Spyware / Malware / Virus Removal

Infected? [Solved]

91 min read

Looking for the outcome? Ask AI

sinnead Topic Starter

Post #1April 19, 2013, 2:29 PM UTC

Computer freezes, google crashes, loading can be(but isn't always) slow. When it freezes, it has to be rebooted. Ran a malwarebytes scan, found two "suspect" items. Those were quarantined and deleted. This didn't seem to make any difference so I downloaded and ran a Highjack This scan to post here. I have included both logs. I should say I tried to upload the highjack log. Can't do it.

Attachments:

📎mbam_log_2013_03_30__14_34_14_.txt

Satchfan

Post #2April 22, 2013, 2:52 PM UTC

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

run AdwCleaner and select Delete
when it has finished it will ask to reboot - allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run OTL

download OTL to your desktop.
double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
click Scan all users.
under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
DRIVES
CREATERESTOREPOINT
click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
you may need two posts to fit them both in.

===================================================

Run aswMBR

download aswMBR.exe to your desktop.
double click the aswMBR.exe to run it
if asked, accept the AVAST virus definition download
click the "Scan" button to start scan
on completion of the scan click Save log, save it to your desktop and post in your next reply. Note - do NOT attempt any Fix yet.

Please do not attach the logs - just copy, (Ctrl+C) and paste, (Ctrl+V), them in the post.

Logs to include with next post:

AdwCleaner log
OTL.txt
Extras.txt
aswMBR log

Thanks

Satchfan

sinnead

Post #3April 23, 2013, 3:44 AM UTC

Thanks for the help! Here are the scans:

# AdwCleaner v2.202 - Logfile created 04/22/2013 at 19:46:30
# Updated 23/04/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Sherry - DA658A6C7
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Sherry\My Documents\Downloads\adwcleaner.exe
# Option [Delete]

***** [Services] *****

Stopped & Deleted : CltMngSvc

***** [Files / Folders] *****

Deleted on reboot : C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oajgghejjpgkmpgbchgjieahoefimdle
Deleted on reboot : C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oajgghejjpgkmpgbchgjieahoefimdle
Deleted on reboot : C:\Program Files\Common Files\AVG Secure Search
File Deleted : C:\DOCUME~1\Sherry\LOCALS~1\Temp\Uninstall.exe
File Deleted : C:\END
Folder Deleted : C:\DOCUME~1\Cliff\LOCALS~1\Temp\avg@toolbar
Folder Deleted : C:\DOCUME~1\Sherry\LOCALS~1\Temp\avg@toolbar
Folder Deleted : C:\Documents and Settings\All Users\Application Data\APN
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Ask
Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Cliff\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Cliff\Application Data\SearchProtect
Folder Deleted : C:\Documents and Settings\Cliff\Local Settings\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Cliff\Local Settings\Application Data\AVG Security Toolbar
Folder Deleted : C:\Documents and Settings\Sherry\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Sherry\Application Data\PriceGong
Folder Deleted : C:\Documents and Settings\Sherry\Application Data\SearchProtect
Folder Deleted : C:\Documents and Settings\Sherry\Local Settings\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Sherry\Local Settings\Application Data\AVG Security Toolbar
Folder Deleted : C:\Documents and Settings\Sherry\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\Sherry\Local Settings\Application Data\PackageAware
Folder Deleted : C:\Program Files\AVG Secure Search
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\SearchProtect

***** [Registry] *****

Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}
Key Deleted : HKCU\Software\PriceGong
Key Deleted : HKCU\Software\SearchProtect
Key Deleted : HKCU\Software\SmartBar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\DiscoveryHelper.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GIFAnimator.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\IMTrProgress.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\IMWeb.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\WMHelper.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2656B92B-0207-4AFB-BEBF-F5FD231ECD39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{34CB0620-E343-4772-BBA8-D3074BC47516}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{412CD209-DDA4-4275-8C79-55F1C93FBD47}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{59570C1F-B692-48C9-91B4-7809E6945287}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{63A0F7FA-2C95-4D7E-AF25-EFCC303D20A1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6559E502-6EE1-46B8-A83C-F3A45BDA23EE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A2858A72-758F-4486-B6A1-7F1DCC0924FA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C63CA8A4-AB4E-49E5-A6C0-33FC86D80205}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C6A7847E-8931-4A9A-B4EF-72A91E3CCF4D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DD0F1D24-E250-4E93-966C-65615720AEFB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EC1277BB-1C71-4C0D-BA6D-BFEA16E773A6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\DiscoveryHelper.iMesh6Discovery
Key Deleted : HKLM\SOFTWARE\Classes\DiscoveryHelper.iMesh6Discovery.1
Key Deleted : HKLM\SOFTWARE\Classes\imweb.imwebcontrol
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3287822
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{252C2315-CCE0-4446-8DA7-C00292A690BA}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\Software\SearchProtect
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [searchprotect]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchProtectAll]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com/?ctid=CT3287822&octid;=CT3287822&SearchSource;=61&CUI;=UN28824354799108085&UM;=2&UP;=SPDCD84AC6-687C-40EA-BA94-C96D21249960 –> hxxp://www.google.com

-\\ Google Chrome v26.0.1410.64

File : C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

Deleted [l.75] : icon_url = "hxxp://search.conduit.com/fav.ico",
Deleted [l.78] : keyword = "search.conduit.com",
Deleted [l.82] : search_url = "hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource;=49&cui;=UN33[…]
Deleted [l.83] : suggest_url = "hxxp://suggest.search.conduit.com/Suggest.ashx?q=[{searchTerms}]"

File : C:\Documents and Settings\Cliff\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [13699 octets] - [22/04/2013 19:46:30]

########## EOF - C:\AdwCleaner[S1].txt - [13760 octets] ##########

OTL logfile created on: 22/04/2013 7:56:30 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Sherry\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

1.44 Gb Total Physical Memory | 0.60 Gb Available Physical Memory | 41.47% Memory free
3.29 Gb Paging File | 2.53 Gb Available in Paging File | 76.98% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 137.23 Gb Free Space | 58.93% Space Free | Partition Type: NTFS

Computer Name: DA658A6C7 | User Name: Sherry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/04/22 19:55:59 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Sherry\My Documents\Downloads\OTL (2).exe
PRC - [2013/04/05 10:01:27 | 000,968,880 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
PRC - [2013/03/26 07:13:04 | 000,170,912 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2013/03/13 17:15:00 | 004,394,032 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2013\avgui.exe
PRC - [2013/03/12 01:05:50 | 029,106,336 | —- | M] (Dropbox, Inc.) – C:\Documents and Settings\Sherry\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2013/02/27 23:42:12 | 004,937,264 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2013\avgidsagent.exe
PRC - [2013/02/26 23:41:54 | 000,763,440 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2013\avgrsx.exe
PRC - [2013/02/19 04:02:02 | 000,282,624 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/02/19 04:01:34 | 001,116,720 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2013\avgnsx.exe
PRC - [2013/02/19 04:01:04 | 000,799,792 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2013\avgemcx.exe
PRC - [2013/02/19 04:00:58 | 000,448,560 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG2013\avgcsrvx.exe
PRC - [2013/02/08 13:30:14 | 000,213,384 | —- | M] (Google Inc.) – C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Update\1.3.21.135\GoogleCrashHandler.exe
PRC - [2013/02/06 08:56:56 | 000,213,384 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.3.21.135\GoogleCrashHandler.exe
PRC - [2012/12/14 17:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/12/14 17:49:28 | 000,512,360 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/12/14 17:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/11/29 08:27:10 | 034,219,904 | —- | M] (SlimWare Utilities, Inc.) – C:\Program Files\DriverUpdate\DriverUpdate.exe
PRC - [2011/06/13 22:09:22 | 000,267,568 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Fix it Center\Matsvc.exe
PRC - [2010/10/27 19:17:52 | 000,207,424 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/08/25 11:27:44 | 000,309,824 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
PRC - [2010/03/18 11:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010/02/18 18:27:40 | 000,241,789 | —- | M] (Creative Technology Ltd) – C:\Program Files\Creative\Sound Blaster X-Fi Go Pro\Volume Panel\VolPanlu.exe
PRC - [2010/02/11 20:23:12 | 000,286,720 | —- | M] (Creative Technology Ltd) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/10/18 20:10:42 | 000,479,232 | —- | M] (Nikon Corporation) – C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

========== Modules (No Company Name) ==========

MOD - [2013/04/05 10:01:27 | 000,968,880 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
MOD - [2013/01/02 00:49:10 | 001,292,288 | —- | M] () – C:\WINDOWS\system32\quartz.dll
MOD - [2011/06/24 22:56:36 | 000,087,328 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/07/27 21:33:32 | 000,271,360 | R— | M] () – C:\WINDOWS\system32\KSXPPI32.dll
MOD - [2008/04/13 18:11:59 | 000,014,336 | —- | M] () – C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 18:11:51 | 000,059,904 | —- | M] () – C:\WINDOWS\system32\devenum.dll
MOD - [2006/03/15 06:00:00 | 000,268,288 | —- | M] () – C:\WINDOWS\system32\sbe.dll

========== Services (SafeList) ==========

SRV - [2013/04/06 16:32:02 | 000,079,360 | —- | M] (Creative Labs) [On_Demand | Stopped] – C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe – (Creative Audio Engine Licensing Service)
SRV - [2013/04/05 10:01:27 | 000,968,880 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe – (vToolbarUpdater14.2.0)
SRV - [2013/03/26 07:13:04 | 000,170,912 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2013/03/12 19:07:32 | 000,253,656 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2013/02/27 23:42:12 | 004,937,264 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2013\avgidsagent.exe – (AVGIDSAgent)
SRV - [2013/02/19 04:02:02 | 000,282,624 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG2013\avgwdsvc.exe – (avgwd)
SRV - [2012/12/14 17:49:28 | 000,682,344 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2012/12/14 17:49:28 | 000,398,184 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2011/06/13 22:09:22 | 000,267,568 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Program Files\Microsoft Fix it Center\Matsvc.exe – (MatSvc)
SRV - [2010/03/18 11:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) [Auto | Running] – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon)
SRV - [2010/02/11 20:23:12 | 000,286,720 | —- | M] (Creative Technology Ltd) [Auto | Running] – C:\Program Files\Creative\Shared Files\CTAudSvc.exe – (CTAudSvcService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - [2013/04/22 19:53:23 | 000,013,024 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SWDUMon.sys – (SWDUMon)
DRV - [2013/04/05 10:01:27 | 000,033,112 | —- | M] (AVG Technologies) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtpx86.sys – (avgtp)
DRV - [2013/03/01 10:32:20 | 000,022,328 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgidsshimx.sys – (AVGIDSShim)
DRV - [2013/02/26 23:40:46 | 000,208,184 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgidsdriverx.sys – (AVGIDSDriver)
DRV - [2013/02/14 03:52:46 | 000,182,072 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2013/02/08 04:37:58 | 000,096,568 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2013/02/08 04:37:56 | 000,245,048 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\avglogx.sys – (Avglogx)
DRV - [2013/02/08 04:37:52 | 000,060,216 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\avgidshx.sys – (AVGIDSHX)
DRV - [2013/02/08 04:37:44 | 000,170,808 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2013/02/08 04:37:40 | 000,039,224 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\avgrkx86.sys – (Avgrkx86)
DRV - [2012/12/14 17:49:28 | 000,021,104 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\system32\drivers\mbam.sys – (MBAMProtector)
DRV - [2011/07/07 17:39:06 | 006,367,848 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService)
DRV - [2010/08/05 02:34:34 | 001,210,624 | R— | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ksaud.sys – (ksaud)
DRV - [2010/07/24 00:54:26 | 002,016,640 | R— | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ksaudfl.sys – (ksaudfl)
DRV - [2009/11/18 07:17:00 | 001,395,800 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Monfilt.sys – (Monfilt)
DRV - [2009/11/18 07:16:00 | 001,691,480 | —- | M] (Creative) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Ambfilt.sys – (Ambfilt)
DRV - [2006/06/16 22:09:48 | 001,611,776 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2004/08/03 16:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-ca
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 15 FE 87 F9 2B CE 01 [binary data]
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes\{20EF31C4-DFFC-41EA-AB6A-49419C687117}: "URL" = http://websearch.ask.com/redirect?client=i…4C-ADF8D6471379
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes\{53073CDD-DB95-41D2-8AD5-68EB281FC710}: "URL" = http://search.conduit.com/ResultsExt.aspx?…108085&UM;=2
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Video Downloader\Plugin_FireFox [2011/04/17 16:43:48 | 000,000,000 | —D | M]

[2011/05/12 15:40:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/11/04 21:22:58 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/03/02 21:21:07 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/12/04 21:43:54 | 000,151,552 | —- | M] (PopCap Games) – C:\Program Files\mozilla firefox\plugins\nppopcaploader.dll

========== Chrome ==========

CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={…287822&UM;=2
CHR - default_search_provider: suggest_url = http://suggest.search.conduit.com/Suggest.ashx?q=[{searchTerms}]
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: RocketLife Secure Plug-In Layer (Enabled) = C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Java™ Platform SE 7 U17 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll
CHR - plugin: Java Deployment Toolkit 7.0.170.2 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

