What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

infected laptop [Solved]

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Jeff,

results of OTL scan

OTL logfile created on: 1/3/2013 8:24:10 PM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\kafura\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 71.13% Memory free
3.74 Gb Paging File | 2.54 Gb Available in Paging File | 68.09% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.27 Gb Total Space | 165.79 Gb Free Space | 74.25% Space Free | Partition Type: NTFS

Computer Name: BIFF | User Name: kafura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\kafura\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
PRC - C:\Users\kafura\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
PRC - C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Common Files\Teleca Shared\Generic.exe (Teleca AB)
PRC - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe (Teleca)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\dbgout.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe (TODO: )
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe (Teleca AB)
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Common Files\Teleca Shared\logger.exe (Popwire AB)
PRC - C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
PRC - C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe (Teleca Sweden AB)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Modules (No Company Name) ==========

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\17796f2951c17ebf92dd4b7c9b3ce556\System.ServiceProcess.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Users\kafura\AppData\Roaming\Spotify\Data\libcef.dll ()
MOD - C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll ()
MOD - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\tcpsock_object.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll ()
MOD - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\fsync.dll ()
MOD - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\fsync.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll ()
MOD - C:\Program Files\TOSHIBA\PCDiag\NotifyPCD.dll ()
MOD - C:\Program Files\Common Files\Teleca Shared\boost_log-vc80-mt-1_33.dll ()


========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater13.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (TMachInfo) – C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV - (cfWiMAXService) – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
SRV - (TosCoSrv) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ConfigFree Service) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (USBCCID) – system32\DRIVERS\RtsUCcid.sys File not found
DRV - (RtsUIR) – system32\DRIVERS\Rts516xIR.sys File not found
DRV - (catchme) – C:\Users\kafura\AppData\Local\Temp\catchme.sys File not found
DRV - (avgtp) – C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (LVUVC) – C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (RTL8187B) – C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation )
DRV - (HTCAND32) – C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC1124 Inc)
DRV - (UsbDiag) – C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) – C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (tos_sps32) – C:\Windows\System32\drivers\tos_sps32.sys (TOSHIBA Corporation)
DRV - (RSUSBSTOR) – C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (TVALZ) – C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (LPCFilter) – C:\Windows\System32\drivers\LPCFilter.sys (COMPAL ELECTRONIC INC.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br…A&bmod;=TSNA
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{7AA0C22D-3016-4FE8-9ECC-4E762954DD33}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\..\SearchScopes\{7A13F886-FA12-43B1-B7F2-30FE3B84C785}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "npr.org"
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.5
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.5
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7BAE93811A-5C9A-4d34-8462-F7B864FC4696%7D:4.16
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\kafura\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\kafura\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/06 15:11:00 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/06/10 09:00:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/07 06:45:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/07 06:44:55 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/07 06:45:15 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/07 06:44:55 | 000,000,000 | —D | M]

[2010/04/24 00:26:39 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Extensions
[2012/12/29 12:37:21 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\vufdye7f.default\extensions
[2012/11/16 22:34:36 | 000,124,993 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/10/27 17:54:38 | 000,230,040 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/12/29 11:51:06 | 000,377,738 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2012/11/23 09:17:08 | 000,804,627 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/11/30 12:32:08 | 000,243,496 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012/12/07 06:44:53 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/12/07 06:44:53 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/10 09:00:47 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012/12/07 06:45:14 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/06 15:10:49 | 000,129,144 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/09/04 17:43:16 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/10/13 20:18:01 | 000,002,058 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/12/31 10:06:05 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe (Toshiba)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [MyTOSHIBA] C:\Program Files\TOSHIBA\My Toshiba\MyToshiba.exe (TOSHIBA)
O4 - HKCU..\Run: [Spotify] C:\Users\kafura\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk = C:\pmw\PMREMIND.EXE ()
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.10.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B767279-59A0-4ECD-B116-B25B002EEAAF}: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2B628043-564D-499C-B681-5AC04A3A786D}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/03 18:42:03 | 000,000,000 | —D | C] – C:\_OTL
[2013/01/01 19:26:02 | 000,000,000 | —D | C] – C:\windows\ERUNT
[2013/01/01 19:25:55 | 000,000,000 | —D | C] – C:\JRT
[2013/01/01 19:25:09 | 000,497,009 | —- | C] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:04 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:08:19 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/12/31 10:08:16 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\temp
[2012/12/31 09:53:59 | 000,518,144 | —- | C] (SteelWerX) – C:\windows\SWREG.exe
[2012/12/31 09:53:59 | 000,406,528 | —- | C] (SteelWerX) – C:\windows\SWSC.exe
[2012/12/31 09:53:59 | 000,060,416 | —- | C] (NirSoft) – C:\windows\NIRCMD.exe
[2012/12/31 09:36:52 | 000,000,000 | —D | C] – C:\Qoobox
[2012/12/31 09:36:27 | 000,000,000 | —D | C] – C:\windows\erdnt
[2012/12/31 09:31:57 | 005,016,388 | R— | C] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2012/12/29 20:06:24 | 000,688,992 | R— | C] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/12/29 11:36:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/12/16 20:09:35 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy 2
[2012/12/16 20:07:10 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\Programs
[2012/12/09 09:50:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/12/07 06:44:52 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox

========== Files - Modified Within 30 Days ==========

[2013/01/03 20:22:01 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/01/03 18:57:10 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/03 18:57:10 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/03 18:49:17 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2013/01/03 18:49:12 | 1504,354,304 | -HS- | M] () – C:\hiberfil.sys
[2013/01/01 19:25:19 | 000,497,009 | —- | M] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:12 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:06:05 | 000,000,027 | —- | M] () – C:\windows\System32\drivers\etc\hosts
[2012/12/31 09:39:41 | 000,126,976 | —- | M] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/31 09:32:12 | 005,016,388 | R— | M] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2012/12/29 20:06:34 | 000,688,992 | R— | M] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,002,969 | —- | M] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/12/21 03:20:50 | 000,358,136 | —- | M] () – C:\windows\System32\FNTCACHE.DAT
[2012/12/16 10:29:42 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\AVG 2013.lnk
[2012/12/16 10:17:12 | 000,001,042 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/12/07 06:48:19 | 000,002,005 | —- | M] () – C:\Users\kafura\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

========== Files Created - No Company Name ==========

[2012/12/31 09:53:59 | 000,256,000 | —- | C] () – C:\windows\PEV.exe
[2012/12/31 09:53:59 | 000,208,896 | —- | C] () – C:\windows\MBR.exe
[2012/12/31 09:53:59 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2012/12/31 09:53:59 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2012/12/31 09:53:59 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2012/12/31 09:39:39 | 000,126,976 | —- | C] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/29 12:50:31 | 000,002,969 | —- | C] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/08/31 16:44:53 | 000,000,000 | —- | C] () – C:\windows\MSREGUSR.INI
[2012/07/04 11:23:28 | 000,173,074 | —- | C] () – C:\windows\hpoins46.dat
[2012/07/04 11:23:28 | 000,000,601 | —- | C] () – C:\windows\hpomdl46.dat
[2012/01/18 06:44:00 | 010,920,984 | —- | C] () – C:\windows\System32\LogiDPP.dll
[2012/01/18 06:44:00 | 000,336,408 | —- | C] () – C:\windows\System32\DevManagerCore.dll
[2012/01/18 06:44:00 | 000,104,472 | —- | C] () – C:\windows\System32\LogiDPPApp.exe
[2011/08/12 12:20:14 | 000,015,896 | —- | C] () – C:\windows\System32\drivers\iKeyLFT2.dll
[2011/07/26 06:48:54 | 000,028,418 | —- | C] () – C:\windows\System32\lvcoinst.ini
[2010/03/14 20:03:04 | 000,271,673 | —- | C] () – C:\Users\kafura\skywest quiz.mht
[2009/12/25 23:03:29 | 000,008,416 | —- | C] () – C:\Users\kafura\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009/07/13 22:42:31 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 22:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 06:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 19:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/02/25 10:32:49 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Astro Gemini Software
[2012/10/07 15:38:50 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\AVG2013
[2012/04/08 11:16:04 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Blackberry Desktop
[2010/02/24 15:32:19 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\DreamDale
[2010/03/08 17:52:52 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Facebook
[2010/04/22 21:46:42 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\InfraRecorder
[2010/04/13 19:37:22 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Leader Technologies
[2010/04/13 11:57:48 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Leadertech
[2010/02/24 15:19:57 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\MB3
[2010/02/13 17:06:23 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\OpenOffice.org
[2010/01/27 01:44:02 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\PlayFirst
[2010/03/21 19:39:59 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Playrix Entertainment
[2012/04/08 11:00:46 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Research In Motion
[2010/02/24 15:08:26 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\SmashFrenzy3
[2013/01/03 19:20:44 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Spotify
[2010/02/26 00:26:56 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Teleca
[2012/10/07 15:38:25 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\TuneUp Software
[2010/04/22 21:40:30 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\WeatherBug
[2009/12/25 00:11:17 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\WinBatch

========== Purity Check ==========



< End of report >
Post #32
Random question, is there a way to change the user name? I bought this from the previous owner (kafura) and he shows up in scans, reports, & saved docs.
Post #33

Random question,
is there a way to change the user name?
I bought this from the previous owner (kafura) and he shows up in scans, reports, & saved docs.

Well…do you have the disks to reinstall everything? If that were the case then I would have fomatted the hard drive and put a fresh operating system on it. There is no telling what was on the system when you got it. Otherwise you could create a new profile and use that instead I believe.

How is your system running? Are you still having problems in Firefox?
Post #34
Hi Jeff, I just got back from a grueling 12 hour day. All my basic problems are still here. I still see "deal drop down " ads on any open page and in search results My home page is still scrambled I've attached a png screen shot of my home page and a page that has hover ads. I did not get any of the discs. Setting up a new profile sounds doable Thanks, Patrick

Attachments:

Post #35
An easier way to fix this might be to uninstall your Firefox and then download a fresh copy. That should remove all of the problems you are having. If you choose to do this though, be sure to save all of your Favorites. :)
Post #38
Jeff,
Closed everything and ran OTL, log posted below.
If I haven't said it yet,
Thank you
for your help and patience

Patrick

OTL logfile created on: 1/5/2013 9:32:46 PM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\kafura\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.05 Gb Available Physical Memory | 56.13% Memory free
3.74 Gb Paging File | 2.26 Gb Available in Paging File | 60.57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.27 Gb Total Space | 166.74 Gb Free Space | 74.68% Space Free | Partition Type: NTFS

Computer Name: BIFF | User Name: kafura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\kafura\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
PRC - C:\Users\kafura\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
PRC - C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Common Files\Teleca Shared\Generic.exe (Teleca AB)
PRC - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe (Teleca)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\dbgout.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe (TODO: )
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe (Teleca AB)
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Windows\System32\mspaint.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Teleca Shared\logger.exe (Popwire AB)
PRC - C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
PRC - C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe (Teleca Sweden AB)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Modules (No Company Name) ==========

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\17796f2951c17ebf92dd4b7c9b3ce556\System.ServiceProcess.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Users\kafura\AppData\Roaming\Spotify\Data\libcef.dll ()
MOD - C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll ()
MOD - C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\tcpsock_object.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll ()
MOD - C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll ()
MOD - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\fsync.dll ()
MOD - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\fsync.dll ()
MOD - C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll ()
MOD - C:\Program Files\TOSHIBA\PCDiag\NotifyPCD.dll ()
MOD - C:\Program Files\Common Files\Teleca Shared\boost_log-vc80-mt-1_33.dll ()


========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater13.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (TMachInfo) – C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV - (cfWiMAXService) – C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION)
SRV - (TosCoSrv) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ConfigFree Service) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV - (USBCCID) – system32\DRIVERS\RtsUCcid.sys File not found
DRV - (RtsUIR) – system32\DRIVERS\Rts516xIR.sys File not found
DRV - (catchme) – C:\Users\kafura\AppData\Local\Temp\catchme.sys File not found
DRV - (avgtp) – C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (LVUVC) – C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (RTL8187B) – C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation )
DRV - (HTCAND32) – C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC1124 Inc)
DRV - (UsbDiag) – C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) – C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (tdcmdpst) – C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (tos_sps32) – C:\Windows\System32\drivers\tos_sps32.sys (TOSHIBA Corporation)
DRV - (RSUSBSTOR) – C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (TVALZ) – C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (LPCFilter) – C:\Windows\System32\drivers\LPCFilter.sys (COMPAL ELECTRONIC INC.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br…A&bmod;=TSNA
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{7AA0C22D-3016-4FE8-9ECC-4E762954DD33}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7TSNA

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\..\SearchScopes\{7A13F886-FA12-43B1-B7F2-30FE3B84C785}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "npr.org"
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.5
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.5
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7BAE93811A-5C9A-4d34-8462-F7B864FC4696%7D:4.16
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\kafura\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\kafura\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/06 15:11:00 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/06/10 09:00:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/05 20:41:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/12/07 06:44:55 | 000,000,000 | —D | M]

[2010/04/24 00:26:39 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Extensions
[2012/12/29 12:37:21 | 000,000,000 | —D | M] (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\Firefox\Profiles\vufdye7f.default\extensions
[2012/11/16 22:34:36 | 000,124,993 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/10/27 17:54:38 | 000,230,040 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\[removed]
[2012/12/29 11:51:06 | 000,377,738 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2012/11/23 09:17:08 | 000,804,627 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/11/30 12:32:08 | 000,243,496 | —- | M] () (No name found) – C:\Users\kafura\AppData\Roaming\mozilla\firefox\profiles\vufdye7f.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2013/01/05 20:41:03 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/12/07 06:44:53 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/10 09:00:47 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012/11/29 02:27:51 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/06 15:10:49 | 000,129,144 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/11/29 02:27:12 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/11/29 02:27:12 | 000,002,058 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/12/31 10:06:05 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe (Toshiba)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [MyTOSHIBA] C:\Program Files\TOSHIBA\My Toshiba\MyToshiba.exe (TOSHIBA)
O4 - HKCU..\Run: [Spotify] C:\Users\kafura\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Event Reminder.lnk = C:\pmw\PMREMIND.EXE ()
O4 - Startup: C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_09)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.10.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B767279-59A0-4ECD-B116-B25B002EEAAF}: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2B628043-564D-499C-B681-5AC04A3A786D}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/05 20:41:07 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2013/01/03 18:42:03 | 000,000,000 | —D | C] – C:\_OTL
[2013/01/01 19:26:02 | 000,000,000 | —D | C] – C:\windows\ERUNT
[2013/01/01 19:25:55 | 000,000,000 | —D | C] – C:\JRT
[2013/01/01 19:25:09 | 000,497,009 | —- | C] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:04 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:08:19 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/12/31 10:08:16 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\temp
[2012/12/31 09:53:59 | 000,518,144 | —- | C] (SteelWerX) – C:\windows\SWREG.exe
[2012/12/31 09:53:59 | 000,406,528 | —- | C] (SteelWerX) – C:\windows\SWSC.exe
[2012/12/31 09:53:59 | 000,060,416 | —- | C] (NirSoft) – C:\windows\NIRCMD.exe
[2012/12/31 09:36:52 | 000,000,000 | —D | C] – C:\Qoobox
[2012/12/31 09:36:27 | 000,000,000 | —D | C] – C:\windows\erdnt
[2012/12/31 09:31:57 | 005,016,388 | R— | C] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2012/12/29 20:06:24 | 000,688,992 | R— | C] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/12/29 12:50:31 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/12/29 11:36:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/12/16 20:09:35 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy 2
[2012/12/16 20:07:10 | 000,000,000 | —D | C] – C:\Users\kafura\AppData\Local\Programs
[2012/12/09 09:50:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/12/07 06:44:52 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox

========== Files - Modified Within 30 Days ==========

[2013/01/05 21:22:00 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/01/05 20:41:08 | 000,001,080 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/01/05 18:41:38 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2013/01/04 21:38:18 | 000,102,847 | —- | M] () – C:\Users\kafura\Desktop\hover ads.png
[2013/01/04 21:35:00 | 000,242,864 | —- | M] () – C:\Users\kafura\Desktop\Untitled.png
[2013/01/03 18:57:10 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/03 18:57:10 | 000,016,304 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/03 18:49:12 | 1504,354,304 | -HS- | M] () – C:\hiberfil.sys
[2013/01/01 19:25:19 | 000,497,009 | —- | M] (Oleg N. Scherbakov) – C:\Users\kafura\Desktop\JRT.exe
[2013/01/01 01:11:12 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\kafura\Desktop\OTL.exe
[2012/12/31 10:06:05 | 000,000,027 | —- | M] () – C:\windows\System32\drivers\etc\hosts
[2012/12/31 09:39:41 | 000,126,976 | —- | M] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/31 09:32:12 | 005,016,388 | R— | M] (Swearware) – C:\Users\kafura\Desktop\ComboFix.exe
[2012/12/29 20:06:34 | 000,688,992 | R— | M] (Swearware) – C:\Users\kafura\Desktop\dds.com
[2012/12/29 12:50:31 | 000,002,969 | —- | M] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/12/21 03:20:50 | 000,358,136 | —- | M] () – C:\windows\System32\FNTCACHE.DAT
[2012/12/16 10:29:42 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\AVG 2013.lnk
[2012/12/16 10:17:12 | 000,001,042 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

========== Files Created - No Company Name ==========

[2013/01/05 20:41:08 | 000,001,092 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013/01/05 20:41:08 | 000,001,080 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/01/04 21:38:17 | 000,102,847 | —- | C] () – C:\Users\kafura\Desktop\hover ads.png
[2013/01/04 21:34:59 | 000,242,864 | —- | C] () – C:\Users\kafura\Desktop\Untitled.png
[2012/12/31 09:53:59 | 000,256,000 | —- | C] () – C:\windows\PEV.exe
[2012/12/31 09:53:59 | 000,208,896 | —- | C] () – C:\windows\MBR.exe
[2012/12/31 09:53:59 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2012/12/31 09:53:59 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2012/12/31 09:53:59 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2012/12/31 09:39:39 | 000,126,976 | —- | C] () – C:\Users\kafura\Desktop\ResetTeaTimer.exe
[2012/12/29 12:50:31 | 000,002,969 | —- | C] () – C:\Users\kafura\Desktop\HiJackThis.lnk
[2012/08/31 16:44:53 | 000,000,000 | —- | C] () – C:\windows\MSREGUSR.INI
[2012/07/04 11:23:28 | 000,173,074 | —- | C] () – C:\windows\hpoins46.dat
[2012/07/04 11:23:28 | 000,000,601 | —- | C] () – C:\windows\hpomdl46.dat
[2012/01/18 06:44:00 | 010,920,984 | —- | C] () – C:\windows\System32\LogiDPP.dll
[2012/01/18 06:44:00 | 000,336,408 | —- | C] () – C:\windows\System32\DevManagerCore.dll
[2012/01/18 06:44:00 | 000,104,472 | —- | C] () – C:\windows\System32\LogiDPPApp.exe
[2011/08/12 12:20:14 | 000,015,896 | —- | C] () – C:\windows\System32\drivers\iKeyLFT2.dll
[2011/07/26 06:48:54 | 000,028,418 | —- | C] () – C:\windows\System32\lvcoinst.ini
[2010/03/14 20:03:04 | 000,271,673 | —- | C] () – C:\Users\kafura\skywest quiz.mht
[2009/12/25 23:03:29 | 000,008,416 | —- | C] () – C:\Users\kafura\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009/07/13 22:42:31 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 22:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 06:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 19:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/02/25 10:32:49 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Astro Gemini Software
[2012/10/07 15:38:50 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\AVG2013
[2012/04/08 11:16:04 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Blackberry Desktop
[2010/02/24 15:32:19 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\DreamDale
[2010/03/08 17:52:52 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Facebook
[2010/04/22 21:46:42 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\InfraRecorder
[2010/04/13 19:37:22 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Leader Technologies
[2010/04/13 11:57:48 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Leadertech
[2010/02/24 15:19:57 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\MB3
[2010/02/13 17:06:23 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\OpenOffice.org
[2010/01/27 01:44:02 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\PlayFirst
[2010/03/21 19:39:59 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Playrix Entertainment
[2012/04/08 11:00:46 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Research In Motion
[2010/02/24 15:08:26 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\SmashFrenzy3
[2013/01/05 21:41:34 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Spotify
[2010/02/26 00:26:56 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\Teleca
[2012/10/07 15:38:25 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\TuneUp Software
[2010/04/22 21:40:30 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\WeatherBug
[2009/12/25 00:11:17 | 000,000,000 | —D | M] – C:\Users\kafura\AppData\Roaming\WinBatch

========== Purity Check ==========



< End of report >
Post #39
Hi,

I am not seeing anything jumping out at me unfortunately….let's give something different a try.

SUPERAntispyware
  • Download SUPERAntispyware and install it to your system.
  • Open SUPERAntiSpyware.
  • Click Check for Updates.
  • Under Select Scan Type choose Quick Scan then click the Scan your Computer button.
  • At the end of the scan all of the items detected as threats will appear on the summary screen.
  • You will then click the Remove Threats button to remove those threats.

Let me know if that helped. :)
Post #40
Jeff,
nothing seems to have changed.
I've posted the log below
it appears to be nothing but cookies

Patrick

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/06/2013 at 02:14 PM

Application Version : 5.6.1014

Core Rules Database Version : 9831
Trace Rules Database Version: 7643

Scan type : Quick Scan
Total Scan Time : 00:19:06

Operating System Information
Windows 7 Home Premium 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 872
Memory threats detected : 0
Registry items scanned : 30757
Registry threats detected : 0
File items scanned : 8495
File threats detected : 24

Adware.Tracking Cookie
C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt [ /cts.metricsdirect ]
C:\Users\kafura\AppData\Roaming\Microsoft\Windows\Cookies\[removed][1].txt [ /cts.zroitracker ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@adservr21[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@revsci[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@imrworldwide[2].txt [ Cookie:[removed]/cgi-bin ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@media6degrees[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@invitemedia[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@2o7[2].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@realmedia[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@adbrite[2].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@gotclicky[2].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@interclick[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@ru4[2].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@pointroll[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed]-sys[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@grandetracker[1].txt [ Cookie:[removed]/lab/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@collective-media[2].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\kafura@advertising[1].txt [ Cookie:[removed]/ ]
C:\USERS\KAFURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt [ Cookie:[removed]/ ]
Post #41
Did you remove the entries found by SuperAntispyware?

Please delete the current version of Combofix.exe from your desktop and download a new version from here to your desktop.

Disable your AntiVirus and AntiSpyware applications.

Right-click and Run as Administrator on the Combofix.exe and follow the prombts on your display. When finish, it will create a C:\Combofix.txt. Please post this log for further review.
———
Post #42
Yes, did remove entries found by Super… Ran the new combofix, results posted below Hover ads are gone as well as the related ads on my serch page. However, page tabs still flicker and refresh every few seconds in the couple of miniutes it took to write this, it has done it many many times (screenshot) 📎hover_ads.png ComboFix 13-01-05.01 - kafura 01/06/2013 15:51:05.2.1 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1913.1263 [GMT -6:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-12-06 to 2013-01-06 ))))))))))))))))))))))))))))))) . . 2013-01-06 22:00 . 2013-01-06 22:00 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2013-01-06 22:00 . 2013-01-06 22:00 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-01-06 19:53 . 2013-01-06 19:53 ——– d—–w- c:\users\kafura\AppData\Roaming\SUPERAntiSpyware.com 2013-01-06 19:53 . 2013-01-06 19:53 ——– d—–w- c:\program files\SUPERAntiSpyware 2013-01-06 19:53 . 2013-01-06 19:53 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2013-01-04 00:42 . 2013-01-04 00:42 ——– d—–w- C:\_OTL 2013-01-02 01:26 . 2013-01-02 01:26 ——– d—–w- c:\windows\ERUNT 2013-01-02 01:25 . 2013-01-02 01:25 ——– d—–w- C:\JRT 2012-12-31 16:08 . 2013-01-06 22:00 ——– d—–w- c:\users\kafura\AppData\Local\temp 2012-12-29 18:50 . 2012-12-29 18:50 388096 —-a-r- c:\users\kafura\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-12-29 18:50 . 2012-12-29 18:50 ——– d—–w- c:\program files\Trend Micro 2012-12-29 17:36 . 2012-12-29 17:36 ——– d—–w- c:\program files\Common Files\Java 2012-12-29 17:35 . 2012-12-29 17:35 93640 —-a-w- c:\windows\system32\WindowsAccessBridge.dll 2012-12-21 09:01 . 2012-12-16 14:13 295424 —-a-w- c:\windows\system32\atmfd.dll 2012-12-21 09:01 . 2012-12-16 14:13 34304 —-a-w- c:\windows\system32\atmlib.dll 2012-12-17 02:09 . 2013-01-03 12:46 ——– d—–w- c:\program files\Spybot - Search & Destroy 2 2012-12-17 02:07 . 2012-12-17 02:07 ——– d—–w- c:\users\kafura\AppData\Local\Programs 2012-12-12 02:32 . 2012-11-22 02:56 2345984 —-a-w- c:\windows\system32\win32k.sys 2012-12-11 01:16 . 2012-08-23 14:44 14848 —-a-w- c:\windows\system32\drivers\rdpvideominiport.sys 2012-12-11 01:10 . 2012-08-24 17:05 136560 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2012-12-11 01:10 . 2012-08-24 17:02 369856 —-a-w- c:\windows\system32\drivers\cng.sys 2012-12-11 01:10 . 2012-08-24 16:57 247808 —-a-w- c:\windows\system32\schannel.dll 2012-12-11 01:10 . 2012-08-24 16:57 220160 —-a-w- c:\windows\system32\ncrypt.dll 2012-12-11 01:10 . 2012-08-24 16:56 1039360 —-a-w- c:\windows\system32\lsasrv.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-29 17:35 . 2012-10-07 22:13 859072 —-a-w- c:\windows\system32\npDeployJava1.dll 2012-12-29 17:35 . 2010-05-18 09:35 779704 —-a-w- c:\windows\system32\deployJava1.dll 2012-12-12 02:06 . 2012-04-24 23:46 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-12-12 02:06 . 2012-01-22 01:48 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-09 00:19 . 2012-09-04 20:27 26984 —-a-w- c:\windows\system32\drivers\avgtpx86.sys 2012-10-27 22:23 . 2010-03-11 20:08 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2012-10-27 22:23 . 2010-03-25 02:03 2876528 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2012-10-27 22:23 . 2010-06-04 04:13 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2012-10-27 22:23 . 2010-03-11 20:06 539984 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2012-10-22 19:02 . 2012-10-22 19:02 179936 —-a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2012-10-16 07:39 . 2012-11-28 12:37 561664 —-a-w- c:\windows\apppatch\AcLayers.dll 2012-10-15 09:48 . 2012-10-15 09:48 55776 —-a-w- c:\windows\system32\drivers\avgidshx.sys 2012-10-09 17:40 . 2012-11-14 07:11 193536 —-a-w- c:\windows\system32\dhcpcore6.dll 2012-10-09 17:40 . 2012-11-14 07:11 44032 —-a-w- c:\windows\system32\dhcpcsvc6.dll 2012-11-29 08:27 . 2013-01-06 02:41 262112 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MyTOSHIBA"="c:\program files\TOSHIBA\My Toshiba\MyToshiba.exe" [2009-08-06 264048] "Spotify"="c:\users\kafura\AppData\Roaming\Spotify\Spotify.exe" [2012-11-08 7880664] "Spotify Web Helper"="c:\users\kafura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-11-08 1199576] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 4763008] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 174104] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 151064] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-29 7625248] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-21 1545512] "SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2009-07-10 352256] "HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2009-06-02 425984] "KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2009-01-14 34088] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-08-05 476512] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-07-28 460088] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2009-08-05 738616] "ToshibaServiceStation"="c:\program files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-02-11 1295736] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-09-17 611672] "NortonOnlineBackupReminder"="c:\program files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" [2009-07-16 529256] "Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2009-05-27 598016] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120] "LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888] "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448] "TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" [2012-06-06 296056] "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-07 3143800] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\users\kafura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Event Reminder.lnk - c:\pmw\PMREMIND.EXE [1997-8-6 255408] OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x] R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x] S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [x] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x] S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [x] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [x] S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [x] S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [x] S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x] S2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [x] S3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x] S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPService REG_MULTI_SZ HPSLPSVC HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 GPSvcGroup REG_MULTI_SZ GPSvc . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{01250B8F-D947-4F8A-9408-FE8E3EE2EC92}] 2009-08-06 16:15 264048 —-a-w- c:\program files\TOSHIBA\My Toshiba\MyToshiba.exe . Contents of the 'Scheduled Tasks' folder . 2013-01-06 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-24 02:06] . 2013-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-01-06 19:53] . 2013-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-01-06 19:53] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 [removed] FF - ProfilePath - c:\users\kafura\AppData\Roaming\Mozilla\Firefox\Profiles\vufdye7f.default\ FF - prefs.js: browser.startup.homepage - npr.org . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-01-06 16:02:51 ComboFix-quarantined-files.txt 2013-01-06 22:02 ComboFix2.txt 2012-12-31 16:08 . Pre-Run: 178,183,450,624 bytes free Post-Run: 177,897,353,216 bytes free . - - End Of File - - 136B2C17DBFEC1025436D3CB85230A9E

Attachments:

Post #43

However, page tabs still flicker and refresh every few seconds
in the couple of miniutes it took to write this, it has done it many many times (screenshot)

And this is only happening in Firefox?
Post #44
Hello again, Well, apparently yes it is only happening in firefox . I'm now working in Chrome which downloaded w/ Superantispyware My homepage in ok, I see no hover ads and no refreshes. there is now an ad at the tip of this thread but I assume that's just a chrome thing Patrick 📎hover_ads.png
Post #45
Ok….we need to uninstall Firefox all together.

Go to Control Panel >> Programs and Features and uninstall Firefox

Now go and delete the following folders:
C:\Program Files\Firefox <——-
C:\Program Files\Mozilla <——-


Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Right-click and Run as Administrator SystemLook.exe to run it.
  • Copy the content within the following codebox into the main textfield:
    :regfind
Firefox
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI