Spyware / Malware / Virus Removal

Browser Hijack [Solved]

18 min read

Looking for the outcome? Ask AI

randomnumber Topic Starter

Post #1May 11, 2013, 2:28 PM UTC

Chrome, firefox and IE will all shut down unexpectedly. Might be getting slow internet speeds. I've got weird entries in my HJT log. Especially the O1 with an IP address and the "WormRadar" BHO entry.

So far, I've uninstalled old Java, chrome, firefox and I tried to uninstall AVG but it remains. Now I'm here and would greatly appreciate any assistance.

HJT Log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:23:05 AM, on 5/11/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\AVG SafeGuard toolbar\vprot.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe
C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program

Files\AVG\AVG2012\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot -

Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -

C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre7\bin\ssv.dll
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
O2 - BHO: LastPass Browser Helper Object - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program

Files\LastPass\LPBar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program

Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program

Files\LastPass\LPBar.dll
O3 - Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG SafeGuard toolbar\vprot.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Plex Media Server] "C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [A24802D8E0033B87C7A71FBB6D39DEF74469BA10._service_run] "C:\Documents and

Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe"

–type=service
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

(User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

(User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-57989841-920026266-842925246-1002\..\RunOnce: [_nltide_3] rundll32

advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

(User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

(User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Administrator\Application

Data\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver -

res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program

Files\LastPass\context.html?cmd=fillforms
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program

Files\LastPass\LPBar.dll
O9 - Extra 'Tools' menuitem: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program

Files\LastPass\LPBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot -

Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) -

http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} (Creative Software AutoUpdate 2) -

http://ccfiles.creative.com/Web/softwareup…015/CTSUEng.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) -

http://ccfiles.creative.com/Web/softwareup…10926/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} -

C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program

Files\AVG\AVG2012\avgpp.dll (file missing)
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG

Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} -

C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} -

C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems

Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common

Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -

C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program

Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program

Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program

Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program

Files\Java\jre7\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common

Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program

Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program

Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: vToolbarUpdater14.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure

Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe

–
End of file - 10067 bytes

OCD

Post #2May 11, 2013, 3:52 PM UTC

Hello randomnumber,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Important Note for Vista and Windows 7 users:

These tools MUST be run from the executable.(.exe) every time you run them with Admin Rights (Right click, choose "Run as Administrator")

Please stay with this topic until I let you know that your system appears to be "All Clear"

= = = = = = = = = = = = = = = = = = = =

Remove Word Wrap in Notepad

Click the Windows “Start” button.
Enter “Notepad” into the search box and double-click the application from the list of search results that appears. The Notepad application opens.
Click “Format” from the main menu in Notepad to display the formatting drop-down menu. You will see a check mark next to the words “Word Wrap,” which indicates that the Word Wrap feature is currently inserting line endings into your Notepad files.
Click “Word Wrap” to remove line endings. The check mark that used to appear next to “Word Wrap” disappears, indicating that you have successfully disabled this feature and removed all line endings from your document.

- - - - - Next - - - - -

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

- - - - - Next - - - - -

Please download aswMBR.exe and save it to your desktop.
Double click aswMBR.exe to start the tool.
When asked if you want to download Avast's virus definitions please select Yes.
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

- - - - - Next - - - - -

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
BASESERVICES
DRIVES
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

In your next post please provide the following:
checkup.txt
aswMBR.txt
attach MBR.zip
OTL.txt
Extras.txt

randomnumber

Post #3May 11, 2013, 4:52 PM UTC

OCD thank you for your help! I will be getting any responses to this thread via email so I will do my best to promptly perform the steps you recommend and reply with the results throughout the day and weekend.

checkup.txt:

Results of screen317's Security Check version 0.99.63
Windows XP Service Pack 3 x86
Internet Explorer 6 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.75.0.1300
CCleaner
Java 7 Update 21
Adobe Flash Player 11.7.700.169
Adobe Reader XI
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 7%
````````````````````End of Log``````````````````````

aswMBR.txt:

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-05-11 12:00:13
—————————–
12:00:13.171 OS Version: Windows 5.1.2600 Service Pack 3
12:00:13.171 Number of processors: 2 586 0x409
12:00:13.171 ComputerName: DESKTOP UserName:
12:00:13.593 Initialize success
12:03:05.312 AVAST engine defs: 13051100
12:04:30.093 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f
12:04:30.093 Disk 0 Vendor: ST380819AS 8.04 Size: 76293MB BusType: 3
12:04:30.093 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-17
12:04:30.109 Disk 1 Vendor: SAMSUNG_SP2504C VT100-33 Size: 238475MB BusType: 3
12:04:30.234 Disk 0 MBR read successfully
12:04:30.234 Disk 0 MBR scan
12:04:30.250 Disk 0 Windows XP default MBR code
12:04:30.250 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
12:04:30.265 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 52438 MB offset 80325
12:04:30.296 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 19045 MB offset 107490915
12:04:30.312 Disk 0 Partition 4 00 DB CP/M / CTOS MSDOS5.0 4753 MB offset 146496735
12:04:30.312 Disk 0 scanning sectors +156232125
12:04:30.343 Disk 0 scanning C:\WINDOWS\system32\drivers
12:04:37.953 Service scanning
12:04:51.562 Modules scanning
12:04:56.296 Disk 0 trace - called modules:
12:04:56.312 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll intelide.sys PCIIDEX.SYS
12:04:56.312 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89dc5ab8]
12:04:56.328 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-f[0x89dd1d98]
12:04:56.718 AVAST engine scan C:\WINDOWS
12:04:58.265 AVAST engine scan C:\WINDOWS\system32
12:06:39.484 AVAST engine scan C:\WINDOWS\system32\drivers
12:06:50.218 AVAST engine scan C:\Documents and Settings\Administrator
12:09:41.640 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
12:09:41.640 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"

OTL.txt:

OTL logfile created on: 5/11/2013 12:17:13 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 66.58% Memory free
3.33 Gb Paging File | 2.78 Gb Available in Paging File | 83.48% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 51.21 Gb Total Space | 7.91 Gb Free Space | 15.45% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 10.74 Gb Free Space | 4.61% Space Free | Partition Type: NTFS
Drive E: | 1.26 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 18.60 Gb Total Space | 16.92 Gb Free Space | 90.96% Space Free | Partition Type: NTFS
Drive H: | 931.51 Gb Total Space | 542.59 Gb Free Space | 58.25% Space Free | Partition Type: NTFS

Computer Name: DESKTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
PRC - C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
PRC - C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe (Plex, Inc.)
PRC - C:\Program Files\AVG SafeGuard toolbar\vprot.exe ()
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
PRC - C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\etree.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ssl.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\objectify.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_socket.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_multiprocessing.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_hashlib.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ctypes.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\unicodedata.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\pyexpat.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\select.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\WebKit.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\zlib1.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\tag.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\swscale-0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_core-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxml2.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\JavaScriptCore.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libexslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\cairo.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\CFLite.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avcodec-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avformat-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avutil-50.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
MOD - C:\Program Files\AVG SafeGuard toolbar\vprot.exe ()
MOD - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\SiteSafety.dll ()
MOD - C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll ()

========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (vToolbarUpdater14.2.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (CTAudSvcService) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (bvrp_pci) – File not found
DRV - (aswMBR) – C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aswMBR.sys File not found
DRV - (avgtp) – C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (dg_ssudbus) – C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) – C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (hap17v2k) – C:\WINDOWS\system32\drivers\haP17v2k.sys (Creative Technology Ltd)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTERFXFX.SYS) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTERFXFX) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX.SYS) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX.SYS) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (COMMONFX.SYS) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (COMMONFX) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (WinUSB) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searc—- | m] (microsoft corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: support%40lastpass.com:2.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\

[2012/12/11 20:50:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2013/05/08 19:49:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions
[2013/05/08 19:49:06 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\staged
[2012/12/11 20:45:58 | 000,000,000 | —D | M] (LastPass) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2013/03/23 15:48:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash
[2012/12/11 20:49:31 | 000,160,974 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\plex-it.xpi
[2013/03/23 15:48:16 | 002,163,784 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2012/12/12 20:48:43 | 002,151,598 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash\[removed]

O1 HOSTS File: ([2011/12/30 13:05:45 | 000,000,801 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O4 - HKLM..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" File not found
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [UIUCU] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S File not found
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG SafeGuard toolbar\vprot.exe ()
O4 - HKCU..\Run: [A24802D8E0033B87C7A71FBB6D39DEF74469BA10._service_run] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" –type=service File not found
O4 - HKCU..\Run: [Plex Media Server] C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files\LastPass\context.html?cmd=fillforms File not found
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareup…015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…10926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{069327AA-7D9B-4C27-AF88-594FF8655817}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/12/23 12:14:44 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/05/20 01:40:33 | 000,000,000 | RH-D | M] - H:\autorun – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/05/11 12:09:55 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:00:06 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 10:22:10 | 000,263,584 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/05/11 10:18:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2013/05/11 09:39:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis
[2013/05/11 09:27:32 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator\UserData
[2013/05/11 09:18:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PDF Architect
[2013/05/11 09:15:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/04/18 18:22:45 | 000,094,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/04/18 07:31:46 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/11 12:10:00 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:09:41 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 12:05:00 | 000,000,900 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/11 12:01:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/11 12:00:06 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 11:12:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 10:19:34 | 000,000,896 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/11 10:19:27 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/05/11 10:18:40 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 10:18:40 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 10:18:40 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 10:18:40 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 10:18:40 | 000,011,564 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 10:18:27 | 004,931,715 | —- | M] () – C:\WINDOWS\{00000003-00000000-00000001-00001102-00000004-20021102}.CDF
[2013/05/11 09:39:33 | 000,000,951 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:26:20 | 000,000,779 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/05/11 09:22:05 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/05/10 23:00:36 | 000,000,462 | —- | M] () – C:\WINDOWS\tasks\SyncBack Backup to Elements.job
[2013/05/01 19:07:40 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/04/15 07:00:34 | 000,019,778 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/04/14 12:19:59 | 000,861,088 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2013/04/14 12:19:58 | 000,782,240 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2013/04/14 11:32:38 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/14 11:21:37 | 000,000,211 | -HS- | M] () – C:\boot.ini
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/11 12:09:41 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 09:39:33 | 000,000,951 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:32:07 | 000,002,463 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/04/15 07:00:34 | 000,019,778 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/03/23 15:48:34 | 000,007,748 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\recently-used.xbel
[2013/03/02 14:05:01 | 000,937,667 | —- | C] () – C:\Documents and Settings\Administrator\save the date front filetype
[2012/12/05 09:29:21 | 000,027,520 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\dt.dat
[2012/10/07 02:03:27 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/09/17 18:39:50 | 000,056,136 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/09/17 13:00:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator\.swfinfo
[2012/08/28 19:03:41 | 002,811,988 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2012/04/02 18:31:29 | 008,892,928 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2011/12/24 12:51:53 | 000,000,225 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2011/12/24 12:51:53 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2011/12/24 12:51:53 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\bridf06a.dat
[2011/12/24 12:51:40 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2011/12/24 12:51:40 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2011/12/24 12:49:44 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2011/12/24 12:49:44 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2011/12/23 12:38:51 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/12/23 12:38:49 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/12/23 12:38:49 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/12/23 12:38:44 | 002,292,678 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2011/12/23 12:15:08 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2011/12/23 12:12:48 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2011/12/23 12:11:33 | 000,107,212 | —- | C] () – C:\WINDOWS\System32\zlib1.dll
[2011/12/23 12:11:24 | 000,162,304 | —- | C] () – C:\WINDOWS\System32\libpng13.dll
[2011/12/23 07:04:15 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2011/12/23 07:02:41 | 000,315,560 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== ZeroAccess Check ==========

[2011/12/23 12:12:51 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/11/17 05:21:35 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2010/11/17 05:21:09 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 22:42:10 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/08/27 20:44:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Ad-Aware Antivirus
[2013/03/26 09:07:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar
[2013/05/11 10:21:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Dropbox
[2013/01/18 09:34:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FileZilla
[2012/07/20 08:48:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ImgBurn
[2012/09/02 11:39:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2012/12/13 10:02:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Notepad++
[2012/06/07 19:08:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Ohm Force
[2013/03/02 14:18:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\OpenCandy
[2012/08/02 18:59:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Oracle
[2013/03/02 14:35:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\PDF Architect
[2013/03/02 14:18:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\pdfforge
[2012/01/06 18:56:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TeamViewer
[2012/12/11 20:03:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TuneUp Software
[2013/05/11 12:20:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2013/01/21 10:41:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG January 2013 Campaign
[2013/03/26 09:07:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
[2013/05/11 10:20:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/12/24 11:09:04 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2013/05/11 10:15:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2012/06/07 19:09:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ohm Force
[2013/05/11 09:18:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PDF Architect
[2012/02/26 13:03:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/04/13 22:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe

< MD5 for: SERVICES.EXE >
[2010/11/17 05:21:34 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\services.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 22:42:38 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/13 22:42:40 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/13 22:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /rp /s >

< %systemdrive%\$Recycle.Bin|@;true;true;true >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

========== Base Services ==========
No service found with a name of ALG
SRV - [2008/04/13 22:42:12 | 000,006,656 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\wuauserv.dll – (wuauserv)
SRV - [2008/04/13 22:42:04 | 000,409,088 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\qmgr.dll – (BITS)
SRV - [2008/04/13 22:41:52 | 000,077,824 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\browser.dll – (Browser)
SRV - [2008/04/13 22:41:52 | 000,062,464 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\cryptsvc.dll – (CryptSvc)
SRV - [2008/04/13 22:41:52 | 000,126,976 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\dhcpcsvc.dll – (Dhcp)
SRV - [2008/04/13 22:41:54 | 000,045,568 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\dnsrslvr.dll – (Dnscache)
SRV - [2010/11/17 05:21:34 | 000,110,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\services.exe – (Eventlog)
SRV - [2008/04/13 22:41:54 | 000,033,792 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\eapsvc.dll – (EapHost)
SRV - [2008/04/13 22:42:06 | 000,135,168 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\shsvcs.dll – (FastUserSwitchingCompatibility)
SRV - [2008/04/13 22:42:10 | 000,015,872 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\w3ssl.dll – (HTTPFilter)
SRV - [2008/04/14 12:41:56 | 000,021,504 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\hidserv.dll – (HidServ)
SRV - [2008/04/13 22:42:24 | 000,150,528 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\imapi.exe – (ImapiService)
SRV - [2008/04/13 22:42:26 | 000,013,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\lsass.exe – (PolicyAgent)
SRV - [2008/04/13 22:41:54 | 000,023,552 | —- | M] (Microsoft Corp.) [On_Demand | Stopped] – C:\WINDOWS\system32\dmserver.dll – (dmserver)
SRV - [2008/04/13 22:42:18 | 000,224,768 | —- | M] (Microsoft Corp., Veritas Software) [On_Demand | Stopped] – C:\WINDOWS\System32\dmadmin.exe – (dmadmin)
SRV - [2008/04/13 22:42:18 | 000,005,120 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\System32\dllhost.exe – (SwPrv)
SRV - [2008/04/13 22:42:26 | 000,013,312 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\lsass.exe – (Netlogon)
SRV - [2008/04/13 22:42:02 | 000,198,144 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\WINDOWS\system32\netman.dll – (Netman)
SRV - [2010/11/17 05:21:26 | 000,245,248 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\WINDOWS\system32\mswsock.dll – (Nla)
SRV - [2010/11/17 05:21:34 | 000,110,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\services.exe – (PlugPlay)
SRV - [2010/11/17 05:21:41 | 000,058,880 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\spoolsv.exe – (Spooler)
SRV - [2008/04/13 22:42:26 | 000,013,312 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\WINDOWS\system32\lsass.exe – (ProtectedStorage)
SRV - [2008/04/13 22:42:04 | 000,088,576 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\rasauto.dll – (RasAuto)
SRV - [2008/04/13 22:42:04 | 000,186,368 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\rasmans.dll – (RasMan)
SRV - [2010/11/17 05:21:34 | 000,401,408 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\rpcss.dll – (RpcSs)
No service found with a name of NtmsSvc
SRV - [2008/04/13 22:42:06 | 000,018,944 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\seclogon.dll – (seclogon)
SRV - [2008/04/13 22:42:26 | 000,013,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\lsass.exe – (SamSs)
No service found with a name of wscsvc
SRV - [2010/11/17 05:21:41 | 000,099,840 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\srvsvc.dll – (LanmanServer)
SRV - [2008/04/13 22:42:06 | 000,135,168 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\shsvcs.dll – (ShellHWDetection)
SRV - [2008/04/13 22:42:08 | 000,171,008 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\srsvc.dll – (srservice)
SRV - [2008/04/13 22:42:06 | 000,192,512 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\schedsvc.dll – (Schedule)
SRV - [2008/04/13 22:41:58 | 000,013,824 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\WINDOWS\system32\lmhsvc.dll – (LmHosts)
SRV - [2008/04/13 22:42:08 | 000,249,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\tapisrv.dll – (TapiSrv)
SRV - [2008/04/13 22:42:08 | 000,295,424 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\WINDOWS\system32\termsrv.dll – (TermService)
SRV - [2008/04/13 22:42:06 | 000,135,168 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\shsvcs.dll – (Themes)
SRV - [2008/04/13 22:42:40 | 000,289,792 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\vssvc.exe – (VSS)
SRV - [2008/04/13 22:41:52 | 000,042,496 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\audiosrv.dll – (AudioSrv)
SRV - [2008/04/13 22:41:56 | 000,331,264 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\ipnathlp.dll – (SharedAccess)
SRV - [2008/04/13 22:42:10 | 000,333,824 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\wiaservc.dll – (stisvc)
SRV - [2008/04/13 22:42:30 | 000,078,848 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\System32\msiexec.exe – (MSIServer)
SRV - [2008/04/13 22:42:10 | 000,144,896 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\wbem\wmisvc.dll – (winmgmt)
SRV - [2010/11/17 05:21:07 | 000,617,472 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\advapi32.dll – (Wmi)
SRV - [2008/04/13 22:41:54 | 000,132,096 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\system32\dot3svc.dll – (Dot3svc)
SRV - [2010/11/17 05:25:29 | 000,483,840 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\wzcsvc.dll – (WZCSVC)
SRV - [2010/11/17 05:21:46 | 000,132,096 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\WINDOWS\system32\wkssvc.dll – (lanmanworkstation)

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: ST380819AS
Partitions: 4
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: SAMSUNG SP2504C
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 - Fixed\thard disk media
Interface type: USB
Media Type: Fixed\thard disk media
Model: WD 10EACS External USB Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 -
Interface type: USB
Media Type:
Model: Brother MFC-440CN USB Device
Partitions: 0
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 39.00MB
Starting Offset: 32256
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 51.00GB
Starting Offset: 41126400
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 19.00GB
Starting Offset: 55035348480
Hidden sectors: 0

DeviceID: Disk #0, Partition #3
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 5.00GB
Starting Offset: 75006328320
Hidden sectors: 0

DeviceID: Disk #1, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 233.00GB
Starting Offset: 32256
Hidden sectors: 0

DeviceID: Disk #2, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 932.00GB
Starting Offset: 1048576
Hidden sectors: 0

< End of report >

Extras.txt:

OTL Extras logfile created on: 5/11/2013 12:17:13 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 66.58% Memory free
3.33 Gb Paging File | 2.78 Gb Available in Paging File | 83.48% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 51.21 Gb Total Space | 7.91 Gb Free Space | 15.45% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 10.74 Gb Free Space | 4.61% Space Free | Partition Type: NTFS
Drive E: | 1.26 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 18.60 Gb Total Space | 16.92 Gb Free Space | 90.96% Space Free | Partition Type: NTFS
Drive H: | 931.51 Gb Total Space | 542.59 Gb Free Space | 58.25% Space Free | Partition Type: NTFS

Computer Name: DESKTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /k cd "%L" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"43265:TCP" = 43265:TCP:*:Enabled:utorrent

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin – (Google)
"C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox – (Dropbox, Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer
"C:\Program Files\Java\jre7\bin\javaw.exe" = C:\Program Files\Java\jre7\bin\javaw.exe:*:Enabled:Java™ Platform SE binary – (Oracle Corporation)
"C:\Program Files\AVG\AVG2012\avgnsx.exe" = C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Online Shield
"C:\Program Files\AVG\AVG2012\avgdiagex.exe" = C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostics 2012
"C:\Program Files\AVG\AVG2012\avgemcx.exe" = C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Personal E-mail Scanner
"C:\Program Files\AVG\AVG2013\avgmfapx.exe" = C:\Program Files\AVG\AVG2013\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe" = C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe:*:Enabled:Plex Media Server – (Plex, Inc.)
"C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe" = C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe:*:Enabled:Plex Scripting Host – ()
"C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe" = C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe:*:Enabled:Plex DLNA Server – (Plex, Inc.)
"C:\Program Files\Winamp\winamp.exe" = C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp – (Nullsoft, Inc.)
"C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Disabled:Daemonu.exe – (NVIDIA Corporation)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Disabled:Microsoft Office Groove – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Disabled:Microsoft Office OneNote – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Disabled:Microsoft Office Outlook – (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{1A7638A1-E022-4F99-ADF3-F46DB04689C1}" = Plex Media Server
"{1C3DA126-D523-4089-BCCA-FA46FE34D6F8}" = Google Drive
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 21
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{3FE93ACC-83FB-4FE5-9147-8BAD2D33E2EF}" = AVG 2012
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E0C89A4-4040-47C7-AD0C-0E8226B6AFE2}" = AVG 2012
"{5BA1D11C-B981-4CAA-B2B5-B8ADF413EBA5}" = Pure Networks Platform
"{6A69D94E-C569-4154-9643-72E94D1DDFDA}" = XPS Essentials Pack
"{6D12EC75-E7D3-4EAD-AB10-E1F3AFF94AA6}" = AVG 2012
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{8398852A-7B61-4808-8F58-D0A40D1B2CB6}" = AVG 2012
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8FE96B14-E1F9-47BF-8BA1-A81467CD259B}_is1" = Yawcam 0.3.7
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A912C12-A7DA-44D7-BD57-5CA85E2F33E1}" = Brother MFL-Pro Suite
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.02)
"{B143D835-EBAF-4A39-8B31-1868FF4166C1}" = AVG 2012
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 306.81
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 306.81
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.28
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C91B24F6-1629-11E2-B696-21676188709B}" = PDF Split And Merge Basic
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AudioCS" = Creative Audio Console
"AVG" = AVG 2013
"AVG SafeGuard toolbar" = AVG SafeGuard toolbar
"CCleaner" = CCleaner
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"CTMBDemo" = Sound Blaster Audigy ADVANCED MB Demo
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FileZilla Client" = FileZilla Client 3.6.0.2
"GIMP-2_is1" = GIMP 2.8.4
"LastPass" = LastPass (uninstall only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"mIRC" = mIRC
"MIXERLITE" = Mixer
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Network MagicUninstall" = Network Magic
"Notepad++" = Notepad++
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Picasa 3" = Picasa 3
"PROSet" = Intel® PRO Network Connections Drivers
"sp6" = Logitech SetPoint 6.32
"SyncBack_is1" = SyncBack
"Tweak UI 2.10" = Tweak UI
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.11
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR 4.10 beta 1 (32-bit)
"winusb0100" = Microsoft WinUsb 1.0
"winusb0200" = Microsoft WinUsb 2.0
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEP" = XPS Essentials Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Winamp Detect" = Winamp Detector Plug-in

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 5/1/2013 6:39:04 AM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/1/2013 6:39:13 AM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/1/2013 6:39:13 AM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/1/2013 6:39:13 AM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/1/2013 6:39:15 AM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/1/2013 6:39:15 AM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/1/2013 6:39:15 AM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/3/2013 6:33:29 PM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/3/2013 6:33:30 PM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

Error - 5/3/2013 6:33:30 PM | Computer Name = DESKTOP | Source = Bonjour Service | ID = 100
Description =

[ System Events ]
Error - 3/4/2013 7:27:17 AM | Computer Name = DESKTOP | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
RDXWDSK0006 that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{069327AA-7D9B-4C. The master browser is stopping or an election is
being forced.

Error - 3/30/2013 7:13:39 AM | Computer Name = DESKTOP | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\PROGRA~1\COMMON~1\AVGSEC~1\SITESA~1\142~1.0\NPSITE~1.DLL.
Reference
error message: The operation completed successfully. .

Error - 4/7/2013 6:58:44 PM | Computer Name = DESKTOP | Source = DCOM | ID = 10010
Description = The server {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} did not register
with DCOM within the required timeout.

Error - 4/14/2013 1:26:09 AM | Computer Name = DESKTOP | Source = DCOM | ID = 10000
Description = Unable to start a DCOM Server: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}.
The
error: "%1450" Happened while starting this command: C:\WINDOWS\system32\wbem\wmiprvse.exe
-Embedding

Error - 4/28/2013 11:00:08 PM | Computer Name = DESKTOP | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 4/28/2013 11:00:08 PM | Computer Name = DESKTOP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 4/29/2013 6:44:51 AM | Computer Name = DESKTOP | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 4/29/2013 6:44:51 AM | Computer Name = DESKTOP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 15 minutes. NtpClient has no source of accurate
time.

Error - 4/29/2013 6:45:12 AM | Computer Name = DESKTOP | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 4/29/2013 6:45:12 AM | Computer Name = DESKTOP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

< End of report >

Attachments:

📎MBR.zip

OCD

Post #4May 12, 2013, 2:39 AM UTC

Hi randomnumber,

P2P - I see you have/had P2P software uTorrent & BitTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections and possibly Identity Theft. It likely contributed to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall these now.

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

uTorrent
BitTorrent

If you choose to not remove these programs please refrain from using them until we have finished cleaning your computer.

- - - - - Next - - - - -

Please go to Start > Control Panel > Add Remove Programs.
Locate the following programs:
- AVG SafeGuard toolbar
Click Remove and allow Windows to completely remove each one in turn.Then reboot your computer to complete this part of the process.

- - - - - Next - - - - -

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\Program Files\AVG SafeGuard toolbar\vprot.exe ()
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
MOD - C:\Program Files\AVG SafeGuard toolbar\vprot.exe ()
MOD - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\SiteSafety.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll ()
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG SafeGuard toolbar\vprot.exe ()
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll ()
[2013/03/26 09:07:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar
[2013/03/26 09:07:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar

:Services
vToolbarUpdater14.2.0

:Files
ipconfig /flushdns /c

:Commands
[purity]
[createrestorepoint]
[emptyflash]
[emptyjava]
[resethosts]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then re-run OTL and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

In your next post please provide the following:
new OTL.txt
How is the computer running?

randomnumber

Post #5May 12, 2013, 3:18 AM UTC

OCD, Thank you for your help today! I performed the removal and scan that you requested and so far so good. I will need to install chrome and firefox as well as an antivirus software. What would you recommend, avast? Let me know if my OTL scan below looks clean and thanks again! Also, what exactly happened so I can avoid it in the future? Was my browser hijacked? What could have been compromised?

OTL logfile created on: 5/11/2013 10:54:14 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.32 Gb Available Physical Memory | 66.42% Memory free
3.33 Gb Paging File | 2.81 Gb Available in Paging File | 84.54% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 51.21 Gb Total Space | 7.65 Gb Free Space | 14.95% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 10.74 Gb Free Space | 4.61% Space Free | Partition Type: NTFS
Drive E: | 1.26 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 18.60 Gb Total Space | 16.92 Gb Free Space | 90.96% Space Free | Partition Type: NTFS
Drive H: | 931.51 Gb Total Space | 542.55 Gb Free Space | 58.24% Space Free | Partition Type: NTFS

Computer Name: DESKTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
PRC - C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
PRC - C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe (Plex, Inc.)
PRC - C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\etree.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ssl.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\objectify.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_socket.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_multiprocessing.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_hashlib.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ctypes.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\unicodedata.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\pyexpat.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\select.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\WebKit.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\zlib1.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\tag.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\swscale-0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_core-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxml2.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\JavaScriptCore.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libexslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\cairo.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\CFLite.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avcodec-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avformat-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avutil-50.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll ()

========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (CTAudSvcService) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (bvrp_pci) – File not found
DRV - (dg_ssudbus) – C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) – C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (hap17v2k) – C:\WINDOWS\system32\drivers\haP17v2k.sys (Creative Technology Ltd)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTERFXFX.SYS) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTERFXFX) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX.SYS) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX.SYS) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (COMMONFX.SYS) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (COMMONFX) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (WinUSB) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKCU\..\SearchScopes,DefaultScope = {420BB7ED-B829-4019-A8C5-6A923A851F12}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{420BB7ED-B829-4019-A8C5-6A923A851F12}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sear
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: support%40lastpass.com:2.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\

[2012/12/11 20:50:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2013/05/08 19:49:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions
[2013/05/08 19:49:06 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\staged
[2012/12/11 20:45:58 | 000,000,000 | —D | M] (LastPass) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2013/03/23 15:48:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash
[2012/12/11 20:49:31 | 000,160,974 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\plex-it.xpi
[2013/03/23 15:48:16 | 002,163,784 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2012/12/12 20:48:43 | 002,151,598 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash\[removed]

O1 HOSTS File: ([2013/05/11 22:50:11 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O4 - HKLM..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" File not found
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [UIUCU] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S File not found
O4 - HKCU..\Run: [A24802D8E0033B87C7A71FBB6D39DEF74469BA10._service_run] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" –type=service File not found
O4 - HKCU..\Run: [Plex Media Server] C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files\LastPass\context.html?cmd=fillforms File not found
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareup…015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…10926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{069327AA-7D9B-4C27-AF88-594FF8655817}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/12/23 12:14:44 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/05/20 01:40:33 | 000,000,000 | RH-D | M] - H:\autorun – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/11 22:50:18 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2013/05/11 22:49:41 | 000,000,000 | —D | C] – C:\_OTL
[2013/05/11 20:27:30 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\PrivacIE
[2013/05/11 20:25:27 | 000,000,000 | -H-D | C] – C:\Program Files\Uninstall Information
[2013/05/11 20:25:26 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\IETldCache
[2013/05/11 18:01:29 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2013/05/11 18:00:49 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2013/05/11 12:09:55 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:00:06 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 10:22:10 | 000,263,584 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/05/11 09:39:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis
[2013/05/11 09:27:32 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator\UserData
[2013/05/11 09:18:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PDF Architect
[2013/05/11 09:15:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/04/18 18:22:45 | 000,094,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/04/18 07:31:46 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/11 23:05:00 | 000,000,900 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/11 23:01:15 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/11 23:00:55 | 000,000,462 | —- | M] () – C:\WINDOWS\tasks\SyncBack Backup to Elements.job
[2013/05/11 22:51:32 | 000,000,896 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/11 22:51:29 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/05/11 22:50:28 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:28 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:28 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:28 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:28 | 000,011,564 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:15 | 004,931,715 | —- | M] () – C:\WINDOWS\{00000003-00000000-00000001-00001102-00000004-20021102}.CDF
[2013/05/11 22:50:11 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2013/05/11 20:25:29 | 000,000,815 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/11 12:52:11 | 000,000,534 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2013/05/11 12:10:00 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:09:41 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 12:00:06 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 11:12:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:39:33 | 000,000,951 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/05/11 09:22:05 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/05/01 19:07:40 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/04/15 07:00:34 | 000,019,778 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/04/14 12:19:59 | 000,861,088 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2013/04/14 12:19:58 | 000,782,240 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2013/04/14 11:32:38 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/14 11:21:37 | 000,000,211 | -HS- | M] () – C:\boot.ini
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/11 12:52:11 | 000,000,534 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2013/05/11 12:09:41 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 09:39:33 | 000,000,951 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:32:07 | 000,002,463 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/04/15 07:00:34 | 000,019,778 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/03/23 15:48:34 | 000,007,748 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\recently-used.xbel
[2013/03/02 14:05:01 | 000,937,667 | —- | C] () – C:\Documents and Settings\Administrator\save the date front filetype
[2012/12/05 09:29:21 | 000,027,520 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\dt.dat
[2012/10/07 02:03:27 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/09/17 18:39:50 | 000,056,136 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/09/17 13:00:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator\.swfinfo
[2012/08/28 19:03:41 | 002,811,988 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2012/04/02 18:31:29 | 008,892,928 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2011/12/24 12:51:53 | 000,000,225 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2011/12/24 12:51:53 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2011/12/24 12:51:53 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\bridf06a.dat
[2011/12/24 12:51:40 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2011/12/24 12:51:40 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2011/12/24 12:49:44 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2011/12/24 12:49:44 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2011/12/23 12:38:51 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/12/23 12:38:49 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/12/23 12:38:49 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/12/23 12:38:44 | 002,292,678 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2011/12/23 12:15:08 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2011/12/23 12:12:48 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2011/12/23 12:11:33 | 000,107,212 | —- | C] () – C:\WINDOWS\System32\zlib1.dll
[2011/12/23 12:11:24 | 000,162,304 | —- | C] () – C:\WINDOWS\System32\libpng13.dll
[2011/12/23 07:04:15 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2011/12/23 07:02:41 | 000,315,560 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== ZeroAccess Check ==========

[2011/12/23 12:12:51 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/11/17 05:21:35 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2010/11/17 05:21:09 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 22:42:10 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

OCD

Post #6May 12, 2013, 4:26 AM UTC

Hi randomnumber,

It's important that you follow through with the remainder of the steps I will outline. Absence of symptoms doesn't necessarily translate into malware free. We are making progress so please stay with me until I give you the "all clean" sign.

1. I will need to install chrome and firefox as well as an antivirus software.
2. What would you recommend, avast?
3. Also, what exactly happened so I can avoid it in the future?
4. Was my browser hijacked?
5. What could have been compromised?

1. It is not necessary to have multiple browsers installed, it is just a user preference.

2. Yes, you will need an Anti-Virus program, here are a few free ones. Each comes with it's own degree of difficulty in configuration, and set-up.

AntiVirus Program

As a rule of thumb one should run one firewall, one antivirus program in memory, and one antispyware utility in memory. It's fine to have other security tools available on an as-needed or on-demand basis, but when multiple tools simultaneously perform the same function, you're asking for trouble.

I would recommend that you install one of these free Antivirus programs immediately. Just choose one:
Microsoft Security Essentials
Avast

3. With the P2P programs you had installed, you open yourself up for being exposed to malicious files/programs that is why we strongly reccommend that you do not use them.

4. Yes your browser was hijacked.

5. Browser hijacking is the modification of a web browser's settings by malware, spyware or a virus. The term "hijacking" is used as the changes are performed without the user's permission. A browser hijacker may replace the existing home page, error page, or search page with its own.[1] These are generally used to force hits to a particular website. If you do any banking online you can always change your passwords as an added precaution.

= = = = = = = = = = = = = = = = = = = =

Now let's continue:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)

:Files
C:\Program Files\uTorrent

:Commands
[purity]
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then re-run OTL and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

- - - - - Next - - - - -

Locate Malwarebytes' Anti-Malware (it should be on your desktop).

Double - click the MBAM icon to launch the program.
Once the program has loaded, select the Update tab to get the latest updates before performing the scan.
Select Perform quick scan, then click Scan.

[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

- - - - - Next - - - - -

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
When the scan completes, click List of found threats
click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
Include the contents of this report in your next reply

Note - when ESET doesn't find any threats, no report will be created.
Push the back button.
Push Finish
Re-enable your Antivirus software.

- - - - - Next - - - - -

In your next post please provide the following:
OTL.txt
MBAM log
ESET's log.txt
How is the computer running?

randomnumber

Post #7May 12, 2013, 3:47 PM UTC

Ok, I reinstalled chrome and installed avast antivirus prior to performing the steps you outlined. I opted not to uninstall utorrent but will make sure to be more careful about using it. Here are my logs, let me know what you think and once again, thank you very much for your help and prompt replies!!

OTL logfile created on: 5/12/2013 8:32:45 AM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.29 Gb Available Physical Memory | 64.91% Memory free
3.33 Gb Paging File | 2.79 Gb Available in Paging File | 83.76% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 51.21 Gb Total Space | 6.74 Gb Free Space | 13.16% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 10.74 Gb Free Space | 4.61% Space Free | Partition Type: NTFS
Drive E: | 1.26 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 18.60 Gb Total Space | 16.92 Gb Free Space | 90.96% Space Free | Partition Type: NTFS
Drive H: | 931.51 Gb Total Space | 542.56 Gb Free Space | 58.25% Space Free | Partition Type: NTFS

Computer Name: DESKTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
PRC - C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
PRC - C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe (Plex, Inc.)
PRC - C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13051200\algo.dll ()
MOD - C:\Program Files\AVAST Software\Avast\defs\13050900\algo.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\etree.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ssl.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\objectify.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_socket.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_multiprocessing.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_hashlib.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ctypes.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\unicodedata.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\pyexpat.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\select.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\WebKit.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\zlib1.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\tag.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\swscale-0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_core-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxml2.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\JavaScriptCore.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libexslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\cairo.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\CFLite.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avcodec-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avformat-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avutil-50.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll ()

========== Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (CTAudSvcService) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (bvrp_pci) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (dg_ssudbus) – C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) – C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (hap17v2k) – C:\WINDOWS\system32\drivers\haP17v2k.sys (Creative Technology Ltd)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTERFXFX.SYS) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTERFXFX) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX.SYS) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX.SYS) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (COMMONFX.SYS) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (COMMONFX) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (WinUSB) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKCU\..\SearchScopes,DefaultScope = {420BB7ED-B829-4019-A8C5-6A923A851F12}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{420BB7ED-B829-4019-A8C5-6A923A851F12}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sear
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: support%40lastpass.com:2.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\

[2012/12/11 20:50:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2013/05/08 19:49:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions
[2013/05/08 19:49:06 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\staged
[2012/12/11 20:45:58 | 000,000,000 | —D | M] (LastPass) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2013/03/23 15:48:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash
[2012/12/11 20:49:31 | 000,160,974 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\plex-it.xpi
[2013/03/23 15:48:16 | 002,163,784 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2012/12/12 20:48:43 | 002,151,598 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash\[removed]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{
google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\Administrator\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U21 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - Extension: Docs = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\
CHR - Extension: Google Drive = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: YouTube = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: LastPass = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\1.90.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/05/11 22:50:11 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" File not found
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [UIUCU] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S File not found
O4 - HKCU..\Run: [A24802D8E0033B87C7A71FBB6D39DEF74469BA10._service_run] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" –type=service File not found
O4 - HKCU..\Run: [Plex Media Server] C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files\LastPass\context.html?cmd=fillforms File not found
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareup…015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…10926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{069327AA-7D9B-4C27-AF88-594FF8655817}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/12/23 12:14:44 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/05/20 01:40:33 | 000,000,000 | RH-D | M] - H:\autorun – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/12 08:29:47 | 000,029,816 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/05/12 08:29:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/05/12 08:29:46 | 000,368,944 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/05/12 08:29:46 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/05/12 08:29:45 | 000,765,736 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/05/12 08:29:45 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/05/12 08:29:43 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/05/12 08:29:43 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/05/12 08:28:59 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/05/12 08:28:20 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/05/12 08:27:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/05/12 08:26:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
[2013/05/11 22:50:18 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2013/05/11 22:49:41 | 000,000,000 | —D | C] – C:\_OTL
[2013/05/11 20:27:30 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\PrivacIE
[2013/05/11 20:25:27 | 000,000,000 | -H-D | C] – C:\Program Files\Uninstall Information
[2013/05/11 20:25:26 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\IETldCache
[2013/05/11 18:01:29 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2013/05/11 18:00:49 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2013/05/11 12:09:55 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:00:06 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 10:22:10 | 000,263,584 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/05/11 09:39:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis
[2013/05/11 09:27:32 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator\UserData
[2013/05/11 09:18:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PDF Architect
[2013/05/11 09:15:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/04/18 18:22:45 | 000,094,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/04/18 07:31:46 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/12 08:29:47 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/05/12 08:29:45 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/05/12 08:29:43 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/05/12 08:26:42 | 000,001,831 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/12 08:26:28 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/05/12 08:26:18 | 117,478,104 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\avast_free_antivirus_setup.exe
[2013/05/12 00:05:00 | 000,000,900 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/12 00:01:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/11 23:00:55 | 000,000,462 | —- | M] () – C:\WINDOWS\tasks\SyncBack Backup to Elements.job
[2013/05/11 22:51:32 | 000,000,896 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/11 22:51:29 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/05/11 22:50:28 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:28 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:28 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:28 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:28 | 000,011,564 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/11 22:50:15 | 004,931,715 | —- | M] () – C:\WINDOWS\{00000003-00000000-00000001-00001102-00000004-20021102}.CDF
[2013/05/11 22:50:11 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2013/05/11 20:25:29 | 000,000,815 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/11 12:52:11 | 000,000,534 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2013/05/11 12:10:00 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:09:41 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 12:00:06 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 11:12:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:39:33 | 000,000,951 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/05/11 09:22:05 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/05/09 04:59:10 | 000,765,736 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/05/09 04:59:10 | 000,368,944 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/05/09 04:59:10 | 000,174,664 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/05/09 04:59:10 | 000,056,080 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/05/09 04:59:10 | 000,049,376 | —- | M] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/05/09 04:59:09 | 000,066,336 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/05/09 04:59:09 | 000,049,760 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/05/09 04:59:08 | 000,029,816 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/05/09 04:58:37 | 000,041,664 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/05/09 04:58:28 | 000,229,648 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/05/01 19:07:40 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/04/15 07:00:34 | 000,019,778 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/04/14 12:19:59 | 000,861,088 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2013/04/14 12:19:58 | 000,782,240 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2013/04/14 11:32:38 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/14 11:21:37 | 000,000,211 | -HS- | M] () – C:\boot.ini
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/12 08:29:47 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/05/12 08:29:45 | 000,174,664 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/05/12 08:29:44 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/05/12 08:29:44 | 000,000,330 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/05/12 08:26:28 | 000,001,831 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/12 08:26:28 | 000,001,813 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/05/12 08:26:13 | 117,478,104 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\avast_free_antivirus_setup.exe
[2013/05/11 12:52:11 | 000,000,534 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2013/05/11 12:09:41 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 09:39:33 | 000,000,951 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:32:07 | 000,002,463 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/04/15 07:00:34 | 000,019,778 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/03/23 15:48:34 | 000,007,748 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\recently-used.xbel
[2013/03/02 14:05:01 | 000,937,667 | —- | C] () – C:\Documents and Settings\Administrator\save the date front filetype
[2012/12/05 09:29:21 | 000,027,520 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\dt.dat
[2012/10/07 02:03:27 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/09/17 18:39:50 | 000,056,136 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/09/17 13:00:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator\.swfinfo
[2012/08/28 19:03:41 | 002,811,988 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2012/04/02 18:31:29 | 008,892,928 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2011/12/24 12:51:53 | 000,000,225 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2011/12/24 12:51:53 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2011/12/24 12:51:53 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\bridf06a.dat
[2011/12/24 12:51:40 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2011/12/24 12:51:40 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2011/12/24 12:49:44 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2011/12/24 12:49:44 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2011/12/23 12:38:51 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/12/23 12:38:49 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/12/23 12:38:49 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/12/23 12:38:44 | 002,292,678 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2011/12/23 12:15:08 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2011/12/23 12:12:48 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2011/12/23 12:11:33 | 000,107,212 | —- | C] () – C:\WINDOWS\System32\zlib1.dll
[2011/12/23 12:11:24 | 000,162,304 | —- | C] () – C:\WINDOWS\System32\libpng13.dll
[2011/12/23 07:04:15 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2011/12/23 07:02:41 | 000,315,560 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== ZeroAccess Check ==========

[2011/12/23 12:12:51 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/11/17 05:21:35 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2010/11/17 05:21:09 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 22:42:10 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.05.12.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: DESKTOP [administrator]

5/12/2013 8:59:00 AM
mbam-log-2013-05-12 (08-59-00).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 224769
Time elapsed: 6 minute(s), 44 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

ESET found no threats and did not generate a log file.

PC seems to be running better now, I can't comment on speed since I haven't been browsing much during all this.

randomnumber

Post #8May 12, 2013, 4:19 PM UTC

Also, AVG 2013 is still installed when I look at my Add/Remove Programs list and it will not let me remove. I hit "Remove" and nothing happens. Restarted and tried again, same results. That can't be good.

OCD

Post #9May 12, 2013, 9:51 PM UTC

Hi randomnumber,

1.

I opted not to uninstall utorrent but will make sure to be more careful about using it.

If you proceeded to run the OTL script from my previous post you may have uninstalled uTorrent. If so, please refrain from re-downloading it until we are done. If you skipped that step just continue on.

=========================

2. Revo Uninstaller

Uninstall programs and remove remnants left from previous uninstalls.
Tutorial with screen shots available here, if needed.

Please download Revo Uninstaller Pro and save it to your desktop.
(This version is a fully functional, 30 day free trial)

Double click on "RevoUninProSetup.exe" to install. Follow/allow default installation.
Vista-W7 Users: You must right-click on "RevoUninProSetup.exe", and select "Run As Administrator" to install. If UAC prompts, allow it.
Double click Revo Uninstaller from the Start Menu programs list, to run it.
From the list of programs click on
AVG 2013
Chose "Uninstall". When prompted click Yes.
Make sure the advanced option is checked… then click Next.
The program will run, when prompted… click Yes… then Next.
Once the program has searched for leftovers click Next.
Check ONLY the bolded items on the list then… click Next… then Yes.
When done click Finish.

The problem program entries should now be gone.

=========================

3. Re-run OTL

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O4 - HKLM..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found

:Files
C:\Program Files\AVG

:Commands
[purity]
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then re-run OTL and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

=========================
In your next post please provide the following:
OTL.txt
Any remaining issues?

randomnumber

Post #10May 13, 2013, 12:58 AM UTC

Ok, here is the OTL log after I performed the required steps. As for utorrent, I didn't paste the code that you mentioned earlier so it didn't uninstall. I still see this in the OTL log though:
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
So does that mean I didn't fully get rid of AVG? Also, was AVG the problem or just the means for the browser hijack?
Thanks again OCD!

OTL logfile created on: 5/12/2013 7:13:44 PM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.23 Gb Available Physical Memory | 61.99% Memory free
3.33 Gb Paging File | 2.69 Gb Available in Paging File | 80.66% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 51.21 Gb Total Space | 7.05 Gb Free Space | 13.78% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 10.74 Gb Free Space | 4.61% Space Free | Partition Type: NTFS
Drive E: | 1.26 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 18.60 Gb Total Space | 16.92 Gb Free Space | 90.96% Space Free | Partition Type: NTFS
Drive H: | 931.51 Gb Total Space | 542.56 Gb Free Space | 58.25% Space Free | Partition Type: NTFS

Computer Name: DESKTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
PRC - C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
PRC - C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe (Plex, Inc.)
PRC - C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13051201\algo.dll ()
MOD - C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppgooglenaclpluginchrome.dll ()
MOD - C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll ()
MOD - C:\Program Files\Google\Chrome\Application\26.0.1410.64\ffmpegsumo.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\etree.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ssl.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\objectify.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_socket.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_multiprocessing.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_hashlib.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ctypes.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\unicodedata.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\pyexpat.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\select.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\WebKit.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\zlib1.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\tag.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\swscale-0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_core-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxml2.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\JavaScriptCore.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libexslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\cairo.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\CFLite.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avcodec-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avformat-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avutil-50.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
MOD - C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll ()

========== Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (CTAudSvcService) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (bvrp_pci) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (dg_ssudbus) – C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) – C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (hap17v2k) – C:\WINDOWS\system32\drivers\haP17v2k.sys (Creative Technology Ltd)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTERFXFX.SYS) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTERFXFX) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX.SYS) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX.SYS) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (COMMONFX.SYS) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (COMMONFX) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (Revoflt) – C:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (WinUSB) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKCU\..\SearchScopes,DefaultScope = {420BB7ED-B829-4019-A8C5-6A923A851F12}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{420BB7ED-B829-4019-A8C5-6A923A851F12}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sear
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: support%40lastpass.com:2.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

[2012/12/11 20:50:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2013/05/08 19:49:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions
[2013/05/08 19:49:06 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\staged
[2012/12/11 20:45:58 | 000,000,000 | —D | M] (LastPass) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2013/03/23 15:48:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash
[2012/12/11 20:49:31 | 000,160,974 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\plex-it.xpi
[2013/03/23 15:48:16 | 002,163,784 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2012/12/12 20:48:43 | 002,151,598 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash\[removed]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{
google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\Administrator\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U21 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - Extension: Google Docs = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: LastPass = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\2.0.25_0\
CHR - Extension: Gmail = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/05/11 22:50:11 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [UIUCU] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S File not found
O4 - HKCU..\Run: [A24802D8E0033B87C7A71FBB6D39DEF74469BA10._service_run] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" –type=service File not found
O4 - HKCU..\Run: [Plex Media Server] C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files\LastPass\context.html?cmd=fillforms File not found
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareup…015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…10926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{069327AA-7D9B-4C27-AF88-594FF8655817}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/12/23 12:14:44 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/05/20 01:40:33 | 000,000,000 | RH-D | M] - H:\autorun – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/12 18:59:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\VS Revo Group
[2013/05/12 18:58:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Revo Uninstaller Pro
[2013/05/12 18:58:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\VS Revo Group
[2013/05/12 18:58:46 | 000,027,064 | —- | C] (VS Revo Group) – C:\WINDOWS\System32\drivers\revoflt.sys
[2013/05/12 18:58:41 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2013/05/12 11:49:43 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2013/05/12 11:49:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2013/05/12 08:29:47 | 000,029,816 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/05/12 08:29:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/05/12 08:29:46 | 000,368,944 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/05/12 08:29:46 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/05/12 08:29:45 | 000,765,736 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/05/12 08:29:45 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/05/12 08:29:43 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/05/12 08:29:43 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/05/12 08:28:59 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/05/12 08:28:20 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/05/12 08:27:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/05/12 08:26:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
[2013/05/11 22:49:41 | 000,000,000 | —D | C] – C:\_OTL
[2013/05/11 20:27:30 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\PrivacIE
[2013/05/11 20:25:27 | 000,000,000 | -H-D | C] – C:\Program Files\Uninstall Information
[2013/05/11 20:25:26 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\IETldCache
[2013/05/11 18:01:29 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2013/05/11 18:00:49 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2013/05/11 12:09:55 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:00:06 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 10:22:10 | 000,263,584 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/05/11 09:39:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis
[2013/05/11 09:27:32 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator\UserData
[2013/05/11 09:18:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PDF Architect
[2013/05/11 09:15:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/04/18 18:22:45 | 000,094,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/04/18 07:31:46 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/12 19:16:00 | 000,000,378 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/05/12 19:10:37 | 000,000,896 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/12 19:10:30 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/05/12 19:09:32 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:09:32 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:09:32 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:09:32 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:09:32 | 000,011,564 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:05:02 | 000,000,900 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/12 19:01:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/12 18:58:48 | 000,000,943 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2013/05/12 18:58:48 | 000,000,925 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2013/05/12 11:51:02 | 000,001,831 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/12 08:29:47 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/05/12 08:29:43 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/05/12 08:26:28 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/05/12 08:26:18 | 117,478,104 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\avast_free_antivirus_setup.exe
[2013/05/11 23:00:55 | 000,000,462 | —- | M] () – C:\WINDOWS\tasks\SyncBack Backup to Elements.job
[2013/05/11 22:50:11 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2013/05/11 20:25:29 | 000,000,815 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/11 12:52:11 | 000,000,534 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2013/05/11 12:10:00 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:09:41 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 12:00:06 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 11:12:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:39:33 | 000,000,951 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/05/11 09:22:05 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/05/09 04:59:10 | 000,765,736 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/05/09 04:59:10 | 000,368,944 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/05/09 04:59:10 | 000,174,664 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/05/09 04:59:10 | 000,056,080 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/05/09 04:59:10 | 000,049,376 | —- | M] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/05/09 04:59:09 | 000,066,336 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/05/09 04:59:09 | 000,049,760 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/05/09 04:59:08 | 000,029,816 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/05/09 04:58:37 | 000,041,664 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/05/09 04:58:28 | 000,229,648 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/05/01 19:07:40 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/04/15 07:00:34 | 000,019,778 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/04/14 12:19:59 | 000,861,088 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2013/04/14 12:19:58 | 000,782,240 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2013/04/14 11:32:38 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/14 11:21:37 | 000,000,211 | -HS- | M] () – C:\boot.ini
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/12 18:58:48 | 000,000,943 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2013/05/12 18:58:48 | 000,000,925 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2013/05/12 08:29:47 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/05/12 08:29:45 | 000,174,664 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/05/12 08:29:44 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/05/12 08:29:44 | 000,000,378 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/05/12 08:26:28 | 000,001,831 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/12 08:26:28 | 000,001,813 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/05/12 08:26:13 | 117,478,104 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\avast_free_antivirus_setup.exe
[2013/05/11 12:52:11 | 000,000,534 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2013/05/11 12:09:41 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 09:39:33 | 000,000,951 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:32:07 | 000,002,463 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/04/15 07:00:34 | 000,019,778 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/03/23 15:48:34 | 000,007,748 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\recently-used.xbel
[2013/03/02 14:05:01 | 000,937,667 | —- | C] () – C:\Documents and Settings\Administrator\save the date front filetype
[2012/12/05 09:29:21 | 000,027,520 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\dt.dat
[2012/10/07 02:03:27 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/09/17 18:39:50 | 000,056,136 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/09/17 13:00:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator\.swfinfo
[2012/08/28 19:03:41 | 002,811,988 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2012/04/02 18:31:29 | 008,892,928 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2011/12/24 12:51:53 | 000,000,225 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2011/12/24 12:51:53 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2011/12/24 12:51:53 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\bridf06a.dat
[2011/12/24 12:51:40 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2011/12/24 12:51:40 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2011/12/24 12:49:44 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2011/12/24 12:49:44 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2011/12/23 12:38:51 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/12/23 12:38:49 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/12/23 12:38:49 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/12/23 12:38:44 | 002,292,678 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2011/12/23 12:15:08 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2011/12/23 12:12:48 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2011/12/23 12:11:33 | 000,107,212 | —- | C] () – C:\WINDOWS\System32\zlib1.dll
[2011/12/23 12:11:24 | 000,162,304 | —- | C] () – C:\WINDOWS\System32\libpng13.dll
[2011/12/23 07:04:15 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2011/12/23 07:02:41 | 000,315,560 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== ZeroAccess Check ==========

[2011/12/23 12:12:51 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/11/17 05:21:35 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2010/11/17 05:21:09 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 22:42:10 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

OCD

Post #11May 13, 2013, 1:42 AM UTC

Hi randomnumber,

So does that mean I didn't fully get rid of AVG? Also, was AVG the problem or just the means for the browser hijack?

We will address that remaining entry in the following steps. I wouldn't say AVG was the problem for the browser hijack. As stated before a common cause for malware infections come from using P2P programs or networks. That is why we strongly reccommend that users uninstall this software.

1. Run OTL.exe

Windows Vista and Windows 7 users Right Click and select "Run as Administrator"

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)

:Commands
[purity]
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then re-run OTL and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

=========================

In your next post please provide the following:
OTL.txt
Any remaining issues we haven't addressed yet?

randomnumber

Post #12May 13, 2013, 11:46 PM UTC

So far so good. Things are running pretty smooth now, OCD, thanks for the help!

OTL logfile created on: 5/12/2013 7:13:44 PM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.23 Gb Available Physical Memory | 61.99% Memory free
3.33 Gb Paging File | 2.69 Gb Available in Paging File | 80.66% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 51.21 Gb Total Space | 7.05 Gb Free Space | 13.78% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 10.74 Gb Free Space | 4.61% Space Free | Partition Type: NTFS
Drive E: | 1.26 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 18.60 Gb Total Space | 16.92 Gb Free Space | 90.96% Space Free | Partition Type: NTFS
Drive H: | 931.51 Gb Total Space | 542.56 Gb Free Space | 58.25% Space Free | Partition Type: NTFS

Computer Name: DESKTOP | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
PRC - C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
PRC - C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe (Plex, Inc.)
PRC - C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13051201\algo.dll ()
MOD - C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppgooglenaclpluginchrome.dll ()
MOD - C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll ()
MOD - C:\Program Files\Google\Chrome\Application\26.0.1410.64\ffmpegsumo.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\etree.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ssl.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\Exts\lxml\objectify.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_socket.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_multiprocessing.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_hashlib.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\_ctypes.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\unicodedata.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\pyexpat.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\DLLs\select.pyd ()
MOD - C:\Program Files\Plex\Plex Media Server\WebKit.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\zlib1.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\tag.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\swscale-0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_core-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libxml2.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\JavaScriptCore.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\libexslt.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\cairo.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\CFLite.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avcodec-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avformat-52.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\avutil-50.dll ()
MOD - C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe ()
MOD - C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll ()

========== Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (CTAudSvcService) – C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (bvrp_pci) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (dg_ssudbus) – C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) – C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (hap17v2k) – C:\WINDOWS\system32\drivers\haP17v2k.sys (Creative Technology Ltd)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (ctaud2k) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (CTERFXFX.SYS) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTERFXFX) – C:\WINDOWS\system32\drivers\CTERFXFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX.SYS) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTSBLFX) – C:\WINDOWS\system32\drivers\CTSBLFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX.SYS) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (CTAUDFX) – C:\WINDOWS\system32\drivers\CTAUDFX.sys (Creative Technology Ltd)
DRV - (COMMONFX.SYS) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (COMMONFX) – C:\WINDOWS\system32\drivers\COMMONFX.sys (Creative Technology Ltd)
DRV - (Revoflt) – C:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (WinUSB) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKCU\..\SearchScopes,DefaultScope = {420BB7ED-B829-4019-A8C5-6A923A851F12}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{420BB7ED-B829-4019-A8C5-6A923A851F12}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sear
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: support%40lastpass.com:2.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

[2012/12/11 20:50:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2013/05/08 19:49:01 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions
[2013/05/08 19:49:06 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\staged
[2012/12/11 20:45:58 | 000,000,000 | —D | M] (LastPass) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2013/03/23 15:48:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash
[2012/12/11 20:49:31 | 000,160,974 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\plex-it.xpi
[2013/03/23 15:48:16 | 002,163,784 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\[removed]
[2012/12/12 20:48:43 | 002,151,598 | —- | M] () (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\rry0xqn7.default\extensions\trash\[removed]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{
google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\Administrator\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\Administrator\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U21 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - Extension: Google Docs = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: LastPass = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\2.0.25_0\
CHR - Extension: Gmail = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/05/11 22:50:11 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe (Brother Industories, Ltd.)
O4 - HKLM..\Run: [UIUCU] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S File not found
O4 - HKCU..\Run: [A24802D8E0033B87C7A71FBB6D39DEF74469BA10._service_run] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" –type=service File not found
O4 - HKCU..\Run: [Plex Media Server] C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: LastPass - file://C:\Program Files\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files\LastPass\context.html?cmd=fillforms File not found
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareup…13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareup…015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…10926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{069327AA-7D9B-4C27-AF88-594FF8655817}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/12/23 12:14:44 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/05/20 01:40:33 | 000,000,000 | RH-D | M] - H:\autorun – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/12 18:59:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\VS Revo Group
[2013/05/12 18:58:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Revo Uninstaller Pro
[2013/05/12 18:58:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\VS Revo Group
[2013/05/12 18:58:46 | 000,027,064 | —- | C] (VS Revo Group) – C:\WINDOWS\System32\drivers\revoflt.sys
[2013/05/12 18:58:41 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2013/05/12 11:49:43 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2013/05/12 11:49:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2013/05/12 08:29:47 | 000,029,816 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/05/12 08:29:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/05/12 08:29:46 | 000,368,944 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/05/12 08:29:46 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/05/12 08:29:45 | 000,765,736 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/05/12 08:29:45 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/05/12 08:29:43 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/05/12 08:29:43 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/05/12 08:28:59 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/05/12 08:28:20 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/05/12 08:27:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/05/12 08:26:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
[2013/05/11 22:49:41 | 000,000,000 | —D | C] – C:\_OTL
[2013/05/11 20:27:30 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\PrivacIE
[2013/05/11 20:25:27 | 000,000,000 | -H-D | C] – C:\Program Files\Uninstall Information
[2013/05/11 20:25:26 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\IETldCache
[2013/05/11 18:01:29 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2013/05/11 18:00:49 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2013/05/11 12:09:55 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:00:06 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 10:22:10 | 000,263,584 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/05/11 09:39:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2013/05/11 09:39:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2013/05/11 09:32:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis
[2013/05/11 09:27:32 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator\UserData
[2013/05/11 09:18:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PDF Architect
[2013/05/11 09:15:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/04/18 18:22:45 | 000,174,496 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/04/18 18:22:45 | 000,094,112 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/04/18 07:31:46 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/12 19:16:00 | 000,000,378 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/05/12 19:10:37 | 000,000,896 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/12 19:10:30 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/05/12 19:09:32 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:09:32 | 000,031,812 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:09:32 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:09:32 | 000,031,272 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:09:32 | 000,011,564 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000003-00000000-00000001-00001102-00000004-20021102}.rfx
[2013/05/12 19:05:02 | 000,000,900 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/12 19:01:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/05/12 18:58:48 | 000,000,943 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2013/05/12 18:58:48 | 000,000,925 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2013/05/12 11:51:02 | 000,001,831 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/12 08:29:47 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/05/12 08:29:43 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/05/12 08:26:28 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/05/12 08:26:18 | 117,478,104 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\avast_free_antivirus_setup.exe
[2013/05/11 23:00:55 | 000,000,462 | —- | M] () – C:\WINDOWS\tasks\SyncBack Backup to Elements.job
[2013/05/11 22:50:11 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2013/05/11 20:25:29 | 000,000,815 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/05/11 12:52:11 | 000,000,534 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2013/05/11 12:10:00 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2013/05/11 12:09:41 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 12:00:06 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2013/05/11 11:12:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:39:33 | 000,000,951 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/05/11 09:22:05 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/05/09 04:59:10 | 000,765,736 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/05/09 04:59:10 | 000,368,944 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/05/09 04:59:10 | 000,174,664 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/05/09 04:59:10 | 000,056,080 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/05/09 04:59:10 | 000,049,376 | —- | M] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/05/09 04:59:09 | 000,066,336 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/05/09 04:59:09 | 000,049,760 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/05/09 04:59:08 | 000,029,816 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/05/09 04:58:37 | 000,041,664 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/05/09 04:58:28 | 000,229,648 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/05/01 19:07:40 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/04/15 07:00:34 | 000,019,778 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/04/14 12:19:59 | 000,861,088 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2013/04/14 12:19:58 | 000,782,240 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2013/04/14 11:32:38 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/14 11:21:37 | 000,000,211 | -HS- | M] () – C:\boot.ini
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/12 18:58:48 | 000,000,943 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2013/05/12 18:58:48 | 000,000,925 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2013/05/12 08:29:47 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/05/12 08:29:45 | 000,174,664 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/05/12 08:29:44 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/05/12 08:29:44 | 000,000,378 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/05/12 08:26:28 | 000,001,831 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/12 08:26:28 | 000,001,813 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/05/12 08:26:13 | 117,478,104 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\avast_free_antivirus_setup.exe
[2013/05/11 12:52:11 | 000,000,534 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.zip
[2013/05/11 12:09:41 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2013/05/11 09:39:33 | 000,000,951 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/05/11 09:39:33 | 000,000,933 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2013/05/11 09:32:07 | 000,002,463 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2013/05/11 09:25:16 | 000,762,695 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\bookmarks_5_11_13.html
[2013/04/15 07:00:34 | 000,019,778 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\lp creds 041513.csv
[2013/03/23 15:48:34 | 000,007,748 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\recently-used.xbel
[2013/03/02 14:05:01 | 000,937,667 | —- | C] () – C:\Documents and Settings\Administrator\save the date front filetype
[2012/12/05 09:29:21 | 000,027,520 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\dt.dat
[2012/10/07 02:03:27 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/09/17 18:39:50 | 000,056,136 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/09/17 13:00:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator\.swfinfo
[2012/08/28 19:03:41 | 002,811,988 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2012/04/02 18:31:29 | 008,892,928 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2011/12/24 12:51:53 | 000,000,225 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2011/12/24 12:51:53 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2011/12/24 12:51:53 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\bridf06a.dat
[2011/12/24 12:51:40 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2011/12/24 12:51:40 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2011/12/24 12:49:44 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2011/12/24 12:49:44 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2011/12/23 12:38:51 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/12/23 12:38:49 | 001,101,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/12/23 12:38:49 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/12/23 12:38:44 | 002,292,678 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2011/12/23 12:15:08 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2011/12/23 12:12:48 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2011/12/23 12:11:33 | 000,107,212 | —- | C] () – C:\WINDOWS\System32\zlib1.dll
[2011/12/23 12:11:24 | 000,162,304 | —- | C] () – C:\WINDOWS\System32\libpng13.dll
[2011/12/23 07:04:15 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2011/12/23 07:02:41 | 000,315,560 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== ZeroAccess Check ==========

[2011/12/23 12:12:51 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/11/17 05:21:35 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2010/11/17 05:21:09 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 22:42:10 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

OCD

Post #13May 14, 2013, 1:44 AM UTC

Hi randomnumber,

If all seems OK on your end we can wrap this up after these two steps.

1. Delete a File/Folder

Using Windows Explorer (Windows Key + E), locate the following files/folders, and DELETE them (if still present):

C:\Documents and Settings\All Users\Application Data\AVG2012 <– delete the folder, if present

Exit Explorer

=========================

2. ATF Cleaner by Atribune

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Download - ATF Cleaner
Right-click ATF-Cleaner.exe and select "run as administrator" to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

=========================

In your next post please provide the following:
How is the computer running?

randomnumber

Post #14May 14, 2013, 10:59 PM UTC

Done and Done. Things seem to be running well. Thanks OCD!

OCD

Post #15May 15, 2013, 1:41 AM UTC

Hi randomnumber,

Your log appears to be clean.

We have a few items to take care of before we get to the All Clean Speech.

=========================

1. Clean up with OTL:

Right-click OTL.exe select "Run as Administrator" to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

=========================

2. You can now delete any tools and/or logs remaining on your desktop.

=========================

3. Delete All But the Most Recent Restore Point

Open Disk Cleanup by clicking the Start button [external image: Posted Image]. In the search box, type Disk Cleanup, and then, in the list of results, click Disk Cleanup.
If prompted, select the drive that you want to clean up, and then click OK.
In the Disk Cleanup for (drive letter) dialog box, click Clean up system files. [external image: Posted Image] Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
If prompted, select the drive that you want to clean up, and then click OK.
Click the More Options tab, under System Restore and Shadow Copies, click Clean up.
In the Disk Cleanup dialog box, click Delete.
Click Delete Files, and then click OK.

=========================

4. Disable Java in Web Browsers

There is a vulnerability with regards to Java and web browsers. Therefore, we recommend to disable java in web browsers.
More information can be found here: http://www.techsupportforum.com/forums/f50…ers-683721.html

Click on the Start button and then click on the Control Panel option.
In the Control Panel Search enter Java Control Panel.
Click on the Java icon to open the Java Control Panel.

[external image: Posted Image]

Disable Java through the Java Control Panel

In the Java Control Panel, click on the Security tab.
Deselect the check box for Enable Java content in the browser. This will disable the Java plug-in in the browser.
Click Apply. When the Windows User Account Control (UAC) dialog appears, allow permissions to make the changes.
Click OK in the Java Plug-in confirmation window.
Restart the browser for changes to take effect.

[external image: Posted Image]

=========================

With the above items taken care of let's move on to the All Clean part of the process.

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Make your Mozilla Firefox more secure - This can be done by adding these add-ons:

Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

Free Anti-Virus

Avast Free Antivirus
Avira Free Antivirus 2013
PC Tools AntiVirus Free
Ad-Aware Free Antivirus +

Free Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here.

Online Armor Free
Agnitum Outpost Firewall Free
Comodo Firewall

Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Browser Hijack [Solved]

✨ Ask AI

Ask AI