What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google Home page directed to mocaflix [Solved]

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi there . Sorry for the problem again but my sis used my laptop this time and didnt really practise security (Will guide her on that in the future) . My opening page is mocaflix again and i hope you guys can clear this thing out of my system . Awaiting for assistance on this matter . Thanks .
Post #2
Hi again

Sorry for the problem again

No problem - let’s have another look.

Download and run Junkware Removal Tool

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.
  • shut down your protection software now to avoid potential conflicts.
  • run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
  • the tool will open and start scanning your system
  • please be patient as this can take a while to complete depending on your system's specifications
  • on completion, a log (JRT.txt) is saved to your desktop and will automatically open
  • post the contents of JRT.txt into your next message.
================================================

Download and run OTL
  • download OTL to your desktop.
  • double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • click Scan all users.
  • under Custom Scan paste this in


    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    services.exe
    /md5stop
    %systemroot%\*. /rp /s
    DRIVES
    CREATERESTOREPOINT

  • click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
  • when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • you may need two posts to fit them both in.
Logs to include with next post:

JRT.txt
OTL.txt
Extras.txt

Thanks

Satchfan
Post #3
JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.6.3 (02.12.2013:1)
OS: Windows 7 Home Premium x64
Ran by [removed] on Sat 16/02/2013 at 12:48:17.02
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\windows\currentversion\run\\browsers protector
Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\searchscopes\\DefaultScope
Successfully repaired: [Registry Value] hkey_users\S-1-5-21-4176799644-1864613857-429760169-1001\software\microsoft\internet explorer\searchscopes\\DefaultScope



~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_current_user\software\somoto
Successfully deleted: [Registry Key] hkey_current_user\software\startsearch
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{6a1806cd-94d4-4689-ba73-e35ea1ea9990}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{6a1806cd-94d4-4689-ba73-e35ea1ea9990}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\ProgramData\partner"
Successfully deleted: [Folder] "C:\Users\ONewbieO\AppData\Roaming\tencent"
Failed to delete: [Folder] "C:\Program Files (x86)\browsers protector"
Successfully deleted: [Folder] "C:\Program Files (x86)\filesfrog update checker"
Successfully deleted: [Folder] "C:\Program Files (x86)\startsearch plugin"
Successfully deleted: [Folder] "C:\Program Files (x86)\tencent"
Successfully deleted: [Folder] "C:\Program Files (x86)\vshare.tv plugin"



~~~ FireFox

Successfully deleted: [File] C:\Users\ONewbieO\AppData\Roaming\mozilla\firefox\profiles\x6t7q09q.default\searchplugins\startsear.xml
Successfully deleted the following from C:\Users\ONewbieO\AppData\Roaming\mozilla\firefox\profiles\x6t7q09q.default\prefs.js

user_pref("browser.search.defaultengine", "Web Search");
Emptied folder: C:\Users\ONewbieO\AppData\Roaming\mozilla\firefox\profiles\x6t7q09q.default\minidumps [8 files]



~~~ Chrome

Successfully deleted: [Registry Key] hkey_local_machine\software\google\chrome\extensions\bildoibdboopgomcbiplincneeicgipj



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 16/02/2013 at 13:24:32.66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


OTL.txt

OTL logfile created on: 16/2/2013 1:26:26 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ONewbieO\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

3.92 Gb Total Physical Memory | 2.33 Gb Available Physical Memory | 59.52% Memory free
7.83 Gb Paging File | 5.22 Gb Available in Paging File | 66.70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.62 Gb Total Space | 361.86 Gb Free Space | 85.83% Space Free | Partition Type: NTFS
Drive D: | 29.30 Gb Total Space | 26.62 Gb Free Space | 90.87% Space Free | Partition Type: NTFS

Computer Name: ALVINPC | User Name: ONewbieO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/02/16 13:25:42 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\ONewbieO\Downloads\OTL.exe
PRC - [2013/02/12 23:03:18 | 000,086,752 | —- | M] (Avira Operations GmbH & Co. KG) – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013/02/12 23:01:12 | 000,110,816 | —- | M] (Avira Operations GmbH & Co. KG) – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013/02/12 23:01:10 | 000,385,248 | —- | M] (Avira Operations GmbH & Co. KG) – C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013/02/06 08:16:42 | 000,213,384 | —- | M] (Google Inc.) – C:\Users\ONewbieO\AppData\Local\Google\Update\1.3.21.135\GoogleCrashHandler.exe
PRC - [2013/01/31 10:38:54 | 003,289,208 | —- | M] (Skype Technologies S.A.) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/12/18 22:28:08 | 000,065,192 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/10/04 16:48:14 | 002,415,104 | —- | M] (Emsisoft GmbH) – C:\Program Files (x86)\Online Armor\oaui.exe
PRC - [2012/10/04 16:47:14 | 004,463,864 | —- | M] (Emsisoft GmbH) – C:\Program Files (x86)\Online Armor\OAsrv.exe
PRC - [2012/10/04 16:44:49 | 001,248,144 | —- | M] (Emsisoft GmbH) – C:\Program Files (x86)\Online Armor\oahlp.exe
PRC - [2012/10/04 16:44:22 | 000,216,072 | —- | M] (Emsisoft GmbH) – C:\Program Files (x86)\Online Armor\oacat.exe
PRC - [2012/07/06 20:17:02 | 000,207,360 | —- | M] () – C:\Program Files (x86)\Browsers Protector\regmon32.exe
PRC - [2012/01/31 17:10:10 | 000,026,264 | —- | M] (PC Pitstop LLC) – C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe
PRC - [2011/08/02 04:06:24 | 000,291,272 | —- | M] () – C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe
PRC - [2011/07/23 08:41:10 | 000,047,704 | —- | M] (Alcor) – C:\Windows\Webcam\S6000\S6000Mnt.exe
PRC - [2011/04/01 11:24:42 | 000,189,880 | —- | M] (PPLive Corporation) – C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
PRC - [2011/03/31 05:42:34 | 001,001,808 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
PRC - [2011/03/31 05:42:32 | 001,321,296 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
PRC - [2011/03/31 05:42:30 | 000,923,984 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
PRC - [2011/02/22 12:13:50 | 002,656,280 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2011/02/22 12:13:46 | 000,326,168 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2011/01/29 14:29:36 | 000,136,488 | —- | M] (CyberLink) – C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
PRC - [2010/11/18 00:53:16 | 000,113,288 | —- | M] (Renesas Electronics Corporation) – C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010/02/03 15:08:56 | 000,087,336 | —- | M] (CyberLink Corp.) – C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
PRC - [2009/09/18 18:48:34 | 002,412,032 | —- | M] (Vodafone) – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
PRC - [2009/09/18 18:48:28 | 000,009,216 | —- | M] (Vodafone) – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
PRC - [2009/03/08 13:52:32 | 002,327,040 | —- | M] (Lux Aeterna) – C:\Program Files (x86)\Speaking Clock Deluxe\SpClDlx.exe


========== Modules (No Company Name) ==========

MOD - [2013/02/14 13:51:37 | 000,212,992 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\1633b99a3e24b388d51ff1d4284255d7\System.ServiceProcess.ni.dll
MOD - [2013/02/14 13:51:04 | 012,436,480 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\075549b8a14c0f23ccebd72e89721f85\System.Windows.Forms.ni.dll
MOD - [2013/02/14 13:16:11 | 013,199,360 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\806c4ba7d696ab586ffd774a31f1a66b\System.Windows.Forms.ni.dll
MOD - [2013/01/26 10:35:06 | 000,460,240 | —- | M] () – C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppgooglenaclpluginchrome.dll
MOD - [2013/01/26 10:35:04 | 004,012,496 | —- | M] () – C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll
MOD - [2013/01/26 10:34:19 | 000,597,968 | —- | M] () – C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\24.0.1312.57\libglesv2.dll
MOD - [2013/01/26 10:34:18 | 000,124,368 | —- | M] () – C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\24.0.1312.57\libegl.dll
MOD - [2013/01/26 10:34:16 | 001,552,848 | —- | M] () – C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\24.0.1312.57\ffmpegsumo.dll
MOD - [2013/01/10 11:50:02 | 001,051,136 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\7f636abd2ed8c21ed1ab2ba3d3113a04\System.Management.ni.dll
MOD - [2013/01/10 11:47:04 | 000,771,584 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b7cce39782300219e1130698e8fbc30c\System.Runtime.Remoting.ni.dll
MOD - [2013/01/10 11:47:02 | 000,627,200 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\0b8dbb18e28f11ff4913ef33bef2c337\System.Transactions.ni.dll
MOD - [2013/01/10 11:47:01 | 006,611,456 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\07c0618294e07242afd2f0445c90fd49\System.Data.ni.dll
MOD - [2013/01/10 11:46:27 | 001,592,832 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\287e0f73a2bb79d6ba7f6141d6914bab\System.Drawing.ni.dll
MOD - [2013/01/10 11:46:07 | 000,684,032 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\0e86998486549174442e2aa0e29cb4da\System.Security.ni.dll
MOD - [2013/01/10 11:46:04 | 005,453,312 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\1a8cdc51e5752c5ef72b8677017df8c9\System.Xml.ni.dll
MOD - [2013/01/10 11:46:01 | 000,971,264 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\f1d29cd3d9de9febda2ea12ab2796666\System.Configuration.ni.dll
MOD - [2013/01/10 11:46:00 | 007,989,760 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\98b49167a3373cf333d4c89ac47dcefb\System.ni.dll
MOD - [2013/01/10 11:45:54 | 011,493,888 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\2866646f2e764e809451219352b63ef0\mscorlib.ni.dll
MOD - [2013/01/10 01:30:23 | 001,801,728 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\cbb7db665b3ba25a931258eb702527f5\System.Xaml.ni.dll
MOD - [2013/01/09 23:30:39 | 018,002,944 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f28a346ae10e2eec581608f591cf7116\PresentationFramework.ni.dll
MOD - [2013/01/09 23:30:25 | 011,451,904 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\8983c040161b34c64474f195bff5e2de\PresentationCore.ni.dll
MOD - [2013/01/09 23:30:14 | 007,069,696 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\08bebcf66ad666dfdf2a4a934d79c0f9\System.Core.ni.dll
MOD - [2013/01/09 23:30:09 | 005,617,664 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d884c684ee3f738a60e3c50dd5d88caa\System.Xml.ni.dll
MOD - [2013/01/09 23:30:09 | 003,858,944 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\5dbabea688adfc665e3453561736699a\WindowsBase.ni.dll
MOD - [2013/01/09 23:30:09 | 000,595,968 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7d6b122bee0977d953ee2409d74c3c25\PresentationFramework.Aero.ni.dll
MOD - [2013/01/09 23:30:08 | 001,667,584 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b83993cc955262507c8ead67567c8060\System.Drawing.ni.dll
MOD - [2013/01/09 23:30:04 | 000,982,528 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\cb72ac8478a5ea7e2d570bb710ecb1c1\System.Configuration.ni.dll
MOD - [2013/01/09 23:30:03 | 009,094,656 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System\df418085cedae9fa2efee87e20a419a4\System.ni.dll
MOD - [2013/01/09 23:29:58 | 014,413,824 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\60c214b6ad5691e368a16ec65d127c27\mscorlib.ni.dll
MOD - [2012/12/12 13:32:26 | 005,025,792 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012/11/16 23:29:13 | 000,419,272 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsclient.dll
MOD - [2012/11/16 23:28:44 | 000,034,152 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsstatistic.dll
MOD - [2012/11/16 23:28:30 | 000,083,416 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsdone.dll
MOD - [2012/10/05 18:53:24 | 003,198,976 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2012/10/05 18:53:24 | 000,630,784 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012/08/31 18:59:19 | 004,550,656 | —- | M] () – C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
MOD - [2012/07/06 20:17:02 | 000,207,360 | —- | M] () – C:\Program Files (x86)\Browsers Protector\regmon32.exe
MOD - [2011/08/02 04:06:24 | 000,291,272 | —- | M] () – C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe
MOD - [2011/04/01 11:24:42 | 000,912,744 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\MngModule.dll
MOD - [2011/04/01 11:24:42 | 000,516,864 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\sqlite3.dll
MOD - [2010/11/21 11:24:32 | 000,425,984 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2010/11/21 11:24:08 | 002,927,616 | —- | M] () – C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010/11/21 11:23:48 | 002,048,000 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2009/07/14 09:15:45 | 000,364,544 | —- | M] () – C:\Windows\SysWOW64\msjetoledb40.dll
MOD - [2009/06/11 05:23:19 | 000,261,632 | —- | M] () – C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009/06/11 05:22:40 | 000,010,752 | —- | M] () – C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
MOD - [2009/01/27 18:59:38 | 000,295,424 | —- | M] () – C:\Program Files (x86)\Speaking Clock Deluxe\voice\American English (female).dll
MOD - [2003/02/17 19:11:44 | 000,312,832 | —- | M] () – C:\Program Files (x86)\Speaking Clock Deluxe\timer.dll
MOD - [2002/06/02 16:05:40 | 000,038,912 | —- | M] () – C:\Program Files (x86)\Speaking Clock Deluxe\spcl01.dll


========== Services (SafeList) ==========

SRV:64bit: - [2012/12/16 19:25:38 | 000,123,664 | —- | M] (SANDBOXIE L.T.D) [Auto | Running] – C:\Program Files\Sandboxie\SbieSvc.exe – (SbieSvc)
SRV:64bit: - [2012/09/15 13:31:36 | 000,140,672 | —- | M] (SUPERAntiSpyware.com) [Auto | Running] – C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE – (!SASCORE)
SRV:64bit: - [2011/06/02 03:38:30 | 001,517,328 | —- | M] (Intel® Corporation) [Auto | Running] – C:\Program Files\Intel\WiFi\bin\EvtEng.exe – (EvtEng)
SRV:64bit: - [2011/06/02 03:23:40 | 000,340,240 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe – (MyWiFiDHCPDNS)
SRV:64bit: - [2011/06/02 03:19:58 | 000,844,560 | —- | M] (Intel® Corporation) [Auto | Running] – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe – (RegSrvc)
SRV:64bit: - [2011/06/01 09:58:08 | 000,203,776 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2011/04/22 00:34:16 | 001,136,640 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe – (AMPPALR3)
SRV:64bit: - [2011/04/21 23:42:50 | 000,134,928 | —- | M] (Intel® Corporation) [Auto | Running] – C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe – (BTHSSecurityMgr)
SRV:64bit: - [2011/04/12 05:44:46 | 000,171,176 | —- | M] (Intel Corporation) [Auto | Running] – C:\Windows\SysNative\IPROSetMonitor.exe – (Intel®
SRV:64bit: - [2010/12/17 16:46:34 | 000,198,784 | —- | M] (Conexant Systems Inc.) [Auto | Running] – C:\Windows\SysNative\CxAudMsg64.exe – (CxAudMsg)
SRV:64bit: - [2010/09/23 09:10:10 | 000,057,184 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe – (wlcrasvc)
SRV:64bit: - [2009/12/10 00:52:52 | 000,047,712 | —- | M] (Lenovo.) [Auto | Running] – C:\Windows\SysNative\TPHDEXLG64.exe – (TPHDEXLGSVC)
SRV:64bit: - [2009/07/14 09:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2013/02/12 23:03:18 | 000,086,752 | —- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe – (AntiVirSchedulerService)
SRV - [2013/02/12 23:01:12 | 000,110,816 | —- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe – (AntiVirService)
SRV - [2013/02/09 01:08:23 | 000,251,248 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/02/06 15:40:39 | 000,115,608 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2013/01/31 10:38:54 | 003,289,208 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2013/01/08 12:55:20 | 000,161,536 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/12/18 22:28:08 | 000,065,192 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2012/10/04 16:47:14 | 004,463,864 | —- | M] (Emsisoft GmbH) [Auto | Running] – C:\Program Files (x86)\Online Armor\OAsrv.exe – (SvcOnlineArmor)
SRV - [2012/10/04 16:44:22 | 000,216,072 | —- | M] (Emsisoft GmbH) [Auto | Running] – C:\Program Files (x86)\Online Armor\oacat.exe – (OAcat)
SRV - [2011/03/31 05:42:34 | 001,001,808 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe – (Bluetooth OBEX Service)
SRV - [2011/03/31 05:42:32 | 001,321,296 | —- | M] (Intel Corporation) [On_Demand | Running] – C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe – (Bluetooth Media Service)
SRV - [2011/03/31 05:42:30 | 000,923,984 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe – (Bluetooth Device Monitor)
SRV - [2011/02/22 12:13:50 | 002,656,280 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS)
SRV - [2011/02/22 12:13:46 | 000,326,168 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS)
SRV - [2010/03/19 05:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/09/18 18:48:28 | 000,009,216 | —- | M] (Vodafone) [Auto | Running] – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe – (VMCService)
SRV - [2009/06/11 05:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/12/16 19:25:34 | 000,202,632 | —- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] – C:\Program Files\Sandboxie\SbieDrv.sys – (SbieDrv)
DRV:64bit: - [2012/12/11 20:09:02 | 000,129,216 | —- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] – C:\Windows\SysNative\drivers\avipbb.sys – (avipbb)
DRV:64bit: - [2012/12/11 20:09:01 | 000,099,912 | —- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\avgntflt.sys – (avgntflt)
DRV:64bit: - [2012/10/04 16:49:48 | 000,035,376 | —- | M] (Emsisoft) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\OAnet.sys – (OAnet)
DRV:64bit: - [2012/09/24 09:58:11 | 000,027,800 | —- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] – C:\Windows\SysNative\drivers\avkmgr.sys – (avkmgr)
DRV:64bit: - [2012/03/01 14:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/12/09 19:45:00 | 000,060,416 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\iBtFltCoex.sys – (iBtFltCoex)
DRV:64bit: - [2011/11/15 01:13:00 | 000,327,168 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\btmhsf.sys – (btmhsf)
DRV:64bit: - [2011/09/23 14:56:49 | 000,057,952 | —- | M] (Lenovo) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\fbfmon.sys – (fbfmon)
DRV:64bit: - [2011/09/23 14:56:49 | 000,013,408 | —- | M] (Lenovo) [Kernel | System | Running] – C:\Windows\SysNative\drivers\BPntDrv.sys – (BPntDrv)
DRV:64bit: - [2011/09/23 14:56:30 | 000,039,008 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\LhdX64.sys – (LHDmgr)
DRV:64bit: - [2011/09/23 14:56:27 | 000,029,792 | —- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AcpiVpc.sys – (ACPIVPC)
DRV:64bit: - [2011/09/23 14:18:24 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/09/23 14:18:24 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2011/08/02 16:19:54 | 001,448,496 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2011/07/27 03:50:48 | 003,293,008 | —- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\S6000KNT.sys – (S6000KNT)
DRV:64bit: - [2011/07/25 13:51:46 | 001,592,448 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\CHDRT64.sys – (CnxtHdAudService)
DRV:64bit: - [2011/07/23 00:26:56 | 000,014,928 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys – (SASDIFSV)
DRV:64bit: - [2011/07/13 05:55:18 | 000,012,368 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\saskutil64.sys – (SASKUTIL)
DRV:64bit: - [2011/06/01 12:12:36 | 009,320,448 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (amdkmdag)
DRV:64bit: - [2011/06/01 09:19:12 | 000,306,688 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmpag.sys – (amdkmdap)
DRV:64bit: - [2011/05/04 17:19:06 | 000,340,656 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\e1c62x64.sys – (e1cexpress)
DRV:64bit: - [2011/05/02 05:33:06 | 008,593,920 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NETwNs64.sys – (NETwNs64)
DRV:64bit: - [2011/04/27 02:07:36 | 000,557,848 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2011/04/22 00:09:26 | 000,294,912 | —- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\AmpPal.sys – (AMPPALP)
DRV:64bit: - [2011/04/22 00:09:26 | 000,294,912 | —- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AmpPal.sys – (AMPPAL)
DRV:64bit: - [2011/03/26 06:17:48 | 012,262,336 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdpmd64.sys – (intelkmd)
DRV:64bit: - [2011/03/09 05:44:08 | 000,051,712 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\btmaux.sys – (btmaux)
DRV:64bit: - [2011/02/17 08:46:36 | 000,042,392 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\WDKMD.sys – (wdkmd)
DRV:64bit: - [2011/02/11 05:52:34 | 000,181,760 | —- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\nusb3xhc.sys – (nusb3xhc)
DRV:64bit: - [2011/02/11 05:52:34 | 000,082,432 | —- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\nusb3hub.sys – (nusb3hub)
DRV:64bit: - [2011/01/29 14:29:58 | 000,031,088 | —- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\clwvd.sys – (clwvd)
DRV:64bit: - [2010/11/26 18:02:18 | 000,017,720 | —- | M] () [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\SmartDefragDriver.sys – (SmartDefragDriver)
DRV:64bit: - [2010/11/21 11:24:33 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/21 11:23:47 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/21 11:23:47 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbGD.sys – (TsUsbGD)
DRV:64bit: - [2010/10/19 16:34:26 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (MEIx64)
DRV:64bit: - [2010/10/15 13:28:16 | 000,317,440 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud)
DRV:64bit: - [2010/10/12 05:21:56 | 000,135,776 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\ApsX64.sys – (Shockprf)
DRV:64bit: - [2009/12/10 00:52:28 | 000,023,648 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\ApsHM64.sys – (TPDIGIMN)
DRV:64bit: - [2009/07/23 12:57:20 | 000,132,608 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbnet.sys – (ewusbnet)
DRV:64bit: - [2009/07/23 12:57:20 | 000,116,992 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbmdm.sys – (hwdatacard)
DRV:64bit: - [2009/07/23 12:57:20 | 000,113,792 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbfake.sys – (hwusbfake)
DRV:64bit: - [2009/07/22 05:20:06 | 000,121,840 | —- | M] (CyberLink) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\wsvd.sys – (wsvd)
DRV:64bit: - [2009/07/14 09:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/14 09:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/14 09:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/14 07:21:48 | 000,038,400 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\tpm.sys – (TPM)
DRV:64bit: - [2009/06/11 04:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/11 04:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/11 04:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/11 04:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2012/10/04 16:49:47 | 000,040,520 | —- | M] (Emsisoft) [Kernel | System | Running] – C:\Windows\SysWOW64\drivers\OAmon.sys – (OAmon)
DRV - [2012/10/04 16:49:45 | 000,061,632 | —- | M] () [File_System | System | Running] – C:\Windows\SysWOW64\drivers\OADriver.sys – (OADevice)
DRV - [2012/10/04 16:44:51 | 000,062,016 | —- | M] () [Kernel | System | Running] – C:\Windows\SysWOW64\drivers\oahlp64.sys – (oahlpXX)
DRV - [2009/07/14 09:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://startsear.ch/?aff=1&src;=sp&…q={searchTerms}


IE - HKU\.DEFAULT\..\SearchScopes,defaultscope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,defaultscope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,defaultscope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}

IE - HKU\S-1-5-20\..\SearchScopes,defaultscope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}

IE - HKU\S-1-5-21-4176799644-1864613857-429760169-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br…N&bmod;=LENN
IE - HKU\S-1-5-21-4176799644-1864613857-429760169-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com [binary data]
IE - HKU\S-1-5-21-4176799644-1864613857-429760169-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-4176799644-1864613857-429760169-1001\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\S-1-5-21-4176799644-1864613857-429760169-1001\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://startsear.ch/?aff=1&src;=sp&…q={searchTerms}
IE - HKU\S-1-5-21-4176799644-1864613857-429760169-1001\..\SearchScopes\{78049031-5A2B-4D32-988A-6418444B6E0A}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7LENN
IE - HKU\S-1-5-21-4176799644-1864613857-429760169-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "error"
FF - prefs.js..browser.search.order.1: "error"
FF - prefs.js..browser.search.selectedEngine: "error"
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - prefs.js..keyword.URL: "error"
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll ()
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@powerchallenge.com/PowerLoader: C:\Users\ONewbieO\AppData\LocalLow\POWERC~1\nppowerloader.dll (Power Challenge Sweden AB)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ONewbieO\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ONewbieO\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\ONewbieO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/02/06 15:40:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/02/06 15:40:35 | 000,000,000 | —D | M]

[2012/03/12 19:31:00 | 000,000,000 | —D | M] (No name found) – C:\Users\ONewbieO\AppData\Roaming\Mozilla\Extensions
[2013/02/14 16:15:59 | 000,000,000 | —D | M] (No name found) – C:\Users\ONewbieO\AppData\Roaming\Mozilla\Firefox\Profiles\x6t7q09q.default\extensions
[2013/02/14 16:15:59 | 000,817,280 | —- | M] () (No name found) – C:\Users\ONewbieO\AppData\Roaming\Mozilla\Firefox\Profiles\x6t7q09q.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/02/06 15:40:34 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/02/06 15:40:34 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/02/06 15:40:39 | 000,262,552 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/01/02 17:48:42 | 000,083,456 | —- | M] (StartSearch ) – C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2012/12/21 05:15:26 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/12/21 05:15:26 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://websearch.mocaflix.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}&sugkey;={google:suggestAPIKeyParameter},
CHR - homepage: http://websearch.mocaflix.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\24.0.1312.52\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\24.0.1312.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\Application\24.0.1312.52\pdf.dll
CHR - plugin: StartSearch Video plug-in (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\bildoibdboopgomcbiplincneeicgipj\1.3_0\chvsharetvplg.dll
CHR - plugin: StartSearch Video plug-in (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.2.0.10687_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java™ Platform SE 7 U7 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files (x86)\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\ONewbieO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\ONewbieO\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: Entanglement = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.7.9_0\
CHR - Extension: AdBlock = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.55_0\
CHR - Extension: AudioSauna = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkgfemnodkdnenmfkblebnkjpckkjcae\0.402_0\
CHR - Extension: Steam Theme = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcphcjcjgkjmbphkfjleamgkinaeebnm\1.1_0\

O1 HOSTS File: ([2012/04/07 23:31:37 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files (x86)\Online Armor\oaui.exe (Emsisoft GmbH)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SynLenovoGestureMgr] C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Synaptics)
O4:64bit: - HKLM..\Run: [TpShocks] C:\Windows\SysNative\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Info Center] C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe (PC Pitstop LLC)
O4 - HKLM..\Run: [Intelligent Touchpad] C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe ()
O4 - HKLM..\Run: [MobileConnect] C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [S6000Mnt] C:\Windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-4176799644-1864613857-429760169-1001..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKU\S-1-5-21-4176799644-1864613857-429760169-1001..\Run: [PPAP] C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe (PPLive Corporation)
O4 - HKU\S-1-5-21-4176799644-1864613857-429760169-1001..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
O4 - HKU\S-1-5-21-4176799644-1864613857-429760169-1001..\Run: [Speaking Clock Deluxe] C:\Program Files (x86)\Speaking Clock Deluxe\SpClDlx.exe (Lux Aeterna)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe File not found
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCPitstop Utility)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.7.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{642A322F-8D66-4551-BA4F-177A97B18F81}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8FE95196-7119-4FF4-A5CF-287768C56B64}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CCA37BC7-6972-489B-8539-8780FCCFCD6B}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{2e327cc7-aa6c-11e1-8165-ac7289a2028c}\Shell - "" = AutoRun
O33 - MountPoints2\{2e327cc7-aa6c-11e1-8165-ac7289a2028c}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{2e327d5a-aa6c-11e1-8165-ac7289a2028c}\Shell - "" = AutoRun
O33 - MountPoints2\{2e327d5a-aa6c-11e1-8165-ac7289a2028c}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{e3377b78-6613-11e2-8491-dca92253df46}\Shell - "" = AutoRun
O33 - MountPoints2\{e3377b78-6613-11e2-8491-dca92253df46}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{f88f6ce7-52e7-11e2-a127-ac7289a2028c}\Shell - "" = AutoRun
O33 - MountPoints2\{f88f6ce7-52e7-11e2-a127-ac7289a2028c}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/02/16 12:48:09 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/02/16 12:47:29 | 000,000,000 | —D | C] – C:\JRT
[2013/02/16 00:15:01 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{5B537AF2-FDCE-4E2E-8C8F-4425AA88BF1F}
[2013/02/15 11:14:40 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{66B27ADD-A408-4B81-BB6B-D08EAFAA0F63}
[2013/02/14 13:50:19 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{D0385664-314B-442B-8D3C-86B654676A64}
[2013/02/14 13:09:51 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013/02/14 13:09:51 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013/02/14 13:09:50 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/02/14 13:09:50 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/02/14 13:09:50 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013/02/14 13:09:50 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013/02/14 13:09:49 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013/02/14 13:09:48 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/02/14 13:09:48 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013/02/14 13:09:48 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013/02/14 13:09:48 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/02/14 13:09:48 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013/02/14 13:09:45 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/02/14 13:09:45 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/02/14 13:09:45 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013/02/14 11:21:29 | 005,553,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2013/02/14 11:21:28 | 003,967,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2013/02/14 11:21:28 | 003,913,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2013/02/14 11:21:23 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013/02/14 11:21:22 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2013/02/14 11:21:22 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2013/02/14 11:21:22 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2013/02/14 11:21:22 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2013/02/14 11:21:22 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2013/02/14 11:21:20 | 000,288,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2013/02/11 23:01:31 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{38F5446B-3D01-451F-8E40-7A482134E834}
[2013/02/10 19:55:42 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{DC4BD4FD-5D37-4FC9-BA66-7FFA21CCE7D8}
[2013/02/09 12:29:31 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{698B1083-92CB-48E0-AB46-0E810BFFC616}
[2013/02/09 00:28:32 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{33159B8F-3A86-4498-95BB-629D4A032A02}
[2013/02/07 19:15:04 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{C57D6D5E-5386-4FB1-BBB1-C6B9EDAC66AB}
[2013/02/06 15:40:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013/02/06 13:50:58 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{6F2CC035-64B9-4266-9BC0-5052D336F0C0}
[2013/02/06 13:01:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\188BET
[2013/02/05 20:56:53 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{BEC8379D-7942-44A2-9E43-960507564AAD}
[2013/02/05 20:56:53 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{757A64AA-D7BD-4BB7-ABBD-C42CE20855FB}
[2013/02/05 20:56:34 | 000,000,000 | —D | C] – C:\Users\ONewbieO\Tracing
[2013/02/04 18:47:54 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Tencent
[2013/02/04 18:46:58 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tencent Software
[2013/02/04 18:46:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Tencent
[2013/02/04 18:46:13 | 000,000,000 | —D | C] – C:\Users\ONewbieO\Documents\Tencent Files
[2013/01/26 02:08:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013/01/26 02:08:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2013/01/19 17:54:54 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Roaming\Origin
[2013/01/19 17:54:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2013/01/19 17:54:31 | 000,000,000 | —D | C] – C:\ProgramData\Origin
[2013/01/19 17:52:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Origin
[2013/01/18 23:56:03 | 000,000,000 | —D | C] – C:\Users\ONewbieO\jagexcache
[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/02/16 13:21:00 | 000,000,920 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4176799644-1864613857-429760169-1001UA.job
[2013/02/16 13:08:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/02/16 12:06:45 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/02/16 08:21:00 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4176799644-1864613857-429760169-1001Core.job
[2013/02/16 00:21:04 | 000,031,472 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/02/16 00:21:04 | 000,031,472 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/02/16 00:16:36 | 000,779,266 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/02/16 00:16:36 | 000,664,992 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/02/16 00:16:36 | 000,125,696 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/02/16 00:12:16 | 000,371,618 | —- | M] () – C:\Windows\SysNative\fastboot.set
[2013/02/16 00:11:09 | 3153,268,736 | -HS- | M] () – C:\hiberfil.sys
[2013/02/14 13:51:06 | 000,001,498 | —- | M] () – C:\Windows\Sandboxie.ini
[2013/02/14 13:46:17 | 000,313,656 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/02/09 01:08:23 | 000,697,712 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/02/09 01:08:23 | 000,074,096 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/02/06 13:05:04 | 000,001,797 | —- | M] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\188BET.lnk
[2013/02/04 19:45:49 | 000,002,390 | —- | M] () – C:\Users\ONewbieO\Desktop\Google Chrome.lnk
[2013/02/04 18:46:58 | 000,002,280 | —- | M] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\Tencent QQ.lnk
[2013/02/04 18:46:58 | 000,002,258 | —- | M] () – C:\Users\ONewbieO\Desktop\Tencent QQ.lnk
[2013/02/04 18:45:51 | 000,018,760 | —- | M] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2013/01/26 02:08:06 | 000,002,515 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk
[2013/01/19 17:54:39 | 000,000,990 | —- | M] () – C:\Users\Public\Desktop\Origin.lnk
[2013/01/19 00:00:10 | 000,000,024 | —- | M] () – C:\Users\ONewbieO\random.dat
[2013/01/18 23:56:03 | 000,000,047 | —- | M] () – C:\Users\ONewbieO\jagex_cl_runescape_LIVE.dat
[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/02/14 00:11:36 | 000,000,810 | —- | C] () – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Betfair.com Poker.lnk
[2013/02/06 13:01:31 | 000,001,797 | —- | C] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\188BET.lnk
[2013/02/04 18:46:58 | 000,002,280 | —- | C] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\Tencent QQ.lnk
[2013/02/04 18:46:58 | 000,002,258 | —- | C] () – C:\Users\ONewbieO\Desktop\Tencent QQ.lnk
[2013/02/04 18:45:51 | 000,018,760 | —- | C] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2013/01/19 17:54:39 | 000,000,990 | —- | C] () – C:\Users\Public\Desktop\Origin.lnk
[2013/01/18 23:56:03 | 000,000,047 | —- | C] () – C:\Users\ONewbieO\jagex_cl_runescape_LIVE.dat
[2013/01/18 23:56:03 | 000,000,024 | —- | C] () – C:\Users\ONewbieO\random.dat
[2013/01/08 16:13:40 | 000,001,498 | —- | C] () – C:\Windows\Sandboxie.ini
[2012/07/17 14:26:51 | 000,000,000 | —- | C] () – C:\Users\ONewbieO\Tracert
[2012/04/17 15:40:59 | 000,062,016 | —- | C] () – C:\Windows\SysWow64\drivers\oahlp64.sys
[2012/04/17 15:40:59 | 000,061,632 | —- | C] () – C:\Windows\SysWow64\drivers\OADriver.sys
[2011/11/12 02:19:50 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2011/11/12 01:46:07 | 000,007,605 | —- | C] () – C:\Users\ONewbieO\AppData\Local\Resmon.ResmonCfg
[2011/11/12 00:16:37 | 000,000,000 | —- | C] () – C:\Windows\firstboot.dat
[2011/09/23 14:39:32 | 000,765,178 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/09/23 14:35:57 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/09/23 14:28:30 | 000,015,190 | —- | C] () – C:\Windows\S6000Twn.ini
[2011/09/23 14:27:06 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblup.dat
[2011/08/15 14:41:49 | 000,066,856 | —- | C] () – C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/07/25 09:26:57 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/07/25 09:26:52 | 000,216,876 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/07/25 09:26:49 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/07/25 09:26:19 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/06/01 13:06:38 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2009/08/28 15:16:16 | 000,130,238 | R— | C] () – C:\ProgramData\DeviceManager.xml.rc4

========== ZeroAccess Check ==========

[2009/07/14 12:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 13:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 12:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 09:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/21 11:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 09:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/09/23 14:15:46 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/09/23 14:15:46 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/09/23 14:15:46 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/09/23 14:15:46 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/21 11:24:25 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/09/23 14:15:46 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/09/23 14:15:46 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/21 11:24:11 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/14 09:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/14 09:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2012/12/14 16:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/14 09:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/14 09:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/14 09:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/14 09:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/21 11:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/21 11:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/21 11:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/21 11:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/21 11:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/21 11:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012/12/14 16:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: WDC WD5000BPVT-24HXZT3
Partitions: 4
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 200.00MB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 422.00GB
Starting Offset: 210763776
Hidden sectors: 0


DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 29.00GB
Starting Offset: 452920868864
Hidden sectors: 0


DeviceID: Disk #0, Partition #3
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 15.00GB
Starting Offset: 484378148864
Hidden sectors: 0


< End of report >


Extras.txt

OTL Extras logfile created on: 16/2/2013 1:26:26 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ONewbieO\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

3.92 Gb Total Physical Memory | 2.33 Gb Available Physical Memory | 59.52% Memory free
7.83 Gb Paging File | 5.22 Gb Available in Paging File | 66.70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.62 Gb Total Space | 361.86 Gb Free Space | 85.83% Space Free | Partition Type: NTFS
Drive D: | 29.30 Gb Total Space | 26.62 Gb Free Space | 90.87% Space Free | Partition Type: NTFS

Computer Name: ALVINPC | User Name: ONewbieO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = ChromeHTML] – Reg Error: Key error. File not found
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06E34E91-F4F8-473C-889A-2013E8F4C9A7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{11F5BFBB-A3CD-45BD-B7B6-A05FFC03E4E9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3350B387-B673-44CA-BE79-1AB4B6EE445B}" = lport=445 | protocol=6 | dir=in | app=system |
"{33E56E2D-DBAE-458A-810C-ECAA6CD44261}" = rport=138 | protocol=17 | dir=out | app=system |
"{385EEAFD-5245-40C5-A516-9D7DDC4333D5}" = rport=10243 | protocol=6 | dir=out | app=system |
"{432CFB62-80E0-4653-9CD8-6F082E802AAB}" = rport=445 | protocol=6 | dir=out | app=system |
"{482AE436-00E6-410C-9B9D-21CA1C347F5A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4A7D23D9-8FA0-499E-9D77-3B7423AAB8A0}" = rport=137 | protocol=17 | dir=out | app=system |
"{4BAB4479-ADFB-4C2E-8BFF-8D52714277B7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4C4FCF7A-5051-4E97-A1A2-AB7E27A7EA9C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{57920AA7-590F-4324-B21C-A3CEDE7815F2}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{638393B3-7191-433F-8374-0FB216FA92A3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{672DD04E-DA79-489C-90D5-7BFC2C268840}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6A861031-8C15-4F76-A183-E26FBC203DBA}" = lport=138 | protocol=17 | dir=in | app=system |
"{7288EBEC-7E5F-4C9C-809C-DC708C3EBF5E}" = lport=10243 | protocol=6 | dir=in | app=system |
"{83BDC9D0-531E-4255-A9FE-35276A67EDE0}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A0A91131-2421-488D-8D2D-C899F8B4E652}" = lport=139 | protocol=6 | dir=in | app=system |
"{B1FFDE17-7E52-4745-A5E1-28ED37B3078D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CB253827-EF8F-4E20-9A88-AA83BC37E780}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CDAADFE9-52D0-49C8-A807-A0EA4294D429}" = rport=139 | protocol=6 | dir=out | app=system |
"{CECA00F7-37F5-42A4-AB6A-4A205167C655}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D2F4531D-18BD-4FD9-87DD-487B5E5991ED}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{FBB84688-FFAD-44A2-8366-F59EA81B8447}" = lport=137 | protocol=17 | dir=in | app=system |
"{FCB75A56-E98E-4877-AF46-0DB7C7DAD56B}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01064B14-DE6D-4792-9ECC-82D159F20BFD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{011015FA-9445-4943-B0C9-1B1BA81AB1C0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{013462D2-9D1E-4676-972D-BE8489587798}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\pplivenetwork\ppap.exe |
"{028C01C3-0991-476B-AFF8-85D55F64F3E5}" = protocol=6 | dir=out | app=system |
"{02E56FA9-3F13-4D95-AA57-AF29349366C9}" = dir=in | app=c:\program files (x86)\lenovo\powerdvd10\powerdvd10.exe |
"{0468D5C0-10FF-45BB-AED1-4CB79F8625A4}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{056FBF64-517E-4892-A82B-DC8870A8445E}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqintl\bin\txupd.exe |
"{0A4C1901-1FB8-4DAE-B4BD-75205D5F8677}" = dir=in | app=c:\program files (x86)\intel corporation\intel wireless display\widiapp.exe |
"{1B596693-4E09-4927-906A-E06D4AC7BEA4}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{2672C921-0F61-4812-81B7-25A29C96B0C2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2DF1F101-F07A-48DA-81CF-55DC535A67D5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3339918F-E2E6-4A8A-88B3-BA4E888DBB2D}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{3BC693A0-6332-431A-B868-30F8727B04B1}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{55378BBD-DC6A-4AB2-9C3C-E914C4EE7D8B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{5676BE3C-5838-40D1-8811-B80406CEFD34}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{576D8EF4-45E3-4C17-B050-2FD4F0A54B89}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{676E5744-AE77-4355-B6A5-443AECCBFC51}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqintl\bin\auclt.exe |
"{6EBADE55-DC85-4494-9704-924ACDB5DD7B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{75B7F939-6F49-4EEC-A5D2-57CB2F947AF3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{798F2FFB-DD5E-4E08-8777-F521B908166A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7CB1A633-ADA0-4128-B033-FBF0339A2991}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{9B58BF69-1F6E-4BB8-B075-8AD9C4B662F2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{A94DFE6F-E274-4C31-9458-C582661AB5FF}" = protocol=6 | dir=in | app=c:\program files (x86)\veetle\player\veetlenet.exe |
"{C129B955-DE55-4645-A852-F849232855FA}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{CA0411FF-E09C-49A4-94B0-23CEBDC683AF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D8EDDE53-CC61-421E-A8C9-0E0423DFAC1F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D91A71F5-B983-441A-BBD3-FD39653644FC}" = dir=in | app=c:\program files (x86)\lenovo\powerdvd10\powerdvd cinema\powerdvdcinema10.exe |
"{DBC43D44-78F7-4EB4-82A5-4FC1C08C11CD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DBD846AD-BB67-4A44-A264-48713A4AE0A0}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |
"{DCD50CE5-D04F-4497-840F-A0A37D58549A}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqintl\bin\txupd.exe |
"{E2E584DF-9BFB-44C8-87D2-7CB94F22D71D}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqintl\bin\qq.exe |
"{E5963884-7511-4E41-B783-EB53F3F97A2C}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\pplivenetwork\ppap.exe |
"{EAD51DF8-4C17-429C-8427-41CB97F58ACB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F0546A85-F201-4539-A598-105B35FF3BCD}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F259A48B-6B08-449F-8D1D-44069FFE9813}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqintl\bin\auclt.exe |
"{F2E72696-AC9F-43BF-B32F-0A774B54E8EE}" = protocol=6 | dir=in | app=c:\program files (x86)\veetle\player\veetlenet.exe |
"{FFB9F611-64B3-47A6-BC91-30D8A96CB6D7}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqintl\bin\qq.exe |
"TCP Query User{1DFB4E40-C3E3-48FF-BF7D-6471B71C8B59}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"UDP Query User{5F1CA950-33AD-4ADA-90C0-235CD7642110}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{006B5C65-3938-4246-B182-994A7E415EDE}" = Intel® PROSet/Wireless Software for Bluetooth® Technology
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{206BD2C5-DE08-4577-A0D7-D441A79D5A3A}" = Windows Live Remote Client Resources
"{28EF7372-9087-4AC3-9B9F-D9751FCDF830}" = Intel® Wireless Display
"{372C8537-5B83-CEAF-F159-2884E3B770FC}" = WMV9/VC-1 Video Playback
"{3C41721F-AF0F-4086-AA1C-4C7F29076228}" = Intel® PROSet/Wireless WiFi Software
"{44663264-E108-4938-BF9E-A767315072C9}" = Intel® Network Connections 16.3.48.0
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A0E106D2-4815-4B7A-BAA7-7E21B530CFB4}" = Intel® PROSet/Wireless for Bluetooth® 3.0 + High Speed
"{AE91E0F3-C49A-4EF4-8B98-A07BD409EB90}" = Windows Live Remote Service Resources
"{C49C683A-A87F-7A87-5FC1-7B09D5B48C8E}" = ccc-utility64
"{CB2C84FB-93EB-1252-9252-4412E3DE0EB0}" = ATI Catalyst Install Manager
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"ATI Uninstaller" = ATI Uninstaller
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"EB9B45DC947C2D941CA61B992509A71D738AE888" = Windows Driver Package - Lenovo (ACPIVPC) System (01/28/2011 6.1.0.1)
"Lenovo EE Boot Optimizer" = Lenovo EE Boot Optimizer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"ProInst" = Intel PROSet Wireless
"PROSetDX" = Intel® Network Connections [removed]
"Sandboxie" = Sandboxie 3.76 (64-bit)
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000F2A10-9CDF-47BF-9CF2-9AC87567B433}" = Windows Live Photo Common
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"{03241D8D-2217-42F7-9FCB-6A68D141C14D}" = Windows Live 软件包
"{0741B337-5C69-D752-DB23-B334B399EE8B}" = CCC Help Chinese Standard
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0FA80816-F271-4BBA-84FC-855D3A6A09F3}}_is1" = New Star Tennis v1.08
"{14CD5B9D-DC7A-5D39-73BB-44AAB9CC039D}" = CCC Help Spanish
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1B9E8374-76F4-F9E3-06E7-576246E53F5C}" = CCC Help Japanese
"{1DDD2892-2941-B5CA-EF5F-BADA6558E072}" = CCC Help French
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FE655AE-28A5-ADC0-95BF-1B3281BA0CEA}" = CCC Help Dutch
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21B49B4A-BBC3-4A09-9C68-6C3CC0B1EA01}" = Windows Live Messenger
"{2582910D-DAF5-FD3B-55AA-8CD83A2E9DA2}" = Catalyst Control Center Localization All
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{317D56AC-0DB3-48F5-929A-42032DAC9AD7}" = Windows Live Writer
"{31DF7760-99AC-57DC-D3F0-A27B173D45BD}" = CCC Help Thai
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{368BEC2C-B7A2-4762-9213-2D8465D533CA}" = Windows Live UX Platform Language Pack
"{3CA54984-A14B-42FE-9FF1-7EA90151D725}" = Tencent QQ
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{40F4FF7A-B214-4453-B973-080B09CED019}" = Absolute Reminder
"{4422AE2E-8B62-0991-91E5-6235D8126162}" = CCC Help Polish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{588CE0C0-860B-49A8-AFCF-3C69465B345F}" = Windows Live Mesh
"{5B46CEC7-DAD0-46A2-BCD6-B46A3CFD9B61}" = Intel® Wireless Display
"{5DA56A9E-00EE-C7D7-A861-CBC4A2D06D58}" = CCC Help Greek
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{622DE1BE-9EDE-49D3-B349-29D64760342A}" = 適用遠端連線的 Windows Live Mesh ActiveX 控制項
"{63AE67AA-1AB1-4565-B4EF-ABBC5C841E8D}" = Windows Live Messenger
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BFA19E3-1349-6CC1-6D57-A451DCF0D2C2}" = Catalyst Control Center Graphics Previews Common
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7115EEBC-DA7B-434C-B81C-EA5B26EA9A94}" = Windows Live Writer Resources
"{71777A0C-8493-A630-9A64-A8D4970159C6}" = CCC Help Danish
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{753F0A72-59C3-41CE-A36A-F2DF2079275C}" = Windows Live Mail
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B982EBD-D017-4527-BF1A-FC489EC6B100}" = Windows Live 照片库
"{7E2E66F7-B155-CCE7-44A5-2884A7A7624E}" = PX Profile Update
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83C53BA3-A7C3-2EAF-C306-84C0AE74DA14}" = CCC Help Italian
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{903EDF14-4E28-4463-AA5E-4AEE71C0263B}" = Windows Live Movie Maker
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{96A066E6-5709-1DAF-35A7-B8A6226E61ED}" = Catalyst Control Center
"{96B51C0B-D3BE-4DF3-959C-28B22C10CFBB}" = Vodafone Mobile Connect Lite
"{9901F803-DB1B-2AEC-CA0D-BF4CD77FC5EE}" = Catalyst Control Center Profiles Mobile
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.5)
"{AD3E3284-2AF3-544A-9FEC-CB7889605903}" = CCC Help Korean
"{B18B1D52-DB0C-050F-5A66-4454B355F6D8}" = CCC Help Swedish
"{B4659186-0D91-A85E-AF28-3F878EA19A9D}" = CCC Help Hungarian
"{B50C8836-5C29-D8AB-930F-59FC0D8A8FAA}" = Catalyst Control Center InstallProxy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B90CDE7A-845D-89D5-A694-EE1A1FA6581D}" = CCC Help Russian
"{BFDD964A-EF20-416D-AF45-36DE84705D3A}" = AGT Pro - Betfair
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C0790CB6-B34A-9A3C-B4A2-D7397F9DF872}" = CCC Help Turkish
"{C2B3CD38-D00C-7865-4208-44DC1505354A}" = CCC Help English
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C86295D9-A56F-6212-4C0B-47F4832351F8}" = CCC Help Finnish
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D00556A3-11D8-CB29-4913-6E714901052B}" = CCC Help Portuguese
"{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D4448DA8-2947-7169-1C1D-54F75556C783}" = CCC Help German
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = Lenovo PowerDVD 10
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E11B11BB-B6CE-018B-7700-3C73C2A8EC3F}" = Betsafe Fast Poker
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}" = UserGuide
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Display Audio Driver
"{F1FF16B9-457A-C9E9-84CE-E3581478AF32}" = CCC Help Norwegian
"{F493761C-E465-4B9E-9FC1-A312F161DE0A}" = Active Protection System
"{F992409C-9D10-4AE2-BAEB-B5409AD3785E}" = 用于远程连接的 Windows Live Mesh ActiveX 控件(简体中文)
"{FBC823AA-854B-C5FA-B8A6-DD95E592682E}" = CCC Help Chinese Traditional
"{FC9B811E-39BC-4813-9E29-B83CCF700010}" = Lenovo EasyCamera
"{FCC5D014-047B-B826-A072-8EC730C6E20B}" = CCC Help Czech
"{FDB0A81A-1173-4B15-BEA4-89FEA0474F17}" = Intelligent Touchpad
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"1180-6883-2514-0226-redbet-PROD" = redbet
"188BET (Poker)" = 188BET
"32red (Poker)" = 32Red Poker Room
"888poker" = 888poker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"Betfair Poker JPC_is1" = Betfair Poker JPC 1.0.0
"Betfair.com Poker" = Betfair.com Poker
"betsafe (Poker)" = BetSafe Poker Black
"Betsafe Poker_is1" = Betsafe Poker
"Betsson Poker_is1" = Betsson Poker
"betssonpoker (Poker)" = Betsson Poker by Microgaming
"Browsers Protector" = Browsers Protector
"CasinoRedKings" = CasinoRedKings
"com.relaxgaming.prod.betsafe.FastPokerLobby" = Betsafe Fast Poker
"Dafa888" = Dafa888
"EADM" = EA Download Manager
"gnuf (Poker)" = Gnuf Poker
"Gutshot Rush" = Gutshot Rush
"Heaven Bet Poker_is1" = Heaven Bet Poker 1.0.0
"Hoola (Poker)" = Samvo Poker
"Info Center_is1" = Info Center 1.0.0.10
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = Lenovo PowerDVD 10
"InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}" = UserGuide
"InterPoker(EUR)" = InterPoker(EUR)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
"Mozilla Firefox 18.0.2 (x86 en-US)" = Mozilla Firefox 18.0.2 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OnlineArmor_is1" = Online Armor 5.5
"Origin" = Origin
"Paf Spade Poker JPC_is1" = Paf Spade Poker JPC 1.0.0
"PKR" = PKR
"PokerStars" = PokerStars
"ProInst" = Intel PROSet Wireless
"Redbet Poker " = Redbet Poker
"Redbet Poker_is1" = Redbet Poker 1.0.0
"RedKings Poker JPC_is1" = RedKings Poker JPC 1.0.0
"Revo Uninstaller" = Revo Uninstaller 1.93
"Smart Live Poker_is1" = Smart Live Poker 1.0.0
"Speaking Clock Deluxe_is1" = Speaking Clock Deluxe 3.61
"StartSearch Toolbar" = StartSearch Toolbar 1.3
"Veetle TV" = Veetle TV
"Virgin Poker" = Virgin Poker
"vShare.tv plugin" = vShare.tv plugin 1.3
"WinLiveSuite" = Windows Live 程式集

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-4176799644-1864613857-429760169-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Betfred Poker" = Betfred Poker
"Google Chrome" = Google Chrome
"Gutshot" = Gutshot
"Poker Host" = Poker Host
"Power Loader" = Power Challenge Game Plugin
"UnityWebPlayer" = Unity Web Player

< End of report >
Post #4
Hi ONewbieO

Things are not looking too bad but we have a little work to do.

Uninstall the following programs:

Browsers Protector
StartSearch Toolbar1. Click Start, Control Panel, Programs and Features
2. Click on each of the programs in turn and then Uninstall.
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

===================================================

Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
PRC - [2012/07/06 20:17:02 | 000,207,360 | —- | M] () – C:\Program Files (x86)\Browsers Protector\regmon32.exe
MOD - [2012/07/06 20:17:02 | 000,207,360 | —- | M] () – C:\Program Files (x86)\Browsers Protector\regmon32.exe
IE - HKU\S-1-5-21-4176799644-1864613857-429760169-1001\..\SearchScopes\{78049031-5A2B-4D32-988A-6418444B6E0A}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7LENN
FF - prefs.js..browser.search.defaultenginename: "error"
FF - prefs.js..browser.search.order.1: "error"
FF - prefs.js..browser.search.selectedEngine: "error"
CHR - homepage: http://websearch.mocaflix.com/
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
[2013/02/16 00:15:01 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{5B537AF2-FDCE-4E2E-8C8F-4425AA88BF1F}
[2013/02/15 11:14:40 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{66B27ADD-A408-4B81-BB6B-D08EAFAA0F63}
[2013/02/14 13:50:19 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{D0385664-314B-442B-8D3C-86B654676A64}
[2013/02/11 23:01:31 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{38F5446B-3D01-451F-8E40-7A482134E834}
[2013/02/10 19:55:42 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{DC4BD4FD-5D37-4FC9-BA66-7FFA21CCE7D8}
[2013/02/09 12:29:31 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{698B1083-92CB-48E0-AB46-0E810BFFC616}
[2013/02/09 00:28:32 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{33159B8F-3A86-4498-95BB-629D4A032A02}
[2013/02/07 19:15:04 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{C57D6D5E-5386-4FB1-BBB1-C6B9EDAC66AB}
[2013/02/06 13:50:58 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{6F2CC035-64B9-4266-9BC0-5052D336F0C0}
[2013/02/05 20:56:53 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{BEC8379D-7942-44A2-9E43-960507564AAD}
[2013/02/05 20:56:53 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{757A64AA-D7BD-4BB7-ABBD-C42CE20855FB}

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • please post the OTL fix log but don’t run OTL again until all these instructions are completed.
===================================================

Reset Chrome’s home page:
  • open Google Chrome
  • click on the Customize icon 🖼Click to load external image (Posted Image), at the top right
  • click on Settings
  • under “On start-up”, check Open a specific page or set of pages and then on Set pages
  • delete any pages that you don’t want
  • set your start page to the page you want, eg www.google.com.
Once you have typed in the address in the 'Open this page' box, this change is saved. If you close this tab and click on the home icon you should now get your home page.

Please run OTL again.

Logs to include in the next post:

OTL fix log
New OTL log

Satchfan
Post #5
Browsers Protector StartSearch Toolbar Tried to do that but it says they are already removed . I only removed them from the uninstall area only . Not sure if its totally removed . Gonna do the other 2 now .
Post #6
OTL file

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
No active process named regmon32.exe was found!
Registry key HKEY_USERS\S-1-5-21-4176799644-1864613857-429760169-1001\Software\Microsoft\Internet Explorer\SearchScopes\{78049031-5A2B-4D32-988A-6418444B6E0A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78049031-5A2B-4D32-988A-6418444B6E0A}\ not found.
Prefs.js: "error" removed from browser.search.defaultenginename
Prefs.js: "error" removed from browser.search.order.1
Prefs.js: "error" removed from browser.search.selectedEngine
Use Chrome's Settings page to change the HomePage.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.
File Protocol\Handler\msdaipp - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\0x00000001\ not found.
File Protocol\Handler\msdaipp\0x00000001 - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\oledb\ not found.
File Protocol\Handler\msdaipp\oledb - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mso-offdap11\ deleted successfully.
File Protocol\Handler\mso-offdap11 - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
File Protocol\Handler\skype4com - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\ deleted successfully.
C:\Users\ONewbieO\AppData\Local\{5B537AF2-FDCE-4E2E-8C8F-4425AA88BF1F} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{66B27ADD-A408-4B81-BB6B-D08EAFAA0F63} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{D0385664-314B-442B-8D3C-86B654676A64} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{38F5446B-3D01-451F-8E40-7A482134E834} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{DC4BD4FD-5D37-4FC9-BA66-7FFA21CCE7D8} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{698B1083-92CB-48E0-AB46-0E810BFFC616} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{33159B8F-3A86-4498-95BB-629D4A032A02} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{C57D6D5E-5386-4FB1-BBB1-C6B9EDAC66AB} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{6F2CC035-64B9-4266-9BC0-5052D336F0C0} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{BEC8379D-7942-44A2-9E43-960507564AAD} folder moved successfully.
C:\Users\ONewbieO\AppData\Local\{757A64AA-D7BD-4BB7-ABBD-C42CE20855FB} folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
No captured output from command…
C:\Users\ONewbieO\Downloads\cmd.bat deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56478 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 101258 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: ONewbieO
->Temp folder emptied: 280893221 bytes
->Temporary Internet Files folder emptied: 275760729 bytes
->Java cache emptied: 1903257 bytes
->FireFox cache emptied: 386340551 bytes
->Google Chrome cache emptied: 349628151 bytes
->Flash cache emptied: 15174735 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 179056101 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 18944 bytes

Total Files Cleaned = 1,420.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 02172013_171347

Files\Folders moved on Reboot…
C:\Users\ONewbieO\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…
Post #8 last edited
You did well.

Run OTL
  • open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
  • post the OTL.txt log it produces in your next reply.
Please post back with the log, (there will only be one this time).

Can you tell me if uninstalled/re-installed Chrome and if there are any remaining problems.

Satchfan
Post #10

you mean to reinstall google chrome ?

Sorry if I wasn't very clear.

If you intend to use Chrome yes, re-install it and after you have re-installed it run OTL and send a new log.

Any remaining problems?

Satchfan
Post #11
OTl.exe

OTL logfile created on: 18/2/2013 7:17:01 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ONewbieO\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

3.92 Gb Total Physical Memory | 2.22 Gb Available Physical Memory | 56.58% Memory free
7.83 Gb Paging File | 5.77 Gb Available in Paging File | 73.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.62 Gb Total Space | 364.29 Gb Free Space | 86.40% Space Free | Partition Type: NTFS
Drive D: | 29.30 Gb Total Space | 26.62 Gb Free Space | 90.87% Space Free | Partition Type: NTFS

Computer Name: ALVINPC | User Name: ONewbieO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/02/18 19:15:46 | 000,212,432 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Update\1.3.21.123\GoogleCrashHandler.exe
PRC - [2013/02/17 01:29:56 | 000,348,440 | —- | M] (GameXN AS) – C:\ProgramData\GameXN\GameXNGO.exe
PRC - [2013/02/16 13:25:42 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\ONewbieO\Downloads\OTL.exe
PRC - [2013/02/12 23:03:18 | 000,086,752 | —- | M] (Avira Operations GmbH & Co. KG) – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013/02/12 23:01:12 | 000,110,816 | —- | M] (Avira Operations GmbH & Co. KG) – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013/02/12 23:01:10 | 000,385,248 | —- | M] (Avira Operations GmbH & Co. KG) – C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013/01/31 10:38:54 | 003,289,208 | —- | M] (Skype Technologies S.A.) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/12/18 22:28:08 | 000,065,192 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/10/04 16:48:14 | 002,415,104 | —- | M] (Emsisoft GmbH) – C:\Program Files (x86)\Online Armor\oaui.exe
PRC - [2012/10/04 16:47:14 | 004,463,864 | —- | M] (Emsisoft GmbH) – C:\Program Files (x86)\Online Armor\OAsrv.exe
PRC - [2012/10/04 16:44:49 | 001,248,144 | —- | M] (Emsisoft GmbH) – C:\Program Files (x86)\Online Armor\oahlp.exe
PRC - [2012/10/04 16:44:22 | 000,216,072 | —- | M] (Emsisoft GmbH) – C:\Program Files (x86)\Online Armor\oacat.exe
PRC - [2012/01/31 17:10:10 | 000,026,264 | —- | M] (PC Pitstop LLC) – C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe
PRC - [2011/08/02 04:06:24 | 000,291,272 | —- | M] () – C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe
PRC - [2011/07/23 08:41:10 | 000,047,704 | —- | M] (Alcor) – C:\Windows\Webcam\S6000\S6000Mnt.exe
PRC - [2011/04/01 11:24:42 | 000,189,880 | —- | M] (PPLive Corporation) – C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe
PRC - [2011/03/31 05:42:34 | 001,001,808 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
PRC - [2011/03/31 05:42:32 | 001,321,296 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
PRC - [2011/03/31 05:42:30 | 000,923,984 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
PRC - [2011/03/31 05:42:28 | 000,985,424 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
PRC - [2011/02/22 12:13:50 | 002,656,280 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2011/02/22 12:13:46 | 000,326,168 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2011/01/29 14:29:36 | 000,136,488 | —- | M] (CyberLink) – C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
PRC - [2010/11/18 00:53:16 | 000,113,288 | —- | M] (Renesas Electronics Corporation) – C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010/02/03 15:08:56 | 000,087,336 | —- | M] (CyberLink Corp.) – C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
PRC - [2009/03/08 13:52:32 | 002,327,040 | —- | M] (Lux Aeterna) – C:\Program Files (x86)\Speaking Clock Deluxe\SpClDlx.exe


========== Modules (No Company Name) ==========

MOD - [2013/02/14 13:16:11 | 013,199,360 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\806c4ba7d696ab586ffd774a31f1a66b\System.Windows.Forms.ni.dll
MOD - [2013/01/10 01:30:23 | 001,801,728 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\cbb7db665b3ba25a931258eb702527f5\System.Xaml.ni.dll
MOD - [2013/01/09 23:30:39 | 018,002,944 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\f28a346ae10e2eec581608f591cf7116\PresentationFramework.ni.dll
MOD - [2013/01/09 23:30:25 | 011,451,904 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\8983c040161b34c64474f195bff5e2de\PresentationCore.ni.dll
MOD - [2013/01/09 23:30:14 | 007,069,696 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\08bebcf66ad666dfdf2a4a934d79c0f9\System.Core.ni.dll
MOD - [2013/01/09 23:30:09 | 005,617,664 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d884c684ee3f738a60e3c50dd5d88caa\System.Xml.ni.dll
MOD - [2013/01/09 23:30:09 | 003,858,944 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\5dbabea688adfc665e3453561736699a\WindowsBase.ni.dll
MOD - [2013/01/09 23:30:09 | 000,595,968 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\7d6b122bee0977d953ee2409d74c3c25\PresentationFramework.Aero.ni.dll
MOD - [2013/01/09 23:30:08 | 001,667,584 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b83993cc955262507c8ead67567c8060\System.Drawing.ni.dll
MOD - [2013/01/09 23:30:04 | 000,982,528 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\cb72ac8478a5ea7e2d570bb710ecb1c1\System.Configuration.ni.dll
MOD - [2013/01/09 23:30:03 | 009,094,656 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\System\df418085cedae9fa2efee87e20a419a4\System.ni.dll
MOD - [2013/01/09 23:29:58 | 014,413,824 | —- | M] () – C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\60c214b6ad5691e368a16ec65d127c27\mscorlib.ni.dll
MOD - [2012/12/12 13:32:26 | 005,025,792 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012/11/16 23:29:13 | 000,419,272 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsclient.dll
MOD - [2012/11/16 23:28:44 | 000,034,152 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsstatistic.dll
MOD - [2012/11/16 23:28:30 | 000,083,416 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\tipsdone.dll
MOD - [2012/10/05 18:53:24 | 003,198,976 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2012/10/05 18:53:24 | 000,630,784 | —- | M] () – C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012/08/31 18:59:19 | 004,550,656 | —- | M] () – C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
MOD - [2011/08/02 04:06:24 | 000,291,272 | —- | M] () – C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe
MOD - [2011/04/01 11:24:42 | 000,912,744 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\MngModule.dll
MOD - [2011/04/01 11:24:42 | 000,516,864 | —- | M] () – C:\Program Files (x86)\Common Files\PPLiveNetwork\sqlite3.dll
MOD - [2009/06/11 05:22:40 | 000,010,752 | —- | M] () – C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
MOD - [2009/01/27 18:59:38 | 000,295,424 | —- | M] () – C:\Program Files (x86)\Speaking Clock Deluxe\voice\American English (female).dll
MOD - [2003/02/17 19:11:44 | 000,312,832 | —- | M] () – C:\Program Files (x86)\Speaking Clock Deluxe\timer.dll
MOD - [2002/06/02 16:05:40 | 000,038,912 | —- | M] () – C:\Program Files (x86)\Speaking Clock Deluxe\spcl01.dll


========== Services (SafeList) ==========

SRV:64bit: - [2012/12/16 19:25:38 | 000,123,664 | —- | M] (SANDBOXIE L.T.D) [Auto | Running] – C:\Program Files\Sandboxie\SbieSvc.exe – (SbieSvc)
SRV:64bit: - [2012/09/15 13:31:36 | 000,140,672 | —- | M] (SUPERAntiSpyware.com) [Auto | Running] – C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE – (!SASCORE)
SRV:64bit: - [2011/06/02 03:38:30 | 001,517,328 | —- | M] (Intel® Corporation) [Auto | Running] – C:\Program Files\Intel\WiFi\bin\EvtEng.exe – (EvtEng)
SRV:64bit: - [2011/06/02 03:23:40 | 000,340,240 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe – (MyWiFiDHCPDNS)
SRV:64bit: - [2011/06/02 03:19:58 | 000,844,560 | —- | M] (Intel® Corporation) [Auto | Running] – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe – (RegSrvc)
SRV:64bit: - [2011/06/01 09:58:08 | 000,203,776 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2011/04/22 00:34:16 | 001,136,640 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe – (AMPPALR3)
SRV:64bit: - [2011/04/21 23:42:50 | 000,134,928 | —- | M] (Intel® Corporation) [Auto | Running] – C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe – (BTHSSecurityMgr)
SRV:64bit: - [2011/04/12 05:44:46 | 000,171,176 | —- | M] (Intel Corporation) [Auto | Running] – C:\Windows\SysNative\IPROSetMonitor.exe – (Intel®
SRV:64bit: - [2010/12/17 16:46:34 | 000,198,784 | —- | M] (Conexant Systems Inc.) [Auto | Running] – C:\Windows\SysNative\CxAudMsg64.exe – (CxAudMsg)
SRV:64bit: - [2010/09/23 09:10:10 | 000,057,184 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe – (wlcrasvc)
SRV:64bit: - [2009/12/10 00:52:52 | 000,047,712 | —- | M] (Lenovo.) [Auto | Running] – C:\Windows\SysNative\TPHDEXLG64.exe – (TPHDEXLGSVC)
SRV:64bit: - [2009/07/14 09:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2013/02/12 23:03:18 | 000,086,752 | —- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] – C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe – (AntiVirSchedulerService)
SRV - [2013/02/12 23:01:12 | 000,110,816 | —- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] – C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe – (AntiVirService)
SRV - [2013/02/09 01:08:23 | 000,251,248 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/02/06 15:40:39 | 000,115,608 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2013/01/31 10:38:54 | 003,289,208 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2013/01/08 12:55:20 | 000,161,536 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/12/18 22:28:08 | 000,065,192 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2012/10/04 16:47:14 | 004,463,864 | —- | M] (Emsisoft GmbH) [Auto | Running] – C:\Program Files (x86)\Online Armor\OAsrv.exe – (SvcOnlineArmor)
SRV - [2012/10/04 16:44:22 | 000,216,072 | —- | M] (Emsisoft GmbH) [Auto | Running] – C:\Program Files (x86)\Online Armor\oacat.exe – (OAcat)
SRV - [2011/03/31 05:42:34 | 001,001,808 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe – (Bluetooth OBEX Service)
SRV - [2011/03/31 05:42:32 | 001,321,296 | —- | M] (Intel Corporation) [On_Demand | Running] – C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe – (Bluetooth Media Service)
SRV - [2011/03/31 05:42:30 | 000,923,984 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe – (Bluetooth Device Monitor)
SRV - [2011/02/22 12:13:50 | 002,656,280 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS)
SRV - [2011/02/22 12:13:46 | 000,326,168 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS)
SRV - [2010/03/19 05:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/09/18 18:48:28 | 000,009,216 | —- | M] (Vodafone) [Auto | Stopped] – C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe – (VMCService)
SRV - [2009/06/11 05:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/12/16 19:25:34 | 000,202,632 | —- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] – C:\Program Files\Sandboxie\SbieDrv.sys – (SbieDrv)
DRV:64bit: - [2012/12/11 20:09:02 | 000,129,216 | —- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] – C:\Windows\SysNative\drivers\avipbb.sys – (avipbb)
DRV:64bit: - [2012/12/11 20:09:01 | 000,099,912 | —- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\avgntflt.sys – (avgntflt)
DRV:64bit: - [2012/10/04 16:49:48 | 000,035,376 | —- | M] (Emsisoft) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\OAnet.sys – (OAnet)
DRV:64bit: - [2012/09/24 09:58:11 | 000,027,800 | —- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] – C:\Windows\SysNative\drivers\avkmgr.sys – (avkmgr)
DRV:64bit: - [2012/03/01 14:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/12/09 19:45:00 | 000,060,416 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\iBtFltCoex.sys – (iBtFltCoex)
DRV:64bit: - [2011/11/15 01:13:00 | 000,327,168 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\btmhsf.sys – (btmhsf)
DRV:64bit: - [2011/09/23 14:56:49 | 000,057,952 | —- | M] (Lenovo) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\fbfmon.sys – (fbfmon)
DRV:64bit: - [2011/09/23 14:56:49 | 000,013,408 | —- | M] (Lenovo) [Kernel | System | Running] – C:\Windows\SysNative\drivers\BPntDrv.sys – (BPntDrv)
DRV:64bit: - [2011/09/23 14:56:30 | 000,039,008 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\LhdX64.sys – (LHDmgr)
DRV:64bit: - [2011/09/23 14:56:27 | 000,029,792 | —- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AcpiVpc.sys – (ACPIVPC)
DRV:64bit: - [2011/09/23 14:18:24 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/09/23 14:18:24 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2011/08/02 16:19:54 | 001,448,496 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2011/07/27 03:50:48 | 003,293,008 | —- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\S6000KNT.sys – (S6000KNT)
DRV:64bit: - [2011/07/25 13:51:46 | 001,592,448 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\CHDRT64.sys – (CnxtHdAudService)
DRV:64bit: - [2011/07/23 00:26:56 | 000,014,928 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys – (SASDIFSV)
DRV:64bit: - [2011/07/13 05:55:18 | 000,012,368 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\saskutil64.sys – (SASKUTIL)
DRV:64bit: - [2011/06/01 12:12:36 | 009,320,448 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (amdkmdag)
DRV:64bit: - [2011/06/01 09:19:12 | 000,306,688 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmpag.sys – (amdkmdap)
DRV:64bit: - [2011/05/04 17:19:06 | 000,340,656 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\e1c62x64.sys – (e1cexpress)
DRV:64bit: - [2011/05/02 05:33:06 | 008,593,920 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\NETwNs64.sys – (NETwNs64)
DRV:64bit: - [2011/04/27 02:07:36 | 000,557,848 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2011/04/22 00:09:26 | 000,294,912 | —- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\AmpPal.sys – (AMPPALP)
DRV:64bit: - [2011/04/22 00:09:26 | 000,294,912 | —- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AmpPal.sys – (AMPPAL)
DRV:64bit: - [2011/03/26 06:17:48 | 012,262,336 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdpmd64.sys – (intelkmd)
DRV:64bit: - [2011/03/09 05:44:08 | 000,051,712 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\btmaux.sys – (btmaux)
DRV:64bit: - [2011/02/17 08:46:36 | 000,042,392 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\WDKMD.sys – (wdkmd)
DRV:64bit: - [2011/02/11 05:52:34 | 000,181,760 | —- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\nusb3xhc.sys – (nusb3xhc)
DRV:64bit: - [2011/02/11 05:52:34 | 000,082,432 | —- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\nusb3hub.sys – (nusb3hub)
DRV:64bit: - [2011/01/29 14:29:58 | 000,031,088 | —- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\clwvd.sys – (clwvd)
DRV:64bit: - [2010/11/26 18:02:18 | 000,017,720 | —- | M] () [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\SmartDefragDriver.sys – (SmartDefragDriver)
DRV:64bit: - [2010/11/21 11:24:33 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/21 11:23:47 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/21 11:23:47 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbGD.sys – (TsUsbGD)
DRV:64bit: - [2010/10/19 16:34:26 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (MEIx64)
DRV:64bit: - [2010/10/15 13:28:16 | 000,317,440 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud)
DRV:64bit: - [2010/10/12 05:21:56 | 000,135,776 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\ApsX64.sys – (Shockprf)
DRV:64bit: - [2009/12/10 00:52:28 | 000,023,648 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\ApsHM64.sys – (TPDIGIMN)
DRV:64bit: - [2009/07/23 12:57:20 | 000,132,608 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbnet.sys – (ewusbnet)
DRV:64bit: - [2009/07/23 12:57:20 | 000,116,992 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbmdm.sys – (hwdatacard)
DRV:64bit: - [2009/07/23 12:57:20 | 000,113,792 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ewusbfake.sys – (hwusbfake)
DRV:64bit: - [2009/07/22 05:20:06 | 000,121,840 | —- | M] (CyberLink) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\wsvd.sys – (wsvd)
DRV:64bit: - [2009/07/14 09:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/14 09:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/14 09:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/14 07:21:48 | 000,038,400 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\tpm.sys – (TPM)
DRV:64bit: - [2009/06/11 04:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/11 04:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/11 04:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/11 04:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2012/10/04 16:49:47 | 000,040,520 | —- | M] (Emsisoft) [Kernel | System | Running] – C:\Windows\SysWOW64\drivers\OAmon.sys – (OAmon)
DRV - [2012/10/04 16:49:45 | 000,061,632 | —- | M] () [File_System | System | Running] – C:\Windows\SysWOW64\drivers\OADriver.sys – (OADevice)
DRV - [2012/10/04 16:44:51 | 000,062,016 | —- | M] () [Kernel | System | Running] – C:\Windows\SysWOW64\drivers\oahlp64.sys – (oahlpXX)
DRV - [2009/07/14 09:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://startsear.ch/?aff=1&src;=sp&…q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br…N&bmod;=LENN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://startsear.ch/?aff=1&src;=sp&…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - prefs.js..keyword.URL: "error"
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_149.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@powerchallenge.com/PowerLoader: C:\Users\ONewbieO\AppData\LocalLow\POWERC~1\nppowerloader.dll (Power Challenge Sweden AB)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\ONewbieO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/02/06 15:40:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/02/06 15:40:35 | 000,000,000 | —D | M]

[2012/03/12 19:31:00 | 000,000,000 | —D | M] (No name found) – C:\Users\ONewbieO\AppData\Roaming\Mozilla\Extensions
[2013/02/14 16:15:59 | 000,000,000 | —D | M] (No name found) – C:\Users\ONewbieO\AppData\Roaming\Mozilla\Firefox\Profiles\x6t7q09q.default\extensions
[2013/02/14 16:15:59 | 000,817,280 | —- | M] () (No name found) – C:\Users\ONewbieO\AppData\Roaming\Mozilla\Firefox\Profiles\x6t7q09q.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/02/06 15:40:34 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/02/06 15:40:34 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/02/06 15:40:39 | 000,262,552 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/01/02 17:48:42 | 000,083,456 | —- | M] (StartSearch ) – C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2012/12/21 05:15:26 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/12/21 05:15:26 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - Extension: No name found = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.7.9_0\
CHR - Extension: No name found = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.55_0\
CHR - Extension: No name found = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkgfemnodkdnenmfkblebnkjpckkjcae\0.402_0\
CHR - Extension: No name found = C:\Users\ONewbieO\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcphcjcjgkjmbphkfjleamgkinaeebnm\1.1_0\

O1 HOSTS File: ([2012/04/07 23:31:37 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files (x86)\Online Armor\oaui.exe (Emsisoft GmbH)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SynLenovoGestureMgr] C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Synaptics)
O4:64bit: - HKLM..\Run: [TpShocks] C:\Windows\SysNative\TpShocks.exe (Lenovo.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Info Center] C:\Program Files (x86)\PCPitstop\Info Center\InfoCenter.exe (PC Pitstop LLC)
O4 - HKLM..\Run: [Intelligent Touchpad] C:\Program Files (x86)\Lenovo\Intelligent Touchpad\TouchZone.exe ()
O4 - HKLM..\Run: [MobileConnect] C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [S6000Mnt] C:\Windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)
O4 - HKCU..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [GameXN GO] C:\ProgramData\GameXN\GameXNGO.exe (GameXN AS)
O4 - HKCU..\Run: [PPAP] C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe (PPLive Corporation)
O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
O4 - HKCU..\Run: [Speaking Clock Deluxe] C:\Program Files (x86)\Speaking Clock Deluxe\SpClDlx.exe (Lux Aeterna)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe File not found
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCPitstop Utility)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.7.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{642A322F-8D66-4551-BA4F-177A97B18F81}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8FE95196-7119-4FF4-A5CF-287768C56B64}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CCA37BC7-6972-489B-8539-8780FCCFCD6B}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{2e327cc7-aa6c-11e1-8165-ac7289a2028c}\Shell - "" = AutoRun
O33 - MountPoints2\{2e327cc7-aa6c-11e1-8165-ac7289a2028c}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{2e327d5a-aa6c-11e1-8165-ac7289a2028c}\Shell - "" = AutoRun
O33 - MountPoints2\{2e327d5a-aa6c-11e1-8165-ac7289a2028c}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{e3377b78-6613-11e2-8491-dca92253df46}\Shell - "" = AutoRun
O33 - MountPoints2\{e3377b78-6613-11e2-8491-dca92253df46}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{f88f6ce7-52e7-11e2-a127-ac7289a2028c}\Shell - "" = AutoRun
O33 - MountPoints2\{f88f6ce7-52e7-11e2-a127-ac7289a2028c}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/02/18 19:16:19 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/02/18 19:14:42 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{464D69F8-4B15-442F-BE80-533EB8F0DF4F}
[2013/02/17 17:28:36 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{82F5D03A-4F91-4698-AD8B-9AE6903B033E}
[2013/02/17 17:13:47 | 000,000,000 | —D | C] – C:\_OTL
[2013/02/17 01:29:58 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Roaming\go
[2013/02/17 01:29:55 | 000,000,000 | —D | C] – C:\ProgramData\GameXN
[2013/02/17 00:47:51 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{8432B6E6-46F3-46E4-84CE-1645EDB25DF9}
[2013/02/17 00:40:53 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Local\{28B60940-4B2F-4A71-9DDD-A0EFBCCF9148}
[2013/02/16 12:48:09 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/02/16 12:47:29 | 000,000,000 | —D | C] – C:\JRT
[2013/02/06 15:40:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013/02/06 13:01:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\188BET
[2013/02/05 20:56:34 | 000,000,000 | —D | C] – C:\Users\ONewbieO\Tracing
[2013/02/04 18:47:54 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Tencent
[2013/02/04 18:46:58 | 000,000,000 | —D | C] – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tencent Software
[2013/02/04 18:46:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Tencent
[2013/02/04 18:46:13 | 000,000,000 | —D | C] – C:\Users\ONewbieO\Documents\Tencent Files
[2013/01/26 02:08:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013/01/26 02:08:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/02/18 19:20:29 | 000,031,472 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/02/18 19:20:29 | 000,031,472 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/02/18 19:20:12 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/02/18 19:20:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/02/18 19:17:59 | 000,779,266 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/02/18 19:17:59 | 000,664,992 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/02/18 19:17:59 | 000,125,696 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/02/18 19:16:31 | 000,002,290 | —- | M] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/02/18 19:16:19 | 000,002,266 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/02/18 19:12:31 | 000,175,534 | —- | M] () – C:\Windows\SysNative\fastboot.set
[2013/02/18 19:11:50 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/02/18 19:11:44 | 3153,268,736 | -HS- | M] () – C:\hiberfil.sys
[2013/02/18 19:08:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/02/17 01:29:59 | 000,001,616 | —- | M] () – C:\Users\ONewbieO\Desktop\Play games (GameXN).lnk
[2013/02/14 13:51:06 | 000,001,498 | —- | M] () – C:\Windows\Sandboxie.ini
[2013/02/14 13:46:17 | 000,313,656 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/02/06 13:05:04 | 000,001,797 | —- | M] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\188BET.lnk
[2013/02/04 18:46:58 | 000,002,280 | —- | M] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\Tencent QQ.lnk
[2013/02/04 18:46:58 | 000,002,258 | —- | M] () – C:\Users\ONewbieO\Desktop\Tencent QQ.lnk
[2013/02/04 18:45:51 | 000,018,760 | —- | M] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2013/01/26 02:08:06 | 000,002,515 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk
[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/02/18 19:16:19 | 000,002,290 | —- | C] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/02/18 19:16:19 | 000,002,266 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/02/18 19:15:48 | 000,000,902 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/02/18 19:15:47 | 000,000,898 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/02/17 01:29:59 | 000,001,646 | —- | C] () – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play games (GameXN).lnk
[2013/02/17 01:29:59 | 000,001,616 | —- | C] () – C:\Users\ONewbieO\Desktop\Play games (GameXN).lnk
[2013/02/14 00:11:36 | 000,000,810 | —- | C] () – C:\Users\ONewbieO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Betfair.com Poker.lnk
[2013/02/06 13:01:31 | 000,001,797 | —- | C] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\188BET.lnk
[2013/02/04 18:46:58 | 000,002,280 | —- | C] () – C:\Users\ONewbieO\Application Data\Microsoft\Internet Explorer\Quick Launch\Tencent QQ.lnk
[2013/02/04 18:46:58 | 000,002,258 | —- | C] () – C:\Users\ONewbieO\Desktop\Tencent QQ.lnk
[2013/02/04 18:45:51 | 000,018,760 | —- | C] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2013/01/18 23:56:03 | 000,000,047 | —- | C] () – C:\Users\ONewbieO\jagex_cl_runescape_LIVE.dat
[2013/01/18 23:56:03 | 000,000,024 | —- | C] () – C:\Users\ONewbieO\random.dat
[2013/01/08 16:13:40 | 000,001,498 | —- | C] () – C:\Windows\Sandboxie.ini
[2012/07/17 14:26:51 | 000,000,000 | —- | C] () – C:\Users\ONewbieO\Tracert
[2012/04/17 15:40:59 | 000,062,016 | —- | C] () – C:\Windows\SysWow64\drivers\oahlp64.sys
[2012/04/17 15:40:59 | 000,061,632 | —- | C] () – C:\Windows\SysWow64\drivers\OADriver.sys
[2011/11/12 02:19:50 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2011/11/12 01:46:07 | 000,007,605 | —- | C] () – C:\Users\ONewbieO\AppData\Local\Resmon.ResmonCfg
[2011/11/12 00:16:37 | 000,000,000 | —- | C] () – C:\Windows\firstboot.dat
[2011/09/23 14:39:32 | 000,765,178 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/09/23 14:35:57 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/09/23 14:28:30 | 000,015,190 | —- | C] () – C:\Windows\S6000Twn.ini
[2011/09/23 14:27:06 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblup.dat
[2011/08/15 14:41:49 | 000,066,856 | —- | C] () – C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/07/25 09:26:57 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/07/25 09:26:52 | 000,216,876 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/07/25 09:26:49 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/07/25 09:26:19 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/06/01 13:06:38 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2009/08/28 15:16:16 | 000,130,238 | R— | C] () – C:\ProgramData\DeviceManager.xml.rc4

========== ZeroAccess Check ==========

[2009/07/14 12:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 13:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 12:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 09:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/21 11:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 09:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/11/20 14:01:41 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\BetTraderEvolution
[2012/12/31 10:06:10 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\bwincom
[2012/05/30 02:48:12 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\com.relaxgaming.prod.betsafe.FastPokerLobby
[2012/05/01 01:57:32 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\EvoTray
[2013/02/18 16:00:30 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\go
[2012/12/04 23:21:55 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\Lenovo
[2013/02/18 01:55:48 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\Microgaming
[2012/05/01 02:08:46 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\OnlineArmor
[2013/01/19 17:54:54 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\Origin
[2012/05/06 15:46:39 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\PacificPoker
[2012/11/21 13:33:29 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\PPLive
[2012/01/05 01:16:40 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\Unity
[2012/05/31 01:00:00 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\Vodafone
[2012/08/18 07:23:57 | 000,000,000 | —D | M] – C:\Users\ONewbieO\AppData\Roaming\WPT

========== Purity Check ==========



< End of report >


Don't think i have any more problems . Are we done with it ?
Post #12

Don't think i have any more problems . Are we done with it ?

You did a good job with Chrome and it looks like we are nearly there. A couple more scans to be sure then we can tidy up.

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:
  • start Malwarebytes-Anti-Malware and update it, (“Update” tab}
  • once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

================================================

Run ESET Online Scan

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - if ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Satchfan
Post #13
ESET scanner no threats found . Malware bytes log Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Database version: v2013.02.18.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 ONewbieO :: ALVINPC [administrator] 19/2/2013 4:33:59 PM mbam-log-2013-02-19 (16-33-59).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 229990 Time elapsed: 5 minute(s), 20 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
Post #14
Well done, your computer appears to be clean.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall OTL
  • double-click OTL.exe
  • click the CleanUp! button.
  • select Yes when the Begin cleanup Process? prompt appears.
  • if you are prompted to reboot during the cleanup, select Yes.
  • the tool will delete itself once it finishes, if not delete it by yourself.
NOTE: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.

You can delete any other logs and programs from your desktop.

===================================================

Create a Restore Point
  • click on Start > Control Panel (All Control Panel Items)
  • click on System > System Protection
  • check that you have System Protection turned on for the drive that you want to create a restore point for, (usually C:
  • click Create
  • type in a description for the restore point to help recognize it when doing a System Restore, and click on the Create button.
Remove old restore points
  • open Disk Cleanup by clicking Start. In the search box, type Disk Cleanup, and then, in the list of results, click Disk Cleanup.
  • if prompted, select the drive that you want to clean up, and then click OK.
  • in the Disk Cleanup for (drive letter) dialog box, click Clean up system files. If you're prompted for an administrator password or confirmation, type the password or provide confirmation
  • if prompted, select the drive that you want to clean up, and then click OK
  • click the More Options tab, then under System Restore and Shadow Copies, click Clean up
  • in the Disk Cleanup dialog box, click Delete
  • click Delete Files, and then click OK.

===================================================

Update installed programs

You have old versions of Java on your computer which are vulnerable to infections.
  • from the Start menu, select Control Panel.
  • in Large or Small icon view, click Programs and Features. If you're using Category view, under "Programs", click Uninstall a program.
  • select any version of Java and click Uninstall.
Install the latest version:

Java

NOTE – when you install Java, before clicking on Install, be sure to Uncheck “Install the Ask Toolbar and make Ask my default search provider”

🖼Click to load external image (Posted Image)

===================================================

Recommended programs

Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.

===================================================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

If I hear nothing for 24 hours I shall assume all is well and close the topic.

Safe computing

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI