What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

VirTool:Win32/Obfuscator.XZ, HackTool:Win32/Keygen, Spyware.Zbot [Sol

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I already had OTL.exe on my desktop from the other day, but just to follow your instructions I deleted it and downloaded it from the link in your last post. I also renamed the files from the other day to OTL_first_one.txt and Extras_first_one.txt. I selected the boxes as instructed, ran the scan but only got an OTL.txt file which was located on my desktop, there is no OTL folder. I searched my C: drive and there is no Extras.txt file. I did not disable my real-time protection. I do not know if that has anything to do with why there is no Extras.txt file.


OTL.txt

OTL logfile created on: 4/29/2013 1:38:53 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Cry Havoc\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

11.78 Gb Total Physical Memory | 9.86 Gb Available Physical Memory | 83.70% Memory free
17.78 Gb Paging File | 15.63 Gb Available in Paging File | 87.93% Paging File free
Paging file location(s): C:\pagefile.sys 6142 6142E:\pagef [Binary data over 200 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 913.88 Gb Total Space | 561.43 Gb Free Space | 61.43% Space Free | Partition Type: NTFS
Drive D: | 17.35 Gb Total Space | 1.28 Gb Free Space | 7.40% Space Free | Partition Type: NTFS
Drive E: | 100.00 Mb Total Space | 31.83 Mb Free Space | 31.83% Space Free | Partition Type: NTFS
Drive F: | 454.76 Gb Total Space | 239.57 Gb Free Space | 52.68% Space Free | Partition Type: NTFS
Drive G: | 10.90 Gb Total Space | 0.83 Gb Free Space | 7.61% Space Free | Partition Type: NTFS

Computer Name: CRYHAVOC | User Name: Cry Havoc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Cry Havoc\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\EVGA Precision X\EVGAPrecision.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)
PRC - C:\Windows\SysWOW64\WinMsgBalloonClient.exe (AMD)
PRC - C:\Windows\SysWOW64\WinMsgBalloonServer.exe (AMD)
PRC - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)
PRC - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe (AMD)
PRC - C:\Program Files (x86)\Ipswitch\WS_FTP 12\WsftpCOMHelper.exe (Ipswitch)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe ()
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\EVGA Precision X\EVGAPrecision.exe ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTHAL.dll ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTCore.dll ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTUI.dll ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTMUI.dll ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTFC.dll ()
MOD - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\wincfi39.dll ()
MOD - C:\Program Files (x86)\Ipswitch\WS_FTP 12\res0409.dll ()
MOD - C:\Program Files (x86)\Ipswitch\WS_FTP 12\libeay32.dll ()
MOD - C:\Program Files (x86)\Ipswitch\WS_FTP 12\ssleay32.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe ()


========== Services (SafeList) ==========

SRV:64bit: - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SRV:64bit: - (STacSV) – C:\Program Files\IDT\WDM\stacsv64.exe (IDT, Inc.)
SRV:64bit: - (HPClientSvc) – C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (CISVC) – C:\Windows\SysNative\CISVC.EXE (Microsoft Corporation)
SRV:64bit: - (AESTFilters) – C:\Program Files\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (VideoAcceleratorService) – C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAcceleratorService.exe (SpeedBit Ltd.)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (RealNetworks Downloader Resolver Service) – C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe (Symantec Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (CalendarSynchService) – C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe (Hewlett-Packard)
SRV - (pdfcDispatcher) – C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)
SRV - (AMD_RAIDXpert) – C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)
SRV - (CLKMSVC10_38F51D56) – C:\Program Files (x86)\Cyberlink\PowerDVD10\NavFilter\kmsvc.exe (CyberLink)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (NOBU) – C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\drivers\NISx64\1403010.016\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\NISx64\1403010.016\SymEFA64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\NISx64\1403010.016\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\NISx64\1403010.016\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\NISx64\1403010.016\SymDS64.sys (Symantec Corporation)
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (netr28x) – C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\NISx64\1403010.016\Ironx64.sys (Symantec Corporation)
DRV:64bit: - (ccSet_NIS) – C:\Windows\SysNative\drivers\NISx64\1403010.016\ccSetx64.sys (Symantec Corporation)
DRV:64bit: - (sptd) – C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (CpqDfw) – C:\Windows\SysNative\drivers\cpqdfw.sys (Windows ® Codename Longhorn DDK provider)
DRV:64bit: - (STHDA) – C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (tixhci) – C:\Windows\SysNative\drivers\tixhci.sys (Texas Instruments Incorporated)
DRV:64bit: - (tihub3) – C:\Windows\SysNative\drivers\tihub3.sys (Texas Instruments Incorporated)
DRV:64bit: - (usbfilter) – C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (ahcix64s) – C:\Windows\SysNative\drivers\ahcix64s.sys (Advanced Micro Devices, Inc)
DRV:64bit: - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20130428.008\ex64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20130428.008\eng64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20130426.001\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20130412.001\BHDrvx64.sys (Symantec Corporation)
DRV - (RTCore64) – C:\Program Files (x86)\EVGA Precision X\RTCore64.sys ()
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{84A71B6F-DEBF-4205-A9A6-A70A831D2948}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPDTDF
IE:64bit: - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.onthestart.com/auto2.asp?pageid=6078
IE - HKCU\..\SearchScopes,DefaultScope = {84A71B6F-DEBF-4205-A9A6-A70A831D2948}
IE - HKCU\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Dogpile"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.onthestart.com/auto2.asp?pageid=6078"
FF - prefs.js..extensions.enabledAddons: %7B902D2C4A-457A-4EF9-AD43-7014562929FF%7D:0.4.6
FF - prefs.js..extensions.enabledAddons: %7B197573FA-9BF9-11DF-9D68-A441DFD72085%7D:1.2.0
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:[removed]%20-%204
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:[removed]
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.1.18: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.1.18: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/04/14 18:08:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{DAC3F861-B30D-40dd-9166-F4E75327FAC7}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/03/18 12:04:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/03/18 12:04:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013/03/23 13:10:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFFPlgn\ [2013/04/15 22:48:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn\ [2013/04/29 13:32:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/14 18:32:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/04/14 18:08:42 | 000,000,000 | —D | M]

[2012/03/09 17:30:37 | 000,000,000 | —D | M] (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Extensions
[2013/04/29 12:25:48 | 000,000,000 | —D | M] (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions
[2013/02/23 11:52:44 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/11/22 10:32:55 | 000,183,536 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\[removed]
[2012/11/22 10:33:15 | 000,085,537 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\[removed]
[2013/04/29 12:25:48 | 000,346,768 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\[removed]
[2012/11/22 10:31:52 | 000,021,681 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{197573FA-9BF9-11DF-9D68-A441DFD72085}.xpi
[2012/11/22 10:31:00 | 000,008,640 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{902D2C4A-457A-4EF9-AD43-7014562929FF}.xpi
[2013/02/13 23:08:07 | 000,817,280 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/11/20 23:32:40 | 000,002,066 | —- | M] () – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\searchplugins\dogpile.xml
[2013/04/27 09:25:14 | 000,001,635 | —- | M] () – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\searchplugins\ixquick-https.xml
[2012/11/20 23:38:43 | 000,002,152 | —- | M] () – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\searchplugins\startpage.xml
[2013/04/14 18:32:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/03/23 13:10:23 | 000,000,000 | —D | M] (No name found) – C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2013/04/15 22:48:59 | 000,000,000 | —D | M] (Norton Vulnerability Protection) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFFPLGN
[2013/04/10 02:58:33 | 000,263,064 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013/03/18 12:02:55 | 000,124,504 | —- | M] (RealPlayer) – C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll
[2013/04/10 02:57:54 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013/04/10 02:57:54 | 000,002,086 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/04/29 11:22:44 | 000,446,490 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15358 more lines…
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [BeatsOSDApp] C:\Program Files\IDT\WDM\beats64.exe (Hewlett-Packard )
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 157
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionAction = http://hp.digitalriver.com/DRHM/store?Acti…amp;keywords=%w
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionName = Find Software on HP Download Store (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A906977C-CC5A-4A07-B0DD-CE4CE9B5084D}: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BF6CC7F2-6D0F-4034-B242-0EB922660AEC}: DhcpNameServer = 192.168.1.1 192.168.33.1
O18:64bit: - Protocol\Handler\belarc - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…com [@ = ComFile] – Reg Error: Key error. File not found
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/04/29 13:22:28 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Cry Havoc\Desktop\OTL.exe
[2013/04/29 10:13:45 | 000,000,000 | —D | C] – C:\$RECYCLE.BIN
[2013/04/28 12:52:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2013/04/28 11:41:13 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/04/28 11:40:53 | 000,000,000 | —D | C] – C:\JRT
[2013/04/28 11:24:25 | 000,536,737 | —- | C] (Oleg N. Scherbakov) – C:\Users\Cry Havoc\Desktop\JRT.exe
[2013/04/26 12:19:22 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/04/26 12:19:22 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/04/26 12:19:22 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2013/04/26 12:19:13 | 000,000,000 | —D | C] – C:\Qoobox
[2013/04/26 12:18:59 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/04/26 12:08:24 | 005,060,730 | R— | C] (Swearware) – C:\Users\Cry Havoc\Desktop\ComboFix.exe
[2013/04/25 18:17:32 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\Desktop\Jeff's Stuff
[2013/04/24 09:27:49 | 000,311,200 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\javaws.exe
[2013/04/24 09:27:43 | 000,188,832 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\javaw.exe
[2013/04/24 09:27:43 | 000,188,320 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\java.exe
[2013/04/24 09:27:43 | 000,108,448 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013/04/24 09:26:57 | 000,000,000 | —D | C] – C:\Program Files\Java
[2013/04/24 09:24:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/04/24 09:24:15 | 000,263,584 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/04/24 09:24:03 | 000,174,496 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/04/24 09:24:03 | 000,174,496 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/04/24 09:24:03 | 000,095,648 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/04/24 09:23:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2013/04/21 17:10:26 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\Nero_AG
[2013/04/21 16:32:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FUJIFILM
[2013/04/21 16:32:06 | 000,000,000 | —D | C] – C:\ProgramData\FUJIFILM
[2013/04/21 16:31:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\FUJIFILM
[2013/04/21 14:21:47 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Uniblue
[2013/04/21 13:19:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinePixViewer S
[2013/04/21 10:54:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\InstallShield
[2013/04/21 07:42:55 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\InstallShield
[2013/04/19 10:48:48 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2013/04/19 10:48:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2013/04/16 09:33:39 | 000,000,000 | —D | C] – C:\ProgramData\Stardock
[2013/04/16 09:33:39 | 000,000,000 | —D | C] – C:\ProgramData\Ironclad Games
[2013/04/15 23:44:43 | 000,487,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msvcp70.dll
[2013/04/15 23:44:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\AML Products
[2013/04/15 23:31:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Symantec Shared
[2013/04/15 22:47:08 | 000,177,312 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2013/04/15 22:46:06 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
[2013/04/15 22:46:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Norton Internet Security
[2013/04/15 22:39:48 | 000,000,000 | —D | C] – C:\ProgramData\PCSettings
[2013/04/14 19:58:51 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\Zeromus Browser
[2013/04/14 19:58:42 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zeromus Browser
[2013/04/14 19:58:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\Zeromus Browser
[2013/04/14 19:30:54 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/04/14 19:30:53 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/04/14 19:30:53 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013/04/14 19:30:53 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013/04/14 19:30:52 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013/04/14 19:30:52 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013/04/14 19:30:52 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013/04/14 19:30:51 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/04/14 19:30:51 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013/04/14 19:30:51 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013/04/14 19:30:51 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/04/14 19:30:51 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/04/14 19:30:49 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/04/14 19:30:49 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/04/14 19:30:48 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/04/14 19:29:12 | 003,717,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2013/04/14 19:29:12 | 003,217,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2013/04/14 19:29:12 | 000,158,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\aaclient.dll
[2013/04/14 19:29:12 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\aaclient.dll
[2013/04/14 19:29:12 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsgqec.dll
[2013/04/14 19:29:05 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tsgqec.dll
[2013/04/14 19:27:20 | 005,550,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2013/04/14 19:27:19 | 003,968,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2013/04/14 19:27:19 | 003,913,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2013/04/14 19:27:19 | 000,112,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\smss.exe
[2013/04/14 19:27:19 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\csrsrv.dll
[2013/04/14 19:27:18 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\apisetschema.dll
[2013/04/14 18:53:45 | 026,956,576 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2013/04/14 18:53:45 | 020,542,752 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2013/04/14 18:53:45 | 013,088,000 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2013/04/14 18:53:45 | 007,573,816 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvopencl.dll
[2013/04/14 18:53:45 | 006,271,872 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvopencl.dll
[2013/04/14 18:53:45 | 001,807,136 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco6431422.dll
[2013/04/14 18:53:45 | 001,510,176 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispgenco6431422.dll
[2013/04/14 18:53:45 | 000,968,408 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvumdshim.dll
[2013/04/14 18:53:45 | 000,250,504 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvinitx.dll
[2013/04/14 18:53:45 | 000,205,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvinit.dll
[2013/04/14 18:53:43 | 025,256,736 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2013/04/14 18:53:43 | 017,560,352 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2013/04/14 18:53:43 | 009,414,456 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2013/04/14 18:53:43 | 007,959,000 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2013/04/14 18:53:43 | 002,913,056 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2013/04/14 18:53:43 | 002,728,736 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2013/04/14 18:53:43 | 002,539,128 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2013/04/14 18:53:43 | 002,355,488 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2013/04/14 18:53:43 | 001,995,552 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2013/04/11 17:48:56 | 000,000,000 | —D | C] – C:\ProgramData\NVIDIA Corporation
[2013/04/11 16:31:56 | 000,000,000 | -HSD | C] – C:\ProgramData\SecuROM
[2013/04/05 14:24:16 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Bioshock
[2013/04/05 14:24:12 | 000,000,000 | RH-D | C] – C:\Users\Cry Havoc\AppData\Roaming\SecuROM
[2013/04/02 18:45:19 | 000,000,000 | —D | C] – C:\ProgramData\RELOADED
[2013/04/02 18:14:38 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Bioshock2
[2013/04/01 20:34:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cyberlink PowerDVD
[2013/04/01 08:24:14 | 000,000,000 | R–D | C] – C:\Users\Cry Havoc\Desktop\stamp stuff
[2013/03/31 19:39:59 | 000,000,000 | —D | C] – C:\ProgramData\VirtualizedApplications
[2013/03/31 12:21:03 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\SoftGrid Client
[2013/03/31 12:21:01 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\SoftGrid Client
[2013/03/31 12:19:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2013/03/31 12:19:23 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\TP
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/04/29 13:37:25 | 000,024,608 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/04/29 13:37:25 | 000,024,608 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/04/29 13:31:58 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/04/29 13:31:41 | 896,708,606 | -HS- | M] () – C:\hiberfil.sys
[2013/04/29 13:22:29 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Cry Havoc\Desktop\OTL.exe
[2013/04/29 11:22:44 | 000,446,490 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/04/29 10:13:44 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130429-112244.backup
[2013/04/29 09:59:20 | 005,060,730 | R— | M] (Swearware) – C:\Users\Cry Havoc\Desktop\ComboFix.exe
[2013/04/29 09:05:14 | 000,000,348 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForCry Havoc.job
[2013/04/28 11:26:06 | 000,628,743 | —- | M] () – C:\Users\Cry Havoc\Desktop\adwcleaner.exe
[2013/04/28 11:24:26 | 000,536,737 | —- | M] (Oleg N. Scherbakov) – C:\Users\Cry Havoc\Desktop\JRT.exe
[2013/04/27 10:00:09 | 000,446,490 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130429-092538.backup
[2013/04/26 12:52:59 | 000,814,728 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/04/26 12:52:59 | 000,684,378 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/04/26 12:52:59 | 000,131,024 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/04/26 12:31:01 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130427-100009.backup
[2013/04/26 09:45:47 | 000,016,518 | —- | M] () – C:\Users\Cry Havoc\AppData\Roaming\wklnhst.dat
[2013/04/25 08:57:25 | 000,303,089 | —- | M] () – C:\Users\Cry Havoc\Desktop\detox bath.jpg
[2013/04/24 09:31:27 | 001,882,595 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1403010.016\Cat.DB
[2013/04/24 09:27:07 | 000,108,448 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013/04/24 09:27:03 | 001,092,512 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\npDeployJava1.dll
[2013/04/24 09:27:03 | 000,971,680 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\deployJava1.dll
[2013/04/24 09:27:03 | 000,311,200 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\javaws.exe
[2013/04/24 09:27:03 | 000,188,832 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\javaw.exe
[2013/04/24 09:27:03 | 000,188,320 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\java.exe
[2013/04/24 09:23:19 | 000,095,648 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/04/24 09:23:18 | 000,263,584 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/04/24 09:23:18 | 000,174,496 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/04/24 09:23:18 | 000,174,496 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/04/24 09:23:17 | 000,866,720 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npdeployJava1.dll
[2013/04/24 09:23:17 | 000,788,896 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2013/04/23 10:11:19 | 000,160,168 | —- | M] () – C:\Users\Cry Havoc\Desktop\speedupmypc-quickstart-en.pdf
[2013/04/21 16:32:12 | 000,001,184 | —- | M] () – C:\Users\Public\Desktop\MyFinePix Studio.lnk
[2013/04/20 14:49:17 | 000,447,228 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130424-094642.backup
[2013/04/20 08:59:08 | 000,002,052 | —- | M] () – C:\Windows\epplauncher.mif
[2013/04/19 10:48:48 | 000,002,955 | —- | M] () – C:\Users\Cry Havoc\Desktop\HiJackThis.lnk
[2013/04/17 06:22:06 | 000,447,228 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130420-144917.backup
[2013/04/15 22:47:08 | 000,177,312 | —- | M] (Symantec Corporation) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2013/04/15 22:47:08 | 000,007,466 | —- | M] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2013/04/15 22:47:08 | 000,000,855 | —- | M] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2013/04/15 22:08:09 | 000,014,818 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1403010.016\VT20130115.021
[2013/04/14 19:37:09 | 000,420,216 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/14 19:17:09 | 000,446,676 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130417-062206.backup
[2013/04/14 18:36:04 | 000,691,592 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/04/14 18:36:04 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/04/14 18:13:54 | 000,000,632 | RHS- | M] () – C:\Users\Cry Havoc\ntuser.pol
[2013/04/03 04:18:54 | 000,000,172 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1403010.016\isolate.ini
[2013/04/01 20:29:10 | 000,029,480 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msxml3a.dll
[2013/03/31 12:19:58 | 000,831,822 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/28 11:26:05 | 000,628,743 | —- | C] () – C:\Users\Cry Havoc\Desktop\adwcleaner.exe
[2013/04/26 12:19:22 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/04/26 12:19:22 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/04/26 12:19:22 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/04/26 12:19:22 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/04/26 12:19:22 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/04/25 08:57:25 | 000,303,089 | —- | C] () – C:\Users\Cry Havoc\Desktop\detox bath.jpg
[2013/04/23 10:11:18 | 000,160,168 | —- | C] () – C:\Users\Cry Havoc\Desktop\speedupmypc-quickstart-en.pdf
[2013/04/21 16:32:12 | 000,001,184 | —- | C] () – C:\Users\Public\Desktop\MyFinePix Studio.lnk
[2013/04/20 08:59:08 | 000,002,052 | —- | C] () – C:\Windows\epplauncher.mif
[2013/04/19 10:48:48 | 000,002,955 | —- | C] () – C:\Users\Cry Havoc\Desktop\HiJackThis.lnk
[2013/04/15 22:47:08 | 000,007,466 | —- | C] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2013/04/15 22:47:08 | 000,000,855 | —- | C] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/12/22 11:53:18 | 000,010,752 | —- | C] () – C:\Users\Cry Havoc\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/19 21:47:27 | 000,079,872 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2012/06/06 16:57:01 | 000,007,599 | —- | C] () – C:\Users\Cry Havoc\AppData\Local\resmon.resmoncfg
[2012/04/14 16:25:00 | 000,000,116 | —- | C] () – C:\Windows\NeroDigital.ini
[2012/03/10 16:01:33 | 000,000,632 | RHS- | C] () – C:\Users\Cry Havoc\ntuser.pol
[2012/03/10 00:11:29 | 000,016,518 | —- | C] () – C:\Users\Cry Havoc\AppData\Roaming\wklnhst.dat
[2012/03/09 23:21:47 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2012/02/29 17:16:59 | 000,023,040 | —- | C] () – C:\Windows\SysWow64\BeepApp.exe
[2011/10/12 19:33:22 | 000,007,736 | —- | C] () – C:\Windows\hpDSTRES.DLL
[2011/09/28 18:44:14 | 000,179,271 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 01:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 00:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 21:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 23:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 21:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013/04/14 18:08:29 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Bioshock
[2013/04/14 18:08:49 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Bioshock2
[2013/04/26 09:22:07 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\BitTorrent
[2013/03/29 12:32:36 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\BOXEE
[2012/05/17 21:28:53 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.
1
[2013/03/18 08:52:16 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\DAEMON Tools Lite
[2013/04/21 16:04:21 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\FUJIFILM
[2013/04/14 18:08:49 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\IrfanView
[2013/03/18 18:03:35 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Nullsoft
[2012/03/29 12:53:40 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\OpenOffice.org
[2012/08/19 14:25:53 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Opera
[2013/03/14 10:14:25 | 000,000,000 | -H-D | M] – C:\Users\Cry Havoc\AppData\Roaming\RPPrivate
[2012/07/15 10:44:33 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\SanDisk
[2013/04/01 12:09:45 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\SoftGrid Client
[2012/03/10 11:13:56 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\SystemRequirementsLab
[2013/03/31 12:21:22 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\TP
[2013/02/03 22:35:02 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\TuneUp Software
[2013/04/22 18:41:08 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Uniblue
[2013/04/14 18:08:49 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\WebApp
[2012/03/11 18:15:48 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\WinBatch
[2012/11/11 13:37:53 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\ZinioReader4

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:5C321E34

< End of report >
Post #17

I still have the problem with searching.

I want to be sure I understand…where is it you are searching? In a browser? Could you clarify this more?
Post #18 last edited
I used to be able to click the start button and type in the search box there. It would search my whole computer and show some results of different types of files(text files, configuration files, etc.) and have a link to "show more results" which would open a new screen with a lot of results. Now when I click start and search it only lists program files or control panel files and the link to "show more results" is missing. I can however click computer, then C: drive, then do a search in the browser. I am sorry I do not know the correct terminology to use to explain it better. I think it is called a Windows explorer browser that I can actually do a search in. When I say I click the start button, I think that is the Windows button, it is the button that is on my keyboard and the lower left side of my screen on the task bar.
EDIT: I have uploaded 2 images that show when I click the start button and try to search in the search box

Attachments:

Post #19
I understand what you are talking about now….I am not quite sure if that is actually a problem though so much as just a change in the system…

[external image: Posted Image] Download Windows Repair (all in one) from this site

Install and then run the program.

On the Start Repairs tab, select Advanced Mode and click Start
[external image: Posted Image]


When the Repair Options screen populates, be sure to select all items and also check Restart System When Finished.

Now press Start
———-

Once complete let me know how your system is running. :)
Post #20
I am sorry that it has taken so long to get back to you. I could not locate an Avanced Mode on Windows Repair (all in one), there was a Beta Repairs button but I did not click that. I selected all items and Restart System When Finished. It did not seem like there were any problems. I did all the recommendations before the repair (disk scan, system file checker.) My system hasn't really improved. Right now Windows Media Player states that there are 933 items, 136,031,023 hours in the playlist I am listening to (should be 73.5 hours.) I deleted all entries of the same song that were added to the playlist without me adding them and they have not come back. It still takes around two minutes and twenty seconds to shut down after I see the light-blue screen that says Shutting Down. Earlier today the web pages that I was viewing were scrolling up and down without me even touching my mouse or keyboard but only if my pointer hovered over the web page. If the pointer was hovering over the task bar the scrolling would stop. I am still having the issue with not being able to search properly with the start button search box, but I can search by clicking on Computer and searching in the top right-hand corner search box of the window that opens. These are just minor issues to me as long as things with the system do not start changing again, like not being able to search or songs being added to a playlist. Thank you so much for all of your help. I was prepared to wipe everything out. I am so glad that dickevans from the Norton Community pointed me in this direction. Thank you Jeff! :thumbup:
Post #21
You are more than welcome.

Please run Malwarebytes. This time I would like for your to update the software and then run a Full Scan and post the log that is created. I want to be sure there is nothing hiding in here causing your problems. :)
Post #22
I disabled all of my real-time protection and ran the Malwarebytes full scan. I disabled my internet connection and unplugged my modem as I always do when I am not online. And as always when I reboot my system tries to connect to the internet. Is there any way to prevent this?
I had removed my Windows password since you have been working with me because of all the reboots I was having to do. Yesterday I put the password back on. I had no problem yesterday or this morning but just now when I rebooted, my system started, I saw the desktop and a few notification icons in the task bar, and then the system froze. I waited eight minutes and then shut it down by holding the power button. It started fine when I restarted it, I selected "start Windows normally" when asked.
Windows Media Player is showing the correct 73.5 hours of music in my playlist.
I have read that you should only have one antivirus/antimalware/antispyware program running. Can I ask what program you use? Or, what program do you recommend?
Here is the Malwarebytes log.

mbam-log-2013-05-02 (08-08-33).txt

Malwarebytes Anti-Malware (PRO) 1.65.0.1400
www.malwarebytes.org

Database version: v2013.05.02.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.10.9200.16540
Cry Havoc :: CRYHAVOC [administrator]

Protection: Enabled

5/2/2013 8:08:33 AM
mbam-log-2013-05-02 (08-08-33).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 586981
Time elapsed: 1 hour(s), 13 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
Post #24
1. My computer froze once today, during a reboot. I had to hold the power button in to shut it down, but it restarted just fine. 2. Once again, as I am typing this, the screen is scrolling up and down by itself. 3. Windows Media Player is stating that I have 155,629,107 hours of music in the playlist I am currently listening to. 4. My system always tries to connect to the internet when I boot up, even if I disabled the network adapter before I turned the computer off. These are not real problems, just minor annoyances.
Post #25
Ok… What type of mouse are you using for your system? Is it the mouse pad like on a laptop or a normal mouse that you use with your hand? Do you not want your internet to start when your system does?
Post #27
Let's work on the mouse issue first…. Do you have another mouse to try and use? Can you disconnect the wireless mouse and see if you still have the same effects online with the screen moving up and down?
Post #29
Ok….if you are good with that then I am. What about your internet? You are trying to prevent your system from connecting to the internet automatically? Are you connected with a wifi card or with a wire??
Post #30
I have both WiFi and wired. I only use the wired network connection. I always have WIFI and all associated services (WLAN AutoConfig and WWAN AutoConfig) disabled. I enable the wired Ethernet connection when I want to connect and I disable it when I am not going to be online. I always disable the wired Ethernet connection before I turn off my computer but it always tries to connect when I boot up.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI