Spyware / Malware / Virus Removal

win32/small.ca [Solved]

24 min read

Looking for the outcome? Ask AI

kayt Topic Starter

Post #1March 26, 2013, 3:12 PM UTC

Action center says I was infected with win32/small.ca virus. I use BitDefender Internet Security and they didn't find it. I have Super Anti-spyware Professional and they didn't find it. I ran Malwarebytes and they didn't find it. I then ran KDSS Killer and then the Malwarebytes root kit program with no detection. As a last resort I downloaded the microsoft malware scan and they found something different and deleted it but not the win32/small.ca. Do I need to worry that it's hiding somewhere from all of these programs?

Satchfan

Post #2March 28, 2013, 12:48 PM UTC

Hello kayt and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Do I need to worry that it's hiding somewhere from all of these programs?

Let's have a look and see.

Download and run OTL

download OTL to your desktop.
double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
click Scan all users.
under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
consrv.dll
/md5stop
%systemroot%\*. /rp /s
DRIVES
CREATERESTOREPOINT
click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
you may need two posts to fit them both in.

===================================================

Run aswMBR

download aswMBR.exe to your desktop.
double click the aswMBR.exe to run it
if asked, accept the AVAST virus definition download
click the "Scan" button to start scan
on completion of the scan click Save log, save it to your desktop and post in your next reply

Logs to include with next post:

OTL.txt
Extras.txt
aswMBR log

Thanks

Satchfan

kayt

Post #3March 28, 2013, 4:01 PM UTC

Thanks so much for addressing my issue. I am attaching the OTL log here (Extras wouldn't fit so that will come directly after this one) and will send another reply with the 3rd when it is complete:

OTL logfile created on: 3/28/2013 10:42:26 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\kay\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.95 Gb Total Physical Memory | 2.10 Gb Available Physical Memory | 53.22% Memory free
7.89 Gb Paging File | 5.77 Gb Available in Paging File | 73.17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.81 Gb Total Space | 370.29 Gb Free Space | 87.78% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 26.85 Gb Free Space | 92.59% Space Free | Partition Type: NTFS

Computer Name: KAY-PC | User Name: kay | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/03/28 10:38:54 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\kay\Desktop\OTL.exe
PRC - [2013/03/10 19:22:07 | 001,274,320 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2012/12/18 09:28:08 | 000,065,192 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/12/14 17:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/04/17 19:21:52 | 008,969,264 | —- | M] (Lenovo (Beijing) Limited) – C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
PRC - [2011/11/28 15:59:51 | 000,329,056 | —- | M] (Lenovo) – C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
PRC - [2011/02/18 03:20:54 | 000,013,336 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011/02/18 03:20:50 | 000,283,160 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
PRC - [2011/01/28 18:29:36 | 000,136,488 | —- | M] (CyberLink) – C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
PRC - [2010/12/20 21:30:38 | 002,656,280 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2010/12/20 21:30:36 | 000,325,656 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2010/01/19 05:44:40 | 000,536,576 | —- | M] (Vimicro) – C:\Program Files (x86)\USB Camera2\VM332_STI.EXE

========== Modules (No Company Name) ==========

MOD - [2013/03/10 19:22:06 | 000,459,728 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppgooglenaclpluginchrome.dll
MOD - [2013/03/10 19:22:05 | 012,662,224 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll
MOD - [2013/03/10 19:22:04 | 004,050,896 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll
MOD - [2013/03/10 19:21:18 | 000,596,944 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\libglesv2.dll
MOD - [2013/03/10 19:21:18 | 000,124,368 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\libegl.dll
MOD - [2013/03/10 19:21:16 | 001,552,848 | —- | M] () – C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ffmpegsumo.dll
MOD - [2013/02/14 08:18:17 | 011,833,344 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll
MOD - [2013/02/14 08:18:00 | 012,436,480 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll
MOD - [2013/01/10 08:17:46 | 000,475,648 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\7b0ad24d45e2a3f5f54f5f71748d8545\IAStorUtil.ni.dll
MOD - [2013/01/10 08:17:46 | 000,014,336 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\8c4058d017d39a61458f635112f4e394\IAStorCommon.ni.dll
MOD - [2013/01/10 08:15:26 | 000,771,584 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013/01/10 08:14:50 | 001,592,832 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013/01/10 08:14:35 | 003,347,968 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll
MOD - [2013/01/10 08:14:29 | 005,453,312 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013/01/10 08:14:25 | 000,971,264 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll
MOD - [2013/01/10 08:14:24 | 007,989,760 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013/01/10 08:14:18 | 011,493,376 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2011/11/28 15:59:50 | 000,013,664 | —- | M] () – C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
MOD - [2008/12/20 03:20:08 | 000,051,016 | —- | M] () – C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll

========== Services (SafeList) ==========

SRV:64bit: - [2013/02/25 14:30:53 | 001,645,256 | —- | M] (Bitdefender) [Auto | Running] – C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe – (VSSERV)
SRV:64bit: - [2013/02/25 14:30:43 | 000,069,392 | —- | M] (Bitdefender) [Disabled | Stopped] – C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe – (BdDesktopParental)
SRV:64bit: - [2013/01/10 12:59:09 | 000,495,336 | —- | M] (Bitdefender) [Auto | Running] – C:\Program Files\Bitdefender\Bitdefender Anti-Theft\atserv.exe – (atserv)
SRV:64bit: - [2013/01/10 12:59:07 | 000,068,416 | —- | M] (Bitdefender) [Auto | Running] – C:\Program Files\Bitdefender\Bitdefender Anti-Theft\updatesrv.exe – (UPDATESRV_ANTITHEFT)
SRV:64bit: - [2012/11/13 20:49:57 | 000,068,416 | —- | M] (Bitdefender) [Auto | Running] – C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe – (UPDATESRV)
SRV:64bit: - [2012/09/08 06:49:52 | 000,140,672 | —- | M] (SUPERAntiSpyware.com) [Auto | Running] – C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE – (!SASCORE)
SRV:64bit: - [2012/04/02 16:16:39 | 000,075,384 | —- | M] (Bitdefender) [Auto | Stopped] – C:\Program Files\Bitdefender\Safebox\SafeBoxService.exe – (SafeBox)
SRV:64bit: - [2010/09/22 13:10:10 | 000,057,184 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe – (wlcrasvc)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2013/03/09 17:19:19 | 000,251,248 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/18 09:28:08 | 000,065,192 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2012/12/14 17:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2011/02/18 03:20:54 | 000,013,336 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe – (IAStorDataMgrSvc)
SRV - [2010/12/20 21:30:38 | 002,656,280 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS)
SRV - [2010/12/20 21:30:36 | 000,325,656 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS)
SRV - [2010/03/18 14:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys – (esgiguard)
DRV:64bit: - [2013/03/27 17:56:14 | 000,056,016 | —- | M] () [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\fsbts.sys – (fsbts)
DRV:64bit: - [2013/01/29 23:44:02 | 000,589,000 | —- | M] (BitDefender) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\avckf.sys – (avckf)
DRV:64bit: - [2013/01/29 23:43:47 | 000,082,384 | —- | M] (BitDefender SRL) [File_System | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bdsandbox.sys – (BDSandBox)
DRV:64bit: - [2013/01/29 23:43:36 | 000,707,528 | —- | M] (BitDefender) [File_System | Boot | Running] – C:\Windows\SysNative\drivers\avc3.sys – (avc3)
DRV:64bit: - [2013/01/10 12:59:13 | 000,145,696 | —- | M] (BitDefender LLC) [File_System | Boot | Running] – C:\Windows\SysNative\drivers\gzflt.sys – (gzflt)
DRV:64bit: - [2012/11/02 14:17:46 | 000,261,056 | —- | M] (BitDefender) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\avchv.sys – (avchv)
DRV:64bit: - [2012/10/31 13:13:18 | 000,350,160 | —- | M] (BitDefender S.R.L.) [File_System | Boot | Running] – C:\Windows\SysNative\drivers\trufos.sys – (trufos)
DRV:64bit: - [2012/07/06 15:21:55 | 000,093,160 | —- | M] (BitDefender LLC) [Kernel | System | Running] – c:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfndisf6.sys – (BdfNdisf)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/11/28 16:08:57 | 000,039,008 | —- | M] (Lenovo.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\LhdX64.sys – (LHDmgr)
DRV:64bit: - [2011/11/28 16:08:54 | 000,029,792 | —- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AcpiVpc.sys – (ACPIVPC)
DRV:64bit: - [2011/11/28 16:06:24 | 000,057,952 | —- | M] (Lenovo) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\fbfmon.sys – (fbfmon)
DRV:64bit: - [2011/11/28 16:06:24 | 000,013,408 | —- | M] (Lenovo) [Kernel | System | Running] – C:\Windows\SysNative\drivers\BPntDrv.sys – (BPntDrv)
DRV:64bit: - [2011/11/28 07:19:18 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/11/28 07:19:18 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2011/11/14 20:16:37 | 000,103,504 | —- | M] (BitDefender LLC) [Kernel | System | Running] – C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys – (bdfwfpf)
DRV:64bit: - [2011/08/31 12:53:22 | 012,306,848 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2011/07/22 11:26:56 | 000,014,928 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys – (SASDIFSV)
DRV:64bit: - [2011/07/12 16:55:18 | 000,012,368 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\saskutil64.sys – (SASKUTIL)
DRV:64bit: - [2011/04/07 20:59:58 | 001,430,576 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2011/03/23 10:20:58 | 000,077,936 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\L1C62x64.sys – (L1C)
DRV:64bit: - [2011/03/15 18:09:16 | 000,311,400 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\rtsuvstor.sys – (RSUSBVSTOR)
DRV:64bit: - [2011/03/10 04:01:00 | 001,581,184 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\CHDRT64.sys – (CnxtHdAudService)
DRV:64bit: - [2011/02/18 03:11:54 | 000,439,320 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2011/01/28 18:29:58 | 000,031,088 | —- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\clwvd.sys – (clwvd)
DRV:64bit: - [2010/12/10 14:43:40 | 000,234,960 | —- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\vm332avs.sys – (vm332avs)
DRV:64bit: - [2010/11/24 06:33:26 | 002,673,664 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2010/11/20 22:24:33 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 22:23:47 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 22:23:47 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbGD.sys – (TsUsbGD)
DRV:64bit: - [2010/10/19 19:34:26 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (MEIx64)
DRV:64bit: - [2010/10/14 12:28:16 | 000,317,440 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud)
DRV:64bit: - [2010/09/21 17:04:54 | 000,015,056 | —- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\vm2uvcflt.sys – (vm2uvcflt)
DRV:64bit: - [2010/06/21 22:07:24 | 000,304,760 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Apfiltr.sys – (ApfiltrService)
DRV:64bit: - [2009/07/21 09:20:06 | 000,121,840 | —- | M] (CyberLink) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\wsvd.sys – (wsvd)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/10 15:35:42 | 000,187,392 | —- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2007/05/14 16:06:18 | 000,027,520 | —- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys – (RimUsb)
DRV - [2009/07/13 20:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3263915956-1623603887-170817122-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKU\S-1-5-21-3263915956-1623603887-170817122-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.netvibes.com/privatepage/1#General
IE - HKU\S-1-5-21-3263915956-1623603887-170817122-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3263915956-1623603887-170817122-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
IE - HKU\S-1-5-21-3263915956-1623603887-170817122-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\PROGRAM FILES\BITDEFENDER\BITDEFENDER 2013\BDTBEXT [2013/01/10 12:18:27 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013/01/10 12:18:27 | 000,000,000 | —D | M]

[2012/06/10 14:08:16 | 000,000,000 | —D | M] (No name found) – C:\Users\kay\AppData\Roaming\Mozilla\Firefox\extensions
[2012/06/10 14:08:18 | 000,000,000 | —D | M] (Serif PhotoPlus Community Toolbar) – C:\Users\kay\AppData\Roaming\Mozilla\Firefox\extensions\{8f2767f8-338a-4258-bd1c-4de5a3d8cdb2}
[2012/05/16 08:41:08 | 000,003,766 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{
google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\kay\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2161_0\plugins/avgnpss.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: RSS Feed Reader = C:\Users\kay\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnjaodmkngahhkoihejjehlcdlnohgmp\5.0.8_0\

O1 HOSTS File: ([2012/11/24 17:45:49 | 000,000,054 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-3263915956-1623603887-170817122-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [Bdagent] C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe (Bitdefender)
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [332BigDog] C:\Program Files (x86)\USB Camera2\VM332_STI.EXE (Vimicro)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (Lenovo)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3263915956-1623603887-170817122-1000..\Run: [ACE235BB23B59117C12A4EA27521ED35D89A27B0._service_run] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\kay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2012/11/24 17:39:46 | 000,000,000 | -H-D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E1DCFB10-2985-4C29-90E5-C0529EDE0410}: DhcpNameServer = [removed] 192.168.1.1
O18:64bit: - Protocol\Handler\linkscanner - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\UserInit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/03/27 11:26:17 | 000,000,000 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/03/28 10:38:52 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\kay\Desktop\OTL.exe
[2013/03/27 18:15:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\ToniArts
[2013/03/27 18:15:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasyCleaner
[2013/03/27 18:14:11 | 002,951,802 | —- | C] (InstallShield Software Corporation) – C:\Users\kay\Desktop\EClea2_0.exe
[2013/03/27 18:10:51 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2013/03/27 17:37:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Amazon
[2013/03/27 17:36:50 | 000,000,000 | —D | C] – C:\Users\kay\AppData\Roaming\Systweak
[2013/03/27 17:36:48 | 000,020,312 | —- | C] (Systweak Inc., (www.systweak.com)) – C:\windows\SysNative\roboot64.exe
[2013/03/27 17:11:41 | 000,000,000 | —D | C] – C:\ProgramData\HitmanPro
[2013/03/27 16:50:49 | 002,213,976 | —- | C] (Kaspersky Lab ZAO) – C:\Users\kay\Desktop\tdsskiller.exe
[2013/03/27 16:41:11 | 000,000,000 | —D | C] – C:\CCE_Quarantine
[2013/03/27 14:43:30 | 000,000,000 | —D | C] – C:\Users\kay\Desktop\cce_2.5.242177.201_x64
[2013/03/27 11:25:55 | 000,000,000 | —D | C] – C:\Program Files\Enigma Software Group
[2013/03/27 11:25:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013/03/25 15:32:23 | 001,441,280 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\inetcpl.cpl
[2013/03/25 15:32:23 | 001,400,416 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieapfltr.dat
[2013/03/25 15:32:23 | 001,054,720 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\MsSpellCheckingFacility.exe
[2013/03/25 15:32:23 | 000,719,360 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mshtmlmedia.dll
[2013/03/25 15:32:23 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\jscript.dll
[2013/03/25 15:32:23 | 000,629,248 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieapfltr.dll
[2013/03/25 15:32:23 | 000,391,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieui.dll
[2013/03/25 15:32:23 | 000,361,984 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\html.iec
[2013/03/25 15:32:23 | 000,232,960 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\url.dll
[2013/03/25 15:32:23 | 000,226,304 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\elshyph.dll
[2013/03/25 15:32:23 | 000,216,064 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msls31.dll
[2013/03/25 15:32:23 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msrating.dll
[2013/03/25 15:32:23 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\elshyph.dll
[2013/03/25 15:32:23 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\msrating.dll
[2013/03/25 15:32:23 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iexpress.exe
[2013/03/25 15:32:23 | 000,138,752 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\wextract.exe
[2013/03/25 15:32:23 | 000,137,216 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieUnatt.exe
[2013/03/25 15:32:23 | 000,125,440 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\occache.dll
[2013/03/25 15:32:23 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iepeers.dll
[2013/03/25 15:32:23 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\IEAdvpack.dll
[2013/03/25 15:32:23 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesysprep.dll
[2013/03/25 15:32:23 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\RegisterIEPKEYs.exe
[2013/03/25 15:32:23 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\inseng.dll
[2013/03/25 15:32:23 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mshtmled.dll
[2013/03/25 15:32:23 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\SetIEInstalledDate.exe
[2013/03/25 15:32:23 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\RegisterIEPKEYs.exe
[2013/03/25 15:32:23 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\icardie.dll
[2013/03/25 15:32:23 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\tdc.ocx
[2013/03/25 15:32:23 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesetup.dll
[2013/03/25 15:32:23 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\pngfilt.dll
[2013/03/25 15:32:23 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mshtmler.dll
[2013/03/25 15:32:23 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iernonce.dll
[2013/03/25 15:32:23 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\licmgr10.dll
[2013/03/25 15:32:23 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\msfeedssync.exe
[2013/03/25 15:32:22 | 001,509,376 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\inetcpl.cpl
[2013/03/25 15:32:22 | 001,400,416 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieapfltr.dat
[2013/03/25 15:32:22 | 000,905,728 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mshtmlmedia.dll
[2013/03/25 15:32:22 | 000,762,368 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieapfltr.dll
[2013/03/25 15:32:22 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msfeeds.dll
[2013/03/25 15:32:22 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\vbscript.dll
[2013/03/25 15:32:22 | 000,452,096 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\dxtmsft.dll
[2013/03/25 15:32:22 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\html.iec
[2013/03/25 15:32:22 | 000,281,600 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\dxtrans.dll
[2013/03/25 15:32:22 | 000,235,008 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\url.dll
[2013/03/25 15:32:22 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iexpress.exe
[2013/03/25 15:32:22 | 000,144,896 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\wextract.exe
[2013/03/25 15:32:22 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\inseng.dll
[2013/03/25 15:32:22 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mshtmled.dll
[2013/03/25 15:32:22 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\icardie.dll
[2013/03/25 15:32:22 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesetup.dll
[2013/03/25 15:32:22 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ie4uinit.exe
[2013/03/25 15:32:22 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iernonce.dll
[2013/03/25 15:32:22 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\licmgr10.dll
[2013/03/25 15:32:21 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript9.dll
[2013/03/25 15:32:21 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript.dll
[2013/03/25 15:32:21 | 000,526,848 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieui.dll
[2013/03/25 15:32:21 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieUnatt.exe
[2013/03/25 15:32:21 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\occache.dll
[2013/03/25 15:32:21 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesysprep.dll
[2013/03/25 15:32:21 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iepeers.dll
[2013/03/25 15:32:21 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\IEAdvpack.dll
[2013/03/25 15:32:21 | 000,092,160 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\SetIEInstalledDate.exe
[2013/03/25 15:32:21 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\tdc.ocx
[2013/03/25 15:32:21 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\pngfilt.dll
[2013/03/25 15:32:21 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\imgutil.dll
[2013/03/25 15:32:21 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mshtmler.dll
[2013/03/25 15:32:21 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mshta.exe
[2013/03/25 15:32:21 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msfeedssync.exe
[2013/03/24 08:06:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013/03/20 15:21:50 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\usb8023.sys
[2013/03/16 17:37:23 | 000,000,000 | —D | C] – C:\Users\kay\Desktop\mbar-1.01.0.1021
[2013/03/16 17:35:14 | 000,208,216 | —- | C] (Kaspersky Lab, GERT) – C:\windows\SysNative\drivers\42637328.sys
[2013/03/14 07:31:40 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013/03/14 07:30:39 | 000,000,000 | -HSD | C] – C:\windows\SysWow64\%APPDATA%
[2013/03/14 07:30:07 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2013/03/14 07:30:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Silverlight
[2013/02/28 07:46:25 | 002,284,544 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\msmpeg2vdec.dll
[2013/02/28 07:46:24 | 002,776,576 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msmpeg2vdec.dll
[2013/02/28 07:46:24 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\UIAnimation.dll
[2013/02/28 07:46:24 | 000,187,392 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\UIAnimation.dll
[2013/02/28 07:46:21 | 000,465,920 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\WMPhoto.dll
[2013/02/28 07:46:21 | 000,417,792 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\WMPhoto.dll
[2013/02/28 07:46:16 | 002,565,120 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10warp.dll
[2013/02/28 07:46:16 | 000,522,752 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\XpsGdiConverter.dll
[2013/02/28 07:46:16 | 000,194,560 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10_1.dll
[2013/02/28 07:46:16 | 000,010,752 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013/02/28 07:46:16 | 000,010,752 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013/02/28 07:46:16 | 000,009,728 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013/02/28 07:46:16 | 000,009,728 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013/02/28 07:46:16 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013/02/28 07:46:16 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013/02/28 07:46:16 | 000,002,560 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013/02/28 07:46:16 | 000,002,560 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013/02/28 07:46:15 | 000,364,544 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\XpsGdiConverter.dll
[2013/02/28 07:46:15 | 000,363,008 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\dxgi.dll
[2013/02/28 07:46:15 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013/02/28 07:46:15 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013/02/28 07:46:15 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013/02/28 07:46:15 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013/02/28 07:46:15 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013/02/28 07:46:15 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013/02/28 07:46:15 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013/02/28 07:46:15 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013/02/28 07:46:15 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013/02/28 07:46:15 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013/02/28 07:46:14 | 001,887,232 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d11.dll
[2013/02/28 07:46:14 | 001,682,432 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\XpsPrint.dll
[2013/02/28 07:46:14 | 001,504,768 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\d3d11.dll
[2013/02/28 07:46:14 | 001,238,528 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10.dll
[2013/02/28 07:46:14 | 001,158,144 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\XpsPrint.dll
[2013/02/28 07:46:14 | 000,648,192 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10level9.dll
[2013/02/28 07:46:14 | 000,333,312 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10_1core.dll
[2013/02/28 07:46:14 | 000,296,960 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10core.dll
[2013/02/28 07:46:13 | 003,928,064 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d2d1.dll
[2013/02/28 07:46:13 | 001,643,520 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\DWrite.dll
[2013/02/28 07:46:13 | 001,424,384 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\WindowsCodecs.dll
[2013/02/28 07:46:13 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\WindowsCodecsExt.dll
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/03/28 10:42:31 | 000,021,280 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/03/28 10:42:31 | 000,021,280 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/03/28 10:39:47 | 006,167,290 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2013/03/28 10:39:47 | 002,037,542 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2013/03/28 10:39:47 | 000,005,152 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2013/03/28 10:38:54 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\kay\Desktop\OTL.exe
[2013/03/28 10:35:48 | 000,453,679 | —- | M] () – C:\windows\SysNative\fastboot.set
[2013/03/28 10:34:50 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2013/03/28 10:34:43 | 3177,074,688 | -HS- | M] () – C:\hiberfil.sys
[2013/03/27 18:14:21 | 002,951,802 | —- | M] (InstallShield Software Corporation) – C:\Users\kay\Desktop\EClea2_0.exe
[2013/03/27 17:56:14 | 000,056,016 | —- | M] () – C:\windows\SysNative\drivers\fsbts.sys
[2013/03/27 17:21:29 | 000,032,152 | —- | M] () – C:\windows\SysNative\drivers\hitmanpro37.sys
[2013/03/27 17:18:15 | 000,001,722 | —- | M] () – C:\windows\SysNative\.crusader
[2013/03/27 16:50:58 | 002,213,976 | —- | M] (Kaspersky Lab ZAO) – C:\Users\kay\Desktop\tdsskiller.exe
[2013/03/27 11:26:17 | 000,000,000 | —- | M] () – C:\autoexec.bat
[2013/03/25 15:32:23 | 001,441,280 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\inetcpl.cpl
[2013/03/25 15:32:23 | 001,400,416 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\ieapfltr.dat
[2013/03/25 15:32:23 | 001,054,720 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\MsSpellCheckingFacility.exe
[2013/03/25 15:32:23 | 000,719,360 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\mshtmlmedia.dll
[2013/03/25 15:32:23 | 000,690,688 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\jscript.dll
[2013/03/25 15:32:23 | 000,629,248 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\ieapfltr.dll
[2013/03/25 15:32:23 | 000,441,856 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\html.iec
[2013/03/25 15:32:23 | 000,391,680 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\ieui.dll
[2013/03/25 15:32:23 | 000,361,984 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\html.iec
[2013/03/25 15:32:23 | 000,232,960 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\url.dll
[2013/03/25 15:32:23 | 000,226,304 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\elshyph.dll
[2013/03/25 15:32:23 | 000,216,064 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\msls31.dll
[2013/03/25 15:32:23 | 000,197,120 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\msrating.dll
[2013/03/25 15:32:23 | 000,185,344 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\elshyph.dll
[2013/03/25 15:32:23 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\msrating.dll
[2013/03/25 15:32:23 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iexpress.exe
[2013/03/25 15:32:23 | 000,138,752 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\wextract.exe
[2013/03/25 15:32:23 | 000,137,216 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\ieUnatt.exe
[2013/03/25 15:32:23 | 000,125,440 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\occache.dll
[2013/03/25 15:32:23 | 000,117,248 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iepeers.dll
[2013/03/25 15:32:23 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\IEAdvpack.dll
[2013/03/25 15:32:23 | 000,109,056 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iesysprep.dll
[2013/03/25 15:32:23 | 000,089,600 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\RegisterIEPKEYs.exe
[2013/03/25 15:32:23 | 000,082,432 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\inseng.dll
[2013/03/25 15:32:23 | 000,079,872 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\mshtmled.dll
[2013/03/25 15:32:23 | 000,073,728 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\SetIEInstalledDate.exe
[2013/03/25 15:32:23 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\RegisterIEPKEYs.exe
[2013/03/25 15:32:23 | 000,069,120 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\icardie.dll
[2013/03/25 15:32:23 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\tdc.ocx
[2013/03/25 15:32:23 | 000,061,440 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iesetup.dll
[2013/03/25 15:32:23 | 000,057,344 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\pngfilt.dll
[2013/03/25 15:32:23 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\mshtmler.dll
[2013/03/25 15:32:23 | 000,033,280 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iernonce.dll
[2013/03/25 15:32:23 | 000,025,185 | —- | M] () – C:\windows\SysWow64\ieuinit.inf
[2013/03/25 15:32:23 | 000,023,040 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\licmgr10.dll
[2013/03/25 15:32:23 | 000,011,776 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\msfeedssync.exe
[2013/03/25 15:32:22 | 001,509,376 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\inetcpl.cpl
[2013/03/25 15:32:22 | 001,400,416 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ieapfltr.dat
[2013/03/25 15:32:22 | 000,905,728 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\mshtmlmedia.dll
[2013/03/25 15:32:22 | 000,762,368 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ieapfltr.dll
[2013/03/25 15:32:22 | 000,603,136 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\msfeeds.dll
[2013/03/25 15:32:22 | 000,599,552 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\vbscript.dll
[2013/03/25 15:32:22 | 000,452,096 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\dxtmsft.dll
[2013/03/25 15:32:22 | 000,281,600 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\dxtrans.dll
[2013/03/25 15:32:22 | 000,235,008 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\url.dll
[2013/03/25 15:32:22 | 000,167,424 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iexpress.exe
[2013/03/25 15:32:22 | 000,144,896 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\wextract.exe
[2013/03/25 15:32:22 | 000,102,912 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\inseng.dll
[2013/03/25 15:32:22 | 000,097,280 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\mshtmled.dll
[2013/03/25 15:32:22 | 000,081,408 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\icardie.dll
[2013/03/25 15:32:22 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iesetup.dll
[2013/03/25 15:32:22 | 000,051,712 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ie4uinit.exe
[2013/03/25 15:32:22 | 000,039,936 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iernonce.dll
[2013/03/25 15:32:22 | 000,027,648 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\licmgr10.dll
[2013/03/25 15:32:22 | 000,025,185 | —- | M] () – C:\windows\SysNative\ieuinit.inf
[2013/03/25 15:32:21 | 003,958,784 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\jscript9.dll
[2013/03/25 15:32:21 | 000,855,552 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\jscript.dll
[2013/03/25 15:32:21 | 000,526,848 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ieui.dll
[2013/03/25 15:32:21 | 000,173,568 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ieUnatt.exe
[2013/03/25 15:32:21 | 000,149,504 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\occache.dll
[2013/03/25 15:32:21 | 000,136,704 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iesysprep.dll
[2013/03/25 15:32:21 | 000,136,192 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iepeers.dll
[2013/03/25 15:32:21 | 000,135,680 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\IEAdvpack.dll
[2013/03/25 15:32:21 | 000,092,160 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\SetIEInstalledDate.exe
[2013/03/25 15:32:21 | 000,077,312 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\tdc.ocx
[2013/03/25 15:32:21 | 000,062,976 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\pngfilt.dll
[2013/03/25 15:32:21 | 000,051,200 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\imgutil.dll
[2013/03/25 15:32:21 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\mshtmler.dll
[2013/03/25 15:32:21 | 000,013,824 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\mshta.exe
[2013/03/25 15:32:21 | 000,012,800 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\msfeedssync.exe
[2013/03/24 08:06:22 | 000,002,212 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2013/03/16 17:35:14 | 000,208,216 | —- | M] (Kaspersky Lab, GERT) – C:\windows\SysNative\drivers\42637328.sys
[2013/03/14 07:53:25 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/03/09 17:19:19 | 000,691,568 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerApp.exe
[2013/03/09 17:19:19 | 000,071,024 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/03/06 07:37:11 | 000,000,498 | —- | M] () – C:\windows\SysNative\checkdnsid.xml
[2013/02/28 16:27:28 | 000,020,312 | —- | M] (Systweak Inc., (www.systweak.com)) – C:\windows\SysNative\roboot64.exe
[2013/02/27 17:19:42 | 486,923,934 | —- | M] () – C:\windows\MEMORY.DMP
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/03/27 17:56:14 | 000,056,016 | —- | C] () – C:\windows\SysNative\drivers\fsbts.sys
[2013/03/27 17:21:28 | 000,032,152 | —- | C] () – C:\windows\SysNative\drivers\hitmanpro37.sys
[2013/03/27 17:18:15 | 000,001,722 | —- | C] () – C:\windows\SysNative\.crusader
[2013/03/27 11:26:17 | 000,000,000 | —- | C] () – C:\autoexec.bat
[2013/03/25 15:32:23 | 000,025,185 | —- | C] () – C:\windows\SysWow64\ieuinit.inf
[2013/03/25 15:32:22 | 000,025,185 | —- | C] () – C:\windows\SysNative\ieuinit.inf
[2013/03/24 08:06:22 | 000,002,212 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2013/01/10 15:11:20 | 000,088,277 | —- | C] () – C:\ProgramData\1357848541.bdinstall.bin
[2013/01/10 15:09:10 | 000,055,333 | —- | C] () – C:\ProgramData\1357848541.7800.bin
[2013/01/10 15:09:10 | 000,001,736 | —- | C] () – C:\ProgramData\1357848541.7796.bin
[2013/01/10 15:09:01 | 000,026,513 | —- | C] () – C:\ProgramData\1357848541.7736.bin
[2013/01/10 15:09:01 | 000,004,695 | —- | C] () – C:\ProgramData\1357848541.7748.bin
[2013/01/10 12:30:27 | 000,143,146 | —- | C] () – C:\ProgramData\1357838872.bdinstall.bin
[2013/01/10 12:19:45 | 000,551,278 | —- | C] () – C:\ProgramData\1357838003.bdinstall.bin
[2012/08/14 13:48:16 | 000,000,000 | —- | C] () – C:\Users\kay\AppData\Roaming\bibstats
[2012/08/11 07:38:27 | 001,503,232 | —- | C] () – C:\windows\SysWow64\ptj.exe
[2012/08/11 07:38:27 | 001,103,360 | —- | C] () – C:\windows\SysWow64\cidfont.dll
[2012/08/11 07:38:26 | 004,369,408 | —- | C] () – C:\windows\SysWow64\pdftk.exe
[2012/08/11 07:38:26 | 000,235,008 | —- | C] () – C:\windows\SysWow64\office.exe
[2012/05/03 16:36:47 | 000,072,080 | —- | C] () – C:\Users\kay\g2mdlhlpx.exe
[2012/05/03 16:32:04 | 000,041,669 | —- | C] () – C:\Users\kay\Desktop(2)
[2011/11/28 16:14:00 | 000,000,512 | —- | C] () – C:\windows\previous.bin
[2011/11/28 16:14:00 | 000,000,512 | —- | C] () – C:\windows\current.bin
[2011/11/28 15:59:54 | 002,086,240 | —- | C] () – C:\windows\SysWow64\LenovoVeriface.Interface.dll
[2011/11/28 15:59:54 | 001,500,512 | —- | C] () – C:\windows\SysWow64\Apblend.dll
[2011/11/28 15:59:54 | 001,171,456 | —- | C] () – C:\windows\SysWow64\PicNotify.dll
[2011/11/28 15:59:54 | 000,472,416 | —- | C] () – C:\windows\SysWow64\Lenovo.VerifaceStub.dll
[2011/11/28 15:59:49 | 001,044,480 | —- | C] () – C:\windows\SysWow64\3DImageRenderer.dll
[2011/11/28 15:49:52 | 000,001,823 | —- | C] () – C:\windows\vm332Rmv.ini
[2011/11/28 15:49:52 | 000,001,823 | —- | C] () – C:\windows\SysWow64\vm332Rmv.ini
[2011/11/28 15:47:01 | 000,066,856 | —- | C] () – C:\windows\SysWow64\SynTPEnhPS.dll
[2011/11/28 15:35:10 | 000,963,116 | —- | C] () – C:\windows\SysWow64\igkrng600.bin
[2011/11/28 15:35:07 | 000,145,804 | —- | C] () – C:\windows\SysWow64\igcompkrng600.bin
[2011/08/31 12:51:16 | 000,216,000 | —- | C] () – C:\windows\SysWow64\igfcg600m.bin
[2011/08/31 12:46:00 | 000,056,832 | —- | C] () – C:\windows\SysWow64\igdde32.dll
[2011/08/31 12:26:20 | 013,903,872 | —- | C] () – C:\windows\SysWow64\ig4icd32.dll

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 22:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/11/28 07:17:47 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/11/28 07:17:47 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/11/28 07:17:47 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/11/28 07:17:47 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 22:24:25 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/11/28 07:17:47 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/11/28 07:17:47 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 22:24:11 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: SVCHOST.EXE >
[2012/12/14 17:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 20:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\windows\SysNative\svchost.exe
[2009/07/13 20:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 22:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 22:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 22:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\windows\SysNative\userinit.exe
[2010/11/20 22:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 22:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\windows\SysNative\winlogon.exe
[2010/11/20 22:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012/12/14 17:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST9500325AS
Partitions: 4
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 200.00MB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 422.00GB
Starting Offset: 210763776
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Extended w/Extended Int 13
Bootable: False
BootPartition: False
PrimaryPartition: False
Size: 29.00GB
Starting Offset: 453130584064
Hidden sectors: 0

DeviceID: Disk #0, Partition #3
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 15.00GB
Starting Offset: 484264902656
Hidden sectors: 0

< End of report >

OTL Extras logfile created on: 3/28/2013 10:42:26 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\kay\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.95 Gb Total Physical Memory | 2.10 Gb Available Physical Memory | 53.22% Memory free
7.89 Gb Paging File | 5.77 Gb Available in Paging File | 73.17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.81 Gb Total Space | 370.29 Gb Free Space | 87.78% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 26.85 Gb Free Space | 92.59% Space Free | Partition Type: NTFS

Computer Name: KAY-PC | User Name: kay | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] – C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_USERS\S-1-5-21-3263915956-1623603887-170817122-1000\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{16678FF3-853A-45DF-84F9-84EA4A8CCCE6}" = lport=138 | protocol=17 | dir=in | app=system |
"{2628A34D-51EB-4EB2-9CEA-D1F148A2CB97}" = rport=139 | protocol=6 | dir=out | app=system |
"{2CAE0466-D5A2-4092-9FCB-F3C3E2FF49B8}" = rport=445 | protocol=6 | dir=out | app=system |
"{367E9AB2-EA44-4607-AD80-03093B436BE0}" = rport=10243 | protocol=6 | dir=out | app=system |
"{43F9657B-E207-4C3B-A61E-7C35F78FE0B8}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{48BE4B16-7FFF-4BDC-95CB-9969F44B4DF5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5568AA42-F36E-47DD-B006-FD11022993FB}" = lport=137 | protocol=17 | dir=in | app=system |
"{564671BA-9A48-40D2-B883-09DBB3F020FF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{609F75E1-5AD6-4C75-B77B-0C126153CA3D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{6BA545D9-265F-4FD7-9642-0218F6F48C79}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{76451372-84C8-478B-8889-BD4D523C38DD}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{76B8282A-2643-48FA-BFFF-B34569625A37}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{83F6D0EA-455F-4709-BD0F-56A3472398B4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{93205F2B-111D-4CB7-A89B-0E295ECF8F59}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9CCD61CA-6ABB-4195-9B53-988954BD4BD8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AC704EBD-D8A8-4BAF-BE57-0D9969CB7CF9}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B113855E-0D98-49C7-84A8-4FE4B75163A5}" = rport=137 | protocol=17 | dir=out | app=system |
"{BB1CF067-16FA-4241-969F-805B6CD35786}" = lport=139 | protocol=6 | dir=in | app=system |
"{C3D0ECFB-983F-433E-AB6A-BFC8BDC0F3D6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C93EF4FA-402A-4C50-AE50-CAD4DA57E95D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{CC153759-7E70-46E0-AE65-DACDA6CE6FAA}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D1AA7037-7B28-468B-AE27-9280607B2305}" = rport=138 | protocol=17 | dir=out | app=system |
"{DC454A69-477E-4FDF-BED1-DE710E01A721}" = lport=445 | protocol=6 | dir=in | app=system |
"{F60372E2-7F4E-42E5-9BB6-B91EFD53A6FA}" = lport=80 | protocol=6 | dir=in | name=www |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D5E83ED-056C-483D-813A-EB5D074597A5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{121F8BFF-473E-4317-9A92-B686D16C8BED}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{1C211DCD-1A6E-4A51-959C-486DED5BB934}" = protocol=17 | dir=in | app=c:\program files\bitdefender\safebox\safeboxgui.exe |
"{22766E12-863C-413D-B654-2F0B14D57554}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{2C96E484-A64A-49E4-B1F4-2DF68D5F9C09}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2E2B1648-0FD7-4507-88C3-420F7A79857E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{3509962E-DF37-4A7F-BF53-7496B98743B0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{37CD0E5C-2375-4A71-B7EF-E0BD062EA15B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{52EF8596-1D47-45B8-A6CB-2343D1976247}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{52FED71E-E16D-4AF9-9046-B47ECFDB7147}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5A8FF926-49CE-4CFB-9739-6C4BC64B93A7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{63D6B0F2-1A89-4046-8F7B-1AC275C2FD86}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7332425E-9F95-4E2B-BFAF-C4206B32EEEF}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{7ADF1748-A462-4B77-A60C-2C084E08E9D5}" = protocol=6 | dir=out | app=system |
"{8D519BA6-EA28-4703-A340-2493B0FD7FE5}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9184F5EE-A2A3-43E6-8359-0BB7D8CEA887}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9B6D1B04-A372-4B06-BDA2-9249B51A4EB5}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A33EB9EE-BF6A-4D05-B19D-1005FFD5A8CA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A585A58A-3A92-4D57-A841-0C83DD4F294C}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{A68C7ED3-F60F-4DB1-9F54-6D8E7EA141DE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B41FEF34-869C-4327-AF44-DC6D8EFECDDA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C6395485-19B2-4B8E-8DF0-7B306843C645}" = protocol=6 | dir=in | app=c:\program files\bitdefender\safebox\safeboxgui.exe |
"{C6907B25-3B4C-4151-AE86-A296BADCEEE5}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{CE15A25B-4CC5-4F48-B368-FD2DF9F764BB}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{E0ED9B82-75D0-43E2-8C1A-977FFD8514AC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EC0027F7-BD6E-4F05-855C-57758114D547}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{5B3DF1DE-3579-4957-AF32-D4554930EFA8}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"TCP Query User{6448B4EA-194A-449B-A4F6-8FEFDE23DD73}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"UDP Query User{20E28C4C-A84D-41E4-AED4-C85127D3F053}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"UDP Query User{AABCC0DE-68CD-4CF3-AA6E-7A3FF232CF66}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{7FBBB973-E18F-40E3-B8A7-B852A2B4BB50}" = Bitdefender Safebox
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Bitdefender" = Bitdefender Internet Security 2013
"Bitdefender Anti-Theft" = Bitdefender Anti-Theft
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 8.2.0.1394
"CNXT_AUDIO_HDA" = Conexant HD Audio
"EA12B1FB53CE4E387C31A85236C41EF559B5E392" = Windows Driver Package - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1)
"Lenovo EE Boot Optimizer" = Lenovo EE Boot Optimizer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Tee Support Client_is1" = Tee Support Client v5.5.1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java™ 6 Update 33
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{62BBB2F0-E220-4821-A564-730807D2C34D}" = Realtek USB 2.0 Reader Driver
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}" = OpenOffice.org 3.4.1
"{A0765939-76F5-48D8-82B1-8D0BBFAD0702}" = Serif PhotoPlus Starter Edition
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.6)
"{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0333}" = Lenovo EasyCamera
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C675C60B-0CB7-4108-B8CA-C3EC0706DEF0}" = Serif PagePlus Starter Edition
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D3694B69-6F8C-42D3-8A0A-EB2AB528C02C}" = Atheros Client Installation Program
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2B22002-9C8B-43CC-A75B-464B6ED4FF6B}" = Serif PagePlus X6
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}" = UserGuide
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Google Chrome" = Google Chrome
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}" = UserGuide
"Lenovo Games Console" = Lenovo Games Console
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
"office Convert Pdf to Jpg Jpeg Tiff Free_is1" = office Convert Pdf to Jpg Jpeg Tiff Free 6.5
"VeriFace" = VeriFace
"WinLiveSuite" = Windows Live Essentials

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 2/14/2013 8:51:38 AM | Computer Name = kay-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. The BaseIndex value from the
Performance registry is the first DWORD in the Data section, LastCounter value
is the second DWORD in the Data section, and LastHelp value is the third DWORD in
the Data section.

Error - 2/14/2013 8:51:38 AM | Computer Name = kay-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service MSDTC Bridge
4.0.0.0 (MSDTC Bridge 4.0.0.0) failed. The first DWORD in the Data section contains
the error code.

Error - 2/14/2013 9:16:54 AM | Computer Name = kay-PC | Source = WinMgmt | ID = 10
Description =

Error - 2/14/2013 9:20:41 AM | Computer Name = kay-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. The BaseIndex value from the
Performance registry is the first DWORD in the Data section, LastCounter value
is the second DWORD in the Data section, and LastHelp value is the third DWORD in
the Data section.

Error - 2/14/2013 9:20:41 AM | Computer Name = kay-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The first DWORD in the Data section contains the error code.

Error - 2/17/2013 12:46:25 PM | Computer Name = kay-PC | Source = Application Error | ID = 1000
Description = Faulting application name: LogonUI.exe, version: 6.1.7601.17514, time
stamp: 0x4ce79f70 Faulting module name: ole32.dll, version: 6.1.7601.17514, time
stamp: 0x4ce7c92c Exception code: 0xc0000005 Fault offset: 0x0000000000029003 Faulting
process id: 0x2d54 Faulting application start time: 0x01ce0d2b217328a8 Faulting application
path: C:\windows\system32\LogonUI.exe Faulting module path: C:\windows\system32\ole32.dll
Report
Id: 90ce8f0d-7921-11e2-abca-dc0ea16e0970

Error - 2/17/2013 5:38:42 PM | Computer Name = kay-PC | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe_SysMain, version: 6.1.7600.16385,
time stamp: 0x4a5bc3c1 Faulting module name: sysmain.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c9db Exception code: 0xc0000005 Fault offset: 0x0000000000055e99
Faulting
process id: 0x868 Faulting application start time: 0x01ce0ab56d4ce423 Faulting application
path: C:\windows\system32\svchost.exe Faulting module path: c:\windows\system32\sysmain.dll
Report
Id: 65d00d83-794a-11e2-abca-dc0ea16e0970

Error - 2/18/2013 8:20:01 AM | Computer Name = kay-PC | Source = Application Error | ID = 1000
Description = Faulting application name: chrome.exe, version: 24.0.1312.57, time
stamp: 0x510326ea Faulting module name: chrome.dll, version: 24.0.1312.57, time
stamp: 0x51032694 Exception code: 0x80000003 Fault offset: 0x005923cc Faulting process
id: 0xb0c Faulting application start time: 0x01ce0d09b7808c97 Faulting application
path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Faulting module
path: C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\chrome.dll Report
Id: 83eb1904-79c5-11e2-abca-dc0ea16e0970

Error - 2/24/2013 8:34:10 AM | Computer Name = kay-PC | Source = Application Error | ID = 1000
Description = Faulting application name: chrome.exe, version: 24.0.1312.57, time
stamp: 0x510326ea Faulting module name: chrome.dll, version: 24.0.1312.57, time
stamp: 0x51032694 Exception code: 0x80000003 Fault offset: 0x005923cc Faulting process
id: 0x3458 Faulting application start time: 0x01ce0dd28d9e07f2 Faulting application
path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Faulting module
path: C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\chrome.dll Report
Id: 7cacd15e-7e7e-11e2-abca-dc0ea16e0970

Error - 2/26/2013 11:34:26 AM | Computer Name = kay-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 10/2/2012 9:38:10 AM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Dnscache service.

Error - 10/5/2012 4:49:11 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 10/5/2012 4:50:39 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 10/5/2012 4:50:57 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7024
Description = The Windows Search service terminated with service-specific error
%%-1073473535.

Error - 10/5/2012 4:50:57 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7031
Description = The Windows Search service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 30000 milliseconds:
Restart the service.

Error - 10/5/2012 4:56:23 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 10/5/2012 10:21:49 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Dnscache service.

Error - 10/6/2012 8:17:40 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Dnscache service.

Error - 10/7/2012 10:38:38 PM | Computer Name = kay-PC | Source = DCOM | ID = 10010
Description =

Error - 10/8/2012 6:29:26 PM | Computer Name = kay-PC | Source = DCOM | ID = 10010
Description =

< End of report >

kayt

Post #4March 28, 2013, 4:03 PM UTC

Here is OTL Extras: 3rd scan to follow.
OTL Extras logfile created on: 3/28/2013 10:42:26 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\kay\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.95 Gb Total Physical Memory | 2.10 Gb Available Physical Memory | 53.22% Memory free
7.89 Gb Paging File | 5.77 Gb Available in Paging File | 73.17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.81 Gb Total Space | 370.29 Gb Free Space | 87.78% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 26.85 Gb Free Space | 92.59% Space Free | Partition Type: NTFS

Computer Name: KAY-PC | User Name: kay | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] – C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_USERS\S-1-5-21-3263915956-1623603887-170817122-1000\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{16678FF3-853A-45DF-84F9-84EA4A8CCCE6}" = lport=138 | protocol=17 | dir=in | app=system |
"{2628A34D-51EB-4EB2-9CEA-D1F148A2CB97}" = rport=139 | protocol=6 | dir=out | app=system |
"{2CAE0466-D5A2-4092-9FCB-F3C3E2FF49B8}" = rport=445 | protocol=6 | dir=out | app=system |
"{367E9AB2-EA44-4607-AD80-03093B436BE0}" = rport=10243 | protocol=6 | dir=out | app=system |
"{43F9657B-E207-4C3B-A61E-7C35F78FE0B8}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{48BE4B16-7FFF-4BDC-95CB-9969F44B4DF5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5568AA42-F36E-47DD-B006-FD11022993FB}" = lport=137 | protocol=17 | dir=in | app=system |
"{564671BA-9A48-40D2-B883-09DBB3F020FF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{609F75E1-5AD6-4C75-B77B-0C126153CA3D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{6BA545D9-265F-4FD7-9642-0218F6F48C79}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{76451372-84C8-478B-8889-BD4D523C38DD}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{76B8282A-2643-48FA-BFFF-B34569625A37}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{83F6D0EA-455F-4709-BD0F-56A3472398B4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{93205F2B-111D-4CB7-A89B-0E295ECF8F59}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9CCD61CA-6ABB-4195-9B53-988954BD4BD8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AC704EBD-D8A8-4BAF-BE57-0D9969CB7CF9}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B113855E-0D98-49C7-84A8-4FE4B75163A5}" = rport=137 | protocol=17 | dir=out | app=system |
"{BB1CF067-16FA-4241-969F-805B6CD35786}" = lport=139 | protocol=6 | dir=in | app=system |
"{C3D0ECFB-983F-433E-AB6A-BFC8BDC0F3D6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C93EF4FA-402A-4C50-AE50-CAD4DA57E95D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{CC153759-7E70-46E0-AE65-DACDA6CE6FAA}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D1AA7037-7B28-468B-AE27-9280607B2305}" = rport=138 | protocol=17 | dir=out | app=system |
"{DC454A69-477E-4FDF-BED1-DE710E01A721}" = lport=445 | protocol=6 | dir=in | app=system |
"{F60372E2-7F4E-42E5-9BB6-B91EFD53A6FA}" = lport=80 | protocol=6 | dir=in | name=www |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D5E83ED-056C-483D-813A-EB5D074597A5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{121F8BFF-473E-4317-9A92-B686D16C8BED}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{1C211DCD-1A6E-4A51-959C-486DED5BB934}" = protocol=17 | dir=in | app=c:\program files\bitdefender\safebox\safeboxgui.exe |
"{22766E12-863C-413D-B654-2F0B14D57554}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{2C96E484-A64A-49E4-B1F4-2DF68D5F9C09}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2E2B1648-0FD7-4507-88C3-420F7A79857E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{3509962E-DF37-4A7F-BF53-7496B98743B0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{37CD0E5C-2375-4A71-B7EF-E0BD062EA15B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{52EF8596-1D47-45B8-A6CB-2343D1976247}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{52FED71E-E16D-4AF9-9046-B47ECFDB7147}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5A8FF926-49CE-4CFB-9739-6C4BC64B93A7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{63D6B0F2-1A89-4046-8F7B-1AC275C2FD86}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7332425E-9F95-4E2B-BFAF-C4206B32EEEF}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{7ADF1748-A462-4B77-A60C-2C084E08E9D5}" = protocol=6 | dir=out | app=system |
"{8D519BA6-EA28-4703-A340-2493B0FD7FE5}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9184F5EE-A2A3-43E6-8359-0BB7D8CEA887}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9B6D1B04-A372-4B06-BDA2-9249B51A4EB5}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A33EB9EE-BF6A-4D05-B19D-1005FFD5A8CA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A585A58A-3A92-4D57-A841-0C83DD4F294C}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{A68C7ED3-F60F-4DB1-9F54-6D8E7EA141DE}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B41FEF34-869C-4327-AF44-DC6D8EFECDDA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C6395485-19B2-4B8E-8DF0-7B306843C645}" = protocol=6 | dir=in | app=c:\program files\bitdefender\safebox\safeboxgui.exe |
"{C6907B25-3B4C-4151-AE86-A296BADCEEE5}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{CE15A25B-4CC5-4F48-B368-FD2DF9F764BB}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{E0ED9B82-75D0-43E2-8C1A-977FFD8514AC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EC0027F7-BD6E-4F05-855C-57758114D547}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{5B3DF1DE-3579-4957-AF32-D4554930EFA8}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"TCP Query User{6448B4EA-194A-449B-A4F6-8FEFDE23DD73}C:\program files (x86)\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"UDP Query User{20E28C4C-A84D-41E4-AED4-C85127D3F053}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |
"UDP Query User{AABCC0DE-68CD-4CF3-AA6E-7A3FF232CF66}C:\program files (x86)\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files (x86)\oovoo\oovoo.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{7FBBB973-E18F-40E3-B8A7-B852A2B4BB50}" = Bitdefender Safebox
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Bitdefender" = Bitdefender Internet Security 2013
"Bitdefender Anti-Theft" = Bitdefender Anti-Theft
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 8.2.0.1394
"CNXT_AUDIO_HDA" = Conexant HD Audio
"EA12B1FB53CE4E387C31A85236C41EF559B5E392" = Windows Driver Package - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1)
"Lenovo EE Boot Optimizer" = Lenovo EE Boot Optimizer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Tee Support Client_is1" = Tee Support Client v5.5.1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java™ 6 Update 33
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{62BBB2F0-E220-4821-A564-730807D2C34D}" = Realtek USB 2.0 Reader Driver
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}" = OpenOffice.org 3.4.1
"{A0765939-76F5-48D8-82B1-8D0BBFAD0702}" = Serif PhotoPlus Starter Edition
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.6)
"{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0333}" = Lenovo EasyCamera
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C675C60B-0CB7-4108-B8CA-C3EC0706DEF0}" = Serif PagePlus Starter Edition
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D3694B69-6F8C-42D3-8A0A-EB2AB528C02C}" = Atheros Client Installation Program
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2B22002-9C8B-43CC-A75B-464B6ED4FF6B}" = Serif PagePlus X6
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}" = UserGuide
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Google Chrome" = Google Chrome
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}" = UserGuide
"Lenovo Games Console" = Lenovo Games Console
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
"office Convert Pdf to Jpg Jpeg Tiff Free_is1" = office Convert Pdf to Jpg Jpeg Tiff Free 6.5
"VeriFace" = VeriFace
"WinLiveSuite" = Windows Live Essentials

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 2/14/2013 8:51:38 AM | Computer Name = kay-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. The BaseIndex value from the
Performance registry is the first DWORD in the Data section, LastCounter value
is the second DWORD in the Data section, and LastHelp value is the third DWORD in
the Data section.

Error - 2/14/2013 8:51:38 AM | Computer Name = kay-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service MSDTC Bridge
4.0.0.0 (MSDTC Bridge 4.0.0.0) failed. The first DWORD in the Data section contains
the error code.

Error - 2/14/2013 9:16:54 AM | Computer Name = kay-PC | Source = WinMgmt | ID = 10
Description =

Error - 2/14/2013 9:20:41 AM | Computer Name = kay-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. The BaseIndex value from the
Performance registry is the first DWORD in the Data section, LastCounter value
is the second DWORD in the Data section, and LastHelp value is the third DWORD in
the Data section.

Error - 2/14/2013 9:20:41 AM | Computer Name = kay-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The first DWORD in the Data section contains the error code.

Error - 2/17/2013 12:46:25 PM | Computer Name = kay-PC | Source = Application Error | ID = 1000
Description = Faulting application name: LogonUI.exe, version: 6.1.7601.17514, time
stamp: 0x4ce79f70 Faulting module name: ole32.dll, version: 6.1.7601.17514, time
stamp: 0x4ce7c92c Exception code: 0xc0000005 Fault offset: 0x0000000000029003 Faulting
process id: 0x2d54 Faulting application start time: 0x01ce0d2b217328a8 Faulting application
path: C:\windows\system32\LogonUI.exe Faulting module path: C:\windows\system32\ole32.dll
Report
Id: 90ce8f0d-7921-11e2-abca-dc0ea16e0970

Error - 2/17/2013 5:38:42 PM | Computer Name = kay-PC | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe_SysMain, version: 6.1.7600.16385,
time stamp: 0x4a5bc3c1 Faulting module name: sysmain.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c9db Exception code: 0xc0000005 Fault offset: 0x0000000000055e99
Faulting
process id: 0x868 Faulting application start time: 0x01ce0ab56d4ce423 Faulting application
path: C:\windows\system32\svchost.exe Faulting module path: c:\windows\system32\sysmain.dll
Report
Id: 65d00d83-794a-11e2-abca-dc0ea16e0970

Error - 2/18/2013 8:20:01 AM | Computer Name = kay-PC | Source = Application Error | ID = 1000
Description = Faulting application name: chrome.exe, version: 24.0.1312.57, time
stamp: 0x510326ea Faulting module name: chrome.dll, version: 24.0.1312.57, time
stamp: 0x51032694 Exception code: 0x80000003 Fault offset: 0x005923cc Faulting process
id: 0xb0c Faulting application start time: 0x01ce0d09b7808c97 Faulting application
path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Faulting module
path: C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\chrome.dll Report
Id: 83eb1904-79c5-11e2-abca-dc0ea16e0970

Error - 2/24/2013 8:34:10 AM | Computer Name = kay-PC | Source = Application Error | ID = 1000
Description = Faulting application name: chrome.exe, version: 24.0.1312.57, time
stamp: 0x510326ea Faulting module name: chrome.dll, version: 24.0.1312.57, time
stamp: 0x51032694 Exception code: 0x80000003 Fault offset: 0x005923cc Faulting process
id: 0x3458 Faulting application start time: 0x01ce0dd28d9e07f2 Faulting application
path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Faulting module
path: C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\chrome.dll Report
Id: 7cacd15e-7e7e-11e2-abca-dc0ea16e0970

Error - 2/26/2013 11:34:26 AM | Computer Name = kay-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 10/2/2012 9:38:10 AM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Dnscache service.

Error - 10/5/2012 4:49:11 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 10/5/2012 4:50:39 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 10/5/2012 4:50:57 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7024
Description = The Windows Search service terminated with service-specific error
%%-1073473535.

Error - 10/5/2012 4:50:57 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7031
Description = The Windows Search service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 30000 milliseconds:
Restart the service.

Error - 10/5/2012 4:56:23 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 10/5/2012 10:21:49 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Dnscache service.

Error - 10/6/2012 8:17:40 PM | Computer Name = kay-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Dnscache service.

Error - 10/7/2012 10:38:38 PM | Computer Name = kay-PC | Source = DCOM | ID = 10010
Description =

Error - 10/8/2012 6:29:26 PM | Computer Name = kay-PC | Source = DCOM | ID = 10010
Description =

< End of report >

kayt

Post #5March 28, 2013, 4:37 PM UTC

Hello, Satchfan, Here is 3rd log. My system crashed in middle of scan and went to blue screen. I had to restart again so it didn't ask me for the Avast download but I suppose it was already there. I hope it is all inclusive for your analysis. aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-03-28 11:18:08 —————————– 11:18:08.045 OS Version: Windows x64 6.1.7601 Service Pack 1 11:18:08.045 Number of processors: 4 586 0x2A07 11:18:08.046 ComputerName: KAY-PC UserName: kay 11:18:09.564 Initialize success 11:18:20.933 AVAST engine defs: 13032800 11:18:46.749 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 11:18:46.754 Disk 0 Vendor: ST950032 0011 Size: 476940MB BusType: 3 11:18:46.906 Disk 0 MBR read successfully 11:18:46.911 Disk 0 MBR scan 11:18:47.018 Disk 0 Windows 7 default MBR code 11:18:47.026 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 200 MB offset 2048 11:18:47.037 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 431938 MB offset 411648 11:18:47.043 Disk 0 Partition - 00 0F Extended LBA 29692 MB offset 885020672 11:18:47.081 Disk 0 Partition 3 00 12 Compaq diag NTFS 15109 MB offset 945829888 11:18:47.109 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 29691 MB offset 885022720 11:18:47.266 Disk 0 scanning C:\windows\system32\drivers 11:19:00.941 Service scanning 11:19:09.621 Service BdfNdisf c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys **LOCKED** 5 11:19:09.678 Service bdfwfpf C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys **LOCKED** 5 11:19:31.403 Modules scanning 11:19:31.417 Disk 0 trace - called modules: 11:19:31.439 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 11:19:31.446 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006612060] 11:19:31.452 3 CLASSPNP.SYS[fffff88000dab43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80047a4050] 11:19:32.578 AVAST engine scan C:\windows 11:19:35.428 AVAST engine scan C:\windows\system32 11:24:24.787 AVAST engine scan C:\windows\system32\drivers 11:24:55.601 AVAST engine scan C:\Users\kay 11:26:00.951 Disk 0 MBR has been saved successfully to "C:\Users\kay\Desktop\MBR.dat" 11:26:01.049 The log file has been saved successfully to "C:\Users\kay\Desktop\aswMBR.txt" aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-03-28 11:18:08 —————————– 11:18:08.045 OS Version: Windows x64 6.1.7601 Service Pack 1 11:18:08.045 Number of processors: 4 586 0x2A07 11:18:08.046 ComputerName: KAY-PC UserName: kay 11:18:09.564 Initialize success 11:18:20.933 AVAST engine defs: 13032800 11:18:46.749 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 11:18:46.754 Disk 0 Vendor: ST950032 0011 Size: 476940MB BusType: 3 11:18:46.906 Disk 0 MBR read successfully 11:18:46.911 Disk 0 MBR scan 11:18:47.018 Disk 0 Windows 7 default MBR code 11:18:47.026 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 200 MB offset 2048 11:18:47.037 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 431938 MB offset 411648 11:18:47.043 Disk 0 Partition - 00 0F Extended LBA 29692 MB offset 885020672 11:18:47.081 Disk 0 Partition 3 00 12 Compaq diag NTFS 15109 MB offset 945829888 11:18:47.109 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 29691 MB offset 885022720 11:18:47.266 Disk 0 scanning C:\windows\system32\drivers 11:19:00.941 Service scanning 11:19:09.621 Service BdfNdisf c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys **LOCKED** 5 11:19:09.678 Service bdfwfpf C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys **LOCKED** 5 11:19:31.403 Modules scanning 11:19:31.417 Disk 0 trace - called modules: 11:19:31.439 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 11:19:31.446 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006612060] 11:19:31.452 3 CLASSPNP.SYS[fffff88000dab43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80047a4050] 11:19:32.578 AVAST engine scan C:\windows 11:19:35.428 AVAST engine scan C:\windows\system32 11:24:24.787 AVAST engine scan C:\windows\system32\drivers 11:24:55.601 AVAST engine scan C:\Users\kay 11:26:00.951 Disk 0 MBR has been saved successfully to "C:\Users\kay\Desktop\MBR.dat" 11:26:01.049 The log file has been saved successfully to "C:\Users\kay\Desktop\aswMBR.txt" 11:29:00.764 AVAST engine scan C:\ProgramData 11:29:59.872 Scan finished successfully 11:31:27.624 Disk 0 MBR has been saved successfully to "C:\Users\kay\Desktop\MBR.dat" 11:31:27.715 The log file has been saved successfully to "C:\Users\kay\Desktop\aswMBR.txt"

Satchfan

Post #6March 28, 2013, 11:41 PM UTC

Hi kayt

Registry cleaners

I see you are using a “Registry Cleaner”, EasyCleaner amongst others. It's not a good idea to use registry cleaners/boosters.

The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results". Unless you have a particular problem that requires a registry edit to correct it, (and you are expert in the registry), I would suggest you leave the registry alone.

I strongly advise you to get rid of EasyCleaner and any other cleaner/optimizer/booster/tuneup/tweak type utilities that you have on this or any other computer.

One of the malware experts, miekiemoes, has an excellent write-up here
Another excellent article by Bill Castner is located here

===================================================

Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} O2:64bit: - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found. O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

run AdwCleaner and select Delete
when it has finished it will ask to reboot - allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply

===================================================

I see you have run some other scans prior to coming here for help. One of those is TDSSKiller and I’d like to see the results of that scan.

The old TDSSKiller report can be found in your root directory, (usually C:\ folder) and will reflect the date that it was run which appears to be yesterday, 27th.

Please send the AdwCleaner log, the OTL fix log and the TDSSK log.

Thanks

Satchfan

kayt

Post #7March 28, 2013, 11:48 PM UTC

Thanks for the Easy cleaner info, I just downloaded it yesterday thinking it may help but I just uninstalled it. My Malwarebytes is not the paid version so it just runs when I ask it to so I don't see a disable on it - do I need to uninstall?

kayt

Post #8March 29, 2013, 12:05 AM UTC

I uninstalled Malwarebytes anyway just to be sure. Here is OTL log: Will get other 2 asap, All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! 64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: kay ->Temp folder emptied: 1284063 bytes ->Temporary Internet Files folder emptied: 78057978 bytes ->Java cache emptied: 2098930 bytes ->Google Chrome cache emptied: 58815239 bytes ->Flash cache emptied: 9153 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1715540 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 412342781 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67758 bytes RecycleBin emptied: 3418135187 bytes Total Files Cleaned = 3,789.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 03282013_185700 Files\Folders moved on Reboot… C:\Users\kay\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully. File\Folder C:\windows\temp\~bd2639.tmp not found! PendingFileRenameOperations files… Registry entries deleted on Reboot…

kayt

Post #9March 29, 2013, 12:14 AM UTC

Here is Cleaner log: Will do my best to follow instructions to locate TDSSKiller log and attach. Not sure I know how to do that. # AdwCleaner v2.115 - Logfile created 03/28/2013 at 19:07:41 # Updated 17/03/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : kay - KAY-PC # Boot Mode : Normal # Running from : C:\Users\kay\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** File Deleted : C:\END File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\ProgramData\Partner Folder Deleted : C:\Users\kay\AppData\Local\APN Folder Deleted : C:\Users\kay\AppData\Local\Conduit Folder Deleted : C:\Users\kay\AppData\LocalLow\Conduit Folder Deleted : C:\Users\kay\AppData\LocalLow\PriceGong Folder Deleted : C:\windows\SysWOW64\TempDir ***** [Registry] ***** Key Deleted : HKCU\Software\Alexa Internet Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASMANCS Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}] ***** [Internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16521 [OK] Registry is clean. -\\ Google Chrome v25.0.1364.172 File : C:\Users\kay\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[S1].txt - [2704 octets] - [28/03/2013 19:07:41] ########## EOF - C:\AdwCleaner[S1].txt - [2764 octets] ##########

kayt

Post #10March 29, 2013, 12:20 AM UTC

I don't think this is what you wanted for the TDSSKiller: Sorry that's all that I can get! ÿþ1#6#:#4#9#:#0#0#.#0#0#5#6# #1#6#0#4# # #T#D#S#S# #r#o#o#t#k#i#t# #r#e#m#o#v#i#n#g# #t#o#o#l# #2#.#8#.#1#6#.#0# #F#e#b# #1#1# #2#0#1#3# #1#8#:#5#0#:#4#2#=#=#=#=#=#1# #3#8#0#0# # #A#e#L#o#o#k#u#p#S#v#c# #-# #o#k# #3#8#0#0# # #[# #1#E#5#6#3#8#8#B#3#F#E#0#D#0#3#1#C#4#4#1#4#4#E#B#8#C#4#D#6#2#1#7# #]# #A#m#d#P#P#M# # # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#d#r#i#v#e#r#s#\#a#m#d#p#p#m#.#s#y#s# #1#6#:#4#9#:#2#0#.#0#5#6#5# #3#8#0#0# # #[# #C#4#8#4#F#8#C#E#B#1#7#1#7#C#5#4#0#2#4#2#5#3#1#D#B#7#8#4#5#C#4#E# #]# #a#r#c# # # # # # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#d#r#i#v#e#r#s#\#a#r#c#.#s#y#s# #b#5#7#n#d#6#0#a# #-# #o#k# # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#d#r#i#v#e#r#s#\#B#r#F#i#l#t#L#o#.#s#y#s#E#E#1#D#8#2#5#5#C#2#A#A#0#E#9#E#8#E#6#9#4# #]# #B#r#o#w#s#e#r# # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#S#y#s#t#e#m#3#2#\#b#r#o#w#s#e#r#.#d#l#l#F#A#6#2#0#5#0#5#1#5#3#1#4#C#F#B#5#2#C#F# #]# #c#i#r#c#l#a#s#s# # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#d#r#i#v#e#r#s#\#c#i#r#c#l#a#s#s#.#s#y#s#3#2#\#D#R#I#V#E#R#S#\#C#o#m#p#o#s#i#t#e#B#u#s#.#s#y#s# #3#8#0#0# # #d#e#f#r#a#g#s#v#c# #-# #o#k#t#e#m#3#2#\#e#a#p#s#v#c#.#d#l#l#6#:#4#9#:#2#5#.#0#1#2#1# #3#8#0#0# # #f#d#c# #-# #o#k# #3#8#0#0# # #[# #1#F#7#B#2#5#B#8#5#8#F#A#2#7#0#1#5#1#6#9#F#E#9#5#E#5#4#1#0#8#E#D# #]# #f#v#e#v#o#l# # # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#D#R#I#V#E#R#S#\#f#v#e#v#o#l#.#s#y#s#P#r#o#g#r#a#m# #F#i#l#e#s# #(#x#8#6#)#\#G#o#o#g#l#e#\#U#p#d#a#t#e#\#G#o#o#g#l#e#U#p#d#a#t#e#.#e#x#e#4#9#:#2#6#.#0#2#0#0# #3#8#0#0# # #[# #9#0#8#A#C#B#1#F#5#9#4#2#7#4#9#6#5#A#5#3#9#2#6#B#1#0#C#8#1#E#8#9# #]# #H#o#m#e#G#r#o#u#p#P#r#o#v#i#d#e#r# #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#p#r#o#v#s#v#c#.#d#l#l#0#0#8#3#A#0#5#1#8#A#A# #]# #i#n#t#e#l#i#d#e# # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#d#r#i#v#e#r#s#\#i#n#t#e#l#i#d#e#.#s#y#s# #-# #o#k#E#C#5#9#D#E#D#A#1#8#8#D#1#D#A#0#7# #]# #K#S#e#c#P#k#g# # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#D#r#i#v#e#r#s#\#k#s#e#c#p#k#g#.#s#y#s#0# #3#8#0#0# # #[# #0#5#0#4#E#A#C#A#F#F#0#D#3#C#8#A#E#D#1#6#1#C#4#B#0#D#3#6#9#D#4#A# #]# #L#S#I#_#S#C#S#I# # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#d#r#i#v#e#r#s#\#l#s#i#_#s#c#s#i#.#s#y#s# #3#8#0#0# # #M#o#d#e#m# #-# #o#k# # #m#p#i#o# #-# #o#k#y#s# #3#8#0#0# # #N#D#P#r#o#x#y# #-# #o#k#t#e#m#3#2#\#d#r#i#v#e#r#s#\#N#u#l#l#.#s#y#s#1#.#0#2#4#2# #3#8#0#0# # #P#E#A#U#T#H# #-# #o#k# #]# #P#p#t#p#M#i#n#i#p#o#r#t# # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#D#R#I#V#E#R#S#\#r#a#s#p#p#t#p#.#s#y#s#5# #3#8#0#0# # #[# #9#0#6#1#9#1#6#3#4#E#9#9#A#E#A#9#2#C#4#8#1#6#1#5#0#B#D#A#3#7#3#2# #]# #Q#W#A#V#E# # # # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#q#w#a#v#e#.#d#l#l#3#8#0#0# # #[# #E#6#1#6#0#8#A#A#3#5#E#9#8#9#9#9#A#F#9#A#A#E#E#E#A#6#1#1#4#B#0#A# #]# #R#D#P#W#D# # # # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#d#r#i#v#e#r#s#\#R#D#P#W#D#.#s#y#s# #]# #S#a#m#S#s# # # # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#l#s#a#s#s#.#e#x#e#3#.#0#1#6#4# #3#8#0#0# # #[# #3#2#8#9#7#6#6#0#3#8#D#B#2#C#B#1#4#D#0#7#D#C#8#4#3#9#2#1#3#8#D#5# #]# #S#A#S#D#I#F#S#V# # # # # # # # #C#:#\#P#r#o#g#r#a#m# #F#i#l#e#s#\#S#U#P#E#R#A#n#t#i#S#p#y#w#a#r#e#\#S#A#S#D#I#F#S#V#6#4#.#S#Y#S#3#8#0#0# # #[# #1#C#5#4#5#A#7#D#0#6#9#1#C#C#4#A#0#2#7#3#9#6#5#3#5#6#9#1#C#3#E#3# #]# #s#e#r#m#o#u#s#e# # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#d#r#i#v#e#r#s#\#s#e#r#m#o#u#s#e#.#s#y#s#3#8#0#0# # #[# #E#1#7#E#0#1#8#8#B#B#9#0#F#A#E#4#2#D#8#3#E#9#8#7#0#7#E#F#A#5#9#C# #]# #s#p#p#s#v#c# # # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#s#p#p#s#v#c#.#e#x#e# #3#8#0#0# # #s#r#v#n#e#t# #-# #o#k#C#E#C#7#1#3#5#8#5# #]# #T#a#b#l#e#t#I#n#p#u#t#S#e#r#v#i#c#e# #C#:#\#w#i#n#d#o#w#s#\#S#y#s#t#e#m#3#2#\#T#a#b#S#v#c#.#d#l#l#s#\#s#y#s#t#e#m#3#2#\#D#R#I#V#E#R#S#\#t#r#u#f#o#s#.#s#y#s# #]# #U#N#S# # # # # # # # # # # # # #C#:#\#P#r#o#g#r#a#m# #F#i#l#e#s# #(#x#8#6#)#\#I#n#t#e#l#\#I#n#t#e#l#(#R#)# #M#a#n#a#g#e#m#e#n#t# #E#n#g#i#n#e# #C#o#m#p#o#n#e#n#t#s#\#U#N#S#\#U#N#S#.#e#x#e#:#3#6#.#0#5#3#5# #3#8#0#0# # #[# #3#8#D#1#5#D#4#9#4#9#5#C#8#8#6#7#0#2#9#C#6#6#7#5#E#2#8#A#5#0#3#D# #]# #U#P#D#A#T#E#S#R#V#_#A#N#T#I#T#H#E#F#T# #C#:#\#P#r#o#g#r#a#m# #F#i#l#e#s#\#B#i#t#d#e#f#e#n#d#e#r#\#B#i#t#d#e#f#e#n#d#e#r# #A#n#t#i#-#T#h#e#f#t#\#u#p#d#a#t#e#s#r#v#.#e#x#e# #1#6#:#4#9#:#3#6#.#0#9#0#8# #3#8#0#0# # #v#d#r#v#r#o#o#t# #-# #o#k# #3#8#0#0# # #W#A#N#A#R#P# #-# #o#k#0#4#9#4# #3#8#0#0# # #W#d#i#S#y#s#t#e#m#H#o#s#t# #-# #o#k#0# # #[# #3#8#B#8#4#C#9#4#C#5#A#8#A#F#2#9#1#A#D#F#E#A#4#7#8#A#E#5#4#F#9#3# #]# #w#m#i#A#p#S#r#v# # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#s#y#s#t#e#m#3#2#\#w#b#e#m#\#W#m#i#A#p#S#r#v#.#e#x#e# #3#8#0#0# # #[# #9#A#3#4#5#2#B#3#C#2#A#4#6#C#0#7#3#1#6#6#C#5#C#F#4#9#F#A#D#1#A#E# #]# #W#w#a#n#S#v#c# # # # # # # # # #C#:#\#w#i#n#d#o#w#s#\#S#y#s#t#e#m#3#2#\#w#w#a#n#s#v#c#.#d#l#l#y#s#t#e#m#3#2#\#s#x#s#s#r#v#.#d#l#l#

Satchfan

Post #11March 29, 2013, 12:29 AM UTC

No, that is not what I expected to see.

I’m pretty sure from what I’ve seen so far that there is nothing too serious on your computer but we’ll run a deeper scan to be sure.

Download and run ComboFix

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It MUST be saved directly to your desktop. Choose save as and then make sure you choose Desktop

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Double click on ComboFix.exe & follow the prompts.

when finished, it will produce a report for you.
please post the C:\ComboFix.txt in your next post.

It’s past midnight here and I have an early start so won’t reply again tonight.

Thanks

Satchfan

kayt

Post #12March 29, 2013, 2:11 PM UTC

Hi, Satchfan, I downloaded the last program and double clicked it and let it run, after disabling my Bitdefender and AntiSpyware. It ran for an hour, got to stage 4 and nothing else has happened – no log or any further progress. In the meantime my Bitdefender and AntiSpywre programs were back on! I don't have a log and the scan window is still there. What do I do? Maybe try the 2nd link in your last email?

Satchfan

Post #13March 29, 2013, 2:44 PM UTC

Try running it in Safe Mode:

restart your computer.
when the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with the Windows Advanced Boot Options menu
select the option for Safe Mode using the arrow keys
then press Enter on your keyboard to boot into Safe Mode.

You should then be presented with the Windows Login screen. Log in to Windows and try it again.

Satchfan.

kayt

Post #14March 29, 2013, 3:47 PM UTC

Here is log from ComboFix - I had a heck of a time getting it to boot in safe mode! ComboFix 13-03-28.01 - kay 03/29/2013 10:38:09.2.4 - x64 NETWORK Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4040.2882 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Bitdefender Antivirus *Disabled/Outdated* {9B5F5313-CAF9-DD97-C460-E778420237B4} FW: Bitdefender Firewall *Disabled* {A364D236-8096-DCCF-EF3F-4E4DBCD170CF} SP: Bitdefender Antispyware *Disabled/Outdated* {203EB2F7-ECC3-D219-FED0-DC0A39857D09} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\1357838003.bdinstall.bin c:\programdata\1357838872.bdinstall.bin c:\programdata\1357848541.7736.bin c:\programdata\1357848541.7748.bin c:\programdata\1357848541.7796.bin c:\programdata\1357848541.7800.bin c:\programdata\1357848541.bdinstall.bin c:\users\kay\g2mdlhlpx.exe c:\users\Public\AlexaNSISPlugin.5360.dll c:\windows\s.bat c:\windows\SysWow64\office.exe . . ((((((((((((((((((((((((( Files Created from 2013-02-28 to 2013-03-29 ))))))))))))))))))))))))))))))) . . 2013-03-29 15:42 . 2013-03-29 15:42 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-03-28 23:57 . 2013-03-28 23:57 ——– d—–w- C:\_OTL 2013-03-28 20:23 . 2013-03-28 20:23 147232 —-a-w- c:\windows\system32\drivers\gzflt.sys 2013-03-27 22:56 . 2013-03-27 22:56 56016 —-a-w- c:\windows\system32\drivers\fsbts.sys 2013-03-27 22:37 . 2013-03-27 23:06 ——– d—–w- c:\program files (x86)\Amazon 2013-03-27 22:36 . 2013-03-27 23:09 ——– d—–w- c:\users\kay\AppData\Roaming\Systweak 2013-03-27 22:36 . 2013-02-28 21:27 20312 —-a-w- c:\windows\system32\roboot64.exe 2013-03-27 22:21 . 2013-03-27 22:21 32152 —-a-w- c:\windows\system32\drivers\hitmanpro37.sys 2013-03-27 22:11 . 2013-03-27 22:19 ——– d—–w- c:\programdata\HitmanPro 2013-03-27 21:41 . 2013-03-27 21:41 ——– d—–w- C:\CCE_Quarantine 2013-03-27 16:25 . 2013-03-27 16:25 ——– d—–w- c:\program files\Enigma Software Group 2013-03-27 16:25 . 2013-03-27 16:25 ——– d—–w- c:\program files (x86)\Common Files\Wise Installation Wizard 2013-03-20 20:21 . 2013-02-12 04:12 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-16 22:35 . 2013-03-16 22:35 208216 —-a-w- c:\windows\system32\drivers\42637328.sys 2013-03-14 12:30 . 2013-03-14 12:30 ——– d-sh–w- c:\windows\SysWow64\%APPDATA% 2013-03-14 12:30 . 2013-03-14 12:30 ——– d—–w- c:\program files\Microsoft Silverlight 2013-03-14 12:30 . 2013-03-14 12:30 ——– d—–w- c:\program files (x86)\Microsoft Silverlight . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-14 12:33 . 2012-04-01 14:42 72013344 —-a-w- c:\windows\system32\MRT.exe 2013-03-09 22:19 . 2012-04-04 14:39 691568 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-09 22:19 . 2012-03-19 22:22 71024 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-02-24 23:35 . 2013-02-24 23:35 208216 —-a-w- c:\windows\system32\drivers\54700942.sys 2013-02-12 05:45 . 2013-03-13 21:37 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-13 21:37 308736 —-a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-13 21:37 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45 . 2013-03-13 21:37 111104 —-a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48 . 2013-03-13 21:37 474112 —-a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-13 21:37 2176512 —-a-w- c:\windows\apppatch\AcGenral.dll 2013-02-11 13:28 . 2013-02-11 13:28 208216 —-a-w- c:\windows\system32\drivers\97046278.sys 2013-01-30 04:44 . 2013-01-30 04:44 589000 —-a-w- c:\windows\system32\drivers\avckf.sys 2013-01-30 04:43 . 2013-01-10 17:18 82384 —-a-w- c:\windows\system32\drivers\bdsandbox.sys 2013-01-30 04:43 . 2013-01-10 17:18 707528 —-a-w- c:\windows\system32\drivers\avc3.sys 2013-01-10 17:51 . 2013-01-10 17:51 76944 —-a-w- c:\windows\system32\drivers\bdvedisk.sys 2013-01-05 05:53 . 2013-02-13 12:54 5553512 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-01-05 05:00 . 2013-02-13 12:54 3967848 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-01-05 05:00 . 2013-02-13 12:54 3913064 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-01-04 05:46 . 2013-02-13 12:54 215040 —-a-w- c:\windows\system32\winsrv.dll 2013-01-04 04:51 . 2013-02-13 12:54 5120 —-a-w- c:\windows\SysWow64\wow32.dll 2013-01-04 04:43 . 2013-02-13 12:54 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2013-01-04 03:26 . 2013-02-13 12:54 3153408 —-a-w- c:\windows\system32\win32k.sys 2013-01-04 02:47 . 2013-02-13 12:54 25600 —-a-w- c:\windows\SysWow64\setup16.exe 2013-01-04 02:47 . 2013-02-13 12:54 7680 —-a-w- c:\windows\SysWow64\instnm.exe 2013-01-04 02:47 . 2013-02-13 12:54 2048 —-a-w- c:\windows\SysWow64\user.exe 2013-01-04 02:47 . 2013-02-13 12:54 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll 2013-01-03 06:00 . 2013-02-13 12:54 1913192 —-a-w- c:\windows\system32\drivers\tcpip.sys 2013-01-03 06:00 . 2013-02-13 12:54 288088 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ACE235BB23B59117C12A4EA27521ED35D89A27B0._service_run"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2013-03-11 1274320] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-02-18 283160] "UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504] "YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2011-01-28 136488] "YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2011-01-28 228448] "VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2011-11-28 329056] "UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504] "332BigDog"="c:\program files (x86)\USB Camera2\VM332_STI.EXE" [2010-01-19 536576] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] . c:\users\kay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [2013-01-30 707528] R0 gzflt;gzflt;c:\windows\system32\DRIVERS\gzflt.sys [2013-03-28 147232] R0 ssuhop;ssuhop; [x] R1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2011-11-28 13408] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] R2 atserv;Bitdefender Anti-Theft Service;c:\program files\Bitdefender\Bitdefender Anti-Theft\atserv.exe [2013-01-10 495336] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-02-18 13336] R2 SafeBox;SafeBox;c:\program files\Bitdefender\Safebox\SafeBoxService.exe [2012-04-02 75384] R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-21 2656280] R2 UPDATESRV;Bitdefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2013\updatesrv.exe [2013-03-28 68856] R2 UPDATESRV_ANTITHEFT;Bitdefender Anti-Theft Update Service;c:\program files\Bitdefender\Bitdefender Anti-Theft\updatesrv.exe id UPDATESRV_ANTITHEFT /service [x] R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [2013-01-30 589000] R3 BDSandBox;BDSandBox;c:\windows\system32\drivers\bdsandbox.sys [2013-01-30 82384] R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-01-28 31088] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] R3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 vm2uvcflt;Vimicro USB Camera Filter 2;c:\windows\system32\Drivers\vm2uvcflt.sys [2010-09-21 15056] R3 vm332avs;Lenovo Camera2;c:\windows\system32\Drivers\vm332avs.sys [2010-12-10 234960] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-20 1255736] R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840] R4 BdDesktopParental;Bitdefender Desktop Parental Control;c:\program files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [2013-03-28 69392] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2011-11-28 57952] S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2013-03-27 56016] S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2011-11-28 39008] S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2012-07-06 93160] S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-15 103504] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-09-08 140672] S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2011-11-28 29792] S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [2012-11-02 261056] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-03-23 77936] S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys [2011-03-15 311400] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-03-14 21:03 1629648 —-a-w- c:\program files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-03-14 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 22:19] . 2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-28 20:52] . 2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-28 20:52] . 2012-11-26 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1ee047da-b94b-4a4b-b8eb-84fbb6d8daac.job - c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52] . 2012-11-26 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 23f2daaa-fb4c-4159-93be-657db9fbbfac.job - c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc] @="{771C7324-DA80-49D3-8017-753B0AF60951}" [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}] 2011-11-28 20:59 1508192 —-a-w- c:\windows\System32\IcnOvrly.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox1] @="{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}" [HKEY_CLASSES_ROOT\CLSID\{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}] 2012-05-03 20:13 266952 —-a-w- c:\program files\Bitdefender\Safebox\SafeBoxShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox2] @="{342DAA0B-D796-460D-8566-901E08A1CCAD}" [HKEY_CLASSES_ROOT\CLSID\{342DAA0B-D796-460D-8566-901E08A1CCAD}] 2012-05-03 20:13 266952 —-a-w- c:\program files\Bitdefender\Safebox\SafeBoxShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox3] @="{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}" [HKEY_CLASSES_ROOT\CLSID\{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}] 2012-05-03 20:13 266952 —-a-w- c:\program files\Bitdefender\Safebox\SafeBoxShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox4] @="{33816773-98AE-4723-ADE0-EBE54C8B5A67}" [HKEY_CLASSES_ROOT\CLSID\{33816773-98AE-4723-ADE0-EBE54C8B5A67}] 2012-05-03 20:13 266952 —-a-w- c:\program files\Bitdefender\Safebox\SafeBoxShell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2011-11-28 114688] "Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2012-04-18 8969264] "EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2011-11-28 5908928] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2010-06-10 353648] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-31 167704] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-31 392472] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-31 416024] "Bdagent"="c:\program files\Bitdefender\Bitdefender 2013\bdagent.exe" [2013-03-28 1576240] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ——- Supplementary Scan ——- . uStart Page = hxxp://www.netvibes.com/privatepage/1#General mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = [removed] 192.168.1.1 TCP: Interfaces\{E1DCFB10-2985-4C29-90E5-C0529EDE0410}\255646F5452796D626164786: NameServer = 8.8.8.8,8.8.4.4 . . ——- File Associations ——- . inifile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1 txtfile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1 . - - - - ORPHANS REMOVED - - - - . HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start WebBrowser-{8F2767F8-338A-4258-BD1C-4DE5A3D8CDB2} - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-03-29 10:44:48 ComboFix-quarantined-files.txt 2013-03-29 15:44 . Pre-Run: 401,034,506,240 bytes free Post-Run: 400,380,329,984 bytes free . - - End Of File - - B641A6EB4A9E6420D6096B1056E70B7E

Satchfan

Post #15March 30, 2013, 5:33 PM UTC

There are a few questionable files in your logs but I really would like to see the TDSSKiller log.

The old TDSSKiller report should be at C:\TDSSKiller and will reflect the date that it was run which appears to be March 27th.

If you still can't locate it, download TDSSKiller.zip

extract it to your desktop
double click TDSSKiller.exe
press Start Scan
only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
click Continue > Reboot now
copy and paste the log in your next reply
a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

Thanks

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

win32/small.ca [Solved]

✨ Ask AI

Ask AI