O1 HOSTS File: ([2006/03/15 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Creative KSRun Persistence Module] C:\WINDOWS\System32\KSRun.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [CTAPR2] C:\Program Files\Creative\Sound Blaster X-Fi Go Pro\Console Launcher 3\Entertainment Console\CTAPR2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [HF_G_Jul] "C:\Program Files\AVG Secure Search\HF_G_Jul.exe" /DoAction File not found
O4 - HKLM..\Run: [ROC_roc_dec12] "C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 File not found
O4 - HKLM..\Run: [ROC_ROC_JULY_P1] "C:\Program Files\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1 File not found
O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\Sound Blaster X-Fi Go Pro\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" File not found
O4 - HKU\S-1-5-21-1085031214-1682526488-839522115-1003..\Run: [DriverUpdate] C:\Program Files\DriverUpdate\DriverUpdate.exe (SlimWare Utilities, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - Startup: C:\Documents and Settings\Cliff\Start Menu\Programs\Startup\Styler.lnk = C:\Documents and Settings\Cliff\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe ()
O4 - Startup: C:\Documents and Settings\Sherry\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Sherry\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plu…Detection32.cab (Device Detection)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.shockwave.com/content/bejeweled…ploader_v10.cab (PopCapLoader Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareup…015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…30321/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{22C0B27B-0C75-4F33-8875-CAC5AA0C595B}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\intu-qt2009 {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Sherry\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sherry\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/10/26 19:25:31 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/04/22 19:53:58 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2013/04/16 00:22:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Start Menu\Programs\HiJackThis
[2013/04/16 00:22:36 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2013/04/08 18:34:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2013/04/06 17:12:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\DriverUpdate
[2013/04/06 17:12:10 | 000,000,000 | —D | C] – C:\Program Files\DriverUpdate
[2013/04/06 16:41:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Creative
[2013/04/06 16:36:45 | 000,090,112 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\Updreg.EXE
[2013/04/06 16:35:58 | 000,196,608 | R— | C] (Creative Technology Limited) – C:\WINDOWS\System32\KsDvInst.dll
[2013/04/06 16:35:58 | 000,025,600 | R— | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\KSRun.dll
[2013/04/06 16:35:57 | 002,016,640 | R— | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\drivers\ksaudfl.sys
[2013/04/06 16:35:56 | 001,210,624 | R— | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\drivers\ksaud.sys
[2013/04/06 16:32:58 | 000,647,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\Mscomct2.ocx
[2013/04/06 16:32:57 | 000,053,248 | —- | C] (Creative Technology Ltd ) – C:\WINDOWS\Ctregrun.exe
[2013/04/06 16:32:14 | 000,445,016 | —- | C] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2013/04/06 16:32:14 | 000,109,144 | —- | C] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2013/04/06 16:32:02 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Creative Labs Shared
[2013/04/06 16:31:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Creative
[2013/04/06 16:30:03 | 000,000,000 | —D | C] – C:\Program Files\Creative
[2013/04/06 16:27:09 | 000,060,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbaudio.sys
[2013/04/05 08:20:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG
[2013/04/04 08:42:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Application Data\AVG2013
[2013/04/04 08:39:11 | 000,033,112 | —- | C] (AVG Technologies) – C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/04/04 08:39:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search
[2013/04/04 08:37:23 | 000,000,000 | -H-D | C] – C:\$AVG
[2013/04/04 08:27:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Local Settings\Application Data\Avg2013
[2013/04/01 10:28:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Local Settings\Application Data\Help
[2013/04/01 10:28:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Application Data\Help
[2013/03/28 16:26:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Local Settings\Application Data\CRE
[2013/03/28 16:17:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Local Settings\Application Data\SlimWare Utilities Inc
[2013/03/28 16:17:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Downloaded Installers
[2013/03/28 15:42:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Local Settings\Application Data\FixItCenter
[2013/03/28 15:35:43 | 000,000,000 | —D | C] – C:\WINDOWS\MATS
[2013/03/28 15:35:40 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Fix it Center
[2013/03/28 15:33:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Application Data\ElevatedDiagnostics
[2013/03/28 15:31:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Windows PowerShell 1.0
[2013/03/28 15:30:22 | 000,000,000 | —D | C] – C:\WINDOWS\System32\windowspowershell
[2013/03/26 07:14:04 | 000,262,560 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/03/26 07:13:29 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/03/26 07:13:29 | 000,094,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/03/26 07:13:28 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/03/25 08:16:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/04/22 20:01:00 | 000,000,422 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{1E190112-6B6B-4844-9261-1AEE0E9744AB}.job
[2013/04/22 19:53:23 | 000,013,024 | —- | M] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/04/22 19:50:45 | 000,000,616 | -H– | M] () – C:\WINDOWS\tasks\ConfigExec.job
[2013/04/22 19:50:19 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/04/22 19:50:17 | 000,000,280 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1085031214-1682526488-839522115-1003.job
[2013/04/22 19:50:17 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1085031214-1682526488-839522115-1004.job
[2013/04/22 19:49:26 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/04/22 19:43:12 | 000,000,492 | —- | M] () – C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/04/22 19:40:00 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1682526488-839522115-1004UA.job
[2013/04/22 19:35:00 | 000,000,982 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1682526488-839522115-1003UA.job
[2013/04/22 19:08:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/04/22 19:05:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/04/22 17:22:55 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{1C1E1B38-3B03-4225-B51C-915EED3A727E}.job
[2013/04/22 15:38:01 | 000,000,580 | -H– | M] () – C:\WINDOWS\tasks\DataUpload.job
[2013/04/22 15:30:07 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/04/22 12:35:02 | 000,000,930 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1682526488-839522115-1003Core.job
[2013/04/22 11:58:00 | 000,000,820 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2013/04/22 10:40:00 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1682526488-839522115-1004Core.job
[2013/04/20 18:08:00 | 000,000,288 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1085031214-1682526488-839522115-1003.job
[2013/04/19 07:47:00 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1085031214-1682526488-839522115-1004.job
[2013/04/18 09:19:41 | 000,002,449 | —- | M] () – C:\Documents and Settings\Sherry\Desktop\HiJackThis.lnk
[2013/04/18 09:19:23 | 000,065,856 | —- | M] () – C:\Documents and Settings\Sherry\Desktop\Phaedra's girl.jpg
[2013/04/17 11:51:03 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2013/04/17 08:03:43 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/04/16 07:27:58 | 000,187,958 | —- | M] () – C:\Documents and Settings\Sherry\Desktop\Jason.jpg
[2013/04/10 03:25:39 | 000,894,256 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/04/10 03:07:28 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2013/04/09 16:37:40 | 000,002,311 | —- | M] () – C:\Documents and Settings\Sherry\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/04/09 16:37:40 | 000,002,293 | —- | M] () – C:\Documents and Settings\Sherry\Desktop\Google Chrome.lnk
[2013/04/06 16:37:10 | 000,505,196 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/04/06 16:37:10 | 000,088,458 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/04/06 16:36:16 | 000,000,268 | RH– | M] () – C:\WINDOWS\ctfile.rfc
[2013/04/06 16:32:14 | 000,445,016 | —- | M] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2013/04/06 16:32:14 | 000,109,144 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2013/04/06 12:47:46 | 000,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2013/04/05 10:01:27 | 000,033,112 | —- | M] (AVG Technologies) – C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/04/05 08:20:01 | 000,000,702 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2013.lnk
[2013/03/30 14:35:52 | 000,001,029 | —- | M] () – C:\Documents and Settings\Sherry\Start Menu\Programs\Startup\Dropbox.lnk
[2013/03/28 16:26:30 | 000,000,064 | —- | M] () – C:\WINDOWS\GPlrLanc.dat
[2013/03/28 16:23:37 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\TempWmicBatchFile.bat
[2013/03/28 15:35:48 | 000,000,720 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Microsoft Fix it Center.lnk
[2013/03/26 07:13:07 | 000,094,112 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/03/26 07:13:03 | 000,262,560 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/03/26 07:13:03 | 000,174,496 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/03/26 07:13:02 | 000,174,496 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/03/26 07:13:02 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2013/03/26 07:13:01 | 000,861,088 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2013/03/26 07:13:01 | 000,782,240 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2013/03/25 08:16:21 | 000,001,915 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/18 09:19:21 | 000,065,856 | —- | C] () – C:\Documents and Settings\Sherry\Desktop\Phaedra's girl.jpg
[2013/04/16 07:27:55 | 000,187,958 | —- | C] () – C:\Documents and Settings\Sherry\Desktop\Jason.jpg
[2013/04/16 00:22:37 | 000,002,449 | —- | C] () – C:\Documents and Settings\Sherry\Desktop\HiJackThis.lnk
[2013/04/06 16:35:58 | 000,034,637 | R— | C] () – C:\WINDOWS\System32\ksaud.ini
[2013/04/06 16:34:03 | 000,044,795 | R— | C] () – C:\WINDOWS\System32\kschimp.ini
[2013/04/06 16:34:02 | 000,271,360 | R— | C] () – C:\WINDOWS\System32\KSXPPI32.dll
[2013/04/06 16:33:33 | 000,026,768 | R— | C] () – C:\WINDOWS\ksaudENG.reg
[2013/04/06 16:33:33 | 000,015,724 | R— | C] () – C:\WINDOWS\System32\MixerDefaultXP.reg
[2013/04/06 16:33:33 | 000,008,520 | R— | C] () – C:\WINDOWS\System32\DeviceDefaultsXP.reg
[2013/04/06 16:33:33 | 000,002,630 | R— | C] () – C:\WINDOWS\MixerName.reg
[2013/04/06 16:33:33 | 000,000,268 | RH– | C] () – C:\WINDOWS\ctfile.rfc
[2013/04/06 16:33:17 | 000,007,062 | —- | C] () – C:\WINDOWS\System32\audiopid.vxd
[2013/04/04 08:39:28 | 000,000,702 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG 2013.lnk
[2013/03/28 16:23:37 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\TempWmicBatchFile.bat
[2013/03/28 16:17:50 | 000,013,024 | —- | C] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/03/28 15:38:02 | 000,000,580 | -H– | C] () – C:\WINDOWS\tasks\DataUpload.job
[2013/03/28 15:38:01 | 000,000,616 | -H– | C] () – C:\WINDOWS\tasks\ConfigExec.job
[2013/03/28 15:35:48 | 000,000,726 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Fix it Center.lnk
[2013/03/28 15:35:48 | 000,000,720 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Microsoft Fix it Center.lnk
[2013/03/25 08:16:21 | 000,001,915 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2012/09/02 15:54:21 | 000,027,520 | —- | C] () – C:\Documents and Settings\Sherry\Local Settings\Application Data\dt.dat
[2012/02/15 20:35:29 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/04 14:05:47 | 000,000,013 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2011/11/26 14:30:05 | 000,000,064 | —- | C] () – C:\WINDOWS\GPlrLanc.dat
[2011/11/23 14:14:27 | 000,002,216 | —- | C] () – C:\Documents and Settings\Sherry\.recently-used.xbel
[2011/08/31 13:57:47 | 000,000,272 | —- | C] () – C:\Documents and Settings\Sherry\Application Data\.backup.dm
[2011/08/09 22:19:09 | 000,163,118 | —- | C] () – C:\WINDOWS\hpoins28.dat
[2011/08/09 22:19:09 | 000,000,796 | —- | C] () – C:\WINDOWS\hpomdl28.dat
[2011/07/17 20:36:28 | 000,000,129 | —- | C] () – C:\Documents and Settings\Sherry\jagex_runescape_preferences2.dat
[2011/07/17 20:34:48 | 000,000,035 | —- | C] () – C:\Documents and Settings\Sherry\jagex_runescape_preferences.dat
[2011/05/29 17:58:48 | 000,145,412 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/11/04 20:14:37 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Analog Swirl
[2010/11/04 20:14:37 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Sherry\Application Data\Ambience
[2010/11/04 20:14:36 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2010/11/03 16:09:31 | 000,059,904 | —- | C] () – C:\Documents and Settings\Sherry\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2010/10/26 19:19:20 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2008/04/13 18:12:05 | 001,499,136 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 06:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 18:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\sherrystone\WINDOWS\explorer.exe
[2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\sherrystone\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2006/03/15 06:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/02/06 05:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/13 18:12:34 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\sherrystone\WINDOWS\ServicePackFiles\i386\services.exe
[2008/04/13 18:12:34 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\ServicePackFiles\i386\services.exe
[2009/02/06 11:14:03 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE – C:\WINDOWS\$NtServicePackUninstall$\services.exe
[2009/02/06 04:22:21 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD – C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe
[2009/02/06 05:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\sherrystone\WINDOWS\system32\dllcache\services.exe
[2009/02/06 05:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\sherrystone\WINDOWS\system32\services.exe
[2009/02/06 05:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe
[2009/02/06 05:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 05:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\services.exe

< MD5 for: SVCHOST.EXE >
[2012/12/14 17:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2008/04/13 18:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\sherrystone\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 18:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\sherrystone\WINDOWS\system32\svchost.exe
[2008/04/13 18:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 18:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2006/03/15 06:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2006/03/15 06:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\sherrystone\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\sherrystone\WINDOWS\system32\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 18:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2006/03/15 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2012/12/14 17:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\sherrystone\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\sherrystone\WINDOWS\system32\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 18:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: WDC WD2500JS-60NCB1
Partitions: 1
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 233.00GB
Starting Offset: 32256
Hidden sectors: 0

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 -> Junction
[C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e -> Junction
[C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 -> Junction
[C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35] -> C:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5 -> Junction

========== Alternate Data Streams ==========

@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >

OTL Extras logfile created on: 22/04/2013 7:56:30 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Sherry\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

1.44 Gb Total Physical Memory | 0.60 Gb Available Physical Memory | 41.47% Memory free
3.29 Gb Paging File | 2.53 Gb Available in Paging File | 76.98% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 137.23 Gb Free Space | 58.93% Space Free | Partition Type: NTFS

Computer Name: DA658A6C7 | User Name: Sherry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Reg Error: Value error.] – Reg Error: Key error. File not found

[HKEY_USERS\S-1-5-21-1085031214-1682526488-839522115-1003\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"C:\Program Files\iMesh Applications\iMesh\iMesh.exe" = C:\Program Files\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh – (iMesh, Inc)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote – (Microsoft Corporation)
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer
"C:\Program Files\Messenger\msmsgs.exe" = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger – (Microsoft Corporation)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth – (Google)
"C:\Program Files\Internet Explorer\iexplore.exe" = C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer – (Microsoft Corporation)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service – (Apple Inc.)
"C:\Program Files\iMesh Applications\iMesh\iMesh.exe" = C:\Program Files\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh – (iMesh, Inc)
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer
"C:\Documents and Settings\Sherry\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\Sherry\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox – (Dropbox, Inc.)
"C:\WINDOWS\system32\msiexec.exe" = C:\WINDOWS\system32\msiexec.exe:*:Enabled:UpdateManagerSetup – (Microsoft Corporation)
"C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe" = C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe:*:Enabled:SweetPacksUpdateManager
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\AVG\AVG2013\avgmfapx.exe" = C:\Program Files\AVG\AVG2013\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2013\avgnsx.exe" = C:\Program Files\AVG\AVG2013\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2013\avgdiagex.exe" = C:\Program Files\AVG\AVG2013\avgdiagex.exe:*:Enabled:AVG Diagnostics 2013 – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2013\avgemcx.exe" = C:\Program Files\AVG\AVG2013\avgemcx.exe:*:Enabled:Personal Email Scanner – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy
"{1D2AB963-7FF4-4446-BF22-822101AA550F}" = The Print Shop 22
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery
"{268278CF-FB69-4D98-B70E-BFEC1CDCA225}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40963A3A-734C-48A6-9DF6-230A5E8B56ED}" = RoE Power Tools
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{48A5AB54-6327-43DC-A376-4AC74C5D40B0}" = AVG 2013
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{587B7A6F-CA1F-4639-9083-16F9BB2363B4}" = Sound Blaster X-Fi Go! Pro
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7735BD50-87C5-4838-A276-4A3621BBD306}" = AVG 2013
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01
"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FB495A1-4A3F-4C1D-BD27-3F3AB2E66763}" = iMesh
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{355EFB0F-D42B-4E8F-9BC8-42513EC417D9}" =
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = 2007 Microsoft Office Suite Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BC6AB96-3613-4676-ABE8-4B7F55D7D8E7}" = DriverUpdate
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.6)
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B2C61EBB-F47C-48ba-B375-27A40F8F48F7}" = HP Deskjet All-In-One Software 9.0
"{B4F35A00-24FD-4fb3-BF5E-413D5423434D}" = DJ_AIO_Software_min
"{B7588D45-AFDC-4C93-9E2E-A100F3554B64}" = Microsoft Fix it Center
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{BE8A9C2C-8E41-445B-A746-BEB0B1F992F8}" = DJ_AIO_03_F4200_Software_Min
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3B6AEB1-390C-4792-8677-CD87F8B2C959}" = HP Deskjet F4200 All-In-One Driver 11.0 03
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{C8B44566-839A-459C-A73D-49764CE216CC}" = ArcSoft Video Downloader
"{C8E95BF5-C07F-4D98-BB42-F58FC98BC03E}" = Google Apps
"{CA50045C-5119-48e7-9BA7-6B317379857A}" = DJ_AIO_Software
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}" = Styler
"{ECB9C58E-C565-4683-9599-B72290BD3B25}" = QuickTax 2009
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE
"{FA8A44D7-3E8A-4034-9C4F-088FA6B72BC4}" = HP Deskjet All-In-One Software 9.0
"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Alchemy" = Alchemy
"ATI Display Driver" = ATI Display Driver
"AVG" = AVG 2013
"Bubble Town" = Bubble Town
"Chuzzle Deluxe" = Chuzzle Deluxe
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Google Updater" = Google Updater
"Hardwood Euchre v2" = Hardwood Euchre
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Photo Creations" = HP Photo Creations
"HP Photosmart Essential" = HP Photosmart Essential 2.01
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"iMesh" = iMesh
"ImgBurn" = ImgBurn
"IrfanView" = IrfanView (remove only)
"MahJong Suite_is1" = MahJong Suite 2012 v9.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"MSNINST" = MSN
"PopCap Browser Plugin" = PopCap Browser Plugin
"Pretty Good Solitaire_is1" = Pretty Good Solitaire version 12.4.0
"SysInfo" = Creative System Information
"WebPost" = Microsoft Web Publishing Wizard 1.52
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1085031214-1682526488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 22/04/2013 5:43:01 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262148
Description = The MATS service encountered a failure when uploading data. hr=0xC004F018

Error - 22/04/2013 9:39:43 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262152
Description = The MATS service encountered a failure when loading SAP. hr=0x80040154

SAP folder: C:\Program Files\Microsoft Fix it Center\SAPFolder\Scheduled\DDA435FA-6E05-4DBF-80FE-C4EBE882E798.32

Error - 22/04/2013 9:39:44 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262159
Description = The scheduled MATS task encountered a failure when collecting configuration
data. hr=0x80040154 .

Error - 22/04/2013 9:44:22 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262147
Description = The MATS service encountered a web service failure. hr=0xC004F018

Error - 22/04/2013 9:44:22 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262148
Description = The MATS service encountered a failure when uploading data. hr=0xC004F018

Error - 22/04/2013 9:46:30 PM | Computer Name = DA658A6C7 | Source = CltMngSvc | ID = 1000
Description =

Error - 22/04/2013 9:50:44 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262152
Description = The MATS service encountered a failure when loading SAP. hr=0x80040154

SAP folder: C:\Program Files\Microsoft Fix it Center\SAPFolder\Scheduled\DDA435FA-6E05-4DBF-80FE-C4EBE882E798.32

Error - 22/04/2013 9:50:45 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262159
Description = The scheduled MATS task encountered a failure when collecting configuration
data. hr=0x80040154 .

Error - 22/04/2013 9:55:22 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262147
Description = The MATS service encountered a web service failure. hr=0xC004F018

Error - 22/04/2013 9:55:22 PM | Computer Name = DA658A6C7 | Source = MatSvc | ID = 262148
Description = The MATS service encountered a failure when uploading data. hr=0xC004F018

[ OSession Events ]
Error - 18/03/2011 6:19:44 PM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 442
seconds with 180 seconds of active time. This session ended with a crash.

Error - 13/04/2011 3:43:35 PM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 38
seconds with 0 seconds of active time. This session ended with a crash.

Error - 19/04/2011 8:03:30 PM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6555.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 327
seconds with 240 seconds of active time. This session ended with a crash.

Error - 20/04/2011 9:42:34 AM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6555.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 276
seconds with 60 seconds of active time. This session ended with a crash.

Error - 22/04/2011 6:49:00 PM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6555.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 939
seconds with 480 seconds of active time. This session ended with a crash.

Error - 28/12/2011 2:09:58 AM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 56
seconds with 0 seconds of active time. This session ended with a crash.

Error - 06/04/2012 10:33:51 AM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 46
seconds with 0 seconds of active time. This session ended with a crash.

Error - 13/04/2012 1:41:57 PM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 84
seconds with 60 seconds of active time. This session ended with a crash.

Error - 07/05/2012 2:53:34 PM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 58
seconds with 0 seconds of active time. This session ended with a crash.

Error - 25/05/2012 2:52:39 PM | Computer Name = DA658A6C7 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 81
seconds with 60 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 20/04/2013 5:38:23 AM | Computer Name = DA658A6C7 | Source = Service Control Manager | ID = 7000
Description = The Microsoft Automated Troubleshooting Service service failed to
start due to the following error: %%1053

Error - 20/04/2013 9:38:20 AM | Computer Name = DA658A6C7 | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service MatSvc with
arguments "" in order to run the server: {8843B4A2-A3CB-4CB9-9CCE-F443F641009F}

Error - 20/04/2013 9:38:22 AM | Computer Name = DA658A6C7 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Microsoft Automated Troubleshooting
Service service to connect.

Error - 20/04/2013 9:38:23 AM | Computer Name = DA658A6C7 | Source = Service Control Manager | ID = 7000
Description = The Microsoft Automated Troubleshooting Service service failed to
start due to the following error: %%1053

Error - 21/04/2013 6:23:33 AM | Computer Name = DA658A6C7 | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC000009A'
while processing the file 'toolbar_log.txt' on the volume 'HarddiskVolume1'. It
has stopped monitoring the volume.

Error - 21/04/2013 9:39:10 AM | Computer Name = DA658A6C7 | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service MatSvc with
arguments "" in order to run the server: {8843B4A2-A3CB-4CB9-9CCE-F443F641009F}

Error - 21/04/2013 9:39:16 AM | Computer Name = DA658A6C7 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Microsoft Automated Troubleshooting
Service service to connect.

Error - 21/04/2013 9:39:16 AM | Computer Name = DA658A6C7 | Source = Service Control Manager | ID = 7000
Description = The Microsoft Automated Troubleshooting Service service failed to
start due to the following error: %%1053

Error - 21/04/2013 9:56:45 AM | Computer Name = DA658A6C7 | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 22/04/2013 9:42:45 PM | Computer Name = DA658A6C7 | Source = System Error | ID = 1003
Description = Error code 1000008e, parameter1 c0000005, parameter2 bf956ddc, parameter3
b0be67c0, parameter4 00000000.

< End of report >

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-04-22 20:36:42
—————————–
20:36:42.437 OS Version: Windows 5.1.2600 Service Pack 3
20:36:42.437 Number of processors: 1 586 0x409
20:36:42.437 ComputerName: DA658A6C7 UserName: Sherry
20:36:44.828 Initialize success
20:48:46.203 AVAST engine defs: 13042202
20:50:41.500 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-5
20:50:41.515 Disk 0 Vendor: WDC_WD2500JS-60NCB1 10.02E02 Size: 238475MB BusType: 3
20:50:41.828 Disk 0 MBR read successfully
20:50:41.828 Disk 0 MBR scan
20:50:41.906 Disk 0 Windows XP default MBR code
20:50:41.906 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 238464 MB offset 63
20:50:41.921 Disk 0 scanning sectors +488376000
20:50:42.171 Disk 0 scanning C:\WINDOWS\system32\drivers
20:51:09.812 Service scanning
20:51:42.484 Modules scanning
20:51:51.500 Disk 0 trace - called modules:
20:51:51.546 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
20:51:51.546 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89a73ab8]
20:51:52.078 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-5[0x899dcd98]
20:51:53.640 AVAST engine scan C:\WINDOWS
20:52:05.718 AVAST engine scan C:\WINDOWS\system32
20:58:23.937 AVAST engine scan C:\WINDOWS\system32\drivers
20:58:51.796 AVAST engine scan C:\Documents and Settings\Sherry
21:28:22.640 AVAST engine scan C:\Documents and Settings\All Users
21:32:56.843 Scan finished successfully
21:44:13.281 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Sherry\Desktop\MBR.dat"
21:44:13.281 The log file has been saved successfully to "C:\Documents and Settings\Sherry\Desktop\aswMBR.txt"

Satchfan

Post #4April 23, 2013, 1:47 PM UTC

Chrome search provider is defaulted as Conduit. I suggest you change this:

right click the URL bar in Chrome (where web addresses appear at the top)
select Edit Search Engines
place your mouse over Conduit and click the X on the right
next, place your mouse over Google and choose Make Default.

===================================================

Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes\{20EF31C4-DFFC-41EA-AB6A-49419C687117}: "URL" = http://websearch.ask.com/redirect?client=i…4C-ADF8D6471379 IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes\{53073CDD-DB95-41D2-8AD5-68EB281FC710}: "URL" = http://search.conduit.com/ResultsExt.aspx?…108085&UM=2 CHR - default_search_provider: Conduit (Enabled) CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={…287822&UM=2 CHR - default_search_provider: suggest_url = http://suggest.search.conduit.com/Suggest.ashx?q=[{searchTerms}] O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM..\Run: [HF_G_Jul] "C:\Program Files\AVG Secure Search\HF_G_Jul.exe" /DoAction File not found O4 - HKLM..\Run: [ROC_roc_dec12] "C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 File not found O4 - HKLM..\Run: [ROC_ROC_JULY_P1] "C:\Program Files\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1 File not found O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT O4 - HKLM..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" File not found O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found :Files ipconfig /flushdns /c :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log and new OTL log.

Logs to include in the next post:

OTL fix log
New OTL log

Can you tell me how the computer is now and if there are any outstanding problems.

Satchfan

sinnead

Post #5April 24, 2013, 2:28 AM UTC

Okay, three times I tried to do the "run fix" with OTL, and three times the computer froze up completely. The last time I tried leaving it for two hours, just in case. The screen never changed the entire time. Nor could I shut down from either the start button or the button on the front of the processor. I had to use the one on the back of it. What now?

Satchfan

Post #6April 24, 2013, 6:53 AM UTC last edited April 24, 2013, 6:55 AM UTC

If you have changed Conduit from being the default search provider we can exclude it from the instructions. Ignore the previous instruction and do this:

Disable Malwarebytes.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes\{20EF31C4-DFFC-41EA-AB6A-49419C687117}: "URL" = http://websearch.ask.com/redirect?client=i…4C-ADF8D6471379 IE - HKU\S-1-5-21-1085031214-1682526488-839522115-1003\..\SearchScopes\{53073CDD-DB95-41D2-8AD5-68EB281FC710}: "URL" = http://search.conduit.com/ResultsExt.aspx?…108085&UM=2 O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM..\Run: [HF_G_Jul] "C:\Program Files\AVG Secure Search\HF_G_Jul.exe" /DoAction File not found O4 - HKLM..\Run: [ROC_roc_dec12] "C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 File not found O4 - HKLM..\Run: [ROC_ROC_JULY_P1] "C:\Program Files\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1 File not found O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT O4 - HKLM..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" File not found O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found :Files ipconfig /flushdns /c :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log and new OTL log.

If it still doesn’t work, please try it in safe mode:

To Enter Safe mode

go to Start> Shut off your Computer> Restart
as the computer starts to boot-up, tap the F8 key - this will bring up a menu
use the Up and Down arrow keys to scroll up to Safe mode with Networking
then press Enter on your keyboard

Logs to include in the next post:

OTL fix log
New OTL log

Can you tell me how the computer is now and if there are any outstanding problems.

Satchfan

sinnead

Post #7April 25, 2013, 1:01 PM UTC

It froze the computer up again. Had to do a hard shut down.

Satchfan

Post #8April 25, 2013, 2:34 PM UTC

I think AVG may be causing some problems. I’d like you to temporarily uninstall it.

When you have done that, your computer will have no protection, so don’t use the Internet except to follow my instructions.

You can either re-install AVG afterwards or I can give you links to other good, free antiviruses that are less “bloated”.

To uninstall AVG:

click on Start, Settings, Control Panel
double-click Add or Remove Programs
scroll down the list click on AVG and then on Remove.

Run AVG removal tool

There will still be some remnants of AVG on your computer even after the uninstall so please download and run AVG Removal Tool from here.

===================================================

Run OTL

double click on the icon to run it.

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log and new OTL log.

Let me know how that goes.

Also, did you try it in safe mode?

Satchfan

sinnead

Post #9April 27, 2013, 3:35 PM UTC

I didn't have a chance to run it in safe mode prior to deleting avg. However- even after deleting avg it STILL froze up, so started it in safe mode and was finally able to get it to run. But only the one log came up. Or did I screw up? All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry key HKEY_USERS\S-1-5-21-1085031214-1682526488-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{20EF31C4-DFFC-41EA-AB6A-49419C687117}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20EF31C4-DFFC-41EA-AB6A-49419C687117}\ not found. Registry key HKEY_USERS\S-1-5-21-1085031214-1682526488-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{53073CDD-DB95-41D2-8AD5-68EB281FC710}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53073CDD-DB95-41D2-8AD5-68EB281FC710}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} C:\WINDOWS\Downloaded Program Files\gp.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Cliff ->Temp folder emptied: 602354232 bytes ->Temporary Internet Files folder emptied: 30292300 bytes ->Java cache emptied: 2676941 bytes ->FireFox cache emptied: 1026130525 bytes ->Google Chrome cache emptied: 400089908 bytes ->Opera cache emptied: 5546257 bytes ->Flash cache emptied: 118165 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 56502 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33723 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 61913468 bytes User: Sherry ->Temp folder emptied: 665894347 bytes ->Temporary Internet Files folder emptied: 39905947 bytes ->Java cache emptied: 8109132 bytes ->Google Chrome cache emptied: 6141696 bytes ->Apple Safari cache emptied: 171757568 bytes ->Flash cache emptied: 82319 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1240100 bytes %systemroot%\System32 .tmp files removed: 1621697 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 133855828 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 669992433 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes RecycleBin emptied: 3523301536 bytes Total Files Cleaned = 7,011.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 04272013_091509 Files\Folders moved on Reboot… PendingFileRenameOperations files… Registry entries deleted on Reboot…

sinnead

Post #10April 27, 2013, 3:36 PM UTC last edited April 27, 2013, 4:26 PM UTC

Edited to change from "need a new antivirus program" to "downloaded and ran bitdefender antivirus free edition"!

Satchfan

Post #11April 27, 2013, 4:45 PM UTC

only the one log came up. Or did I screw up?

No, you did fine.

downloaded and ran bitdefender antivirus free edition

I asked at the beginning for you not to download or run anything while we are attempting to fix your computer.

Also, BitDefender is not one of the antiviruses that I would recommend.

==================================

I have just had another look at your logs and I don't feel that malware is causing the problem but I noticed that ACDaemon.exe is running at startup.

You only need to have your anti-virus program and firewall running at startup. ACDaemon.exe is known to cause all kinds of problems so I suggest you disable this and others from automatically starting - it won’t affect your programs starting normally, as and when you need them.

Make sure you are logged in as administrator.

Click Start, Run – (alternatively, use Windows key+R), type in msconfig and then press Enter. Click on the “Start up” tab and uncheck everything except your anti virus and firewall. Click OK and reboot. When you come back to the desktop, check the box Do not show this message again and click OK

When you’ve done that, please run OTL again and send the new log.

Thanks

Satchfan

sinnead

Post #12April 28, 2013, 3:23 PM UTC

Okay- how do I tell which are my antivirus and firewall? They aren't listed under the name for those. Sorry, not very tech savvy here.

Satchfan

Post #13April 28, 2013, 10:04 PM UTC

Your antivirus is listed as AVG.

Remove the checkmarks from everything else.

Can you tell me Iif there are any remaining problems.

Satchfan

sinnead

Post #14April 30, 2013, 1:15 PM UTC

Finally got the chance to get everything done. However- after deleting AVG and closing down those items on the start menu everything seems to have cleared up! Here's the log:

OTL logfile created on: 30/04/2013 7:06:47 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Sherry\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

1.44 Gb Total Physical Memory | 0.74 Gb Available Physical Memory | 51.25% Memory free
3.29 Gb Paging File | 2.22 Gb Available in Paging File | 67.54% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 143.61 Gb Free Space | 61.67% Space Free | Partition Type: NTFS

Computer Name: DA658A6C7 | User Name: Sherry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/04/22 19:55:59 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Sherry\My Documents\Downloads\OTL (2).exe
PRC - [2013/04/05 10:01:27 | 000,968,880 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/03/26 07:13:04 | 000,170,912 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2013/03/12 01:05:50 | 029,106,336 | —- | M] (Dropbox, Inc.) – C:\Documents and Settings\Sherry\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2013/02/08 13:30:14 | 000,213,384 | —- | M] (Google Inc.) – C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Update\1.3.21.135\GoogleCrashHandler.exe
PRC - [2013/02/08 10:03:23 | 000,235,728 | —- | M] (Bitdefender) – C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
PRC - [2013/02/08 10:03:23 | 000,027,136 | —- | M] (Bitdefender) – C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
PRC - [2013/02/06 11:35:12 | 000,213,384 | —- | M] (Google Inc.) – C:\Documents and Settings\Cliff\Local Settings\Application Data\Google\Update\1.3.21.135\GoogleCrashHandler.exe
PRC - [2013/02/06 08:56:56 | 000,213,384 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.3.21.135\GoogleCrashHandler.exe
PRC - [2012/11/29 08:27:10 | 034,219,904 | —- | M] (SlimWare Utilities, Inc.) – C:\Program Files\DriverUpdate\DriverUpdate.exe
PRC - [2010/10/27 19:17:52 | 000,207,424 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/08/25 11:27:44 | 000,309,824 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
PRC - [2010/03/18 11:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010/02/18 18:27:40 | 000,241,789 | —- | M] (Creative Technology Ltd) – C:\Program Files\Creative\Sound Blaster X-Fi Go Pro\Volume Panel\VolPanlu.exe
PRC - [2010/02/11 20:23:12 | 000,286,720 | —- | M] (Creative Technology Ltd) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe
PRC - [2008/04/13 18:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/10/18 20:10:42 | 000,479,232 | —- | M] (Nikon Corporation) – C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

========== Modules (No Company Name) ==========

MOD - [2013/04/05 10:01:27 | 000,968,880 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
MOD - [2013/01/02 00:49:10 | 001,292,288 | —- | M] () – C:\WINDOWS\system32\quartz.dll
MOD - [2012/09/07 17:09:26 | 000,394,408 | —- | M] () – \\?\C:\Program Files\Bitdefender\Antivirus Free Edition\ThreatScanner\trufos.dll
MOD - [2012/07/17 07:45:13 | 000,508,136 | —- | M] () – C:\Program Files\Bitdefender\Antivirus Free Edition\sqlite3.dll
MOD - [2012/04/27 15:08:08 | 000,093,040 | —- | M] () – C:\Program Files\Bitdefender\Antivirus Free Edition\bdmetrics.dll
MOD - [2012/02/16 04:59:28 | 001,781,760 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4e7e9b07db31551c887d5c80552e3885\System.Xaml.ni.dll
MOD - [2012/02/16 04:13:10 | 013,137,920 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\ae33325d95b86d18adfe3b2b76deb55e\System.Windows.Forms.ni.dll
MOD - [2012/02/16 04:12:28 | 001,652,736 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\2f6d092e53fd5fe14e5a2e6ba7055cef\System.Drawing.ni.dll
MOD - [2012/02/16 04:11:52 | 000,450,560 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\72202ed003d4162846b9120ff75c1dae\PresentationFramework.Aero.ni.dll
MOD - [2012/02/16 04:11:28 | 017,671,168 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\8a2a9287a39972a655346abcb1453fc9\PresentationFramework.ni.dll
MOD - [2012/02/16 04:10:11 | 011,106,816 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\980130114bd7169de0d4f68bbc6d8559\PresentationCore.ni.dll
MOD - [2012/02/16 04:09:39 | 003,798,016 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\d99143e827c2bc46871c85a04a0a3313\WindowsBase.ni.dll
MOD - [2012/02/16 04:09:24 | 005,618,176 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\fd4bcc08668bb561ba59e57a30de6bcf\System.Xml.ni.dll
MOD - [2012/02/16 04:09:09 | 000,284,160 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\45fcd44e26075d44224fbc9a3ce4038c\PresentationFramework.Classic.ni.dll
MOD - [2012/02/16 04:09:05 | 009,090,560 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2f52fc9cf3baf5181d1897788d9678f4\System.ni.dll
MOD - [2011/10/14 03:08:10 | 014,408,704 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\f3b6f64941ee3b90d6abb16e415ceb3b\mscorlib.ni.dll
MOD - [2011/06/24 22:56:36 | 000,087,328 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/07/27 21:33:32 | 000,271,360 | R— | M] () – C:\WINDOWS\system32\KSXPPI32.dll
MOD - [2008/04/13 18:11:59 | 000,014,336 | —- | M] () – C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 18:11:51 | 000,059,904 | —- | M] () – C:\WINDOWS\system32\devenum.dll
MOD - [2006/03/15 06:00:00 | 000,268,288 | —- | M] () – C:\WINDOWS\system32\sbe.dll

========== Services (SafeList) ==========

SRV - [2013/04/06 16:32:02 | 000,079,360 | —- | M] (Creative Labs) [On_Demand | Stopped] – C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe – (Creative Audio Engine Licensing Service)
SRV - [2013/04/05 10:01:27 | 000,968,880 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe – (vToolbarUpdater14.2.0)
SRV - [2013/04/04 14:50:32 | 000,701,512 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2013/03/26 07:13:04 | 000,170,912 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2013/03/12 19:07:32 | 000,253,656 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2013/02/08 10:03:23 | 000,027,136 | —- | M] (Bitdefender) [Auto | Running] – C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe – (gzserv)
SRV - [2011/06/13 22:09:22 | 000,267,568 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Microsoft Fix it Center\Matsvc.exe – (MatSvc)
SRV - [2010/03/18 11:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) [Auto | Running] – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon)
SRV - [2010/02/11 20:23:12 | 000,286,720 | —- | M] (Creative Technology Ltd) [Auto | Running] – C:\Program Files\Creative\Shared Files\CTAudSvc.exe – (CTAudSvcService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - [2013/04/27 09:35:23 | 000,013,024 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SWDUMon.sys – (SWDUMon)
DRV - [2013/04/05 10:01:27 | 000,033,112 | —- | M] (AVG Technologies) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtpx86.sys – (avgtp)
DRV - [2013/04/04 14:50:32 | 000,022,856 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\system32\drivers\mbam.sys – (MBAMProtector)
DRV - [2012/10/31 12:13:10 | 000,343,456 | —- | M] (BitDefender S.R.L.) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\trufos.sys – (trufos)
DRV - [2012/10/10 14:00:04 | 000,622,616 | —- | M] (BitDefender) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\avc3.sys – (avc3)
DRV - [2012/10/04 13:30:05 | 000,162,976 | —- | M] (BitDefender LLC) [File_System | System | Running] – C:\WINDOWS\system32\drivers\gzflt.sys – (gzflt)
DRV - [2012/10/02 11:31:18 | 000,134,136 | —- | M] (BitDefender LLC) [Kernel | System | Running] – C:\Program Files\Bitdefender\Antivirus Free Edition\bdselfpr.sys – (bdselfpr)
DRV - [2012/02/17 15:45:12 | 000,447,208 | —- | M] (BitDefender) [File_System | On_Demand | Running] – C:\WINDOWS\system32\drivers\avckf.sys – (avckf)
DRV - [2012/02/07 17:41:38 | 000,131,432 | —- | M] (BitDefender LLC) [Kernel | System | Running] – C:\Program Files\Bitdefender\Antivirus Free Edition\bdftdif.sys – (bdftdif)
DRV - [2011/07/07 17:39:06 | 006,367,848 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService)
DRV - [2010/08/05 02:34:34 | 001,210,624 | R— | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ksaud.sys – (ksaud)
DRV - [2010/07/24 00:54:26 | 002,016,640 | R— | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ksaudfl.sys – (ksaudfl)
DRV - [2009/11/18 07:17:00 | 001,395,800 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Monfilt.sys – (Monfilt)
DRV - [2009/11/18 07:16:00 | 001,691,480 | —- | M] (Creative) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Ambfilt.sys – (Ambfilt)
DRV - [2006/06/16 22:09:48 | 001,611,776 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2004/08/03 16:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-ca
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 15 FE 87 F9 2B CE 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Video Downloader\Plugin_FireFox [2011/04/17 16:43:48 | 000,000,000 | —D | M]

[2011/05/12 15:40:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/11/04 21:22:58 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/03/02 21:21:07 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/12/04 21:43:54 | 000,151,552 | —- | M] (PopCap Games) – C:\Program Files\mozilla firefox\plugins\nppopcaploader.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{
google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: RocketLife Secure Plug-In Layer (Enabled) = C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Java™ Platform SE 7 U17 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll
CHR - plugin: Java Deployment Toolkit 7.0.170.2 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Google Drive = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: DoNotTrackMe = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\epanfjkfahimkgomnigadpkobaefekcd\2.2.8.109_0\
CHR - Extension: Google Drive = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: DoNotTrackMe = C:\Documents and Settings\Sherry\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\epanfjkfahimkgomnigadpkobaefekcd\2.2.8.109_0\

O1 HOSTS File: ([2006/03/15 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} http://www.logitech.com/devicedetector/plu…Detection32.cab (Device Detection)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.shockwave.com/content/bejeweled…ploader_v10.cab (PopCapLoader Object)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareup…015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…30321/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{22C0B27B-0C75-4F33-8875-CAC5AA0C595B}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\intu-qt2009 {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Sherry\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sherry\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/10/26 19:25:31 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/04/27 10:35:30 | 000,241,992 | —- | C] (BitDefender) – C:\WINDOWS\System32\drivers\avchv.sys
[2013/04/27 10:34:46 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\QuickScan
[2013/04/27 10:28:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus Free Edition
[2013/04/27 10:28:14 | 000,622,616 | —- | C] (BitDefender) – C:\WINDOWS\System32\drivers\avc3.sys
[2013/04/27 10:28:14 | 000,447,208 | —- | C] (BitDefender) – C:\WINDOWS\System32\drivers\avckf.sys
[2013/04/27 10:25:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Application Data\QuickScan
[2013/04/27 10:25:07 | 000,000,000 | —D | C] – C:\Program Files\Bitdefender
[2013/04/27 10:25:04 | 000,343,456 | —- | C] (BitDefender S.R.L.) – C:\WINDOWS\System32\drivers\trufos.sys
[2013/04/27 10:25:01 | 000,162,976 | —- | C] (BitDefender LLC) – C:\WINDOWS\System32\drivers\gzflt.sys
[2013/04/27 09:35:43 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2013/04/27 09:11:47 | 000,000,000 | —D | C] – C:\WINDOWS\CSC
[2013/04/23 18:53:10 | 000,000,000 | —D | C] – C:\_OTL
[2013/04/16 00:22:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Start Menu\Programs\HiJackThis
[2013/04/16 00:22:36 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2013/04/08 18:34:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2013/04/06 17:12:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\DriverUpdate
[2013/04/06 17:12:10 | 000,000,000 | —D | C] – C:\Program Files\DriverUpdate
[2013/04/06 16:41:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Creative
[2013/04/06 16:36:45 | 000,090,112 | —- | C] (Creative Technology Ltd.) – C:\WINDOWS\Updreg.EXE
[2013/04/06 16:35:58 | 000,196,608 | R— | C] (Creative Technology Limited) – C:\WINDOWS\System32\KsDvInst.dll
[2013/04/06 16:35:58 | 000,025,600 | R— | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\KSRun.dll
[2013/04/06 16:35:57 | 002,016,640 | R— | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\drivers\ksaudfl.sys
[2013/04/06 16:35:56 | 001,210,624 | R— | C] (Creative Technology Ltd.) – C:\WINDOWS\System32\drivers\ksaud.sys
[2013/04/06 16:32:58 | 000,647,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\Mscomct2.ocx
[2013/04/06 16:32:57 | 000,053,248 | —- | C] (Creative Technology Ltd ) – C:\WINDOWS\Ctregrun.exe
[2013/04/06 16:32:14 | 000,445,016 | —- | C] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2013/04/06 16:32:14 | 000,109,144 | —- | C] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2013/04/06 16:32:02 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Creative Labs Shared
[2013/04/06 16:31:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Creative
[2013/04/06 16:30:03 | 000,000,000 | —D | C] – C:\Program Files\Creative
[2013/04/06 16:27:09 | 000,060,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbaudio.sys
[2013/04/04 08:39:11 | 000,033,112 | —- | C] (AVG Technologies) – C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/04/04 08:39:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search
[2013/04/01 10:28:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Local Settings\Application Data\Help
[2013/04/01 10:28:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Sherry\Application Data\Help

========== Files - Modified Within 30 Days ==========

[2013/04/30 07:08:07 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/04/30 07:05:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/04/30 07:03:26 | 000,000,422 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{1E190112-6B6B-4844-9261-1AEE0E9744AB}.job
[2013/04/30 07:03:17 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2013/04/30 06:43:00 | 000,000,492 | —- | M] () – C:\WINDOWS\tasks\HP Photo Creations Communicator.job
[2013/04/30 06:40:01 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1682526488-839522115-1004UA.job
[2013/04/30 06:35:00 | 000,000,982 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1682526488-839522115-1003UA.job
[2013/04/30 03:38:00 | 000,000,580 | -H– | M] () – C:\WINDOWS\tasks\DataUpload.job
[2013/04/29 22:09:11 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{1C1E1B38-3B03-4225-B51C-915EED3A727E}.job
[2013/04/29 15:30:04 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/04/29 12:35:01 | 000,000,930 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1682526488-839522115-1003Core.job
[2013/04/29 11:58:13 | 000,000,820 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2013/04/29 10:40:01 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1682526488-839522115-1004Core.job
[2013/04/29 08:07:02 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/04/29 07:40:25 | 000,000,209 | -HS- | M] () – C:\boot.ini
[2013/04/29 07:38:43 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/27 18:08:01 | 000,000,288 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1085031214-1682526488-839522115-1003.job
[2013/04/27 10:35:30 | 000,241,992 | —- | M] (BitDefender) – C:\WINDOWS\System32\drivers\avchv.sys
[2013/04/27 10:30:26 | 000,192,171 | —- | M] () – C:\Documents and Settings\All Users\Application Data\1367079887.bdinstall.bin
[2013/04/27 09:35:23 | 000,013,024 | —- | M] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/04/27 09:33:24 | 000,000,616 | -H– | M] () – C:\WINDOWS\tasks\ConfigExec.job
[2013/04/27 09:33:04 | 000,000,280 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1085031214-1682526488-839522115-1003.job
[2013/04/27 09:33:04 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1085031214-1682526488-839522115-1004.job
[2013/04/27 09:32:55 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/04/27 08:35:13 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/04/26 18:30:03 | 000,136,303 | —- | M] () – C:\Documents and Settings\Sherry\Desktop\Clipboard01.jpg
[2013/04/26 07:47:00 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1085031214-1682526488-839522115-1004.job
[2013/04/10 03:25:39 | 000,894,256 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/04/10 03:07:28 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2013/04/09 16:37:40 | 000,002,311 | —- | M] () – C:\Documents and Settings\Sherry\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/04/09 16:37:40 | 000,002,293 | —- | M] () – C:\Documents and Settings\Sherry\Desktop\Google Chrome.lnk
[2013/04/06 16:37:10 | 000,505,196 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/04/06 16:37:10 | 000,088,458 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/04/06 16:36:16 | 000,000,268 | RH– | M] () – C:\WINDOWS\ctfile.rfc
[2013/04/06 16:32:14 | 000,445,016 | —- | M] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2013/04/06 16:32:14 | 000,109,144 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2013/04/06 12:47:46 | 000,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2013/04/05 10:01:27 | 000,033,112 | —- | M] (AVG Technologies) – C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/04/04 14:50:32 | 000,022,856 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2013/04/27 10:30:26 | 000,192,171 | —- | C] () – C:\Documents and Settings\All Users\Application Data\1367079887.bdinstall.bin
[2013/04/26 18:30:03 | 000,136,303 | —- | C] () – C:\Documents and Settings\Sherry\Desktop\Clipboard01.jpg
[2013/04/06 16:35:58 | 000,034,637 | R— | C] () – C:\WINDOWS\System32\ksaud.ini
[2013/04/06 16:34:03 | 000,044,795 | R— | C] () – C:\WINDOWS\System32\kschimp.ini
[2013/04/06 16:34:02 | 000,271,360 | R— | C] () – C:\WINDOWS\System32\KSXPPI32.dll
[2013/04/06 16:33:33 | 000,026,768 | R— | C] () – C:\WINDOWS\ksaudENG.reg
[2013/04/06 16:33:33 | 000,015,724 | R— | C] () – C:\WINDOWS\System32\MixerDefaultXP.reg
[2013/04/06 16:33:33 | 000,008,520 | R— | C] () – C:\WINDOWS\System32\DeviceDefaultsXP.reg
[2013/04/06 16:33:33 | 000,002,630 | R— | C] () – C:\WINDOWS\MixerName.reg
[2013/04/06 16:33:33 | 000,000,268 | RH– | C] () – C:\WINDOWS\ctfile.rfc
[2013/04/06 16:33:17 | 000,007,062 | —- | C] () – C:\WINDOWS\System32\audiopid.vxd
[2013/03/28 16:17:50 | 000,013,024 | —- | C] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2012/09/02 15:54:21 | 000,027,520 | —- | C] () – C:\Documents and Settings\Sherry\Local Settings\Application Data\dt.dat
[2012/02/15 20:35:29 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/04 14:05:47 | 000,000,013 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2011/11/26 14:30:05 | 000,000,064 | —- | C] () – C:\WINDOWS\GPlrLanc.dat
[2011/11/23 14:14:27 | 000,002,216 | —- | C] () – C:\Documents and Settings\Sherry\.recently-used.xbel
[2011/08/31 13:57:47 | 000,000,272 | —- | C] () – C:\Documents and Settings\Sherry\Application Data\.backup.dm
[2011/08/09 22:19:09 | 000,163,118 | —- | C] () – C:\WINDOWS\hpoins28.dat
[2011/08/09 22:19:09 | 000,000,796 | —- | C] () – C:\WINDOWS\hpomdl28.dat
[2011/07/17 20:36:28 | 000,000,129 | —- | C] () – C:\Documents and Settings\Sherry\jagex_runescape_preferences2.dat
[2011/07/17 20:34:48 | 000,000,035 | —- | C] () – C:\Documents and Settings\Sherry\jagex_runescape_preferences.dat
[2011/05/29 17:58:48 | 000,145,412 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/11/04 20:14:37 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Analog Swirl
[2010/11/04 20:14:37 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Sherry\Application Data\Ambience
[2010/11/04 20:14:36 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2010/11/03 16:09:31 | 000,059,904 | —- | C] () – C:\Documents and Settings\Sherry\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2010/10/26 19:19:20 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2008/04/13 18:12:05 | 001,499,136 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 06:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 18:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >

Satchfan

Post #15April 30, 2013, 2:32 PM UTC

All looking and sounding good.

Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.) O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.shockwave.com/content/bejeweled…ploader_v10.cab (PopCapLoader Object) [2013/04/04 08:39:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVG Secure Search [2013/04/05 10:01:27 | 000,033,112 | —- | M] (AVG Technologies) – C:\WINDOWS\System32\drivers\avgtpx86.sys @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4 :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log

================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

start Malwarebytes-Anti-Malware and update it, (“Update” tab}
once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
when the scan is complete, click OK, then Show Results to view the results.
be sure that everything is checked, and click Remove Selected.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

save it to your Desktop.
double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
a Notepad document should open automatically called checkup.txt; please post the contents of that document.

Logs to include in the next post:

OTL fix log
Mbam.txt
checkup.txt

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Infected? [Solved]

✨ Ask AI

Ask AI