What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Random Audio Plays [Solved]

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Delete C:\windows.old.

When finished:

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Download the attached CFScript.txt and save it to the location where Combofix is.


[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.



Then we can do the cleanup - if you are facing any issues, report that immediately.

Scan with adwCleaner


Please download AdwCleaner to your desktop.


  • Run adwcleaner.exe.
  • Hit delete.
  • When the run is finished, it will open up a text file.
  • Please post its contents within your next reply.
  • You´ll find the log file at C:\AdwCleaner[S1].txt also.

SecurityCheck

Please download SecurityCheck: LINK1 LINK2

  • Save it to your desktop, start it and follow the instructions in the window.
  • After the scan finished the (checkup.txt) will open. Copy its content to your thread.

Attachments:

Post #17 last edited
Here is the next log as requested:

ComboFix 13-06-22.01 - Laura 06/25/2013 17:31:50.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2045.920 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\Virus removal\ComboFix.exe
Command switches used :: c:\users\Laura\Desktop\Virus removal\CFScript.txt
AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}
FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}
SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Laura\AppData\LocalLow\9937.tmp"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\prefs.js
c:\programdata\Tarma Installer
c:\programdata\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setup.dll
c:\programdata\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll
c:\programdata\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.dat
c:\programdata\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.exe
c:\programdata\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.ico
c:\users\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setup.dll
c:\users\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll
c:\users\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.dat
c:\users\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.exe
c:\users\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.ico
c:\users\Laura\AppData\LocalLow\9937.tmp
.
Infected copy of c:\windows\system32\Version.dll was found and disinfected
Restored copy from - c:\windows\erdnt\cache\version.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-05-25 to 2013-06-25 )))))))))))))))))))))))))))))))
.
.
2013-06-25 22:38 . 2013-06-25 22:38 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-06-24 13:35 . 2013-06-24 13:35 ——– d—–w- c:\program files\ESET
2013-06-23 15:57 . 2013-06-23 15:57 ——– d—–w- c:\program files\Common Files\Java
2013-06-23 15:57 . 2013-06-23 15:56 867240 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-06-23 15:57 . 2013-06-23 15:56 94632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-06-21 16:19 . 2013-06-21 16:19 31560 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-06-20 19:57 . 2013-06-20 19:57 ——– d—–w- c:\programdata\Malwarebytes
2013-06-19 13:04 . 2013-06-19 13:04 ——– d—–w- C:\FRST
2013-06-16 18:10 . 2013-06-16 18:21 ——– d—–w- c:\programdata\Ad-Aware Antivirus
2013-06-16 18:10 . 2013-06-16 18:10 ——– d—–w- c:\users\Laura\AppData\Roaming\LavasoftStatistics
2013-06-16 17:53 . 2013-06-16 17:53 ——– d—–w- c:\programdata\Lavasoft
2013-06-16 17:53 . 2013-06-17 03:08 ——– d—–w- c:\program files\Ad-Aware Antivirus
2013-06-16 17:50 . 2013-06-16 17:50 ——– d—–w- c:\programdata\Downloaded Installations
2013-06-16 17:50 . 2013-06-16 17:58 ——– d—–w- c:\users\Laura\AppData\Local\adawarebp
2013-06-16 17:50 . 2013-06-16 17:50 ——– d—–w- c:\programdata\Ad-Aware Browsing Protection
2013-06-16 17:37 . 2013-06-16 17:37 44424 —-a-w- c:\windows\system32\sbbd.exe
2013-06-16 17:37 . 2013-06-16 17:37 13560 —-a-w- c:\windows\system32\drivers\gfibto.sys
2013-06-16 17:37 . 2013-06-18 20:15 ——– d—–w- c:\users\Laura\AppData\Roaming\Ad-Aware Antivirus
2013-06-14 13:45 . 2013-05-16 22:27 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2013-06-14 12:24 . 2013-06-14 12:24 ——– d—–w- c:\windows\system32\N360_BACKUP
2013-06-13 21:45 . 2013-05-08 04:37 905576 —-a-w- c:\windows\system32\drivers\tcpip.sys
2013-06-13 21:44 . 2013-05-02 04:04 443904 —-a-w- c:\windows\system32\win32spl.dll
2013-06-13 21:44 . 2013-05-02 04:03 37376 —-a-w- c:\windows\system32\printcom.dll
2013-06-13 21:44 . 2013-04-24 04:00 985600 —-a-w- c:\windows\system32\crypt32.dll
2013-06-13 21:44 . 2013-04-24 04:00 98304 —-a-w- c:\windows\system32\cryptnet.dll
2013-06-13 21:44 . 2013-04-24 04:00 133120 —-a-w- c:\windows\system32\cryptsvc.dll
2013-06-13 21:44 . 2013-04-24 04:00 41984 —-a-w- c:\windows\system32\certenc.dll
2013-06-13 21:44 . 2013-04-24 01:46 812544 —-a-w- c:\windows\system32\certutil.exe
2013-06-13 21:44 . 2013-04-17 12:30 24576 —-a-w- c:\windows\system32\cryptdlg.dll
2013-06-10 12:23 . 2013-06-10 12:23 ——– d—–w- c:\windows\Sun
2013-06-02 01:40 . 2013-06-02 01:40 ——– d—–w- c:\programdata\FitbitConnect
2013-06-02 01:40 . 2013-06-02 01:40 ——– d—–w- c:\program files\Fitbit Connect
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-23 15:56 . 2011-10-01 22:28 789416 —-a-w- c:\windows\system32\deployJava1.dll
2013-06-11 20:51 . 2012-04-02 11:32 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-11 20:51 . 2011-08-21 02:27 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-01 08:59 . 2013-05-01 08:59 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2013-05-01 08:59 . 2013-05-01 08:59 69632 —-a-w- c:\windows\system32\QuickTime.qts
2013-04-15 14:20 . 2013-05-15 11:40 638328 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-13 10:56 . 2013-05-15 11:40 37376 —-a-w- c:\windows\system32\cdd.dll
2013-04-09 01:36 . 2013-05-15 11:40 2049024 —-a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-04-05 59720]
"ApplePhotoStreams"="c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-04-05 59720]
"com.apple.dav.bookmarks.daemon"="c:\program files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe" [2013-04-05 59720]
"Fitbit Connect"="c:\program files\Fitbit Connect\Fitbit Connect.exe" [2013-02-25 3093024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ad-Aware Antivirus"="c:\program files\Ad-Aware Antivirus\AdAwareLauncher –windows-run" [X]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-09 36864]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-14 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-14 8433664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-14 81920]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2007-06-14 67584]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-15 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
"Fitbit Connect"="c:\program files\Fitbit Connect\Fitbit Connect.exe" [2013-02-25 3093024]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-24 27776968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
@="Ad-Aware Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
S2 Ad-Aware Service;Ad-Aware Service;c:\program files\Ad-Aware Antivirus\AdAwareService.exe [2013-03-18 1236336]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-09-20 73728]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 20:52]
.
2013-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-21 02:26]
.
2013-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-21 02:26]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://msn.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 4.2.2.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-25 17:42
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(2892)
c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
———————— Other Running Processes ————————
.
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fitbit Connect\FitbitConnectService.exe
c:\windows\system32\STacSV.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Ad-Aware Antivirus\SBAMSvc.exe
.
**************************************************************************
.
Completion time: 2013-06-25 17:46:01 - machine was rebooted
ComboFix-quarantined-files.txt 2013-06-25 22:45
ComboFix2.txt 2013-06-23 02:20
.
Pre-Run: 412,756,299,776 bytes free
Post-Run: 413,482,397,696 bytes free
.
- - End Of File - - 4547A148C86032B32243D3D565B6C6B4
5C616939100B85E558DA92B899A0FC36

As I went to post this Internet Explorer would not open and I got the following message: C:\Program Files\Internet Explorer\iexplore.exe
Illegal operation atempted on a registry key that has been marked for deletion.

I was able to pull IE up as administrator to post this log.


Should I proceed with the next steps?
Post #19 last edited
Here is the AdwCleaner log as requested:

# AdwCleaner v2.303 - Logfile created 06/26/2013 at 17:40:10
# Updated 08/06/2013 by Xplode
# Operating system : Windows Vista ™ Home Premium Service Pack 2 (32 bits)
# User : Laura - LAURA-PC
# Boot Mode : Normal
# Running from : C:\Users\Laura\Desktop\Virus removal\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Users\Public\Desktop\jZip.lnk
Folder Deleted : C:\Program Files\Common Files\Wondershare
Folder Deleted : C:\Program Files\jZip
Folder Deleted : C:\Program Files\Wondershare
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jZip
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
Folder Deleted : C:\Users\Laura\AppData\Local\jZip
Folder Deleted : C:\Users\Laura\AppData\Local\Wondershare

***** [Registry] *****

Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\jZip
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\jZip
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\Software\jZip
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\jZip

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16490

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [2565 octets] - [26/06/2013 17:38:59]
AdwCleaner[S1].txt - [2232 octets] - [26/06/2013 17:40:10]

########## EOF - C:\AdwCleaner[S1].txt - [2292 octets] ##########

Here is security check log:

Results of screen317's Security Check version 0.99.68
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Lavasoft Ad-Aware
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Ad-Aware
Java 7 Update 25
Adobe Reader 10.1.7 Adobe Reader out of Date!
````````Process Check: objlist.exe by Laurent````````
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Ad-Aware Antivirus AdAwareService.exe
Laura Desktop Virus removal SecurityCheck1.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 5 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

I have restarted, computer starts quickly, random audio is gone, but I am still getting the pop up for "A website wants to open web content using this program on your computer" from Adobe Flash and Java SE Runtime Environment 7. The Adobe Flash one is relentless, the Java one only comes up once when I open a new window, then I just X it out.
Post #20
Download and run OTL

  • Download OTL by OldTimer and save it to your desktop.
  • Double click on the OTL.exe icon on your desktop. If you are using Vista, please right-click and select run as administrator
  • Click the "Scan All Users" checkbox.


    Note: If you are using a Windows 64bit machine, please make sure the checkbox next to Include 64Bit Scans is checked. It will be checked by default.

  • Push the [external image: Posted Image] button.
  • It will now begin to scan, please be paitent while it scans.
  • Two reports will open once it's done.
  • Please copy and paste them in your next reply:
  • OTL.txt <– Will be opened
  • Extras.txt <– Will be minimized

Post #21
Here is the OTL Log as requested:

OTL logfile created on: 6/27/2013 2:16:40 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Laura\Desktop\Virus removal
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 53.43% Memory free
4.23 Gb Paging File | 3.15 Gb Available in Paging File | 74.56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 462.71 Gb Total Space | 368.76 Gb Free Space | 79.70% Space Free | Partition Type: NTFS

Computer Name: LAURA-PC | User Name: Laura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/27 14:15:14 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Laura\Desktop\Virus removal\OTL.exe
PRC - [2013/05/24 19:47:30 | 027,776,968 | —- | M] (Dropbox, Inc.) – C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2013/05/10 02:57:22 | 000,065,640 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/04/21 21:43:52 | 000,059,720 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
PRC - [2013/04/05 12:59:08 | 000,059,720 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
PRC - [2013/04/05 12:58:26 | 000,059,720 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
PRC - [2013/04/05 12:58:14 | 000,059,720 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
PRC - [2013/03/18 03:25:46 | 001,236,336 | —- | M] (Lavasoft Limited) – C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
PRC - [2013/03/18 03:25:44 | 018,828,128 | —- | M] (Lavasoft Limited) – C:\Program Files\Ad-Aware Antivirus\AdAware.exe
PRC - [2013/02/25 10:58:30 | 003,093,024 | —- | M] (Fitbit, Inc.) – C:\Program Files\Fitbit Connect\Fitbit Connect.exe
PRC - [2013/02/25 10:58:30 | 001,239,584 | —- | M] (Fitbit, Inc.) – C:\Program Files\Fitbit Connect\FitbitConnectService.exe
PRC - [2012/09/20 05:39:12 | 003,677,000 | —- | M] (GFI Software) – C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe
PRC - [2009/12/03 10:12:12 | 000,976,320 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\Epson Software\Event Manager\EEventManager.exe
PRC - [2009/04/10 23:27:38 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2007/09/20 14:31:10 | 000,073,728 | —- | M] (Andrea Electronics Corporation) – C:\Windows\System32\AEstSrv.exe
PRC - [2007/09/13 14:45:38 | 000,102,400 | —- | M] (IDT, Inc.) – C:\Windows\System32\stacsv.exe
PRC - [2007/09/13 14:44:48 | 000,405,504 | —- | M] (IDT, Inc.) – C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
PRC - [2007/05/09 17:01:00 | 000,036,864 | —- | M] (Creative Technology Ltd.) – C:\Windows\OEM02Mon.exe
PRC - [2006/12/19 18:23:20 | 000,094,208 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe


========== Modules (No Company Name) ==========

MOD - [2013/03/13 15:48:52 | 024,978,944 | —- | M] () – C:\Users\Laura\AppData\Roaming\Dropbox\bin\libcef.dll
MOD - [2012/11/13 18:32:50 | 003,558,400 | —- | M] () – C:\Users\Laura\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2011/09/27 07:23:00 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 07:22:40 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll


========== Services (SafeList) ==========

SRV - [2013/06/11 15:52:50 | 000,256,904 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/10 02:57:22 | 000,065,640 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2013/03/18 03:25:46 | 001,236,336 | —- | M] (Lavasoft Limited) [Auto | Running] – C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe – (Ad-Aware Service)
SRV - [2013/02/25 10:58:30 | 001,239,584 | —- | M] (Fitbit, Inc.) [Auto | Running] – C:\Program Files\Fitbit Connect\FitbitConnectService.exe – (Fitbit Connect)
SRV - [2012/09/20 05:39:12 | 003,677,000 | —- | M] (GFI Software) [Auto | Running] – C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe – (SBAMSvc)
SRV - [2008/01/18 23:38:26 | 000,272,952 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/09/20 14:31:10 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/09/13 14:45:38 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Running] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2006/12/19 18:23:20 | 000,094,208 | —- | M] (SEIKO EPSON CORPORATION) [Auto | Running] – C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe – (EpsonBidirectionalService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\ComboFix\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - [2013/06/21 11:19:40 | 000,031,560 | —- | M] () [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\mbamchameleon.sys – (mbamchameleon)
DRV - [2013/06/16 12:37:06 | 000,013,560 | —- | M] (GFI Software) [Kernel | Boot | Running] – C:\Windows\System32\drivers\gfibto.sys – (gfibto)
DRV - [2008/05/06 16:06:00 | 000,011,520 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\wdcsam.sys – (WDC_SAM)
DRV - [2007/10/10 17:03:00 | 000,235,648 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Dev.sys – (OEM02Dev)
DRV - [2007/09/13 14:46:06 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/06/14 16:25:00 | 007,110,880 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\nvlddmkm.sys – (nvlddmkm)
DRV - [2007/03/05 10:45:04 | 000,007,424 | —- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Vfx.sys – (OEM02Vfx)
DRV - [2007/02/25 07:14:00 | 002,216,448 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NETw4v32.sys – (NETw4v32)
DRV - [2006/11/15 00:16:24 | 000,032,256 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2006/11/14 19:42:46 | 000,043,520 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2006/11/14 17:35:20 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 56 6F 0C 77 50 CD 01 [binary data]
IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)



O1 HOSTS File: ([2013/06/25 17:41:40 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O4 - HKLM..\Run: [Ad-Aware Antivirus] C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher.exe (Lavasoft Limited)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [Fitbit Connect] C:\Program Files\Fitbit Connect\Fitbit Connect.exe (Fitbit, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000..\Run: [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
O4 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000..\Run: [com.apple.dav.bookmarks.daemon] C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe (Apple Inc.)
O4 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000..\Run: [Fitbit Connect] C:\Program Files\Fitbit Connect\Fitbit Connect.exe (Fitbit, Inc.)
O4 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000..\Run: [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08EC9B7A-44E7-49B9-AECC-5F3060C8EFDB}: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Laura\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Laura\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/25 17:46:03 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Local\temp
[2013/06/25 17:41:43 | 000,000,000 | —D | C] – C:\$RECYCLE.BIN
[2013/06/24 08:35:00 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2013/06/23 10:57:21 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2013/06/23 10:57:17 | 000,867,240 | —- | C] (Oracle Corporation) – C:\Windows\System32\npDeployJava1.dll
[2013/06/23 10:57:17 | 000,263,592 | —- | C] (Oracle Corporation) – C:\Windows\System32\javaws.exe
[2013/06/23 10:57:01 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\System32\javaw.exe
[2013/06/23 10:57:01 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\System32\java.exe
[2013/06/23 10:57:01 | 000,094,632 | —- | C] (Oracle Corporation) – C:\Windows\System32\WindowsAccessBridge.dll
[2013/06/22 21:28:46 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Virus removal
[2013/06/22 21:07:48 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/06/22 21:07:48 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/06/22 21:07:48 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2013/06/22 21:07:33 | 000,000,000 | —D | C] – C:\Qoobox
[2013/06/22 21:07:11 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/06/20 14:57:43 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2013/06/19 08:04:12 | 000,000,000 | —D | C] – C:\FRST
[2013/06/16 13:10:31 | 000,000,000 | —D | C] – C:\ProgramData\Ad-Aware Antivirus
[2013/06/16 13:10:29 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Roaming\LavasoftStatistics
[2013/06/16 12:53:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
[2013/06/16 12:53:49 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2013/06/16 12:53:46 | 000,000,000 | —D | C] – C:\Program Files\Ad-Aware Antivirus
[2013/06/16 12:50:47 | 000,000,000 | —D | C] – C:\ProgramData\Downloaded Installations
[2013/06/16 12:50:39 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Local\adawarebp
[2013/06/16 12:50:24 | 000,000,000 | —D | C] – C:\ProgramData\Ad-Aware Browsing Protection
[2013/06/16 12:37:07 | 000,044,424 | —- | C] (GFI Software) – C:\Windows\System32\sbbd.exe
[2013/06/16 12:37:07 | 000,013,560 | —- | C] (GFI Software) – C:\Windows\System32\drivers\gfibto.sys
[2013/06/16 12:37:01 | 000,000,000 | —D | C] – C:\Users\Laura\AppData\Roaming\Ad-Aware Antivirus
[2013/06/14 08:46:27 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2013/06/14 08:46:19 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2013/06/14 08:46:18 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2013/06/14 08:46:18 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2013/06/14 08:46:17 | 000,607,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2013/06/14 08:46:13 | 001,800,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2013/06/14 08:46:12 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2013/06/14 08:45:55 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2013/06/14 07:24:37 | 000,000,000 | —D | C] – C:\Windows\System32\N360_BACKUP
[2013/06/13 17:03:13 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Corpus 2013
[2013/06/13 16:52:28 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Graduation Chris
[2013/06/13 16:44:41 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printcom.dll
[2013/06/13 16:44:34 | 000,812,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\certutil.exe
[2013/06/13 16:44:34 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\certenc.dll
[2013/06/13 16:44:04 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cryptdlg.dll
[2013/06/13 16:39:43 | 000,000,000 | —D | C] – C:\Users\Laura\Desktop\Swim Team 2013
[2013/06/10 07:23:33 | 000,000,000 | —D | C] – C:\Windows\Sun
[2013/06/01 20:40:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fitbit Connect
[2013/06/01 20:40:16 | 000,000,000 | —D | C] – C:\ProgramData\FitbitConnect
[2013/06/01 20:40:13 | 000,000,000 | —D | C] – C:\Program Files\Fitbit Connect

========== Files - Modified Within 30 Days ==========

[2013/06/27 14:12:06 | 000,003,664 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/27 14:12:06 | 000,003,664 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/27 13:51:06 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/27 13:51:02 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/27 13:51:01 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/06/27 07:29:19 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/26 17:59:41 | 000,027,335 | —- | M] () – C:\Users\Laura\AppData\Roaming\nvModes.001
[2013/06/26 17:59:41 | 000,001,753 | —- | M] () – C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
[2013/06/26 17:58:21 | 2145,431,552 | -HS- | M] () – C:\hiberfil.sys
[2013/06/26 17:57:37 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2013/06/26 17:44:14 | 000,027,335 | —- | M] () – C:\Users\Laura\AppData\Roaming\nvModes.dat
[2013/06/25 17:41:40 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2013/06/24 20:53:32 | 000,607,694 | —- | M] () – C:\Windows\System32\perfh009.dat
[2013/06/24 20:53:32 | 000,105,302 | —- | M] () – C:\Windows\System32\perfc009.dat
[2013/06/23 10:56:32 | 000,094,632 | —- | M] (Oracle Corporation) – C:\Windows\System32\WindowsAccessBridge.dll
[2013/06/23 10:56:31 | 000,867,240 | —- | M] (Oracle Corporation) – C:\Windows\System32\npDeployJava1.dll
[2013/06/23 10:56:31 | 000,789,416 | —- | M] (Oracle Corporation) – C:\Windows\System32\deployJava1.dll
[2013/06/23 10:56:31 | 000,263,592 | —- | M] (Oracle Corporation) – C:\Windows\System32\javaws.exe
[2013/06/23 10:56:31 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\System32\javaw.exe
[2013/06/23 10:56:31 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\System32\java.exe
[2013/06/22 18:03:18 | 000,000,116 | —- | M] () – C:\Users\Public\Desktop\NortonIdentifySafe.url
[2013/06/21 11:19:40 | 000,031,560 | —- | M] () – C:\Windows\System32\drivers\mbamchameleon.sys
[2013/06/19 08:34:06 | 308,313,514 | —- | M] () – C:\Windows\MEMORY.DMP
[2013/06/17 07:08:17 | 000,000,838 | —- | M] () – C:\Windows\System32\RegistrationConfig.xml
[2013/06/17 01:15:35 | 000,000,616 | —- | M] () – C:\Windows\System32\SoftwareUpdateConfig.xml
[2013/06/16 22:08:26 | 000,000,722 | —- | M] () – C:\Windows\System32\ThreatDefinitionsConfig.xml
[2013/06/16 22:08:25 | 000,001,188 | —- | M] () – C:\Windows\System32\ServiceConfig.xml
[2013/06/16 12:37:06 | 000,044,424 | —- | M] (GFI Software) – C:\Windows\System32\sbbd.exe
[2013/06/16 12:37:06 | 000,013,560 | —- | M] (GFI Software) – C:\Windows\System32\drivers\gfibto.sys
[2013/06/16 12:36:43 | 000,000,680 | —- | M] () – C:\Users\Laura\AppData\Local\d3d9caps.dat
[2013/06/14 08:45:07 | 000,000,129 | —- | M] () – C:\Windows\System32\MRT.INI
[2013/06/14 08:09:22 | 000,000,852 | —- | M] () – C:\Users\Laura\Desktop\Norton Installation Files.lnk
[2013/06/11 15:51:38 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 15:51:37 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/06/11 07:23:34 | 000,000,951 | —- | M] () – C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013/06/11 07:22:03 | 000,000,919 | —- | M] () – C:\Users\Laura\Desktop\Dropbox.lnk
[2013/06/08 12:39:47 | 000,001,680 | —- | M] () – C:\Users\Laura\Application Data\Microsoft\Internet Explorer\Quick Launch\Snipping Tool.lnk

========== Files Created - No Company Name ==========

[2013/06/22 21:07:48 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/06/22 21:07:48 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/06/22 21:07:48 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/06/22 21:07:48 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/06/22 21:07:48 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/06/22 18:03:18 | 000,000,116 | —- | C] () – C:\Users\Public\Desktop\NortonIdentifySafe.url
[2013/06/21 11:55:30 | 2145,431,552 | -HS- | C] () – C:\hiberfil.sys
[2013/06/21 11:19:40 | 000,031,560 | —- | C] () – C:\Windows\System32\drivers\mbamchameleon.sys
[2013/06/17 01:15:35 | 000,000,616 | —- | C] () – C:\Windows\System32\SoftwareUpdateConfig.xml
[2013/06/16 22:08:26 | 000,000,838 | —- | C] () – C:\Windows\System32\RegistrationConfig.xml
[2013/06/16 22:08:26 | 000,000,722 | —- | C] () – C:\Windows\System32\ThreatDefinitionsConfig.xml
[2013/06/16 22:08:25 | 000,001,188 | —- | C] () – C:\Windows\System32\ServiceConfig.xml
[2013/06/16 12:53:58 | 000,001,753 | —- | C] () – C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
[2013/06/14 08:45:07 | 000,000,129 | —- | C] () – C:\Windows\System32\MRT.INI
[2013/06/08 12:39:47 | 000,001,680 | —- | C] () – C:\Users\Laura\Application Data\Microsoft\Internet Explorer\Quick Launch\Snipping Tool.lnk
[2013/02/09 13:14:08 | 000,000,173 | -HS- | C] () – C:\ProgramData\.zreglib
[2012/06/28 12:01:38 | 000,001,907 | —- | C] () – C:\Users\Laura\systemlog
[2011/09/14 11:00:06 | 000,013,824 | —- | C] () – C:\Users\Laura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/12 09:07:12 | 000,073,220 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2011/09/12 09:07:12 | 000,001,140 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2011/09/12 09:07:12 | 000,001,140 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2011/09/12 09:07:12 | 000,001,137 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2011/09/12 09:07:12 | 000,001,130 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2011/09/12 09:07:12 | 000,001,130 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2011/09/12 09:07:12 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2011/09/12 09:07:12 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2011/09/12 09:07:11 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2011/09/12 09:07:11 | 000,029,114 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2011/09/12 09:07:11 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2011/09/12 09:07:11 | 000,021,021 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2011/09/12 09:07:11 | 000,015,670 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2011/09/12 09:07:11 | 000,013,280 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2011/09/12 09:07:11 | 000,010,673 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2011/09/12 09:07:11 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2011/09/12 07:15:00 | 000,000,079 | —- | C] () – C:\Windows\ENX625.ini
[2011/09/01 19:41:07 | 000,000,552 | —- | C] () – C:\Users\Laura\AppData\Local\d3d8caps.dat
[2011/08/24 07:17:08 | 000,000,000 | —- | C] () – C:\Users\Laura\AppData\Local\{8456B38C-F65B-4564-9055-A36F44B787A9}
[2011/08/23 20:06:35 | 000,002,194 | —- | C] () – C:\Users\Laura\AppData\Roaming\evpro32.prf
[2011/08/20 17:02:25 | 000,189,203 | —- | C] () – C:\Windows\hpwins23.dat
[2011/08/20 17:02:25 | 000,001,501 | —- | C] () – C:\Windows\hpwmdl23.dat
[2011/08/20 15:14:07 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2011/08/20 15:13:49 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/08/20 15:13:49 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/08/20 15:00:29 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2011/08/20 14:03:09 | 000,027,335 | —- | C] () – C:\Users\Laura\AppData\Roaming\nvModes.001
[2011/08/20 13:29:05 | 000,027,335 | —- | C] () – C:\Users\Laura\AppData\Roaming\nvModes.dat
[2011/08/20 13:09:56 | 000,000,680 | —- | C] () – C:\Users\Laura\AppData\Local\d3d9caps.dat
[2011/08/17 13:43:28 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll

========== ZeroAccess Check ==========

[2006/11/02 07:54:22 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 12:47:00 | 011,586,048 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/04/10 23:28:20 | 000,614,912 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/04/10 23:28:26 | 000,347,648 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Alternate Data Streams ==========

@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:0D786AE3

< End of report >


And Here is the Extras log:

OTL Extras logfile created on: 6/27/2013 2:16:40 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Laura\Desktop\Virus removal
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 53.43% Memory free
4.23 Gb Paging File | 3.15 Gb Available in Paging File | 74.56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 462.71 Gb Total Space | 368.76 Gb Free Space | 79.70% Space Free | Partition Type: NTFS

Computer Name: LAURA-PC | User Name: Laura | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C6FC6CE-9747-4582-A5AF-B3EEA7B58378}" = rport=445 | protocol=6 | dir=out | app=system |
"{4FE2F359-B8D2-42A9-A4C2-31A669399C6C}" = lport=138 | protocol=17 | dir=in | app=system |
"{550B8A04-4143-4857-BFF4-34F03A2DFDC4}" = rport=138 | protocol=17 | dir=out | app=system |
"{60BEF404-CEC9-4D36-992E-7051BD9ED4FF}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{61D5A5AA-C8EC-4F00-972F-4565901F403A}" = lport=139 | protocol=6 | dir=in | app=system |
"{7F334563-17E4-4701-9966-AF30D36702CB}" = lport=445 | protocol=6 | dir=in | app=system |
"{B09EFD3E-F171-42A9-ABA4-61093345900B}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{C48ADAF0-D1FF-4364-9E6C-A713BC541FB5}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{D78BB285-1089-457E-8B74-66CD1DA1CFFA}" = rport=139 | protocol=6 | dir=out | app=system |
"{D9E171F5-0234-424A-86A2-A0AB152A0A41}" = rport=137 | protocol=17 | dir=out | app=system |
"{E9BEB17E-4A73-4AEF-B2A2-6A150A6C1838}" = lport=137 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01C6D4EC-B36F-4563-95DA-3AE190D4EEE1}" = protocol=17 | dir=in | app=c:\program files\adawaretb\dtuser.exe |
"{0C40935E-D9C4-4720-A5FF-9A8C1EF1796F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{0CAEC97C-47D0-43D1-BFA8-A9608B8E07C2}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{0F048601-5460-4AC7-9B82-22155FA8492F}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{14B3C15A-C370-481A-8817-C6ECAF9F4702}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{166BC570-1B83-4D0B-A6D2-7E8ECAAE11EF}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{1970467A-A97F-4958-8B82-B7AE613F0D55}" = protocol=6 | dir=in | app=c:\program files\adawaretb\dtuser.exe |
"{24409642-D674-4708-BA58-D0C3C698801F}" = protocol=17 | dir=in | app=c:\users\laura\appdata\roaming\dropbox\bin\dropbox.exe |
"{3B26AD40-F39F-46FB-ABBF-6C0A3C4042E7}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{5659A053-9ADA-44B6-BED9-840C530C4AAB}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6FD20811-779C-4854-897D-EE13B5EC3876}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{7BD0CFE9-82F4-49E0-9626-5FB25CC06C71}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{896D26B2-2316-4F6F-B265-3D904DC08CA7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{91A9D3B0-E322-4C1A-A7C8-DA3E66582CEA}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{A31ECBC3-7299-44A6-8CB0-4FADE351435C}" = protocol=6 | dir=in | app=c:\users\laura\appdata\roaming\dropbox\bin\dropbox.exe |
"{B87F0071-D47D-44C1-9158-CE45091F59AB}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{D0DD4B8D-8496-4D75-A361-3AB392AC4796}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{E0920CB2-F2F8-4A6F-8CAB-B24C05ADD85B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{F62DF185-F8A9-4DC1-A25C-6D55F6DA01D9}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"TCP Query User{3B8F3449-A194-45EF-8AD1-9766986CAA0B}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe |
"UDP Query User{3E21DBBE-4508-4192-BA80-FF3612A0C8AE}C:\program files\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files\epson software\event manager\eeventmanager.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}" = Epson Event Manager
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network
"{0E52A52C-E120-461C-AA1B-21B045BEE842}" = bpd_scan
"{11968F04-71FB-4C8C-B4D8-14FA4171EE36}" = 6500_E709_Help_BasicWeb
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C8C6D37-CA3C-4EF6-A1E5-0D188E7B6021}" = HP Officejet 6500 E709 Series
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72144B9D-58C4-4C09-A5CF-C6A914B912E8}" = Camtasia Studio 8
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B7044AE-6D1F-456D-B2BA-28BFFFAF3F71}" = Epson Easy Photo Print Plug-in for Windows Live Photo Gallery Setup
"{84BBFA13-C40E-4287-85EF-E8B1034451AA}" = Windows Media Encoder 9 Series SDK
"{86196C81-759C-4F74-8DFF-36F9F50FEEAC}" = 6500_E709_BasicWeb
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{925F1DB6-E86E-4378-9091-D1F68B0583C9}" = iCloud
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.7)
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{C0E8FE43-C35B-451D-B35F-D4BD056D70E7}" = Camtasia Studio 7
"{C1A0A3F9-C302-4A18-A2E0-71C927D24652}" = Epson Easy Photo Print 2
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{C9D8A041-2963-4B31-8FFC-1500F3DB9293}" = EpsonNet Setup 3.3
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E6C82F8F-2031-4825-8CC3-98C5960875C1}" = Epson CreativeZone
"{F075020E-43B2-4F2C-9723-C81CE162E7B6}" = Ad-Aware Antivirus
"{F8E3C768-71F3-11E1-9DF7-70804824019B}" = Snagit 11
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FAD96046-769E-4A4B-949B-8D29D885EFD6}" = BPDSoftware_Ini
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FEA3976F-D621-45F3-AFBD-E812A1F2F00D}_is1" = Wondershare Data Recovery(Build [removed])
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"CloneDVD2" = CloneDVD2
"CloneDVDmobile" = CloneDVDmobile
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"EEPPPlugIn" = Epson Easy Photo Print Plug-in for Windows Live Photo Gallery
"ENTERPRISER" = Microsoft Office Enterprise 2007
"EPSON NX620 Series" = EPSON NX620 Series Printer Uninstall
"EPSON Scanner" = EPSON Scan
"ESET Online Scanner" = ESET Online Scanner v3
"ExamView Pro" = ExamView Pro
"Fitbit Connect" = Fitbit Connect
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.1
"FreeStar Convert MP3 to WMA" = FreeStar Convert MP3 to WMA 1.0.5
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 9/16/2012 5:42:44 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 9/16/2012 5:42:45 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2746

Error - 9/16/2012 5:42:45 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2746

Error - 9/16/2012 5:42:46 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 9/16/2012 5:42:46 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3869

Error - 9/16/2012 5:42:46 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3869

Error - 9/16/2012 5:42:47 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 9/16/2012 5:42:47 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4867

Error - 9/16/2012 5:42:47 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4867

Error - 9/16/2012 5:42:48 PM | Computer Name = Laura-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

[ Media Center Events ]
Error - 9/11/2012 6:20:55 PM | Computer Name = Laura-PC | Source = MCUpdate | ID = 0
Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed
due to an abandoned mutex.'.

[ OSession Events ]
Error - 6/24/2013 9:53:29 PM | Computer Name = Laura-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 506
seconds with 240 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 6/26/2013 6:44:31 PM | Computer Name = Laura-PC | Source = DCOM | ID = 10005
Description =

Error - 6/26/2013 6:44:32 PM | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 6/26/2013 7:00:01 PM | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/26/2013 7:00:01 PM | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 6/26/2013 7:00:03 PM | Computer Name = Laura-PC | Source = DCOM | ID = 10005
Description =

Error - 6/26/2013 7:00:04 PM | Computer Name = Laura-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 6/27/2013 8:22:21 AM | Computer Name = Laura-PC | Source = BTHUSB | ID = 327697
Description = The local Bluetooth adapter has failed in an undetermined manner and
will not be used. The driver has been unloaded.

Error - 6/27/2013 10:30:02 AM | Computer Name = Laura-PC | Source = BTHUSB | ID = 327697
Description = The local Bluetooth adapter has failed in an undetermined manner and
will not be used. The driver has been unloaded.

Error - 6/27/2013 2:50:59 PM | Computer Name = Laura-PC | Source = BTHUSB | ID = 327697
Description = The local Bluetooth adapter has failed in an undetermined manner and
will not be used. The driver has been unloaded.

Error - 6/27/2013 3:00:11 PM | Computer Name = Laura-PC | Source = bowser | ID = 8003
Description =


< End of report >
Post #22
I´m currently on my way back from a military training and will reply as soon as I´m at home. Please be patient with me. Thank you!
Post #24
Please double-click OTL.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :OTL
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
    O7 - HKU\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    @Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:0D786AE3
    :commands
    [emptytemp]

  • Return to OTL, right click in the "Custom Scans/Fixes" section and choose Paste.
  • Click the red Run Fix button.
  • OTL may ask to reboot the machine. Please do so.
  • If OTL did not reboot the machine, click OK and the log will open. Post the contents of the log in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

    Also post a new OTL log.



Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Post that log back here.
Post #25
OTL Log as requested: All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully. Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry key HKEY_USERS\S-1-5-21-3498360357-3444985229-4079282796-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully. Registry value HKEY_USERS\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoLowDiskSpaceChecks deleted successfully. Registry value HKEY_USERS\S-1-5-21-3498360357-3444985229-4079282796-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully. ADS C:\ProgramData\TEMP:0D786AE3 deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 56468 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Laura ->Temp folder emptied: 157956 bytes ->Temporary Internet Files folder emptied: 219007992 bytes ->Java cache emptied: 0 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 31857 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 46168 bytes RecycleBin emptied: 890988 bytes Total Files Cleaned = 210.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 06302013_152424 Files\Folders moved on Reboot… C:\Users\Laura\AppData\Local\Temp\Low\JavaDeployReg.log moved successfully. File\Folder C:\Users\Laura\AppData\Local\Temp\~DF57AF.tmp not found! File\Folder C:\Users\Laura\AppData\Local\Temp\~DF57B4.tmp not found! File\Folder C:\Users\Laura\AppData\Local\Temp\~DF57FA.tmp not found! File\Folder C:\Users\Laura\AppData\Local\Temp\~DF57FF.tmp not found! C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HSWNND9H\index[1].htm moved successfully. C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CNG92E6N\iframe[1].htm moved successfully. C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully. C:\Users\Laura\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully. PendingFileRenameOperations files… Registry entries deleted on Reboot… Mbam log as requested: Malwarebytes Anti-Malware (Trial) 1.75.0.1300 www.malwarebytes.org Database version: v2013.06.30.07 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Laura :: LAURA-PC [administrator] Protection: Enabled 6/30/2013 3:56:22 PM mbam-log-2013-06-30 (15-56-22).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 213673 Time elapsed: 9 minute(s), 18 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Mbam scan showed no malicious items, so nothing to remove. As I opened this to run and post, I still continue to get the yellow popup boxes re Adobe Flash and Java SE Runtime 7.
Post #28
Well´allow them both as they are the legit updaters of these programs.

when finished with them both, reboot and do the following.


SecurityCheck

Please download SecurityCheck: LINK1 LINK2

  • Save it to your desktop, start it and follow the instructions in the window.
  • After the scan finished the (checkup.txt) will open. Copy its content to your thread.
Post #29
Here is the Security Check log:

Results of screen317's Security Check version 0.99.68
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Lavasoft Ad-Aware
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Ad-Aware
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 25
Adobe Reader 10.1.7 Adobe Reader out of Date!
````````Process Check: objlist.exe by Laurent````````
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Ad-Aware Antivirus AdAwareService.exe
Ad-Aware Antivirus AdAware.exe
Ad-Aware Antivirus SBAMSvc.exe
Laura Desktop Virus removal SecurityCheck.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 6 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````


The Java Popup has stopped, but the Adobe Flash popup has not gone away in spite of repeatedly "allowing" the updates. In fact it has increased, having to click 8-12 times now every time I change the screen. The security one only pops up once or twice occasionally, but the Adobe one is relentless.
Post #30
Adobe flash player update


Your Adobe flash player is outdated. We will fix this.
  • Get the actual player from here. Important: Uncheck any optional software (for example Google Chrome, etc.) offered.
  • Click upon Start–>control panel–>add/remove programs.
  • Search for and remove any older reader versions.

Tell me if the window still appears

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI