What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

infected laptop [Solved]

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16

Welcome to wonderful 2013

Happy New Year to you and yours! :)

I am doing some things with family today so I won't have a good chance to look this over until tonight. I will post the new set of instructions then.
Post #18
Hi,

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
Post #19
Jeff,
I let JRT run while busy doing other things. The results are posted below.
Tomorrow starts another short work week so I will not get back to this till Wednesday night.

Patrick

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.3.2 (12.29.2012:3)
OS: Windows 7 Home Premium x86
Ran by [removed] on Tue 01/01/2013 at 19:26:14.25
Blog: http://thisisudax.blogspot.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{02478d38-c3f9-4efb-9b51-7695eca05670}



~~~ Files

Successfully deleted: [File] C:\eula.1028.txt
Successfully deleted: [File] C:\eula.1031.txt
Successfully deleted: [File] C:\eula.1033.txt
Successfully deleted: [File] C:\eula.1036.txt
Successfully deleted: [File] C:\eula.1040.txt
Successfully deleted: [File] C:\eula.1041.txt
Successfully deleted: [File] C:\eula.1042.txt
Successfully deleted: [File] C:\eula.2052.txt
Successfully deleted: [File] C:\install.res.1028.dll
Successfully deleted: [File] C:\install.res.1031.dll
Successfully deleted: [File] C:\install.res.1033.dll
Successfully deleted: [File] C:\install.res.1036.dll
Successfully deleted: [File] C:\install.res.1040.dll
Successfully deleted: [File] C:\install.res.1041.dll
Successfully deleted: [File] C:\install.res.1042.dll
Successfully deleted: [File] C:\install.res.2052.dll
Successfully deleted: [File] C:\install.res.3082.dll



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 01/01/2013 at 19:29:48.66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Post #20

Tomorrow starts another short work week so I will not get back to this till Wednesday night.

No problem…thanks for letting me know. Are you still getting the ads problem in your browser(s)? If so, which browser(s) is being effected?
Post #21
Hello Jeff, I use Firefox exclusively. Yes, I am still having ad issues, even on this site. Such as in the last post, where it says " Junkware removal tool " , "removal tool" is underlined and in blue. It is a drop down deal ad, they are also still the top three ads on my test google search. Tabs are still refreshing every few seconds Patrick
Post #23
Jeff,
Ran OTL but only go 1 report

Patrick


OTL logfile created on: 1/2/2013 7:28:58 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\kafura\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.23 Gb Available Physical Memory | 65.87% Memory free
3.74 Gb Paging File | 2.45 Gb Available in Paging File | 65.46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.27 Gb Total Space | 165.19 Gb Free Space | 73.99% Space Free | Partition Type: NTFS

Computer Name: BIFF | User Name: kafura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\kafura\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
PRC - C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcfgex.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe (Teleca)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe (TODO: )
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Modules (No Company Name) ==========

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\17796f2951c17ebf92dd4b7c9b3ce556\System.ServiceProcess.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll ()
MOD - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll ()
MOD - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\fsync.dll ()
MOD - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\fsync.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll ()
MOD - C:\Program Files\TOSHIBA\PCDiag\NotifyPCD.dll ()


========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater13.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (TMachInfo) – C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV - (cfWiMAXService) – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
SRV - (TosCoSrv) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ConfigFree Service) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (USBCCID) – system32\DRIVERS\RtsUCcid.sys File not found
DRV - (RtsUIR) – system32\DRIVERS\Rts516xIR.sys File not found
DRV - (mbr) – C:\ComboFix\mbr.sys File not found
DRV - (catchme) – C:\Users\kafura\AppData\Local\Temp\catchme.sys File not found
DRV - (avgtp) – C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (LVUVC) – C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (RTL8187B) – C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation )
DRV - (HTCAND32) – C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC1124 Inc)
DRV - (UsbDiag) – C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) – C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (tos_sps32) – C:\Windows\System32\drivers\tos_sps32.sys (TOSHIBA Corporation)
DRV - (RSUSBSTOR) – C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (TVALZ) – C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (LPCFilter) – C:\Windows\System32\drivers\LPCFilter.sys (COMPAL ELECTRONIC INC.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br…A&bmod;=TSNA
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{7AA0C22D-3016-4FE8-9ECC-4E762954DD33}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\..\SearchScopes\{7A13F886-FA12-43B1-B7F2-30FE3B84C785}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "npr.org"
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.5
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.5
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7BAE93811A-5C9A-4d34-8462-F7B864FC4696%7D:4.16
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..browser.startup.homepage: "http://www.npr.org/"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\kafura\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\kafura\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/06 15:11:00 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/06/10 09:00:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/07 06:45:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/07 06:44:55 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/07 06:45:15 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/07 06:44:55 | 000,000,000 | —D | M]

[2010/04/24 00:26:39 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Extensions
[2012/12/29 12:37:21 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\vufdye7f.default\extensions
[2012/11/16 22:34:36 | 000,124,993 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/10/27 17:54:38 | 000,230,040 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/12/29 11:51:06 | 000,377,738 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2012/11/23 09:17:08 | 000,804,627 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/11/30 12:32:08 | 000,243,496 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012/12/07 06:44:53 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/12/07 06:44:53 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/10 09:00:47 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012/12/07 06:45:14 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/06 15:10:49 | 000,129,144 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/09/04 17:43:16 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/10/13 20:18:01 | 000,002,058 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/12/31 10:06:05 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe (Toshiba)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [MyTOSHIBA] C:\Program Files\TOSHIBA\My Toshiba\MyToshiba.exe (TOSHIBA)
O4 - HKCU..\Run: [Spotify] C:\Users\kafura\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk = C:\pmw\PMREMIND.EXE ()
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.10.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B767279-59A0-4ECD-B116-B25B002EEAAF}: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2B628043-564D-499C-B681-5AC04A3A786D}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/01 19:26:02 | 000,000,000 | —D | C] – C:\windows\ERUNT
[2013/01/01 19:25:55 | 000,000,000 | —D | C] – C:\JRT
[2013/01/01 19:25:09 | 000,497,009 | —- | C] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:04 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:08:19 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/12/31 10:08:16 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\temp
[2012/12/31 09:53:59 | 000,518,144 | —- | C] (SteelWerX) – C:\windows\SWREG.exe
[2012/12/31 09:53:59 | 000,406,528 | —- | C] (SteelWerX) – C:\windows\SWSC.exe
[2012/12/31 09:53:59 | 000,060,416 | —- | C] (NirSoft) – C:\windows\NIRCMD.exe
[2012/12/31 09:36:52 | 000,000,000 | —D | C] – C:\Qoobox
[2012/12/31 09:36:27 | 000,000,000 | —D | C] – C:\windows\erdnt
[2012/12/31 09:31:57 | 005,016,388 | R— | C] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2012/12/29 20:06:24 | 000,688,992 | R— | C] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/12/29 11:36:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/12/16 20:09:35 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy 2
[2012/12/16 20:07:10 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\Programs
[2012/12/09 09:50:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/12/07 06:44:52 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/01/02 19:22:00 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/01/01 19:25:19 | 000,497,009 | —- | M] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:12 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:06:05 | 000,000,027 | —- | M] () – C:\windows\System32\drivers\etc\hosts
[2012/12/31 09:39:41 | 000,126,976 | —- | M] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/31 09:32:12 | 005,016,388 | R— | M] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2012/12/30 19:30:30 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2012/12/30 06:45:52 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/30 06:45:52 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/30 06:37:48 | 1504,354,304 | -HS- | M] () – C:\hiberfil.sys
[2012/12/29 20:06:34 | 000,688,992 | R— | M] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,002,969 | —- | M] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/12/21 03:20:50 | 000,358,136 | —- | M] () – C:\windows\System32\FNTCACHE.DAT
[2012/12/16 10:29:42 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\AVG 2013.lnk
[2012/12/16 10:17:12 | 000,001,042 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/12/07 06:48:19 | 000,002,005 | —- | M] () – C:\Users\kafura\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/12/31 09:53:59 | 000,256,000 | —- | C] () – C:\windows\PEV.exe
[2012/12/31 09:53:59 | 000,208,896 | —- | C] () – C:\windows\MBR.exe
[2012/12/31 09:53:59 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2012/12/31 09:53:59 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2012/12/31 09:53:59 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2012/12/31 09:39:39 | 000,126,976 | —- | C] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/29 12:50:31 | 000,002,969 | —- | C] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/08/31 16:44:53 | 000,000,000 | —- | C] () – C:\windows\MSREGUSR.INI
[2012/07/04 11:23:28 | 000,173,074 | —- | C] () – C:\windows\hpoins46.dat
[2012/07/04 11:23:28 | 000,000,601 | —- | C] () – C:\windows\hpomdl46.dat
[2012/04/08 11:02:14 | 000,003,584 | —- | C] () – C:\Users\kafura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/18 06:44:00 | 010,920,984 | —- | C] () – C:\windows\System32\LogiDPP.dll
[2012/01/18 06:44:00 | 000,336,408 | —- | C] () – C:\windows\System32\DevManagerCore.dll
[2012/01/18 06:44:00 | 000,104,472 | —- | C] () – C:\windows\System32\LogiDPPApp.exe
[2011/08/12 12:20:14 | 000,015,896 | —- | C] () – C:\windows\System32\drivers\iKeyLFT2.dll
[2011/07/26 06:48:54 | 000,028,418 | —- | C] () – C:\windows\System32\lvcoinst.ini
[2010/03/14 20:03:04 | 000,271,673 | —- | C] () – C:\Users\kafura\skywest quiz.mht
[2009/12/25 23:03:29 | 000,008,416 | —- | C] () – C:\Users\kafura\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009/07/13 22:42:31 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 22:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 06:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 19:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/02/25 10:32:49 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Astro Gemini Software
[2012/10/07 15:38:50 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\AVG2013
[2012/04/08 11:16:04 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Blackberry Desktop
[2010/02/24 15:32:19 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\DreamDale
[2010/03/08 17:52:52 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Facebook
[2010/04/22 21:46:42 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\InfraRecorder
[2010/04/13 19:37:22 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Leader Technologies
[2010/04/13 11:57:48 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Leadertech
[2010/02/24 15:19:57 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\MB3
[2010/02/13 17:06:23 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\OpenOffice.org
[2010/01/27 01:44:02 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\PlayFirst
[2010/03/21 19:39:59 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Playrix Entertainment
[2012/04/08 11:00:46 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Research In Motion
[2010/02/24 15:08:26 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\SmashFrenzy3
[2012/12/31 17:05:48 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Spotify
[2010/02/26 00:26:56 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Teleca
[2012/10/07 15:38:25 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\TuneUp Software
[2010/04/22 21:40:30 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\WeatherBug
[2009/12/25 00:11:17 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\WinBatch

========== Purity Check ==========



< End of report >
Post #24
Hi,

Only the OTL.txt will be created…don't worry about the other.

[external image: Posted Image] Run OTL.exe
  • Copy/paste the following text written inside of the quote box into the Custom Scans/Fixes box located at the bottom of OTL


    :Services

    :OTL
    FF - prefs.js..browser.startup.homepage: "npr.org"
    FF - prefs.js..extensions.enabledItems: [removed]:[removed]
    FF - prefs.js..network.proxy.no_proxies_on: "*.local"
    FF - prefs.js..browser.startup.homepage: "http://www.npr.org/"
    [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
    [2012/04/08 11:02:14 | 000,003,584 | —- | C] () – C:\Users\kafura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

    :Files
    ipconfig /flushdns /c

    :Commands
    [emptytemp]
    [start explorer]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
———-

Post the logs made by OTL and let me know how your system is running now. :)
Post #25
Jeff,

The OTL log file is below
Still have ads (deal drop down) on various pages but they no longer appear on my search results page
My home page (NPR.org) is still scrambled.
I believe both problems are related. When my home page first opens, it looks fine then the tab flickers and the page scrambles.
same thing with this page, at first it is ok, then it refreshes and the hover ads appear.
Any ideas?

Patrick

I just previewed this post and the following words are now ads:
Log file, service pack & internet explorer


OTL logfile created on: 1/3/2013 6:35:11 AM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\kafura\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.20 Gb Available Physical Memory | 64.26% Memory free
3.74 Gb Paging File | 2.44 Gb Available in Paging File | 65.37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.27 Gb Total Space | 165.19 Gb Free Space | 73.99% Space Free | Partition Type: NTFS

Computer Name: BIFF | User Name: kafura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\kafura\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
PRC - C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcfgex.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe (Teleca)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe (TODO: )
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Modules (No Company Name) ==========

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\17796f2951c17ebf92dd4b7c9b3ce556\System.ServiceProcess.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll ()
MOD - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll ()
MOD - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\fsync.dll ()
MOD - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\fsync.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll ()
MOD - C:\Program Files\TOSHIBA\PCDiag\NotifyPCD.dll ()


========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater13.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (TMachInfo) – C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV - (cfWiMAXService) – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
SRV - (TosCoSrv) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ConfigFree Service) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (USBCCID) – system32\DRIVERS\RtsUCcid.sys File not found
DRV - (RtsUIR) – system32\DRIVERS\Rts516xIR.sys File not found
DRV - (mbr) – C:\ComboFix\mbr.sys File not found
DRV - (catchme) – C:\Users\kafura\AppData\Local\Temp\catchme.sys File not found
DRV - (avgtp) – C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (LVUVC) – C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (RTL8187B) – C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation )
DRV - (HTCAND32) – C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC1124 Inc)
DRV - (UsbDiag) – C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) – C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (tos_sps32) – C:\Windows\System32\drivers\tos_sps32.sys (TOSHIBA Corporation)
DRV - (RSUSBSTOR) – C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (TVALZ) – C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (LPCFilter) – C:\Windows\System32\drivers\LPCFilter.sys (COMPAL ELECTRONIC INC.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br…A&bmod;=TSNA
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{7AA0C22D-3016-4FE8-9ECC-4E762954DD33}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\..\SearchScopes\{7A13F886-FA12-43B1-B7F2-30FE3B84C785}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "npr.org"
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.5
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.5
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7BAE93811A-5C9A-4d34-8462-F7B864FC4696%7D:4.16
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..browser.startup.homepage: "http://www.npr.org/"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\kafura\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\kafura\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/06 15:11:00 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/06/10 09:00:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/07 06:45:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/07 06:44:55 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/07 06:45:15 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/07 06:44:55 | 000,000,000 | —D | M]

[2010/04/24 00:26:39 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Extensions
[2012/12/29 12:37:21 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\vufdye7f.default\extensions
[2012/11/16 22:34:36 | 000,124,993 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/10/27 17:54:38 | 000,230,040 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/12/29 11:51:06 | 000,377,738 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2012/11/23 09:17:08 | 000,804,627 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/11/30 12:32:08 | 000,243,496 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012/12/07 06:44:53 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/12/07 06:44:53 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/10 09:00:47 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012/12/07 06:45:14 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/06 15:10:49 | 000,129,144 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/09/04 17:43:16 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/10/13 20:18:01 | 000,002,058 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/12/31 10:06:05 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe (Toshiba)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [MyTOSHIBA] C:\Program Files\TOSHIBA\My Toshiba\MyToshiba.exe (TOSHIBA)
O4 - HKCU..\Run: [Spotify] C:\Users\kafura\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk = C:\pmw\PMREMIND.EXE ()
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.10.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B767279-59A0-4ECD-B116-B25B002EEAAF}: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2B628043-564D-499C-B681-5AC04A3A786D}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/01 19:26:02 | 000,000,000 | —D | C] – C:\windows\ERUNT
[2013/01/01 19:25:55 | 000,000,000 | —D | C] – C:\JRT
[2013/01/01 19:25:09 | 000,497,009 | —- | C] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:04 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:08:19 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/12/31 10:08:16 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\temp
[2012/12/31 09:53:59 | 000,518,144 | —- | C] (SteelWerX) – C:\windows\SWREG.exe
[2012/12/31 09:53:59 | 000,406,528 | —- | C] (SteelWerX) – C:\windows\SWSC.exe
[2012/12/31 09:53:59 | 000,060,416 | —- | C] (NirSoft) – C:\windows\NIRCMD.exe
[2012/12/31 09:36:52 | 000,000,000 | —D | C] – C:\Qoobox
[2012/12/31 09:36:27 | 000,000,000 | —D | C] – C:\windows\erdnt
[2012/12/31 09:31:57 | 005,016,388 | R— | C] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2012/12/29 20:06:24 | 000,688,992 | R— | C] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/12/29 11:36:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/12/29 11:36:08 | 000,260,528 | —- | C] (Oracle Corporation) – C:\windows\System32\javaws.exe
[2012/12/29 11:35:32 | 000,174,000 | —- | C] (Oracle Corporation) – C:\windows\System32\javaw.exe
[2012/12/29 11:35:32 | 000,093,640 | —- | C] (Oracle Corporation) – C:\windows\System32\WindowsAccessBridge.dll
[2012/12/29 11:35:31 | 000,173,992 | —- | C] (Oracle Corporation) – C:\windows\System32\java.exe
[2012/12/21 03:01:46 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\windows\System32\atmfd.dll
[2012/12/21 03:01:46 | 000,034,304 | —- | C] (Adobe Systems) – C:\windows\System32\atmlib.dll
[2012/12/16 20:09:35 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy 2
[2012/12/16 20:07:10 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\Programs
[2012/12/12 12:26:12 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\windows\System32\mshtml.tlb
[2012/12/12 12:26:11 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\windows\System32\ieui.dll
[2012/12/12 12:26:11 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\windows\System32\jsproxy.dll
[2012/12/12 12:26:10 | 000,607,744 | —- | C] (Microsoft Corporation) – C:\windows\System32\msfeeds.dll
[2012/12/12 12:26:10 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\windows\System32\ieUnatt.exe
[2012/12/12 12:26:08 | 001,800,704 | —- | C] (Microsoft Corporation) – C:\windows\System32\jscript9.dll
[2012/12/12 12:26:08 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\windows\System32\url.dll
[2012/12/12 12:26:06 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\windows\System32\inetcpl.cpl
[2012/12/11 20:32:04 | 002,345,984 | —- | C] (Microsoft Corporation) – C:\windows\System32\win32k.sys
[2012/12/11 20:31:57 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\windows\System32\conhost.exe
[2012/12/11 20:31:56 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\windows\System32\winsrv.dll
[2012/12/11 20:31:53 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-file-l1-1-0.dll
[2012/12/11 20:31:53 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/11 20:31:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/11 20:31:53 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2012/12/11 20:31:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/11 20:31:53 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/11 20:31:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-string-l1-1-0.dll
[2012/12/11 20:31:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/11 20:31:53 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2012/12/11 20:31:52 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-security-base-l1-1-0.dll
[2012/12/11 20:31:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2012/12/11 20:31:52 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-util-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-io-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2012/12/11 20:31:52 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/11 20:31:51 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/11 20:31:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2012/12/11 20:31:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\System32\api-ms-win-core-console-l1-1-0.dll
[2012/12/11 20:31:44 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\windows\System32\dpnet.dll
[2012/12/11 20:31:39 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\windows\System32\tzres.dll
[2012/12/10 19:16:47 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\windows\System32\drivers\rdpvideominiport.sys
[2012/12/10 19:16:47 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\windows\System32\TsUsbRedirectionGroupPolicyControl.exe
[2012/12/10 19:16:46 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
[2012/12/10 19:16:45 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\windows\System32\RdpGroupPolicyExtension.dll
[2012/12/10 19:16:44 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\windows\System32\drivers\TsUsbFlt.sys
[2012/12/10 19:16:43 | 000,269,312 | —- | C] (Microsoft Corporation) – C:\windows\System32\aaclient.dll
[2012/12/10 19:16:43 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\windows\System32\rdpudd.dll
[2012/12/10 19:16:43 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\windows\System32\TSWbPrxy.exe
[2012/12/10 19:16:43 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\windows\System32\MsRdpWebAccess.dll
[2012/12/10 19:16:43 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\windows\System32\tsgqec.dll
[2012/12/10 19:16:43 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\windows\System32\TsUsbGDCoInstaller.dll
[2012/12/10 19:16:43 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\windows\System32\wksprtPS.dll
[2012/12/10 19:16:42 | 002,739,712 | —- | C] (Microsoft Corporation) – C:\windows\System32\rdpcorets.dll
[2012/12/10 19:16:42 | 000,317,440 | —- | C] (Microsoft Corporation) – C:\windows\System32\wksprt.exe
[2012/12/10 19:16:42 | 000,192,000 | —- | C] (Microsoft Corporation) – C:\windows\System32\rdpendp_winip.dll
[2012/12/10 19:10:22 | 000,220,160 | —- | C] (Microsoft Corporation) – C:\windows\System32\ncrypt.dll
[2012/12/09 09:50:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/12/07 06:44:52 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/01/03 06:22:00 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/01/01 19:25:19 | 000,497,009 | —- | M] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:12 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:06:05 | 000,000,027 | —- | M] () – C:\windows\System32\drivers\etc\hosts
[2012/12/31 09:39:41 | 000,126,976 | —- | M] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/31 09:32:12 | 005,016,388 | R— | M] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2012/12/30 19:30:30 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2012/12/30 06:45:52 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/30 06:45:52 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/30 06:37:48 | 1504,354,304 | -HS- | M] () – C:\hiberfil.sys
[2012/12/29 20:06:34 | 000,688,992 | R— | M] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,002,969 | —- | M] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/12/29 11:35:19 | 000,093,640 | —- | M] (Oracle Corporation) – C:\windows\System32\WindowsAccessBridge.dll
[2012/12/29 11:35:18 | 000,859,072 | —- | M] (Oracle Corporation) – C:\windows\System32\npDeployJava1.dll
[2012/12/29 11:35:18 | 000,779,704 | —- | M] (Oracle Corporation) – C:\windows\System32\deployJava1.dll
[2012/12/29 11:35:18 | 000,260,528 | —- | M] (Oracle Corporation) – C:\windows\System32\javaws.exe
[2012/12/29 11:35:18 | 000,174,000 | —- | M] (Oracle Corporation) – C:\windows\System32\javaw.exe
[2012/12/29 11:35:18 | 000,173,992 | —- | M] (Oracle Corporation) – C:\windows\System32\java.exe
[2012/12/21 03:20:50 | 000,358,136 | —- | M] () – C:\windows\System32\FNTCACHE.DAT
[2012/12/16 10:29:42 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\AVG 2013.lnk
[2012/12/16 10:17:12 | 000,001,042 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/12/16 08:13:28 | 000,295,424 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\atmfd.dll
[2012/12/16 08:13:20 | 000,034,304 | —- | M] (Adobe Systems) – C:\windows\System32\atmlib.dll
[2012/12/11 20:06:39 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\FlashPlayerApp.exe
[2012/12/11 20:06:39 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\FlashPlayerCPLApp.cpl
[2012/12/07 06:48:19 | 000,002,005 | —- | M] () – C:\Users\kafura\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/12/31 09:53:59 | 000,256,000 | —- | C] () – C:\windows\PEV.exe
[2012/12/31 09:53:59 | 000,208,896 | —- | C] () – C:\windows\MBR.exe
[2012/12/31 09:53:59 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2012/12/31 09:53:59 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2012/12/31 09:53:59 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2012/12/31 09:39:39 | 000,126,976 | —- | C] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/29 12:50:31 | 000,002,969 | —- | C] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/08/31 16:44:53 | 000,000,000 | —- | C] () – C:\windows\MSREGUSR.INI
[2012/07/04 11:23:28 | 000,173,074 | —- | C] () – C:\windows\hpoins46.dat
[2012/07/04 11:23:28 | 000,000,601 | —- | C] () – C:\windows\hpomdl46.dat
[2012/04/08 11:02:14 | 000,003,584 | —- | C] () – C:\Users\kafura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/18 06:44:00 | 010,920,984 | —- | C] () – C:\windows\System32\LogiDPP.dll
[2012/01/18 06:44:00 | 000,336,408 | —- | C] () – C:\windows\System32\DevManagerCore.dll
[2012/01/18 06:44:00 | 000,104,472 | —- | C] () – C:\windows\System32\LogiDPPApp.exe
[2011/08/12 12:20:14 | 000,015,896 | —- | C] () – C:\windows\System32\drivers\iKeyLFT2.dll
[2011/07/26 06:48:54 | 000,028,418 | —- | C] () – C:\windows\System32\lvcoinst.ini
[2010/03/14 20:03:04 | 000,271,673 | —- | C] () – C:\Users\kafura\skywest quiz.mht
[2009/12/25 23:03:29 | 000,008,416 | —- | C] () – C:\Users\kafura\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009/07/13 22:42:31 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 22:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 06:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 19:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

< :Services >

< >

< :OTL >

< FF - prefs.js..browser.startup.homepage: "npr.org" >

< FF - prefs.js..extensions.enabledItems: [removed]:11.0.0.0 >

< FF - prefs.js..network.proxy.no_proxies_on: "*.local" >

< FF - prefs.js..browser.startup.homepage: "http://www.npr.org/" >

< [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] >

< [2012/04/08 11:02:14 | 000,003,584 | —- | C] () – C:\Users\kafura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini >
Invalid Switch: 08 11:02:14 | 000,003,584 | —- | C] () – C:\Users\kafura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

< >

< :Files >

< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.

< >

< :Commands >

< [emptytemp] >

< [start explorer] >

< [Reboot] >

< End of report >
Post #26
Hi,

Looks like you may have accidentally press Scan instead of Fix with the last set of instructions. Please run the same instructions I provided for OTL but this time be sure to press Fix. :)
Post #29
Jeff,

I see no change from last post.
things are still the same
had to reset my home page

Patrick

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Prefs.js: "npr.org" removed from browser.startup.homepage
Prefs.js: [removed]:[removed] removed from extensions.enabledItems
Prefs.js: "*.local" removed from network.proxy.no_proxies_on
Prefs.js: "http://www.npr.org/" removed from browser.startup.homepage
C:\windows\msdownld.tmp folder deleted successfully.
C:\Users\kafura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\kafura\Desktop\cmd.bat deleted successfully.
C:\Users\kafura\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 134 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: kafura
->Temp folder emptied: 614265 bytes
->Temporary Internet Files folder emptied: 1133549919 bytes
->Java cache emptied: 2272466 bytes
->FireFox cache emptied: 109338499 bytes
->Apple Safari cache emptied: 12098560 bytes
->Flash cache emptied: 131360 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 111097 bytes
RecycleBin emptied: 268352 bytes

Total Files Cleaned = 1,200.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 01032013_184203

Files\Folders moved on Reboot…

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI