Spyware / Malware / Virus Removal

Infected Sony Laptop [Solved]

26 min read

Looking for the outcome? Ask AI

Satchfan

Post #31October 14, 2012, 8:38 AM UTC

Hello again Penpen – thank you for your patience.

The MPEG4 music file may or may not be the culprit.

Did you download Addict Thing and sProtector knowingly?

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.searchonme.com/ IE - HKLM\..\SearchScopes\{624F0464-C722-4EC7-99FB-E4BCC314E2B3}: "URL" = http://search.yahoo.co.jp/search?&p={s…e7&ei=utf-8 IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.searchonme.com/ IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{09A8233A-8B2D-4B39-A897-A6E585EBE661}: "URL" = http://uk.search.yahoo.com/search/audio?ei…s}&fr=yessv IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{4D5CB369-D501-4641-AA1C-B3F63C4AF055}: "URL" = http://uk.news.search.yahoo.com/search/new…s}&fr=yessv IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{5E48C6CC-FEF8-491C-91C7-7EC8DEFBA5B2}: "URL" = http://uk.search.yahoo.com/search/video?ei…s}&fr=yessv IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{624F0464-C722-4EC7-99FB-E4BCC314E2B3}: "URL" = http://search.yahoo.co.jp/search?&p={s…e7&ei=utf-8 IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{6397F18E-6073-409C-BADF-780E6508CBCE}: "URL" = http://uk.local.yahoo.com/search.html?p={s…s=&fr=yessv IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{698A4840-AA4B-4577-BCBE-B05816A91D6F}: "URL" = http://uk.search.yahoo.com/search/images?e…s}&fr=yessv IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{C04AFA50-AFA3-4421-A83C-703F6E1E7144}: "URL" = http://uk.search.yahoo.com/search/dir?ei=U…s}&fr=yessv IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://uk.search.yahoo.com/search?p={searc…s}&fr=yessv IE - HKU\S-1-5-21-739007543-2237649779-995633458-1004\..\SearchScopes\{F211E784-4A3A-4E2C-874E-B6DA5D0CB473}: "URL" = http://shopping.yahoo.co.uk/ctl/do/search?…s}&fr=yessv FF - prefs.js..browser.search.defaultenginename: "SearchOnMe" FF - prefs.js..browser.search.defaultenginename,S: S", "SearchOnMe" FF - prefs.js..browser.search.defaulturl: "http://search.searchonme.com/?l=1&q=" FF - prefs.js..browser.search.order.1: "SearchOnMe" FF - prefs.js..browser.search.order.1,S: S", "SearchOnMe" FF - prefs.js..browser.search.selectedEngine,S: S", "SearchOnMe" FF - prefs.js..extensions.enabledItems: [removed]:1.1.3 [2012/10/11 11:43:54 | 000,007,756 | —- | M] () – C:\Users\Emi\AppData\Roaming\mozilla\firefox\profiles\bw6pfu9s.default\searchplugins\SearchOnMe.xml CHR - homepage: http://search.searchonme.com/ @Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0B4227B4 @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4 :Reg :Files ipconfig /flushdns /c :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

===================================================

Please run AdwCleaner again and select Delete. Send the new log

Logs to include in the next post:

OTL fix log
New OTL log
AdwCleaner[Rn].txt

Thanks

Satchfan

Penpen

Post #32October 14, 2012, 6:09 PM UTC

Hi, I'll post the OTL log first for now.

OTL
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{624F0464-C722-4EC7-99FB-E4BCC314E2B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{624F0464-C722-4EC7-99FB-E4BCC314E2B3}\ not found.
HKU\S-1-5-21-739007543-2237649779-995633458-1004\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{09A8233A-8B2D-4B39-A897-A6E585EBE661}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09A8233A-8B2D-4B39-A897-A6E585EBE661}\ not found.
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{4D5CB369-D501-4641-AA1C-B3F63C4AF055}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D5CB369-D501-4641-AA1C-B3F63C4AF055}\ not found.
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{5E48C6CC-FEF8-491C-91C7-7EC8DEFBA5B2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E48C6CC-FEF8-491C-91C7-7EC8DEFBA5B2}\ not found.
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{624F0464-C722-4EC7-99FB-E4BCC314E2B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{624F0464-C722-4EC7-99FB-E4BCC314E2B3}\ not found.
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{6397F18E-6073-409C-BADF-780E6508CBCE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6397F18E-6073-409C-BADF-780E6508CBCE}\ not found.
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{698A4840-AA4B-4577-BCBE-B05816A91D6F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{698A4840-AA4B-4577-BCBE-B05816A91D6F}\ not found.
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{C04AFA50-AFA3-4421-A83C-703F6E1E7144}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C04AFA50-AFA3-4421-A83C-703F6E1E7144}\ not found.
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ not found.
Registry key HKEY_USERS\S-1-5-21-739007543-2237649779-995633458-1004\Software\Microsoft\Internet Explorer\SearchScopes\{F211E784-4A3A-4E2C-874E-B6DA5D0CB473}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F211E784-4A3A-4E2C-874E-B6DA5D0CB473}\ not found.
Prefs.js: "SearchOnMe" removed from browser.search.defaultenginename
Prefs.js: S", "SearchOnMe" removed from browser.search.defaultenginename,S
Prefs.js: "http://search.searchonme.com/?l=1&q=" removed from browser.search.defaulturl
Prefs.js: "SearchOnMe" removed from browser.search.order.1
Prefs.js: S", "SearchOnMe" removed from browser.search.order.1,S
Prefs.js: S", "SearchOnMe" removed from browser.search.selectedEngine,S
Prefs.js: [removed]:1.1.3 removed from extensions.enabledItems
C:\Users\Emi\AppData\Roaming\mozilla\firefox\profiles\bw6pfu9s.default\searchplugins\SearchOnMe.xml moved successfully.
Use Chrome's Settings page to change the HomePage.
ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully.
Unable to delete ADS C:\ProgramData\TEMP:0B4227B4 .
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP 構成
DNS リゾルバキャッシュは正常にフラッシュされました。
C:\Users\Emi\Desktop\デスクトップ\cmd.bat deleted successfully.
C:\Users\Emi\Desktop\デスクトップ\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User

User: Emi
->Temp folder emptied: 308257 bytes
->Temporary Internet Files folder emptied: 79306493 bytes
->Java cache emptied: 24811 bytes
->FireFox cache emptied: 711365359 bytes
->Google Chrome cache emptied: 213309980 bytes
->Apple Safari cache emptied: 728064 bytes
->Flash cache emptied: 85399 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 68566 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 959.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 10142012_184302

Files\Folders moved on Reboot…
File\Folder C:\Windows\temp\JET730.tmp not found!

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Penpen

Post #33October 14, 2012, 6:25 PM UTC

Right then, here is the AdwCleaner.

AdwCleaner
# AdwCleaner v2.004 - Logfile created 10/14/2012 at 19:12:57
# Updated 06/10/2012 by Xplode
# Operating system : Windows Vista ™ Home Premium (32 bits)
# User : Emi - EMI-PC
# Boot Mode : Normal
# Running from : C:\Users\Emi\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Users\Emi\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Folder Deleted : C:\Users\Emi\AppData\Roaming\Mozilla\Firefox\Profiles\bw6pfu9s.default\FCTB

***** [Registry] *****

Key Deleted : HKLM\Software\Description

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.6000.17037

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0 (ja)

Profile name : default
File : C:\Users\Emi\AppData\Roaming\Mozilla\Firefox\Profiles\bw6pfu9s.default\prefs.js

Deleted : user_pref("aol_toolbar.default.homepage.check", false);
Deleted : user_pref("aol_toolbar.default.search.check", false);
Deleted : user_pref("extensions.506f531d51474.scode", "(function(){try{if('aol.com,mail.google.com,mystart.inc[…]
Deleted : user_pref("extensions.5071f293e68ec.scode", "(function(){try{if('aol.com,mail.google.com,mystart.inc[…]
Deleted : user_pref("extensions.5071f587bdd2f.scode", "(function(){try{if('aol.com,mail.google.com,mystart.inc[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.AutoSearchEventData", "auto%20search");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.ClearCacheDate", 14);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.DisplayEULA", true);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.DnsCatchEventData", "dns%20catch");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.EnableDCA", true);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.FirstLaunchShown", true);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.LoadLayoutDate.1", 14);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.NewTabSearchEventData", "tab%20search");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.ShowRecommendedOptions", true);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.StateReportDate", "1350237785191");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.TopRightSearchEventData", "top%20right%20search[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.beforeInstallSaved", true);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.beforeinstall.homepage", "chrome%3A//branding/l[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.beforeinstall.search", "Google");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.comp.search.MultiSearch.engine_im
g", "aHR0cDovL[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.comp.search.MultiSearch.engine_ur
l", "aHR0cDovL[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.comp.search.MultiSearch.text", "%u30A6%u30A7%u3[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.customNewTab", false);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.helpUsImprove", true);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.hideOthers", true);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.processAddrBar", false);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.restoreSearch", false);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.searchHistory", true);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.showFirstLaunchOptions", false);
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.tb_lang", "ja");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.tool_id", "1");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.user_id", "105170654");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.user_key", "77c74da1f666e52e99cf6b8af5c9ba13337[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.user_layouts", "1");
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.user_lnames", "%u697D%u5929%u30C4%u30FC%u30EB%u[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.xml_service_url", "df9d74e0be0b3087f8b4164d1c36[…]
Deleted : user_pref("freecause8b5bea8c61944c7ca440d5ca181480c3.yahooSearch", false);

-\\ Google Chrome v [Unable to get version]

File : C:\Users\Emi\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S2].txt - [14615 octets] - [11/10/2012 11:37:04]
AdwCleaner[S3].txt - [4710 octets] - [14/10/2012 19:12:58]

########## EOF - C:\AdwCleaner[S3].txt - [4770 octets] ##########

Penpen

Post #34October 14, 2012, 6:29 PM UTC

I was not aware that I downloaded Addict Thing and sProtector… I've got those two new logs I posted earlier and I haven't got another OTL, am I wrong? Thanks!

Satchfan

Post #35October 14, 2012, 9:50 PM UTC

You did everything perfectly.

I'd like a new log to see how things are.

open OTL again and click the Quick Scan button.
post the OTL.txt log it produces in your next reply.

Please also let me know how your computer is behaving.

Satchfan

Penpen

Post #36October 15, 2012, 8:00 AM UTC

Hi Satchfan

Sadly, I still get popups on Facebook and shopping sites ( and coupons at the bottom corner) , also underline texts with pop up adverts…

Here is the new log.

OTL
OTL logfile created on: 2012/10/15 8:28:44 - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Emi\Desktop\デスクトップ
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

1013.56 Mb Total Physical Memory | 445.08 Mb Available Physical Memory | 43.91% Memory free
2.24 Gb Paging File | 1.08 Gb Available in Paging File | 48.10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 85.71 Gb Total Space | 17.51 Gb Free Space | 20.43% Space Free | Partition Type: NTFS

Computer Name: EMI-PC | User Name: Emi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/13 15:51:17 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Emi\Desktop\デスクトップ\OTL.exe
PRC - [2012/07/31 03:37:02 | 002,596,984 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2012/07/26 03:23:08 | 000,758,392 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2012/06/13 03:48:24 | 001,255,544 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2012/02/14 04:53:38 | 000,193,288 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 04:52:38 | 000,338,784 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2012/01/23 05:43:08 | 000,247,728 | —- | M] (TomTom) – C:\Users\Emi\TomTom HOME 2\TomTomHOMERunner.exe
PRC - [2012/01/23 05:43:08 | 000,092,592 | —- | M] (TomTom) – C:\Users\Emi\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2011/11/03 17:20:58 | 000,803,144 | —- | M] (AVG) – C:\Program Files\AVG\AVG PC Tuneup\BoostSpeed.exe
PRC - [2011/07/29 00:08:12 | 001,259,376 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2008/10/29 07:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/08/24 12:59:10 | 000,870,240 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
PRC - [2007/02/06 04:36:22 | 000,090,112 | —- | M] (SigmaTel, Inc.) – C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
PRC - [2007/01/18 06:48:42 | 002,752,512 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2007/01/16 02:53:08 | 002,170,880 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
PRC - [2007/01/12 15:14:34 | 000,278,528 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
PRC - [2007/01/12 14:41:40 | 000,278,528 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2006/11/28 11:27:46 | 000,274,432 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
PRC - [2006/11/28 11:09:58 | 000,135,168 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
PRC - [2006/11/28 11:09:46 | 000,172,032 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
PRC - [2006/11/27 13:15:30 | 000,465,016 | —- | M] (Sony Corporation) – C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
PRC - [2006/11/24 09:58:38 | 000,919,672 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
PRC - [2006/11/24 02:36:54 | 000,182,392 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
PRC - [2006/11/24 02:36:54 | 000,100,472 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2006/11/14 02:46:24 | 000,411,768 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
PRC - [2006/11/13 10:43:36 | 000,472,632 | —- | M] () – C:\Program Files\Sony\SonicStage\SSAAD.exe
PRC - [2006/11/11 07:35:36 | 000,043,128 | —- | M] (Sony Corporation) – C:\Program Files\Sony\ISB Utility\ISBMgr.exe
PRC - [2006/11/02 10:44:59 | 000,068,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\conime.exe
PRC - [2006/10/31 14:40:16 | 000,077,824 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2006/10/27 12:13:48 | 000,270,336 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2006/10/13 02:34:56 | 000,448,632 | —- | M] (Sony Corporation) – C:\Program Files\Sony\SetGamma\SetGamma.exe
PRC - [2006/10/01 04:00:00 | 000,045,056 | —- | M] (Texim Corporarion.) – C:\Program Files\Justsystem\PersonalShelter\TxVDrvSvc.exe
PRC - [2006/09/27 07:25:40 | 004,038,656 | —- | M] (Sony Corporation) – C:\Program Files\Sony\FeliCa Sensing\FeliSen.exe
PRC - [2006/09/11 08:23:22 | 000,118,784 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\Apoint.exe
PRC - [2006/09/08 07:06:08 | 000,040,960 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\ApntEx.exe
PRC - [2006/09/08 06:54:30 | 000,042,544 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\ApMsgFwd.exe
PRC - [2006/02/06 15:00:20 | 000,311,296 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
PRC - [2006/01/23 15:14:10 | 000,069,632 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

========== Modules (No Company Name) ==========

MOD - [2011/11/03 17:21:06 | 000,350,024 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madExcept_.bpl
MOD - [2011/11/03 17:21:06 | 000,184,136 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madBasic_.bpl
MOD - [2011/11/03 17:21:06 | 000,050,504 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madDisAsm_.bpl
MOD - [2011/07/29 00:09:42 | 000,096,112 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011/07/29 00:08:12 | 001,259,376 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
MOD - [2011/06/24 22:56:36 | 000,087,328 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2006/11/14 02:46:24 | 000,040,960 | —- | M] () – C:\Program Files\Sony\VAIO Camera Utility\VCULib.dll
MOD - [2006/11/13 10:43:36 | 000,472,632 | —- | M] () – C:\Program Files\Sony\SonicStage\SSAAD.exe
MOD - [2006/11/13 06:20:07 | 000,061,440 | —- | M] () – C:\Windows\System32\igfxTMM.dll
MOD - [2006/11/13 06:20:00 | 000,077,824 | —- | M] () – C:\Windows\System32\hccutils.dll
MOD - [2006/09/29 14:20:18 | 000,096,352 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\plugins\device\usb.gp
MOD - [2006/09/29 14:20:10 | 000,137,312 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\plugins\command\basic.gp
MOD - [2006/09/29 14:20:00 | 000,383,072 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\rw.dll
MOD - [2006/09/29 14:19:56 | 000,190,560 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\felica.dll
MOD - [2005/07/22 13:30:20 | 000,065,536 | —- | M] () – C:\Windows\System32\TosCommAPI.dll
MOD - [2004/10/14 02:18:24 | 000,040,960 | —- | M] () – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtAfh.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe – (vToolbarUpdater12.2.6)
SRV - File not found [Auto | Stopped] – C:\Program Files\Spybot – (SBSDWSCService)
SRV - [2012/10/13 15:05:47 | 000,115,168 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/10/08 20:51:56 | 000,250,808 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/13 03:24:48 | 005,167,736 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] – C:\Program Files\AVG\AVG2012\avgidsagent.exe – (AVGIDSAgent)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/02/14 04:53:38 | 000,193,288 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2012/01/23 05:43:08 | 000,092,592 | —- | M] (TomTom) [Auto | Running] – C:\Users\Emi\TomTom HOME 2\TomTomHOMEService.exe – (TomTomHOMEService)
SRV - [2007/06/29 04:00:04 | 000,265,912 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/02/06 04:36:22 | 000,090,112 | —- | M] (SigmaTel, Inc.) [Auto | Running] – C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe – (STacSV)
SRV - [2007/01/10 08:51:06 | 000,745,472 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe – (VAIOMediaPlatform-UCLS-AppServer)
SRV - [2007/01/10 02:43:24 | 000,073,728 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe – (VAIO Entertainment TV Device Arbitration Service)
SRV - [2007/01/08 09:06:40 | 001,089,536 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-UCLS-UPnP)
SRV - [2007/01/08 09:06:40 | 001,089,536 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-IntegratedServer-UPnP)
SRV - [2007/01/08 09:06:40 | 000,397,312 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-UCLS-HTTP)
SRV - [2007/01/08 09:06:40 | 000,397,312 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-IntegratedServer-HTTP)
SRV - [2006/11/28 11:27:46 | 000,274,432 | —- | M] (Sony Corporation) [On_Demand | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe – (Vcsw)
SRV - [2006/11/28 11:09:58 | 000,135,168 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe – (VzFw)
SRV - [2006/11/28 11:09:46 | 000,172,032 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe – (VzCdbSvc)
SRV - [2006/11/27 09:14:44 | 000,413,696 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\Smart Network\BeService.exe – (BeService)
SRV - [2006/11/24 02:36:54 | 000,182,392 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Event Service\VESMgr.exe – (VAIO Event Service)
SRV - [2006/11/13 09:31:22 | 000,069,632 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe – (SSScsiSV)
SRV - [2006/10/31 14:40:16 | 000,077,824 | —- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe – (TOSHIBA Bluetooth Service)
SRV - [2006/10/24 02:32:08 | 002,523,136 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe – (VAIOMediaPlatform-IntegratedServer-AppServer)
SRV - [2006/10/04 10:25:00 | 000,057,344 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe – (MSCSPTISRV)
SRV - [2006/10/04 10:15:30 | 000,057,344 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe – (PACSPTISVR)
SRV - [2006/10/04 10:06:58 | 000,069,632 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe – (SPTISRV)
SRV - [2006/10/01 04:00:00 | 000,045,056 | —- | M] (Texim Corporarion.) [Auto | Running] – C:\Program Files\Justsystem\PersonalShelter\TxVDrvSvc.exe – (TxVDrvSvc)
SRV - [2006/08/28 13:38:04 | 000,491,520 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe – (VAIOMediaPlatform-Mobile-Gateway)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\SymIM.sys – (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Emi\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - [2012/09/04 09:18:29 | 000,027,496 | —- | M] (AVG Technologies) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtpx86.sys – (avgtp)
DRV - [2012/08/24 15:43:18 | 000,301,920 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2012/07/26 03:21:30 | 000,237,408 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2012/04/19 04:50:26 | 000,024,896 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\Windows\System32\drivers\avgidshx.sys – (AVGIDSHX)
DRV - [2012/01/31 04:46:50 | 000,031,952 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\Windows\System32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2011/12/23 13:32:14 | 000,041,040 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/12/23 13:32:08 | 000,017,232 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsshimx.sys – (AVGIDSShim)
DRV - [2011/12/23 13:32:06 | 000,024,144 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsfilterx.sys – (AVGIDSFilter)
DRV - [2011/12/23 13:32:00 | 000,139,856 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsdriverx.sys – (AVGIDSDriver)
DRV - [2008/04/22 18:33:30 | 000,038,856 | —- | M] (Teruten Co. LTD.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\GDISpy.sys – (GDISpyDevice)
DRV - [2007/02/06 04:36:48 | 000,650,240 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/01/12 13:41:32 | 000,113,792 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfbd.sys – (tosrfbd)
DRV - [2007/01/12 13:16:54 | 000,040,576 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfusb.sys – (tosrfusb)
DRV - [2006/11/20 09:55:16 | 000,036,480 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfbnp.sys – (tosrfbnp)
DRV - [2006/11/07 03:51:50 | 000,506,368 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ExpasAG.sys – (LEX_AS_NIC_SERVICE_YNOS)
DRV - [2006/11/06 14:56:03 | 000,227,328 | —- | M] (Texas Instruments) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ti21sony.sys – (ti21sony)
DRV - [2006/11/02 08:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express)
DRV - [2006/11/01 05:31:46 | 000,017,328 | —- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\SiWinAcc.sys – (SiFilter)
DRV - [2006/11/01 05:31:14 | 000,012,464 | —- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\SiRemFil.sys – (SiRemFil)
DRV - [2006/11/01 05:30:34 | 000,074,672 | —- | M] (Silicon Image, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\SI3132.sys – (SI3132)
DRV - [2006/10/30 01:42:28 | 001,786,880 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NETw3v32.sys – (NETw3v32)
DRV - [2006/10/27 14:08:36 | 000,072,704 | —- | M] (Ricoh) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\R5U870FLx86.sys – (R5U870FLx86)
DRV - [2006/10/27 14:08:32 | 000,043,904 | —- | M] (Ricoh) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\R5U870FUx86.sys – (R5U870FUx86)
DRV - [2006/10/25 12:53:00 | 000,058,112 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Sonyddpu.sys – (Sonyddpu)
DRV - [2006/10/18 03:56:30 | 000,010,216 | —- | M] (Sony Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\DMICall.sys – (DMICall)
DRV - [2006/10/13 12:34:22 | 000,027,520 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SonyNC.sys – (SNC)
DRV - [2006/10/10 11:33:00 | 000,041,600 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosporte.sys – (tosporte)
DRV - [2006/10/05 08:07:46 | 000,073,600 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Tosrfhid.sys – (Tosrfhid)
DRV - [2006/10/01 04:00:00 | 000,022,272 | —- | M] (Texim Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\TxVDrv.sys – (TxVDrv)
DRV - [2006/09/06 10:44:52 | 000,030,976 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SonyImgF.sys – (SonyImgF)
DRV - [2006/08/30 01:35:58 | 000,140,800 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2006/08/04 09:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
DRV - [2005/08/01 08:45:00 | 000,064,896 | —- | M] (TOSHIBA Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\tosrfcom.sys – (Tosrfcom)
DRV - [2005/01/06 05:42:00 | 000,018,612 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfnds.sys – (tosrfnds)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: "楽天ウェブ検索"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.co.jp/"
FF - prefs.js..keyword.URL: "http://websearch.rakuten.co.jp/Web?q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Emi\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/09/11 10:43:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/07/02 16:58:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/13 15:05:51 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/13 15:05:03 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/13 15:05:51 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/13 15:05:03 | 000,000,000 | —D | M]

[2008/10/22 12:00:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\Extensions
[2008/10/22 12:00:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\Extensions\[removed]
[2012/10/11 11:37:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\Firefox\Profiles\bw6pfu9s.default\extensions
[2010/05/11 06:52:16 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Emi\AppData\Roaming\mozilla\Firefox\Profiles\bw6pfu9s.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/10/05 20:35:39 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Emi\AppData\Roaming\mozilla\Firefox\Profiles\bw6pfu9s.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/10/05 22:33:26 | 000,000,000 | —D | M] (ADDICT-THING) – C:\Users\Emi\AppData\Roaming\mozilla\Firefox\Profiles\bw6pfu9s.default\extensions\[removed]
[2012/10/07 22:18:22 | 000,000,000 | —D | M] (ADDICT-THING) – C:\Users\Emi\AppData\Roaming\mozilla\Firefox\Profiles\bw6pfu9s.default\extensions\[removed]
[2012/10/07 22:30:20 | 000,000,000 | —D | M] (ADDICT-THING) – C:\Users\Emi\AppData\Roaming\mozilla\Firefox\Profiles\bw6pfu9s.default\extensions\[removed]
[2012/10/09 12:21:27 | 000,684,162 | —- | M] () (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\firefox\profiles\bw6pfu9s.default\extensions\{8b5bea8c-6194-4c7c-a440-d5ca181480c3}.xpi
[2012/07/31 09:28:39 | 000,375,811 | —- | M] () (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\firefox\profiles\bw6pfu9s.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2012/10/14 19:03:03 | 000,001,105 | —- | M] () – C:\Users\Emi\AppData\Roaming\mozilla\firefox\profiles\bw6pfu9s.default\searchplugins\flxe6v0v2xq.xml
[2012/10/13 15:04:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/10/13 15:04:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012/10/13 15:05:50 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/10/13 15:05:40 | 000,002,016 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-jp.xml
[2012/10/13 15:05:40 | 000,004,043 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google-jp.xml
[2012/10/13 15:05:40 | 000,001,443 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\oshiete-goo.xml
[2012/10/13 15:05:40 | 000,000,988 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\rakuten.xml
[2012/10/13 15:05:40 | 000,002,271 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter-ja.xml
[2012/10/13 15:05:39 | 000,001,392 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia-ja.xml
[2012/10/13 15:05:39 | 000,001,063 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-jp-auctions.xml
[2012/10/13 15:05:39 | 000,000,870 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-jp.xml

========== Chrome ==========

CHR - homepage: http://search.searchonme.com/

O1 HOSTS File: ([2012/10/12 22:19:06 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (かんたん登録2) - {0DD41AE7-6196-42E7-BDE5-4F393997449E} - C:\Program Files\Justsystem\SimpleAutoInput\AtInBnd.dll (株式会社ジャストシステム)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (かんたん登録2 ツールバー) - {833CFE4E-05BD-43A3-97A7-A4E80D742F0F} - C:\Program Files\Justsystem\SimpleAutoInput\AtInBnd.dll (株式会社ジャストシステム)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [E-Flyer] C:\Program Files\Sony\E-Flyer\SubFlyer.exe ()
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [SetGamma] C:\Program Files\Sony\SetGamma\SetGamma.exe (Sony Corporation)
O4 - HKLM..\Run: [VAIOCameraUtility] C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation)
O4 - HKCU..\Run: [SsAAD.exe] C:\Program Files\Sony\SonicStage\SSAAD.exe ()
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Users\Emi\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - Startup: C:\Users\Emi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\かざそうFeliCa.lnk = C:\Program Files\Sony\FeliCa Sensing\FeliSen.exe (Sony Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Easy-WebPrint プレビュー - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 印刷 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 印刷リストに追加 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 高速印刷 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {91DFB26C-AFD7-47C2-A07D-D22AF3548169} http://beauty.geocities.yahoo.co.jp/namo/g…or/NamoWec6.cab (NamoWeCtl 6.0 for YahooJpn)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{22CD1543-C312-4180-8903-388A87EEC278}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{85066FAF-0A01-4877-ADDD-EB81ECE91A6C}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\Emi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows フォトギャラリー壁紙.jpg
O24 - Desktop BackupWallPaper: C:\Users\Emi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows フォトギャラリー壁紙.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/14 18:43:02 | 000,000,000 | —D | C] – C:\_OTL
[2012/10/13 15:04:53 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/10/12 22:25:00 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/10/12 22:24:46 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\temp
[2012/10/12 21:59:18 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/10/12 21:59:18 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/10/12 21:59:17 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/10/12 21:59:17 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2012/10/12 21:59:03 | 000,000,000 | —D | C] – C:\ComboFix
[2012/10/12 21:55:24 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\デスクトップ
[2012/10/11 22:15:47 | 000,000,000 | —D | C] – C:\Qoobox
[2012/10/11 22:14:35 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/10/11 11:59:16 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Malwarebytes
[2012/10/11 11:58:49 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/10/11 11:58:47 | 000,022,856 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/10/11 11:58:47 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/10/10 16:07:52 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\RK_Quarantine
[2012/10/09 16:40:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/10/09 16:40:19 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/10/09 16:40:19 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2012/10/07 22:07:01 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\favorite songs 2
[2012/10/05 22:32:52 | 000,000,000 | —D | C] – C:\Program Files\SProtector
[2012/10/05 22:32:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ADDICT-THING
[2012/10/05 22:31:54 | 000,000,000 | —D | C] – C:\ProgramData\ADDICT-THING
[2012/10/05 21:52:06 | 000,000,000 | —D | C] – C:\Users\Emi\dwhelper
[2012/10/03 22:11:46 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Video
[2012/10/03 22:10:41 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Video
[2012/10/03 22:09:21 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Converter
[2012/10/03 22:09:04 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Converter
[2012/10/03 22:07:42 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Audio
[2012/10/03 22:07:16 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Audio
[2012/10/03 22:07:16 | 000,000,000 | —D | C] – C:\Users\Emi\Documents\Freecorder
[2012/10/03 22:06:38 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Jaksta_Technologies_Pty_L
[2012/10/03 22:00:49 | 000,000,000 | —D | C] – C:\Program Files\Applian Technologies
[2012/10/03 20:52:05 | 000,000,000 | —D | C] – C:\Users\Emi\Documents\Abelssoft
[2012/10/03 20:03:27 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Abelssoft
[2012/10/03 15:26:32 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\favorite music
[2012/09/29 08:22:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
[2012/09/27 18:12:09 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\photos from ray
[2012/09/23 19:59:33 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Unity
[2012/09/15 12:15:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/09/15 12:11:45 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/09/15 12:11:09 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2012/09/15 12:11:09 | 000,000,000 | —D | C] – C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

========== Files - Modified Within 30 Days ==========

[2012/10/15 07:51:38 | 000,000,626 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/15 07:46:10 | 000,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/15 07:46:09 | 000,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/15 07:45:58 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/10/14 18:33:33 | 097,335,507 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/10/12 22:19:06 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/10/11 11:58:50 | 000,000,906 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/10 18:31:20 | 000,000,512 | —- | M] () – C:\Users\Emi\Documents\MBR.dat
[2012/10/10 18:22:02 | 000,467,173 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/10/09 16:41:01 | 000,001,079 | —- | M] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/10/09 16:41:01 | 000,001,055 | —- | M] () – C:\Users\Emi\Desktop\Spybot - Search & Destroy.lnk
[2012/10/09 07:48:55 | 000,446,406 | —- | M] () – C:\Windows\System32\perfh011.dat
[2012/10/09 07:48:55 | 000,140,234 | —- | M] () – C:\Windows\System32\perfc011.dat
[2012/10/09 07:48:54 | 000,704,984 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/10/09 07:48:54 | 000,140,134 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/10/07 12:25:33 | 000,000,932 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/10/05 22:12:41 | 000,118,272 | —- | M] () – C:\Users\Emi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/19 09:20:26 | 158,419,261 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/09/15 12:15:57 | 000,001,664 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk

========== Files Created - No Company Name ==========

[2012/10/12 21:59:18 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/10/12 21:59:18 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/10/12 21:59:18 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/10/12 21:59:18 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/10/12 21:59:18 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/10/11 11:58:50 | 000,000,906 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/10 18:31:20 | 000,000,512 | —- | C] () – C:\Users\Emi\Documents\MBR.dat
[2012/10/09 16:41:01 | 000,001,079 | —- | C] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/10/09 16:41:01 | 000,001,055 | —- | C] () – C:\Users\Emi\Desktop\Spybot - Search & Destroy.lnk
[2012/09/15 12:15:57 | 000,001,664 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/06/06 10:54:02 | 000,034,814 | —- | C] () – C:\Users\Emi\AppData\Local\dt.dat
[2011/02/08 12:48:55 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/10/28 08:04:15 | 000,001,940 | —- | C] () – C:\Users\Emi\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/09/26 11:01:28 | 000,000,680 | —- | C] () – C:\Users\Emi\AppData\Local\d3d9caps.dat
[2009/10/16 13:41:04 | 000,700,572 | —- | C] () – C:\ProgramData\LUUnInstall.LiveUpdate
[2009/02/10 18:49:02 | 000,000,104 | —- | C] () – C:\Users\Emi\コンピュータ - ショートカット.lnk
[2007/06/27 14:16:13 | 000,118,272 | —- | C] () – C:\Users\Emi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 13:54:22 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2008/11/06 13:57:06 | 011,315,712 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/03/03 05:16:12 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2006/11/02 10:46:13 | 000,348,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/06/06 11:00:08 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\AVG
[2011/10/30 22:26:06 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\AVG2012
[2009/11/29 10:37:48 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\EPSON
[2012/10/03 22:07:16 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Audio
[2012/10/03 22:09:05 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Converter
[2012/10/03 22:11:32 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Video
[2007/12/22 01:23:22 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\InterVideo
[2007/08/05 11:08:57 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Justsystem
[2010/01/20 12:02:21 | 000,000,000 | -H-D | M] – C:\Users\Emi\AppData\Roaming\Question Tools
[2008/10/22 12:00:50 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\TomTom
[2009/10/27 22:05:55 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\らくちんCDダイレクトプリント for Canon
[2008/05/22 03:32:36 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\エレコムらくちんプリント

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >

Thank you for your help.

Satchfan

Post #37October 15, 2012, 10:58 AM UTC last edited October 15, 2012, 11:01 AM UTC

Searchonme is still showing up.

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2

double-click SystemLook.exe to run it.
copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning.:

:filefind *SearchOnMe* :folderfind *SearchOnMe* :Regfind SearchOnMe
click the Look button to start the scan.
when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Can you tell me which browser(s) you use: if you uase more than one, does the same things happen in all.

Thanks

Satchfan

Penpen

Post #38October 15, 2012, 11:59 AM UTC

Hi there,
I usually use Mozilla Firefox. I have tried with IE, and I haven't seen any strange adverts, underline in blue with popups, and coupons from there so far. So it may be something to do with the browser.
Here is the SystemLook log.

SystemLook
SystemLook 30.07.11 by jpshortstuff
Log created at 12:27 on 15/10/2012 by Emi
Administrator - Elevation successful

========== filefind ==========

Searching for "*SearchOnMe*"
C:\_OTL\MovedFiles\10142012_184302\C_Users\Emi\AppData\Roaming\mozilla\firefox\profiles\bw6pfu9s.default\searchplugins\SearchOnMe.xml –a—- 7756 bytes [10:43 11/10/2012] [10:43 11/10/2012] 898E7DA5EBDE40B66EC0CB062B2A8298

========== folderfind ==========

Searching for "*SearchOnMe*"
No folders found.

========== Regfind ==========

Searching for "SearchOnMe"
No data found.

-= EOF =-

Thanks!

Satchfan

Post #39October 15, 2012, 2:40 PM UTC

I think the best thing is to uninstall and reinstall Firefox; this will clear out all user data and plugins, so we are starting with a fresh install of Firefox,

You can backup your bookmarks if you need to but you will need to install any addins again.

Also note down any passwords etc.

Download a new copy of Firefox from here and save it to your desktop.

How to backup your bookmarks

open Firefox.
click the “Bookmarks” menu
click select Show All Bookmarks
in the “Library” window, click the Import and Backup button and then select Backup
in the “Bookmarks backup filename” window that opens, choose a location to save the file, which is named Bookmarks-"date".json by default
once the backup has run, close all windows and check location for backup file.

Remove Firefox

click on Start, Run
in the open text entry box please copy/paste appwiz.cpl Then click Enter.
press the Remove or Change/Remove…button to uninstall Firefox.

Delete folders in red

C:\Program Files\Mozilla Firefox
c:\documents and settings\tiffany\application data\mozilla

Reboot

Install the new copy of Firefox that you saved to the desktop.

Restore Bookmarks

open Firefox
click the “Bookmarks” menu
click Show All Bookmarks
in the “Library” window, click the “Import and Backup” button and then select Restore
in the “Bookmarks backup filename” window that opens, choose the location you saved the backup file to ,

When the restore has taken place, close all windows.

Open Firefox again and let me know how it is working now.

====================================

Reset Chrome’s home page

This entry in tour OTL log shows a bad setting for Chrome’s home page:

http://search.searchonme.com/

We need to change it

open Google Chrome
click the wrench icon at the top, right of the browser toolbar.
select Options.
at the bottom of the “Options” box go to the Home Page section at the bottom
make sure “Open this page” is checked
type in the page you want as your home page – eg http://www.google.com

Once you have typed in the address in the 'Open this page' box, this change is saved. If you close this tab and click on the home icon you should now get your home page.

====================================

Run OTL

open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
post the OTL.txt log it produces in your next reply.

Please post back with the log and let me know if there are any changes.

Satchfan

Penpen

Post #40October 16, 2012, 5:10 PM UTC

Hi as I was planning to do what you told me, Mozilla crushed and I couldn't open it anymore, so I just had to uninstall it in an ordinally way….Oh no, don't tell me I've done something really bad… What shall I do now? Can I move on to your next instruction? I'll wait for your reply.silly me…

Satchfan

Post #41October 16, 2012, 10:08 PM UTC

Don't worry, just try to carry on with the other instructions.

Penpen

Post #42October 17, 2012, 12:33 PM UTC

Hi, I don't think I have used Google chrome, or at least I can't fine one.(I searched from the start button.) What shall I do? Do I need to install it ??? Thanks.

Satchfan

Post #43October 17, 2012, 2:03 PM UTC

No, if you can't find any trace of Google Chrome then that should be OK. How are things running now and are there any outstanding problems? Satchfan

Penpen

Post #44October 17, 2012, 3:06 PM UTC last edited October 17, 2012, 3:08 PM UTC

Hi there

Since I uninstalled Firefox and reinstalled after, my PC has been behaving well, no adverts, no coupons! It may have been sorted???
Here is the latest OTL anyway. (I didn't tick ' Scan all users' though…)

OTL
OTL logfile created on: 2012/10/17 15:47:46 - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Emi\Desktop\デスクトップ
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

1013.56 Mb Total Physical Memory | 378.71 Mb Available Physical Memory | 37.36% Memory free
2.24 Gb Paging File | 0.97 Gb Available in Paging File | 43.40% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 85.71 Gb Total Space | 18.08 Gb Free Space | 21.10% Space Free | Partition Type: NTFS

Computer Name: EMI-PC | User Name: Emi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/13 15:51:17 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Emi\Desktop\デスクトップ\OTL.exe
PRC - [2012/08/13 03:24:48 | 005,167,736 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgidsagent.exe
PRC - [2012/07/31 03:37:02 | 002,596,984 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2012/07/26 03:23:08 | 000,758,392 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2012/06/13 03:48:24 | 001,255,544 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2012/02/14 04:53:38 | 000,193,288 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 04:52:38 | 000,338,784 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2012/01/23 05:43:08 | 000,247,728 | —- | M] (TomTom) – C:\Users\Emi\TomTom HOME 2\TomTomHOMERunner.exe
PRC - [2012/01/23 05:43:08 | 000,092,592 | —- | M] (TomTom) – C:\Users\Emi\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2011/11/03 17:20:58 | 000,803,144 | —- | M] (AVG) – C:\Program Files\AVG\AVG PC Tuneup\BoostSpeed.exe
PRC - [2011/07/29 00:08:12 | 001,259,376 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2008/10/29 07:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/08/24 12:59:10 | 000,870,240 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
PRC - [2007/02/06 04:36:22 | 000,090,112 | —- | M] (SigmaTel, Inc.) – C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
PRC - [2007/01/18 06:48:42 | 002,752,512 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2007/01/12 15:14:34 | 000,278,528 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
PRC - [2007/01/12 14:41:40 | 000,278,528 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2006/11/28 11:27:46 | 000,274,432 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
PRC - [2006/11/28 11:09:58 | 000,135,168 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
PRC - [2006/11/28 11:09:46 | 000,172,032 | —- | M] (Sony Corporation) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
PRC - [2006/11/27 13:15:30 | 000,465,016 | —- | M] (Sony Corporation) – C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
PRC - [2006/11/24 09:58:38 | 000,919,672 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
PRC - [2006/11/24 02:36:54 | 000,182,392 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
PRC - [2006/11/24 02:36:54 | 000,100,472 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2006/11/14 02:46:24 | 000,411,768 | —- | M] (Sony Corporation) – C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
PRC - [2006/11/13 10:43:36 | 000,472,632 | —- | M] () – C:\Program Files\Sony\SonicStage\SSAAD.exe
PRC - [2006/11/11 07:35:36 | 000,043,128 | —- | M] (Sony Corporation) – C:\Program Files\Sony\ISB Utility\ISBMgr.exe
PRC - [2006/11/02 10:44:59 | 000,068,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\conime.exe
PRC - [2006/10/31 14:40:16 | 000,077,824 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2006/10/27 12:13:48 | 000,270,336 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2006/10/13 02:34:56 | 000,448,632 | —- | M] (Sony Corporation) – C:\Program Files\Sony\SetGamma\SetGamma.exe
PRC - [2006/10/01 04:00:00 | 000,045,056 | —- | M] (Texim Corporarion.) – C:\Program Files\Justsystem\PersonalShelter\TxVDrvSvc.exe
PRC - [2006/09/27 07:25:40 | 004,038,656 | —- | M] (Sony Corporation) – C:\Program Files\Sony\FeliCa Sensing\FeliSen.exe
PRC - [2006/09/11 08:23:22 | 000,118,784 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\Apoint.exe
PRC - [2006/09/08 07:06:08 | 000,040,960 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\ApntEx.exe
PRC - [2006/09/08 06:54:30 | 000,042,544 | —- | M] (Alps Electric Co., Ltd.) – C:\Program Files\Apoint\ApMsgFwd.exe
PRC - [2006/02/06 15:00:20 | 000,311,296 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
PRC - [2006/01/23 15:14:10 | 000,069,632 | —- | M] (TOSHIBA CORPORATION.) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

========== Modules (No Company Name) ==========

MOD - [2011/11/03 17:21:06 | 000,350,024 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madExcept_.bpl
MOD - [2011/11/03 17:21:06 | 000,184,136 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madBasic_.bpl
MOD - [2011/11/03 17:21:06 | 000,050,504 | —- | M] () – C:\Program Files\AVG\AVG PC Tuneup\madDisAsm_.bpl
MOD - [2011/07/29 00:09:42 | 000,096,112 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011/07/29 00:08:12 | 001,259,376 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
MOD - [2011/06/24 22:56:36 | 000,087,328 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2006/11/14 02:46:24 | 000,040,960 | —- | M] () – C:\Program Files\Sony\VAIO Camera Utility\VCULib.dll
MOD - [2006/11/13 10:43:36 | 000,472,632 | —- | M] () – C:\Program Files\Sony\SonicStage\SSAAD.exe
MOD - [2006/11/13 06:20:07 | 000,061,440 | —- | M] () – C:\Windows\System32\igfxTMM.dll
MOD - [2006/11/13 06:20:00 | 000,077,824 | —- | M] () – C:\Windows\System32\hccutils.dll
MOD - [2006/09/29 14:20:18 | 000,096,352 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\plugins\device\usb.gp
MOD - [2006/09/29 14:20:10 | 000,137,312 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\plugins\command\basic.gp
MOD - [2006/09/29 14:20:00 | 000,383,072 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\rw.dll
MOD - [2006/09/29 14:19:56 | 000,190,560 | —- | M] () – C:\Program Files\Common Files\Sony Shared\FeliCaLibrary\felica.dll
MOD - [2005/07/22 13:30:20 | 000,065,536 | —- | M] () – C:\Windows\System32\TosCommAPI.dll
MOD - [2004/10/14 02:18:24 | 000,040,960 | —- | M] () – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtAfh.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe – (vToolbarUpdater12.2.6)
SRV - File not found [Auto | Stopped] – C:\Program Files\Spybot – (SBSDWSCService)
SRV - [2012/10/11 02:04:37 | 000,115,168 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2012/10/08 20:51:56 | 000,250,808 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/13 03:24:48 | 005,167,736 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgidsagent.exe – (AVGIDSAgent)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/02/14 04:53:38 | 000,193,288 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2012\avgwdsvc.exe – (avgwd)
SRV - [2012/01/23 05:43:08 | 000,092,592 | —- | M] (TomTom) [Auto | Running] – C:\Users\Emi\TomTom HOME 2\TomTomHOMEService.exe – (TomTomHOMEService)
SRV - [2007/06/29 04:00:04 | 000,265,912 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/02/06 04:36:22 | 000,090,112 | —- | M] (SigmaTel, Inc.) [Auto | Running] – C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe – (STacSV)
SRV - [2007/01/10 08:51:06 | 000,745,472 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe – (VAIOMediaPlatform-UCLS-AppServer)
SRV - [2007/01/10 02:43:24 | 000,073,728 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe – (VAIO Entertainment TV Device Arbitration Service)
SRV - [2007/01/08 09:06:40 | 001,089,536 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-UCLS-UPnP)
SRV - [2007/01/08 09:06:40 | 001,089,536 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe – (VAIOMediaPlatform-IntegratedServer-UPnP)
SRV - [2007/01/08 09:06:40 | 000,397,312 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-UCLS-HTTP)
SRV - [2007/01/08 09:06:40 | 000,397,312 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe – (VAIOMediaPlatform-IntegratedServer-HTTP)
SRV - [2006/11/28 11:27:46 | 000,274,432 | —- | M] (Sony Corporation) [On_Demand | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe – (Vcsw)
SRV - [2006/11/28 11:09:58 | 000,135,168 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe – (VzFw)
SRV - [2006/11/28 11:09:46 | 000,172,032 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe – (VzCdbSvc)
SRV - [2006/11/27 09:14:44 | 000,413,696 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\Smart Network\BeService.exe – (BeService)
SRV - [2006/11/24 02:36:54 | 000,182,392 | —- | M] (Sony Corporation) [Auto | Running] – C:\Program Files\Sony\VAIO Event Service\VESMgr.exe – (VAIO Event Service)
SRV - [2006/11/13 09:31:22 | 000,069,632 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe – (SSScsiSV)
SRV - [2006/10/31 14:40:16 | 000,077,824 | —- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe – (TOSHIBA Bluetooth Service)
SRV - [2006/10/24 02:32:08 | 002,523,136 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe – (VAIOMediaPlatform-IntegratedServer-AppServer)
SRV - [2006/10/04 10:25:00 | 000,057,344 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe – (MSCSPTISRV)
SRV - [2006/10/04 10:15:30 | 000,057,344 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe – (PACSPTISVR)
SRV - [2006/10/04 10:06:58 | 000,069,632 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe – (SPTISRV)
SRV - [2006/10/01 04:00:00 | 000,045,056 | —- | M] (Texim Corporarion.) [Auto | Running] – C:\Program Files\Justsystem\PersonalShelter\TxVDrvSvc.exe – (TxVDrvSvc)
SRV - [2006/08/28 13:38:04 | 000,491,520 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe – (VAIOMediaPlatform-Mobile-Gateway)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\SymIM.sys – (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Emi\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - [2012/09/04 09:18:29 | 000,027,496 | —- | M] (AVG Technologies) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtpx86.sys – (avgtp)
DRV - [2012/08/24 15:43:18 | 000,301,920 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2012/07/26 03:21:30 | 000,237,408 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2012/04/19 04:50:26 | 000,024,896 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\Windows\System32\drivers\avgidshx.sys – (AVGIDSHX)
DRV - [2012/01/31 04:46:50 | 000,031,952 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\Windows\System32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2011/12/23 13:32:14 | 000,041,040 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2011/12/23 13:32:08 | 000,017,232 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsshimx.sys – (AVGIDSShim)
DRV - [2011/12/23 13:32:06 | 000,024,144 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsfilterx.sys – (AVGIDSFilter)
DRV - [2011/12/23 13:32:00 | 000,139,856 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\avgidsdriverx.sys – (AVGIDSDriver)
DRV - [2008/04/22 18:33:30 | 000,038,856 | —- | M] (Teruten Co. LTD.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\GDISpy.sys – (GDISpyDevice)
DRV - [2007/02/06 04:36:48 | 000,650,240 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/01/12 13:41:32 | 000,113,792 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfbd.sys – (tosrfbd)
DRV - [2007/01/12 13:16:54 | 000,040,576 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfusb.sys – (tosrfusb)
DRV - [2006/11/20 09:55:16 | 000,036,480 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfbnp.sys – (tosrfbnp)
DRV - [2006/11/07 03:51:50 | 000,506,368 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ExpasAG.sys – (LEX_AS_NIC_SERVICE_YNOS)
DRV - [2006/11/06 14:56:03 | 000,227,328 | —- | M] (Texas Instruments) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ti21sony.sys – (ti21sony)
DRV - [2006/11/02 08:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express)
DRV - [2006/11/01 05:31:46 | 000,017,328 | —- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\SiWinAcc.sys – (SiFilter)
DRV - [2006/11/01 05:31:14 | 000,012,464 | —- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\SiRemFil.sys – (SiRemFil)
DRV - [2006/11/01 05:30:34 | 000,074,672 | —- | M] (Silicon Image, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\SI3132.sys – (SI3132)
DRV - [2006/10/30 01:42:28 | 001,786,880 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NETw3v32.sys – (NETw3v32)
DRV - [2006/10/27 14:08:36 | 000,072,704 | —- | M] (Ricoh) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\R5U870FLx86.sys – (R5U870FLx86)
DRV - [2006/10/27 14:08:32 | 000,043,904 | —- | M] (Ricoh) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\R5U870FUx86.sys – (R5U870FUx86)
DRV - [2006/10/25 12:53:00 | 000,058,112 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Sonyddpu.sys – (Sonyddpu)
DRV - [2006/10/18 03:56:30 | 000,010,216 | —- | M] (Sony Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\DMICall.sys – (DMICall)
DRV - [2006/10/13 12:34:22 | 000,027,520 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SonyNC.sys – (SNC)
DRV - [2006/10/10 11:33:00 | 000,041,600 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosporte.sys – (tosporte)
DRV - [2006/10/05 08:07:46 | 000,073,600 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Tosrfhid.sys – (Tosrfhid)
DRV - [2006/10/01 04:00:00 | 000,022,272 | —- | M] (Texim Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\TxVDrv.sys – (TxVDrv)
DRV - [2006/09/06 10:44:52 | 000,030,976 | —- | M] (Sony Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SonyImgF.sys – (SonyImgF)
DRV - [2006/08/30 01:35:58 | 000,140,800 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2006/08/04 09:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
DRV - [2005/08/01 08:45:00 | 000,064,896 | —- | M] (TOSHIBA Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\tosrfcom.sys – (Tosrfcom)
DRV - [2005/01/06 05:42:00 | 000,018,612 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tosrfnds.sys – (tosrfnds)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.jp/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.yahoo.co.jp"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Emi\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/09/11 10:43:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/07/02 16:58:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/17 13:22:27 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/13 15:05:03 | 000,000,000 | —D | M]

[2012/10/16 17:46:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\Extensions
[2008/10/22 12:00:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Emi\AppData\Roaming\mozilla\Extensions\[removed]
[2012/10/17 13:22:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/10/13 15:04:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012/10/11 02:05:24 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/10/11 02:36:32 | 000,002,016 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-jp.xml
[2012/10/11 02:36:32 | 000,004,043 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google-jp.xml
[2012/10/11 02:36:32 | 000,001,443 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\oshiete-goo.xml
[2012/10/11 02:36:32 | 000,000,988 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\rakuten.xml
[2012/10/11 02:36:32 | 000,002,271 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter-ja.xml
[2012/10/11 02:36:32 | 000,001,392 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia-ja.xml
[2012/10/11 02:36:32 | 000,001,063 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-jp-auctions.xml
[2012/10/11 02:36:32 | 000,000,870 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-jp.xml

========== Chrome ==========

CHR - homepage: http://search.searchonme.com/

O1 HOSTS File: ([2012/10/12 22:19:06 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (かんたん登録2) - {0DD41AE7-6196-42E7-BDE5-4F393997449E} - C:\Program Files\Justsystem\SimpleAutoInput\AtInBnd.dll (株式会社ジャストシステム)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (かんたん登録2 ツールバー) - {833CFE4E-05BD-43A3-97A7-A4E80D742F0F} - C:\Program Files\Justsystem\SimpleAutoInput\AtInBnd.dll (株式会社ジャストシステム)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [E-Flyer] C:\Program Files\Sony\E-Flyer\SubFlyer.exe ()
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [SetGamma] C:\Program Files\Sony\SetGamma\SetGamma.exe (Sony Corporation)
O4 - HKLM..\Run: [VAIOCameraUtility] C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe (Sony Corporation)
O4 - HKCU..\Run: [SsAAD.exe] C:\Program Files\Sony\SonicStage\SSAAD.exe ()
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Users\Emi\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - Startup: C:\Users\Emi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\かざそうFeliCa.lnk = C:\Program Files\Sony\FeliCa Sensing\FeliSen.exe (Sony Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Easy-WebPrint プレビュー - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 印刷 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 印刷リストに追加 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O8 - Extra context menu item: Easy-WebPrint 高速印刷 - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\iflsp.dll (デジタルアーツ株式会社)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {91DFB26C-AFD7-47C2-A07D-D22AF3548169} http://beauty.geocities.yahoo.co.jp/namo/g…or/NamoWec6.cab (NamoWeCtl 6.0 for YahooJpn)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{22CD1543-C312-4180-8903-388A87EEC278}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{85066FAF-0A01-4877-ADDD-EB81ECE91A6C}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\Emi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows フォトギャラリー壁紙.jpg
O24 - Desktop BackupWallPaper: C:\Users\Emi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows フォトギャラリー壁紙.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/17 13:22:32 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/10/14 18:43:02 | 000,000,000 | —D | C] – C:\_OTL
[2012/10/13 15:04:53 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/10/12 22:25:00 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/10/12 22:24:46 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\temp
[2012/10/12 21:59:18 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/10/12 21:59:18 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/10/12 21:59:17 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/10/12 21:59:17 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2012/10/12 21:59:03 | 000,000,000 | —D | C] – C:\ComboFix
[2012/10/12 21:55:24 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\デスクトップ
[2012/10/11 22:15:47 | 000,000,000 | —D | C] – C:\Qoobox
[2012/10/11 22:14:35 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/10/11 11:59:16 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Malwarebytes
[2012/10/11 11:58:49 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/10/11 11:58:47 | 000,022,856 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/10/11 11:58:47 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/10/10 16:07:52 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\RK_Quarantine
[2012/10/09 16:40:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/10/09 16:40:19 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/10/09 16:40:19 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2012/10/07 22:07:01 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\favorite songs 2
[2012/10/05 22:32:52 | 000,000,000 | —D | C] – C:\Program Files\SProtector
[2012/10/05 22:32:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ADDICT-THING
[2012/10/05 22:31:54 | 000,000,000 | —D | C] – C:\ProgramData\ADDICT-THING
[2012/10/05 21:52:06 | 000,000,000 | —D | C] – C:\Users\Emi\dwhelper
[2012/10/03 22:11:46 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Video
[2012/10/03 22:10:41 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Video
[2012/10/03 22:09:21 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Converter
[2012/10/03 22:09:04 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Converter
[2012/10/03 22:07:42 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Freecorder 6 Audio
[2012/10/03 22:07:16 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Audio
[2012/10/03 22:07:16 | 000,000,000 | —D | C] – C:\Users\Emi\Documents\Freecorder
[2012/10/03 22:06:38 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Jaksta_Technologies_Pty_L
[2012/10/03 22:00:49 | 000,000,000 | —D | C] – C:\Program Files\Applian Technologies
[2012/10/03 20:52:05 | 000,000,000 | —D | C] – C:\Users\Emi\Documents\Abelssoft
[2012/10/03 20:03:27 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Abelssoft
[2012/10/03 15:26:32 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\favorite music
[2012/09/29 08:22:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
[2012/09/27 18:12:09 | 000,000,000 | —D | C] – C:\Users\Emi\Desktop\photos from ray
[2012/09/23 19:59:33 | 000,000,000 | —D | C] – C:\Users\Emi\AppData\Local\Unity

========== Files - Modified Within 30 Days ==========

[2012/10/17 15:51:00 | 000,000,626 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/17 15:33:26 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/10/17 15:33:25 | 000,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/17 15:33:22 | 000,003,456 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/17 13:22:36 | 000,000,870 | —- | M] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/10/17 13:22:36 | 000,000,846 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/10/17 08:07:43 | 097,562,652 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/10/15 08:47:02 | 000,113,461 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjw.avm
[2012/10/12 22:19:06 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/10/11 11:58:50 | 000,000,906 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/10 18:31:20 | 000,000,512 | —- | M] () – C:\Users\Emi\Documents\MBR.dat
[2012/10/10 18:22:02 | 000,467,173 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/10/09 16:41:01 | 000,001,079 | —- | M] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/10/09 16:41:01 | 000,001,055 | —- | M] () – C:\Users\Emi\Desktop\Spybot - Search & Destroy.lnk
[2012/10/09 07:48:55 | 000,446,406 | —- | M] () – C:\Windows\System32\perfh011.dat
[2012/10/09 07:48:55 | 000,140,234 | —- | M] () – C:\Windows\System32\perfc011.dat
[2012/10/09 07:48:54 | 000,704,984 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/10/09 07:48:54 | 000,140,134 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/10/05 22:12:41 | 000,118,272 | —- | M] () – C:\Users\Emi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/19 09:20:26 | 158,419,261 | —- | M] () – C:\Windows\MEMORY.DMP

========== Files Created - No Company Name ==========

[2012/10/17 13:22:36 | 000,000,870 | —- | C] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/10/17 13:22:36 | 000,000,858 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/10/17 13:22:36 | 000,000,846 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/10/12 21:59:18 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/10/12 21:59:18 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/10/12 21:59:18 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/10/12 21:59:18 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/10/12 21:59:18 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/10/11 11:58:50 | 000,000,906 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/10 18:31:20 | 000,000,512 | —- | C] () – C:\Users\Emi\Documents\MBR.dat
[2012/10/09 16:41:01 | 000,001,079 | —- | C] () – C:\Users\Emi\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/10/09 16:41:01 | 000,001,055 | —- | C] () – C:\Users\Emi\Desktop\Spybot - Search & Destroy.lnk
[2012/06/06 10:54:02 | 000,034,814 | —- | C] () – C:\Users\Emi\AppData\Local\dt.dat
[2011/02/08 12:48:55 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/10/28 08:04:15 | 000,001,940 | —- | C] () – C:\Users\Emi\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/09/26 11:01:28 | 000,000,680 | —- | C] () – C:\Users\Emi\AppData\Local\d3d9caps.dat
[2009/10/16 13:41:04 | 000,700,572 | —- | C] () – C:\ProgramData\LUUnInstall.LiveUpdate
[2009/02/10 18:49:02 | 000,000,104 | —- | C] () – C:\Users\Emi\コンピュータ - ショートカット.lnk
[2007/06/27 14:16:13 | 000,118,272 | —- | C] () – C:\Users\Emi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 13:54:22 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2008/11/06 13:57:06 | 011,315,712 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/03/03 05:16:12 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2006/11/02 10:46:13 | 000,348,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/06/06 11:00:08 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\AVG
[2011/10/30 22:26:06 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\AVG2012
[2009/11/29 10:37:48 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\EPSON
[2012/10/03 22:07:16 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Audio
[2012/10/03 22:09:05 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Converter
[2012/10/03 22:11:32 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Freecorder 6 Video
[2007/12/22 01:23:22 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\InterVideo
[2007/08/05 11:08:57 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\Justsystem
[2010/01/20 12:02:21 | 000,000,000 | -H-D | M] – C:\Users\Emi\AppData\Roaming\Question Tools
[2008/10/22 12:00:50 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\TomTom
[2009/10/27 22:05:55 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\らくちんCDダイレクトプリント for Canon
[2008/05/22 03:32:36 | 000,000,000 | —D | M] – C:\Users\Emi\AppData\Roaming\エレコムらくちんプリント

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0B4227B4
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >

Thanks a lot.

Satchfan

Post #45October 17, 2012, 3:47 PM UTC

It seems like you may be right and your computer clean but we’ll do a final couple of checks before tidying up.

Download TFC to your desktop

close any open windows.
double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
click the Start button to begin the process.
allow TFC to run uninterrupted.
the program should not take long to finish it's job
once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

================================================

Run Security Check

Download Security Check by screen317 from here or here.

save it to your Desktop.
double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
a Notepad document should open automatically called checkup.txt; please post the contents of that document.

================================================

Run ESET Online Scan

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - if ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Infected Sony Laptop [Solved]

✨ Ask AI

Ask AI