows\System32\coinst_8.982.dll 2012-07-28 03:19:34 24935424 —-a-w- C:\Windows\System32\atio6axx.dll 2012-07-28 02:50:10 20546560 —-a-w- C:\Windows\SysWow64\atioglxx.dll 2012-07-28 02:47:40 187392 —-a-w- C:\Windows\System32\clinfo.exe 2012-07-28 02:47:24 75776 —-a-w- C:\Windows\System32\OpenVideo64.dll 2012-07-28 02:47:16 65024 —-a-w- C:\Windows\SysWow64\OpenVideo.dll 2012-07-28 02:47:10 63488 —-a-w- C:\Windows\System32\OVDecode64.dll 2012-07-28 02:47:06 56320 —-a-w- C:\Windows\SysWow64\OVDecode.dll 2012-07-28 02:46:56 16464896 —-a-w- C:\Windows\System32\amdocl64.dll 2012-07-28 02:46:06 13013504 —-a-w- C:\Windows\SysWow64\amdocl.dll 2012-07-28 02:15:50 163840 —-a-w- C:\Windows\System32\atiapfxx.exe 2012-07-28 02:15:42 931328 —-a-w- C:\Windows\SysWow64\aticfx32.dll 2012-07-28 02:13:56 1100288 —-a-w- C:\Windows\System32\aticfx64.dll 2012-07-28 02:10:40 442368 —-a-w- C:\Windows\System32\ATIDEMGX.dll 2012-07-28 02:10:34 534528 —-a-w- C:\Windows\System32\atieclxx.exe 2012-07-28 02:09:44 239616 —-a-w- C:\Windows\System32\atiesrxx.exe 2012-07-28 02:08:20 120320 —-a-w- C:\Windows\System32\atitmm64.dll 2012-07-28 02:08:04 21504 —-a-w- C:\Windows\System32\atimuixx.dll 2012-07-28 02:07:58 59392 —-a-w- C:\Windows\System32\atiedu64.dll 2012-07-28 02:07:52 43520 —-a-w- C:\Windows\SysWow64\ati2edxx.dll 2012-07-28 02:07:10 6430208 —-a-w- C:\Windows\SysWow64\atidxx32.dll 2012-07-28 01:51:12 7052288 —-a-w- C:\Windows\System32\atidxx64.dll 2012-07-28 01:41:32 4266496 —-a-w- C:\Windows\System32\atiumd6a.dll 2012-07-28 01:35:10 51200 —-a-w- C:\Windows\System32\aticalrt64.dll 2012-07-28 01:35:08 46080 —-a-w- C:\Windows\SysWow64\aticalrt.dll 2012-07-28 01:35:02 44544 —-a-w- C:\Windows\System32\aticalcl64.dll 2012-07-28 01:35:00 44032 —-a-w- C:\Windows\SysWow64\aticalcl.dll 2012-07-28 01:34:48 16034304 —-a-w- C:\Windows\System32\aticaldd64.dll 2012-07-28 01:32:32 4751872 —-a-w- C:\Windows\SysWow64\atiumdva.dll 2012-07-28 01:30:10 13605888 —-a-w- C:\Windows\SysWow64\aticaldd.dll 2012-07-28 01:25:52 6676480 —-a-w- C:\Windows\System32\atiumd64.dll 2012-07-28 01:15:32 540160 —-a-w- C:\Windows\System32\atiadlxx.dll 2012-07-28 01:15:22 368640 —-a-w- C:\Windows\SysWow64\atiadlxy.dll 2012-07-28 01:15:12 17920 —-a-w- C:\Windows\System32\atig6pxx.dll 2012-07-28 01:15:08 14848 —-a-w- C:\Windows\SysWow64\atiglpxx.dll 2012-07-28 01:15:08 14848 —-a-w- C:\Windows\System32\atiglpxx.dll 2012-07-28 01:15:04 41984 —-a-w- C:\Windows\System32\atig6txx.dll 2012-07-28 01:14:56 33280 —-a-w- C:\Windows\SysWow64\atigktxx.dll 2012-07-28 01:14:46 368640 —-a-w- C:\Windows\System32\drivers\atikmpag.sys 2012-07-28 01:13:54 129536 —-a-w- C:\Windows\System32\atiuxp64.dll 2012-07-28 01:13:48 109568 —-a-w- C:\Windows\SysWow64\atiuxpag.dll 2012-07-28 01:13:40 103936 —-a-w- C:\Windows\System32\atiu9p64.dll 2012-07-28 01:13:32 83456 —-a-w- C:\Windows\SysWow64\atiu9pag.dll 2012-07-28 01:12:54 53248 —-a-w- C:\Windows\System32\drivers\ati2erec.dll 2012-07-28 01:08:42 56320 —-a-w- C:\Windows\System32\atimpc64.dll 2012-07-28 01:08:42 56320 —-a-w- C:\Windows\System32\amdpcom64.dll 2012-07-28 01:08:36 56832 —-a-w- C:\Windows\SysWow64\atimpc32.dll 2012-07-28 01:08:36 56832 —-a-w- C:\Windows\SysWow64\amdpcom32.dll 2012-07-18 18:15:06 3148800 —-a-w- C:\Windows\System32\win32k.sys 2012-07-04 22:13:27 59392 —-a-w- C:\Windows\System32\browcli.dll 2012-07-04 22:13:27 136704 —-a-w- C:\Windows\System32\browser.dll 2012-07-04 21:14:34 41984 —-a-w- C:\Windows\SysWow64\browcli.dll . ============= FINISH: 12:13:54.35 =============== I should mention that anything called sevencore is a game. Thanks for doing this.
Post #4
Hi,

Run this scans please and post the logs


Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]






Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please





OTL by OldTimer
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Click the "Scan All Users" checkbox.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Post #5
Is this right? it looks so short: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-09-26 14:11:24 —————————– 14:11:24.529 OS Version: Windows x64 6.1.7601 Service Pack 1 14:11:24.529 Number of processors: 2 586 0x603 14:11:24.529 ComputerName: EVONNE-PC UserName: Evonne 14:11:25.574 Initialize success 14:14:06.306 AVAST engine defs: 12092600 14:15:13.281 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005a 14:15:13.296 Disk 0 Vendor: WDC_WD50 15.0 Size: 476940MB BusType: 3 14:15:13.312 Disk 0 MBR read successfully 14:15:13.312 Disk 0 MBR scan 14:15:13.328 Disk 0 Windows 7 default MBR code 14:15:13.328 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 14:15:13.343 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848 14:15:13.374 Disk 0 scanning C:\Windows\system32\drivers 14:15:19.818 Service scanning 14:15:35.356 Modules scanning 14:15:35.371 Disk 0 trace - called modules: 14:15:35.387 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys 14:15:35.387 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004bdb060] 14:15:35.387 3 CLASSPNP.SYS[fffff8800140143f] -> nt!IofCallDriver -> [0xfffffa80047c1230] 14:15:35.403 5 ACPI.sys[fffff88000f677a1] -> nt!IofCallDriver -> \Device\0000005a[0xfffffa80047c2060] 14:15:37.072 AVAST engine scan C:\Windows 14:15:39.568 AVAST engine scan C:\Windows\system32 14:17:31.223 AVAST engine scan C:\Windows\system32\drivers 14:17:38.602 AVAST engine scan C:\Users\Evonne 14:18:58.242 Disk 0 MBR has been saved successfully to "C:\Users\Evonne\Desktop\MBR.dat" 14:18:58.242 The log file has been saved successfully to "C:\Users\Evonne\Desktop\aswMBR.txt" Working on malawarebytes.
Post #6
Malwarebytes Anti-Malware (Trial) 1.65.0.1400 www.malwarebytes.org Database version: v2012.09.26.10 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Evonne :: EVONNE-PC [administrator] Protection: Enabled 9/26/2012 2:21:40 PM mbam-log-2012-09-26 (14-21-40).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 196618 Time elapsed: 1 minute(s), 47 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
Post #7
You did just fine, aswMBR checks for rootkits and it found none, Malwarebytes checks for malicious files and what not and found none, lets see what OTL finds , even if nothing bad we will use it to clean you up a bit and it may make a difference
Post #10
You need to right click on the program and select RUN AS ADMINISTRATOR

Also, try running it in Safemode


To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
Tutorial if you need it How to boot into Safemode
Post #11
Got it, thank you.

OTL logfile created on: 9/27/2012 12:41:21 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Evonne\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.60 Gb Available Physical Memory | 65.02% Memory free
8.00 Gb Paging File | 6.33 Gb Available in Paging File | 79.20% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 370.57 Gb Free Space | 79.58% Space Free | Partition Type: NTFS
Drive D: | 2.80 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: EVONNE-PC | User Name: Evonne | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/27 12:41:12 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Evonne\Desktop\OTL.exe
PRC - [2012/09/07 17:04:46 | 000,676,936 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/09/07 17:04:46 | 000,399,432 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/09/07 17:04:44 | 000,766,536 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/08/25 16:43:02 | 000,307,856 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
PRC - [2012/08/23 12:00:28 | 000,690,888 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_265_ActiveX.exe
PRC - [2012/08/13 13:33:30 | 003,064,000 | —- | M] (Skype Technologies S.A.) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/03/13 05:38:08 | 003,331,872 | —- | M] (Akamai Technologies, Inc) – C:\Users\Evonne\AppData\Local\Akamai\netsession_win.exe
PRC - [2011/10/01 09:30:22 | 000,219,496 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:18 | 000,508,776 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/11/20 23:24:03 | 000,302,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysWOW64\cmd.exe


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV:64bit: - [2012/08/06 12:24:22 | 000,361,984 | —- | M] (Advanced Micro Devices, Inc.) [Auto | Running] – C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe – (AMD FUEL Service)
SRV:64bit: - [2012/07/27 22:09:44 | 000,239,616 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2010/01/21 04:53:42 | 000,496,232 | —- | M] () [Auto | Running] – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe – (ForceWare Intelligent Application Manager (IAM)
SRV:64bit: - [2010/01/21 04:53:42 | 000,209,000 | —- | M] () [Auto | Running] – C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe – (nSvcIp)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2012/09/07 17:04:46 | 000,676,936 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/09/07 17:04:46 | 000,399,432 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2012/08/23 12:00:29 | 000,250,568 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/13 13:33:30 | 003,064,000 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/05/16 00:59:00 | 004,687,672 | —- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] – C:\Windows\SysWOW64\GameMon.des – (npggsvc)
SRV - [2012/05/09 19:47:36 | 000,018,360 | —- | M] (Overwolf Ltd) [On_Demand | Stopped] – C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe – (OverwolfUpdaterService)
SRV - [2011/10/01 09:30:22 | 000,219,496 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe – (sftvsa)
SRV - [2011/10/01 09:30:18 | 000,508,776 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe – (sftlist)
SRV - [2010/03/18 14:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 17:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/09/07 17:04:46 | 000,025,928 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\mbam.sys – (MBAMProtector)
DRV:64bit: - [2012/07/28 00:07:44 | 010,278,912 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (amdkmdag)
DRV:64bit: - [2012/07/27 21:14:46 | 000,368,640 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmpag.sys – (amdkmdap)
DRV:64bit: - [2012/05/14 02:12:30 | 000,096,896 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AtihdW76.sys – (AtiHDAudioService)
DRV:64bit: - [2012/03/05 16:04:30 | 000,053,888 | —- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] – C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys – (AODDriver4.1)
DRV:64bit: - [2012/03/05 16:04:30 | 000,053,888 | —- | M] (Advanced Micro Devices) [Kernel | Auto | Running] – C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys – (AODDriver4.01)
DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/10/01 09:30:22 | 000,022,376 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftvollh.sys – (Sftvol)
DRV:64bit: - [2011/10/01 09:30:18 | 000,268,648 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftplaylh.sys – (Sftplay)
DRV:64bit: - [2011/10/01 09:30:18 | 000,025,960 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftredirlh.sys – (Sftredir)
DRV:64bit: - [2011/10/01 09:30:10 | 000,764,264 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftfslh.sys – (Sftfs)
DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 23:24:33 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 23:23:47 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 23:23:47 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbGD.sys – (TsUsbGD)
DRV:64bit: - [2010/05/15 07:11:48 | 001,327,520 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\viahduaa.sys – (VIAHdAudAddService)
DRV:64bit: - [2010/03/04 06:26:58 | 000,349,416 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\nvmf6264.sys – (NVNET)
DRV:64bit: - [2010/02/18 12:18:24 | 000,046,136 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\amdiox64.sys – (amdiox64)
DRV:64bit: - [2009/07/15 23:38:40 | 000,015,416 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/10 16:35:42 | 000,187,392 | —- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2009/06/10 16:35:35 | 000,408,960 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\nvm62x64.sys – (NVENETFD)
DRV:64bit: - [2009/06/10 16:35:33 | 000,389,120 | —- | M] (Marvell) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2009/07/13 21:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{21A51130-7285-49FE-B3F6-2385CC71CDEA}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{21A51130-7285-49FE-B3F6-2385CC71CDEA}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…1I7GGHP_enUS448
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)



========== Chrome ==========

CHR - homepage: http://www.google.com
CHR - homepage: http://www.google.com
CHR - Extension: YouTube = C:\Users\Evonne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Evonne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: avast! WebRep = C:\Users\Evonne\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\
CHR - Extension: Skype Click to Call = C:\Users\Evonne\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.2.0.10687_0\
CHR - Extension: Norton Identity Protection = C:\Users\Evonne\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.1.0.32_0\
CHR - Extension: Gmail = C:\Users\Evonne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Evonne\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background File not found
O4 - HKCU..\Run: [Spotify] "C:\Users\Evonne\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B361A1BC-CDA8-4F02-AD96-E504C62A534F}: DhcpNameServer = 75.75.75.75 75.75.76.76
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/27 12:41:05 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Evonne\Desktop\OTL.exe
[2012/09/26 14:35:25 | 000,000,000 | —D | C] – C:\Users\Evonne\Desktop\scans
[2012/09/26 14:21:00 | 000,000,000 | —D | C] – C:\Users\Evonne\AppData\Roaming\Malwarebytes
[2012/09/26 14:20:57 | 000,025,928 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2012/09/26 14:20:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/26 14:20:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/09/26 14:20:57 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/09/26 11:45:08 | 000,245,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\OxpsConverter.exe
[2012/09/23 19:10:26 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/09/23 19:10:26 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/09/23 19:10:25 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/09/23 19:10:25 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/09/23 19:10:25 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/09/23 19:10:25 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/09/23 19:10:24 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/09/23 19:10:24 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/09/23 19:10:24 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/09/23 19:10:24 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/09/23 19:10:24 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/09/23 19:10:23 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/09/23 19:10:22 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/09/23 19:10:22 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/09/23 19:10:22 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/09/19 14:06:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2012/09/14 15:37:58 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2012/09/14 15:37:58 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2012/09/14 15:36:55 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\N360x64
[2012/09/14 15:36:55 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\N360x64\1401000.018
[2012/09/14 15:36:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\Norton 360
[2012/09/13 16:19:28 | 000,000,000 | —D | C] – C:\ProgramData\Symantec
[2012/09/13 16:19:02 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Scan
[2012/09/13 16:19:02 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\NSSx64
[2012/09/13 16:19:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\Norton Security Scan
[2012/09/13 16:19:02 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\NSSx64\0307020.005
[2012/09/13 16:19:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\NortonInstaller
[2012/09/12 11:32:35 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\RNDISMP.sys
[2012/09/12 11:32:34 | 000,574,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10level9.dll
[2012/09/12 11:32:32 | 000,376,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\netio.sys
[2012/09/12 11:32:32 | 000,288,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2012/09/04 17:20:26 | 000,000,000 | —D | C] – C:\Users\Evonne\AppData\Local\CrashRpt
[2012/09/04 17:20:24 | 004,687,672 | —- | C] (INCA Internet Co., Ltd.) – C:\Windows\SysWow64\GameMon.des
[2012/09/04 17:20:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\INCA Shared
[2012/08/29 12:07:29 | 000,000,000 | —D | C] – C:\ProgramData\ATI
[2012/08/29 12:07:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\AMD APP
[2012/08/29 12:07:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2012/08/28 15:21:25 | 000,000,000 | —D | C] – C:\ProgramData\Overwolf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/09/27 12:41:12 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Evonne\Desktop\OTL.exe
[2012/09/27 12:38:19 | 000,021,888 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/27 12:38:18 | 000,021,888 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/27 12:35:19 | 000,624,606 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/09/27 12:35:19 | 000,106,724 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/09/27 12:35:18 | 000,727,310 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/27 12:34:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/09/27 12:31:23 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/27 12:31:02 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/09/27 12:30:55 | 3220,615,168 | -HS- | M] () – C:\hiberfil.sys
[2012/09/26 18:46:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/26 16:45:00 | 000,000,450 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Evonne.job
[2012/09/23 11:24:52 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\N360x64\1401000.018\Cat.DB
[2012/09/13 16:13:29 | 000,000,036 | —- | M] () – C:\Users\Evonne\AppData\Local\housecall.guid.cache
[2012/09/07 17:04:46 | 000,025,928 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/09/23 11:24:52 | 000,000,000 | —- | C] () – C:\Windows\SysNative\drivers\N360x64\1401000.018\Cat.DB
[2012/09/13 16:19:28 | 000,000,450 | -H– | C] () – C:\Windows\tasks\Norton Security Scan for Evonne.job
[2012/09/13 16:19:02 | 000,000,172 | —- | C] () – C:\Windows\SysNative\drivers\NSSx64\0307020.005\isolate.ini
[2012/09/13 16:13:29 | 000,000,036 | —- | C] () – C:\Users\Evonne\AppData\Local\housecall.guid.cache
[2012/08/18 12:10:15 | 000,000,168 | —- | C] () – C:\Windows\maxlink.ini
[2012/04/25 12:43:52 | 3048,533,519 | —- | C] () – C:\Users\Evonne\SevenSoulsOnline_full_20120305.7z
[2012/04/25 12:43:49 | 000,394,848 | —- | C] () – C:\Users\Evonne\SevenSoulsOnline_full_20120305.exe
[2012/03/09 00:31:26 | 000,204,952 | —- | C] () – C:\Windows\SysWow64\ativvsvl.dat
[2012/03/09 00:31:26 | 000,157,144 | —- | C] () – C:\Windows\SysWow64\ativvsva.dat
[2012/02/10 14:55:44 | 000,743,066 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/31 07:00:24 | 000,016,896 | —- | C] () – C:\Windows\SysWow64\kdbsdk32.dll
[2011/10/26 01:21:34 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\OVDecoder.dll
[2011/09/12 18:06:16 | 000,003,917 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/06/22 02:26:53 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/06/22 02:25:49 | 000,003,972 | —- | C] () – C:\Windows\SysWow64\drivers\PciBus.sys
[2011/06/22 02:07:05 | 000,031,180 | —- | C] () – C:\Windows\Ascd_log.ini
[2011/06/22 02:06:47 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2011/06/22 02:06:42 | 000,023,465 | —- | C] () – C:\Windows\Ascd_tmp.ini

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 01:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 00:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 21:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 23:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 21:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
Post #12
This will clear you up some

Open OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :processes
killallprocesses

:OTL


:Services

:Reg

:Files
ipconfig /flushdns /c


:Commands
[purity]
[resethosts]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top. <–Not run Scan
  • Let the program run unhindered, reboot when it is done
  • Then post the results of the log it produces
Post #13
All processes killed
========== PROCESSES ==========
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Evonne\Desktop\scans\cmd.bat deleted successfully.
C:\Users\Evonne\Desktop\scans\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Evonne
->Temp folder emptied: 2125787531 bytes
->Temporary Internet Files folder emptied: 426982302 bytes
->Google Chrome cache emptied: 7463485 bytes
->Flash cache emptied: 14480 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 455327 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes
RecycleBin emptied: 23280609496 bytes

Total Files Cleaned = 24,644.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 09272012_152608

Files\Folders moved on Reboot…
C:\Users\Evonne\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI