Spyware / Malware / Virus Removal

altshell.ini? Threat? [Solved]

5 min read

Looking for the outcome? Ask AI

Edd12 Topic Starter

Post #1June 25, 2013, 4:20 PM UTC

Hi experts,
Months ago, my laptop was infected by Australian Federal Police Ukash (similar to FBI moneypak I think) which prevented me from accessing of my laptop. Thanks to the team here who provided excellent advices to help to clear this malware.

Today I performed deep scan using Emsisoft Emergency Kit Scanner to check my laptop. Altshell.ini was found as medium risk threat which seems to always related to ransomwares such as Ukash and FBI moneypak. I have quarantined this file because I am not sure whether it is appropriate to delete it.

I have just checked my previous post which you can see from the link here http://forums.whatthetech.com/index.php?sh…=ukash&st=0, I can see Altshell.ini is in every log produced by OTL and FRST, but I was not advised to take action to remove it. So is it safe to leave it in my laptop? I am confused.

Is my laptop affected by malware again? Although I don't see apparent symptoms from laptop.

Edd12

Edd12

Post #2June 25, 2013, 4:58 PM UTC last edited June 25, 2013, 5:03 PM UTC

here is the log from Emsisoft Emergency Kit

Emsisoft Emergency Kit - Version 3.0
Last update: 25/06/2013 05:51:30 PM

Scan settings:

Scan type: Deep Scan
Objects: Rootkits, Memory, Traces, C:\

Detect Riskware: Off
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start: 25/06/2013 06:02:01 PM

C:\Users\Zhi\AppData\Roaming\AltShell.ini detected: Trace.File.Foreign (A)

Scanned 462107
Found 1

Scan end: 25/06/2013 06:46:00 PM
Scan time: 0:43:59

C:\Users\Zhi\AppData\Roaming\AltShell.ini Quarantined Trace.File.Foreign (A)

Quarantined 1

I have downloaded OTL and followed the instructions from my previous post which is also listed below. It couldn't generate a Extra.txt, maybe it couldn't overwrite the old one from my desktop and there is no OTL folder in C drive to locate the logs. So I only got the OLT.txt here. See if this can help you diagnose the problem. Not sure whether it is due to AltShell.ini was quarantined by Emsisoft Emergency Kit, I don't see AltShell.ini in OTL log.

•Make sure all other windows are closed and to let it run uninterrupted.
•When the window appears, underneath Output at the top change it to Minimal Output.
•Check the boxes beside LOP Check and Purity Check.
•Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
BASESERVICES
DRIVES
CREATERESTOREPOINT

•Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
◦When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
◦Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

OTL.txt

OTL logfile created on: 26/06/2013 02:26:50 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Zhi\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00002009 | Country: Jamaica | Language: ENJ | Date Format: dd/MM/yyyy

11.96 Gb Total Physical Memory | 9.71 Gb Available Physical Memory | 81.20% Memory free
23.92 Gb Paging File | 21.49 Gb Available in Paging File | 89.85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 684.54 Gb Total Space | 313.29 Gb Free Space | 45.77% Space Free | Partition Type: NTFS

Computer Name: ZHI-PC | User Name: Zhi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Zhi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe ()
PRC - C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Toshiba\TOSHIBA Sleep Utility\TSleepSrv.exe (TOSHIBA)
PRC - C:\ProgramData\Clickfree\BoxSoftware\reminder\SacReminder.exe (SAC)
PRC - C:\ProgramData\Clickfree\BoxSoftware\UACProxy.exe (Storage Appliance Corp.)
PRC - C:\Program Files (x86)\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.77\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Toshiba\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\wincfi39.dll ()
MOD - C:\ProgramData\Clickfree\BoxSoftware\reminder\ActivationLib.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (SBUpd) – C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe (Speedbit Ltd.)
SRV:64bit: - (Intel® – C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel® Corporation)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (TosCoSrv) – C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TPCHSrv) – C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TOSHIBA eco Utility Service) – C:\Program Files\TOSHIBA\TECO\TecoService.exe (TOSHIBA Corporation)
SRV:64bit: - (TODDSrv) – C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (GFNEXSrv) – C:\Windows\SysNative\GFNEXSrv.exe ()
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (N360) – C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe (Symantec Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SSUService) – C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.)
SRV - (Secunia PSI Agent) – C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) – C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
SRV - (Skype C2C Service) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (Norton PC Checkup Application Launcher) – C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (SplashtopRemoteService) – C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (Splashtop Inc.)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (jhi_service) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Intel Corporation)
SRV - (Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe ()
SRV - (CFUACProxy_boxsoftware) – C:\ProgramData\Clickfree\BoxSoftware\UACProxy.exe (Storage Appliance Corp.)
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (PCCUJobMgr) – C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.77\ccSvcHst.exe (Symantec Corporation)
SRV - (TMachInfo) – C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (cfWiMAXService) – C:\Program Files (x86)\Toshiba\ConfigFree\CFIWmxSvcs64.exe (TOSHIBA CORPORATION)
SRV - (ConfigFree Service) – C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (NOBU) – C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\N360x64\1404000.028\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\N360x64\1404000.028\symds64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\N360x64\1404000.028\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\drivers\N360x64\1404000.028\symnets.sys (Symantec Corporation)
DRV:64bit: - (ccSet_N360) – C:\Windows\SysNative\drivers\N360x64\1404000.028\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\N360x64\1404000.028\ironx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\N360x64\1404000.028\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SBUpdd) – C:\Program Files\Common Files\SpeedBit\SBUpdate\sbw.sys ()
DRV:64bit: - (PSI) – C:\Windows\SysNative\drivers\psi_mf_amd64.sys (Secunia)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) – C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (tosrfbd) – C:\Windows\SysNative\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (iusb3xhc) – C:\Windows\SysNative\drivers\iusb3xhc.sys (Intel Corporation)
DRV:64bit: - (iusb3hub) – C:\Windows\SysNative\drivers\iusb3hub.sys (Intel Corporation)
DRV:64bit: - (iusb3hcs) – C:\Windows\SysNative\drivers\iusb3hcs.sys (Intel Corporation)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Tosrfusb) – C:\Windows\SysNative\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (BtFilter) – C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (PGEffect) – C:\Windows\SysNative\drivers\PGEffect.sys (TOSHIBA Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (Tosrfhid) – C:\Windows\SysNative\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV:64bit: - (tosrfec) – C:\Windows\SysNative\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV:64bit: - (tdcmdpst) – C:\Windows\SysNative\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (TVALZFL) – C:\Windows\SysNative\drivers\TVALZFL.sys (TOSHIBA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\BASHDefs\20130620.001\BHDrvx64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\VirusDefs\20130625.002\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\VirusDefs\20130625.002\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\IPSDefs\20130622.001\IDSviA64.sys (Symantec Corporation)
DRV - (A2DDA) – C:\Users\Zhi\Desktop\EmsisoftEmergencyKit\Run\a2ddax64.sys (Emsisoft GmbH)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7NOOH
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://nortonsafe.search.ask.com/web?q={SE…d&qsrc=2869
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_43: C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\coFFPlgn\ [2013/06/26 02:23:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\DAP\daplinkchecker [2013/06/03 23:15:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\IPSFFPlgn\ [2013/04/22 21:15:15 | 000,000,000 | —D | M]

O1 HOSTS File: ([2009/06/11 07:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\Toshiba\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll ()
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SpeedBit Link Verification Helper) - {D5974A72-C81C-4DC3-BE77-A8A7BBC8864E} - C:\Program Files (x86)\DAP\LinkVerifier.dll (Speedbit Ltd.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\Toshiba\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll ()
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SRS Premium Sound HD] C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (SRS Labs, Inc.)
O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPSCMain] C:\Program Files\TOSHIBA\PeakShift\TPSCMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [NortonOnlineBackup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [SacReminderBOX] C:\ProgramData\Clickfree\BoxSoftware\reminder\SacReminder.exe (SAC)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TSleepSrv] C:\Program Files (x86)\Toshiba\TOSHIBA Sleep Utility\TSleepSrv.exe (TOSHIBA)
O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [DownloadAccelerator] C:\Program Files (x86)\DAP\DAP.EXE (Speedbit Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O8:64bit: - Extra context menu item: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm ()
O8:64bit: - Extra context menu item: &Verify with DAP - C:\Program Files (x86)\DAP\dapverify.htm ()
O8:64bit: - Extra context menu item: Add to TOSHIBA Bulletin Board - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)
O8:64bit: - Extra context menu item: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm ()
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm ()
O8 - Extra context menu item: &Verify with DAP - C:\Program Files (x86)\DAP\dapverify.htm ()
O8 - Extra context menu item: Add to TOSHIBA Bulletin Board - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)
O8 - Extra context menu item: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm ()
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9:64bit: - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom64.dll (TODO: <会社名>)
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom64.dll (TODO: <会社名>)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)
O9 - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{28F0FCFF-8CA8-4E8D-BF59-8B93DF883E4A}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA01719B-E094-4910-86E3-B7A5AFF092AF}: DhcpNameServer = 192.168.1.1 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/06/26 02:24:44 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Zhi\Desktop\OTL.exe
[2013/06/26 02:21:57 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{96C90D5A-6D49-41F0-8C25-1CE012157FC5}
[2013/06/25 21:04:49 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{D6D6ADAD-47BE-4818-8065-998F75AE5FCE}
[2013/06/25 17:27:46 | 000,000,000 | —D | C] – C:\Users\Zhi\Desktop\EmsisoftEmergencyKit
[2013/06/25 15:28:59 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{0E9EE9E6-E2A4-4AC8-A0AF-B12B86EC8F9B}
[2013/06/25 15:26:28 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{E23AF6F5-8658-48E3-94F0-ECE76E3108DD}
[2013/06/25 15:21:47 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{2DD3DD6E-6292-4D8C-8C6C-B7DE26659B6A}
[2013/06/25 15:18:05 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{86130D19-2CDB-4417-BB40-3BFEDC63C6F1}
[2013/06/24 15:58:02 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{E6233AE9-E6FB-4694-8F32-342CE6E2DE41}
[2013/06/22 23:44:49 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{E54AC3C2-7D14-497F-AF9D-A952142EF809}
[2013/06/22 23:42:20 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{2F820422-AB36-4545-9D5B-C48DE158B85B}
[2013/06/22 23:39:31 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{50137556-89E6-484B-B7FE-5F470F961814}
[2013/06/22 23:32:36 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{238E8125-4F85-4353-88BD-DCF80699FB18}
[2013/06/22 23:30:41 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{FE87CE9E-9F19-4F8D-9100-EE71A63B5ABB}
[2013/06/22 21:29:11 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{4B2EBF38-7F97-4776-B76F-28FA5F339224}
[2013/06/22 18:30:40 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{D1932364-213E-4BBB-AB8C-B42C877C07CA}
[2013/06/22 18:05:39 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{F1CBEFFD-A728-44E5-900A-D50181044812}
[2013/06/21 13:52:42 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{2B7A5E38-BB89-4698-A9DC-3808CDF58AD4}
[2013/06/20 23:47:34 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{296C2378-B51C-47B6-B4EE-320420D63961}
[2013/06/20 18:32:22 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{2462D973-DA1C-449E-9CAB-336F520130EE}
[2013/06/20 18:26:58 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{5216D6C4-AD99-4F41-A089-4735D27102B8}
[2013/06/19 23:20:25 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{E0279D39-2F0E-47EB-95EA-FDA10272C4DB}
[2013/06/16 22:06:25 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{D6C8234C-E103-4DA3-AEC8-110F31CCDC7A}
[2013/06/16 22:02:36 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{7AC0A048-6774-422F-9AA6-F4A9CBCDB168}
[2013/06/16 19:36:01 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{0BD209F3-5046-4EC9-A9D4-0C6B53B28D1A}
[2013/06/16 03:00:31 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieui.dll
[2013/06/16 03:00:30 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieui.dll
[2013/06/15 18:53:22 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{A6024E16-30DC-4D81-8363-41208F59C21E}
[2013/06/14 02:34:29 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{EA3E27F6-EFA4-4441-B105-C5E4BCE4E3F9}
[2013/06/13 16:12:51 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesysprep.dll
[2013/06/13 16:12:51 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesysprep.dll
[2013/06/13 16:12:51 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\RegisterIEPKEYs.exe
[2013/06/13 16:12:51 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/13 16:12:51 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesetup.dll
[2013/06/13 16:12:51 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesetup.dll
[2013/06/13 16:12:51 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ie4uinit.exe
[2013/06/13 16:12:51 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iernonce.dll
[2013/06/13 16:12:51 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iernonce.dll
[2013/06/13 16:12:50 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript9.dll
[2013/06/13 16:12:50 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript.dll
[2013/06/13 16:12:50 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\jscript.dll
[2013/06/13 16:12:50 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msfeeds.dll
[2013/06/12 16:35:02 | 001,887,232 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d11.dll
[2013/06/12 16:35:02 | 001,505,280 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\d3d11.dll
[2013/06/12 16:07:56 | 000,751,104 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\win32spl.dll
[2013/06/12 16:07:56 | 000,492,544 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\win32spl.dll
[2013/06/12 16:07:52 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\cryptdlg.dll
[2013/06/12 16:07:52 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\cryptdlg.dll
[2013/06/12 16:07:43 | 001,424,384 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\WindowsCodecs.dll
[2013/06/12 16:06:36 | 001,192,448 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\certutil.exe
[2013/06/12 16:06:35 | 001,464,320 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\crypt32.dll
[2013/06/12 16:06:35 | 000,903,168 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\certutil.exe
[2013/06/12 16:06:35 | 000,139,776 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\cryptnet.dll
[2013/06/12 16:06:35 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\certenc.dll
[2013/06/12 16:06:35 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\certenc.dll
[2013/06/03 23:15:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Download Accelerator Plus (DAP)
[2013/06/03 23:12:41 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{ED354377-A0D8-4458-AF6B-94490630832F}
[2013/06/02 20:26:08 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{836C65B9-7E40-4B39-841B-4B3790083EE0}
[2013/06/02 01:02:34 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{43B6B7E7-045C-4FF5-B531-5B63D2775B2E}
[2013/06/01 22:25:18 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{26D39CB0-E2BC-49F7-9143-E9F2D711CC57}
[2013/06/01 22:15:18 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{59B77B5E-DBD0-41F5-843C-F7399F32CEAB}
[2013/06/01 18:35:57 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{7AD64828-B969-4C52-B3D2-EA79C46C7961}
[2013/05/31 22:56:48 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Roaming\EQATEC Analytics
[2013/05/31 22:45:48 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2013/05/31 22:45:43 | 000,000,000 | —D | C] – C:\Users\Zhi\Documents\My DAP Downloads
[2013/05/31 22:45:41 | 000,000,000 | —D | C] – C:\ProgramData\SpeedBit
[2013/05/31 22:45:38 | 000,000,000 | —D | C] – C:\Program Files (x86)\DAP
[2013/05/31 22:45:18 | 000,172,032 | —- | C] (Jin Hui E-mail: [removed] Web: http://www.jcomsoft.com) – C:\windows\SysWow64\AniGIF.ocx
[2013/05/31 22:45:09 | 000,000,000 | —D | C] – C:\Program Files\Common Files\SpeedBit
[2013/05/31 22:44:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\SpeedBit
[4 C:\Users\Zhi\Documents\*.tmp files -> C:\Users\Zhi\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/06/26 02:31:04 | 000,000,912 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/26 02:29:05 | 000,025,120 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/26 02:29:05 | 000,025,120 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/26 02:26:13 | 001,939,974 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2013/06/26 02:26:13 | 000,773,816 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2013/06/26 02:26:13 | 000,005,372 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2013/06/26 02:24:44 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Zhi\Desktop\OTL.exe
[2013/06/26 02:23:04 | 000,000,468 | —- | M] () – C:\windows\tasks\SDMsgUpdate (TE).job
[2013/06/26 02:21:36 | 000,000,828 | —- | M] () – C:\windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
[2013/06/26 02:21:31 | 000,000,908 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/26 02:21:19 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2013/06/26 02:21:16 | 1042,128,894 | -HS- | M] () – C:\hiberfil.sys
[2013/06/26 01:50:00 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/06/25 02:31:20 | 000,001,552 | —- | M] () – C:\Users\Zhi\Desktop\My DAP Downloads.lnk
[2013/06/24 17:47:00 | 000,000,830 | —- | M] () – C:\windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
[2013/06/22 23:29:06 | 1035,324,611 | —- | M] () – C:\windows\MEMORY.DMP
[2013/06/19 23:19:44 | 000,002,330 | —- | M] () – C:\Users\Public\Desktop\Norton 360.lnk
[2013/06/19 23:19:15 | 001,860,456 | —- | M] () – C:\windows\SysNative\drivers\N360x64\1404000.028\Cat.DB
[2013/06/18 21:40:47 | 000,177,312 | —- | M] (Symantec Corporation) – C:\windows\SysNative\drivers\SYMEVENT64x86.SYS
[2013/06/18 21:40:47 | 000,007,631 | —- | M] () – C:\windows\SysNative\drivers\SYMEVENT64x86.CAT
[2013/06/18 21:40:47 | 000,000,854 | —- | M] () – C:\windows\SysNative\drivers\SYMEVENT64x86.INF
[2013/06/12 21:51:43 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerApp.exe
[2013/06/12 21:51:43 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/06/09 00:06:58 | 000,526,336 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ieui.dll
[2013/06/08 21:40:02 | 000,391,168 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\ieui.dll
[2013/06/04 16:36:13 | 000,000,172 | —- | M] () – C:\windows\SysNative\drivers\N360x64\1404000.028\isolate.ini
[2013/06/03 23:15:43 | 000,000,950 | —- | M] () – C:\Users\Zhi\Desktop\Download Accelerator Plus (DAP).lnk
[2013/06/03 22:53:22 | 000,002,560 | —- | M] () – C:\windows\_MSRSTRT.EXE
[2013/05/31 22:45:18 | 000,172,032 | —- | M] (Jin Hui E-mail: [removed] Web: http://www.jcomsoft.com) – C:\windows\SysWow64\AniGIF.ocx
[4 C:\Users\Zhi\Documents\*.tmp files -> C:\Users\Zhi\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/06/03 23:15:43 | 000,001,552 | —- | C] () – C:\Users\Zhi\Desktop\My DAP Downloads.lnk
[2013/06/03 23:15:43 | 000,000,950 | —- | C] () – C:\Users\Zhi\Desktop\Download Accelerator Plus (DAP).lnk
[2013/05/31 23:23:47 | 000,002,560 | —- | C] () – C:\windows\_MSRSTRT.EXE
[2013/05/07 00:37:32 | 000,091,264 | —- | C] () – C:\windows\SysWow64\EasyHook32.dll
[2012/11/28 16:26:17 | 000,000,028 | —- | C] () – C:\windows\GameLogCore.INI
[2012/07/18 23:54:34 | 000,735,230 | —- | C] () – C:\windows\SysWow64\PerfStringBackup.INI
[2012/05/30 04:52:09 | 000,000,000 | —- | C] () – C:\windows\NDSTray.INI
[2012/05/30 04:13:01 | 000,128,312 | —- | C] () – C:\windows\SysWow64\GFNEX.dll
[2012/05/30 04:01:28 | 000,000,000 | —- | C] () – C:\windows\ativpsrm.bin
[2012/05/30 03:59:32 | 000,204,960 | —- | C] () – C:\windows\SysWow64\ativvsvl.dat
[2012/05/30 03:59:32 | 000,157,152 | —- | C] () – C:\windows\SysWow64\ativvsva.dat
[2012/05/30 03:59:32 | 000,003,917 | —- | C] () – C:\windows\SysWow64\atipblag.dat
[2012/02/03 15:08:26 | 000,001,536 | —- | C] () – C:\windows\SysWow64\IusEventLog.dll
[2012/01/20 21:49:58 | 000,059,904 | —- | C] () – C:\windows\SysWow64\OpenVideo.dll
[2012/01/20 21:49:48 | 000,054,784 | —- | C] () – C:\windows\SysWow64\OVDecode.dll

========== ZeroAccess Check ==========

[2009/07/14 14:55:00 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013/02/27 15:52:56 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/02/27 14:55:05 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 11:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/21 13:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 11:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/09/11 01:44:54 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2013/06/26 02:21:45 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\EQATEC Analytics
[2012/11/22 00:16:43 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\PCCUStubInstaller
[2012/09/11 02:22:27 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\PDAppFlex
[2012/09/10 21:15:32 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\SmartDraw
[2013/05/03 21:30:30 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\SoftGrid Client
[2012/09/12 21:13:11 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/11/28 16:25:49 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\Tencent
[2012/08/14 22:02:57 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\thriXXX
[2012/08/31 22:40:49 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\Toshiba
[2012/07/18 23:55:28 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\TP
[2012/07/31 22:19:52 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\VPlayer2
[2012/12/09 20:25:39 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\VPlayerLoader
[2012/12/14 21:37:38 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\VPlayerSubscription2.6.1
[2013/02/11 17:06:20 | 000,000,000 | —D | M] – C:\Users\Zhi\AppData\Roaming\VPlayerSubscription2.7

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2007/11/07 08:03:18 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe

< MD5 for: EXPLORER.EXE >
[2011/02/26 15:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/25 16:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 16:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 16:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/21 13:24:25 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/25 15:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 15:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/21 13:24:11 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/14 11:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\windows\SysNative\services.exe
[2009/07/14 11:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 11:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2011/03/01 18:10:51 | 000,027,648 | —- | M] (Microsoft Corporation) MD5=635455A95EB8EC47AC72142E501465ED – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7601.21671_none_14271b75353e4391\svchost.exe
[2011/03/01 18:07:49 | 000,027,648 | —- | M] (Microsoft Corporation) MD5=6F68F63794097E54F36474ED4384B759 – C:\windows\SysNative\svchost.exe
[2011/03/01 18:07:49 | 000,027,648 | —- | M] (Microsoft Corporation) MD5=6F68F63794097E54F36474ED4384B759 – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7601.17568_none_13af509c1c123937\svchost.exe
[2011/03/01 18:07:49 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=A91A288C91F9D9F1CFA4FAA9893C4D55 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7601.21671_none_b8087ff17ce0d25b\svchost.exe
[2009/07/14 11:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe
[2011/03/01 18:05:31 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=ECDB182F885292145826C58252B53000 – C:\Windows\SysWOW64\svchost.exe
[2011/03/01 18:05:31 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=ECDB182F885292145826C58252B53000 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7601.17568_none_b790b51863b4c801\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/21 13:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/21 13:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/21 13:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\windows\SysNative\userinit.exe
[2010/11/21 13:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/21 13:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\windows\SysNative\winlogon.exe
[2010/11/21 13:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

< %systemroot%\*. /rp /s >

< %systemdrive%\$Recycle.Bin|@;true;true;true >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

========== Base Services ==========
SRV:64bit: - [2009/07/14 11:40:01 | 000,072,192 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\aelupsvc.dll – (AeLookupSvc)
SRV:64bit: - [2013/02/27 15:47:10 | 000,070,144 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\appinfo.dll – (Appinfo)
SRV:64bit: - [2009/07/14 11:38:55 | 000,079,360 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\alg.exe – (ALG)
SRV:64bit: - [2010/11/21 13:23:51 | 000,849,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\qmgr.dll – (BITS)
SRV:64bit: - [2010/11/21 13:24:00 | 000,705,024 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\BFE.DLL – (BFE)
SRV:64bit: - [2011/11/17 16:33:55 | 000,031,232 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\lsass.exe – (KeyIso)
SRV:64bit: - [2009/07/14 11:40:50 | 000,402,944 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\es.dll – (EventSystem)
SRV - [2009/07/14 11:15:19 | 000,271,360 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\es.dll – (EventSystem)
SRV:64bit: - [2012/07/05 08:13:27 | 000,136,704 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\browser.dll – (Browser)
SRV:64bit: - [2013/05/13 15:51:01 | 000,184,320 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\cryptsvc.dll – (CryptSvc)
SRV - [2013/05/13 14:45:55 | 000,140,288 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\cryptsvc.dll – (CryptSvc)
SRV:64bit: - [2010/11/21 13:24:01 | 000,512,000 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\rpcss.dll – (DcomLaunch)
SRV:64bit: - [2010/11/21 13:24:00 | 000,317,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dhcpcore.dll – (Dhcp)
SRV - [2010/11/21 13:24:09 | 000,254,464 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\dhcpcore.dll – (Dhcp)
SRV:64bit: - [2011/03/03 16:24:16 | 000,183,296 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dnsrslvr.dll – (Dnscache)
SRV:64bit: - [2009/07/14 11:40:35 | 000,111,104 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\eapsvc.dll – (EapHost)
SRV:64bit: - [2009/07/14 11:41:00 | 000,038,912 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\hidserv.dll – (hidserv)
SRV - [2009/07/14 11:15:24 | 000,049,152 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysWOW64\hidserv.dll – (hidserv)
SRV:64bit: - [2009/07/14 11:41:10 | 000,359,424 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\SysNative\ipnathlp.dll – (SharedAccess)
SRV:64bit: - [2010/11/21 13:23:48 | 000,501,248 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\IPSECSVC.DLL – (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV:64bit: - [2009/07/14 11:41:54 | 000,524,288 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\swprv.dll – (swprv)
SRV:64bit: - [2009/07/14 11:41:26 | 000,067,584 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysNative\mmcss.dll – (MMCSS)
SRV:64bit: - [2009/07/14 11:41:52 | 000,360,448 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\netman.dll – (Netman)
SRV:64bit: - [2009/07/14 11:41:52 | 000,459,776 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\netprofm.dll – (netprofm)
SRV - [2009/07/14 11:16:03 | 000,360,448 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\netprofm.dll – (netprofm)
SRV:64bit: - [2012/10/04 03:44:21 | 000,303,104 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\nlasvc.dll – (NlaSvc)
SRV:64bit: - [2009/07/14 11:41:53 | 000,025,600 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\nsisvc.dll – (nsi)
SRV:64bit: - [2011/05/24 21:42:55 | 000,404,480 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\umpnpmgr.dll – (PlugPlay)
SRV:64bit: - [2012/02/11 16:36:02 | 000,559,104 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\spoolsv.exe – (Spooler)
SRV:64bit: - [2011/11/17 16:33:55 | 000,031,232 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\lsass.exe – (ProtectedStorage)
No service found with a name of EMDMgmt
SRV:64bit: - [2009/07/14 11:41:53 | 000,099,328 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\rasauto.dll – (RasAuto)
SRV:64bit: - [2010/11/21 13:24:17 | 000,344,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\rasmans.dll – (RasMan)
SRV:64bit: - [2010/11/21 13:24:01 | 000,512,000 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\rpcss.dll – (RpcSs)
SRV:64bit: - [2010/11/21 13:24:16 | 000,030,720 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\seclogon.dll – (seclogon)
SRV:64bit: - [2011/11/17 16:33:55 | 000,031,232 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\lsass.exe – (SamSs)
SRV:64bit: - [2009/07/14 11:41:58 | 000,097,280 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wscsvc.dll – (wscsvc)
SRV:64bit: - [2010/11/21 13:23:48 | 000,236,032 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\srvsvc.dll – (LanmanServer)
SRV:64bit: - [2010/11/21 13:23:55 | 000,370,688 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\shsvcs.dll – (ShellHWDetection)
SRV - [2010/11/21 13:24:03 | 000,328,192 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\shsvcs.dll – (ShellHWDetection)
No service found with a name of slsvc
SRV:64bit: - [2010/11/21 13:24:16 | 001,110,016 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\schedsvc.dll – (Schedule)
SRV:64bit: - [2010/11/21 13:24:32 | 000,316,928 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\tapisrv.dll – (TapiSrv)
SRV - [2010/11/21 13:24:00 | 000,242,176 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysWOW64\tapisrv.dll – (TapiSrv)
SRV:64bit: - [2009/07/14 11:41:55 | 000,044,544 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\themeservice.dll – (Themes)
SRV:64bit: - [2012/05/01 15:40:20 | 000,209,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\profsvc.dll – (ProfSvc)
SRV:64bit: - [2010/11/21 13:23:55 | 001,600,512 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\VSSVC.exe – (VSS)
SRV:64bit: - [2010/11/21 13:24:32 | 000,679,424 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\audiosrv.dll – (AudioSrv)
SRV:64bit: - [2010/11/21 13:24:32 | 000,679,424 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\audiosrv.dll – (AudioEndpointBuilder)
SRV:64bit: - [2010/11/21 13:25:06 | 000,170,496 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\sdrsvc.dll – (SDRSVC)
SRV:64bit: - [2009/07/14 11:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2010/11/21 13:23:55 | 001,646,080 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wevtsvc.dll – (eventlog)
SRV:64bit: - [2010/11/21 13:24:28 | 000,828,416 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\MPSSVC.dll – (MpsSvc)
SRV:64bit: - [2010/11/21 13:24:48 | 000,580,096 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wiaservc.dll – (stisvc)
SRV:64bit: - [2010/11/21 13:24:15 | 000,128,000 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\windows\SysNative\msiexec.exe – (msiserver)
SRV - [2010/11/21 13:24:28 | 000,073,216 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\windows\SysWow64\msiexec.exe – (msiserver)
SRV:64bit: - [2009/07/14 11:41:56 | 000,242,688 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wbem\WMIsvc.dll – (Winmgmt)
SRV:64bit: - [2012/06/03 08:19:43 | 002,428,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wuaueng.dll – (wuauserv)
SRV:64bit: - [2010/11/21 13:24:09 | 000,252,416 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\dot3svc.dll – (dot3svc)
SRV:64bit: - [2009/07/14 11:41:56 | 000,886,784 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wlansvc.dll – (Wlansvc)
SRV:64bit: - [2010/11/21 13:24:32 | 000,118,784 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wkssvc.dll – (LanmanWorkstation)

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: Hitachi HTS547575A9E384
Partitions: 3
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 1.00GB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 685.00GB
Starting Offset: 1573912576
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 13.00GB
Starting Offset: 736593182720
Hidden sectors: 0

========== Alternate Data Streams ==========

@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:56E2E879

< End of report >

Satchfan

Post #3June 30, 2013, 8:31 AM UTC

Hello Edd12 and welcome back to the WTT forum.

I'm having a look at the logs and will reply shortly.

Satchfan

Satchfan

Post #4June 30, 2013, 10:21 AM UTC

The last time OCD replied when helping you, you didn’t reply.

We all do this on a voluntary basis and most of us also have day jobs and families, so please be gracious enough to reply even if it is only to say that you no longer require help. Thanks

I have just checked my previous post which you can see from the link here http://forums.whatthetech.com/index.php?sh…=ukash&st=0, I can see Altshell.ini is in every log produced by OTL and FRST, but I was not advised to take action to remove it. So is it safe to leave it in my laptop?

Altshell.ini is connected to the malware that was on your system but it is possible that you were not asked to remove it because it was not capable of any malware activity because of its small file size.

Emisoft picked it up and quarantined it. Although "Quarantine selected objects" and "Delete selected objects" are available, it is usually recommended that you choose “Quarantine” in case there are any false-positives and legitimate files are deleted.

You can run it again and delete the entry.

There is nothing bad in your OTL log but there are some unnecessary files left which we can tidy up and I’d also like to check on your security settings.

Run OTL

double click on the icon to run it.

copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found [2013/06/26 02:21:57 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{96C90D5A-6D49-41F0-8C25-1CE012157FC5} [2013/06/25 21:04:49 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{D6D6ADAD-47BE-4818-8065-998F75AE5FCE} [2013/06/25 15:28:59 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{0E9EE9E6-E2A4-4AC8-A0AF-B12B86EC8F9B} [2013/06/25 15:26:28 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{E23AF6F5-8658-48E3-94F0-ECE76E3108DD} [2013/06/25 15:21:47 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{2DD3DD6E-6292-4D8C-8C6C-B7DE26659B6A} [2013/06/25 15:18:05 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{86130D19-2CDB-4417-BB40-3BFEDC63C6F1} [2013/06/24 15:58:02 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{E6233AE9-E6FB-4694-8F32-342CE6E2DE41} [2013/06/22 23:44:49 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{E54AC3C2-7D14-497F-AF9D-A952142EF809} [2013/06/22 23:42:20 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{2F820422-AB36-4545-9D5B-C48DE158B85B} [2013/06/22 23:39:31 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{50137556-89E6-484B-B7FE-5F470F961814} [2013/06/22 23:32:36 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{238E8125-4F85-4353-88BD-DCF80699FB18} [2013/06/22 23:30:41 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{FE87CE9E-9F19-4F8D-9100-EE71A63B5ABB} [2013/06/22 21:29:11 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{4B2EBF38-7F97-4776-B76F-28FA5F339224} [2013/06/22 18:30:40 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{D1932364-213E-4BBB-AB8C-B42C877C07CA} [2013/06/22 18:05:39 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{F1CBEFFD-A728-44E5-900A-D50181044812} [2013/06/21 13:52:42 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{2B7A5E38-BB89-4698-A9DC-3808CDF58AD4} [2013/06/20 23:47:34 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{296C2378-B51C-47B6-B4EE-320420D63961} [2013/06/20 18:32:22 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{2462D973-DA1C-449E-9CAB-336F520130EE} [2013/06/20 18:26:58 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{5216D6C4-AD99-4F41-A089-4735D27102B8} [2013/06/19 23:20:25 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{E0279D39-2F0E-47EB-95EA-FDA10272C4DB} [2013/06/16 22:06:25 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{D6C8234C-E103-4DA3-AEC8-110F31CCDC7A} [2013/06/16 22:02:36 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{7AC0A048-6774-422F-9AA6-F4A9CBCDB168} [2013/06/16 19:36:01 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{0BD209F3-5046-4EC9-A9D4-0C6B53B28D1A} [2013/06/15 18:53:22 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{A6024E16-30DC-4D81-8363-41208F59C21E} [2013/06/14 02:34:29 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{EA3E27F6-EFA4-4441-B105-C5E4BCE4E3F9} [2013/06/03 23:12:41 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{ED354377-A0D8-4458-AF6B-94490630832F} [2013/06/02 20:26:08 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{836C65B9-7E40-4B39-841B-4B3790083EE0} [2013/06/02 01:02:34 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{43B6B7E7-045C-4FF5-B531-5B63D2775B2E} [2013/06/01 22:25:18 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{26D39CB0-E2BC-49F7-9143-E9F2D711CC57} [2013/06/01 22:15:18 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{59B77B5E-DBD0-41F5-843C-F7399F32CEAB} [2013/06/01 18:35:57 | 000,000,000 | —D | C] – C:\Users\Zhi\AppData\Local\{7AD64828-B969-4C52-B3D2-EA79C46C7961} @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:56E2E879 :Commands [purity] [emptytemp] [Reboot]

click the Run Fix button at the top
let the program run unhindered, reboot when it is done
please post the OTL fix log

===================================================

Run Security Check

Download Security Check by screen317 from here or here.

save it to your Desktop.
double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
a Notepad document should open automatically called checkup.txt; please post the contents of that document.

Logs to include in the next post:

OTL fix log
Checkup.txt

Satchfan

Edd12

Post #5July 2, 2013, 1:59 PM UTC

Hi Satchfan,

Thanks for replying me, I admitted that I didn't reply promptly in my previous thread with OCD, when I was going to post to reply, the thread had already been closed.

Followings are the content of OTL and checkup log. The checkup.txt doesn't seem to save a copy by itself so I copy and paste the content here.

Just have an odd question to ask, since Emsisoft Emergency Kit Scanner is the program that is extracted from a rar or zip file, the question is that if I have quarantine a file using Emsisoft, is this quarantined file going to be deleted as well when I deleted the whole folder of Emisisoft? It seems that the file is saved in its quarantine folder

Edd12

OTL.txt

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki…\ deleted successfully.
C:\Users\Zhi\AppData\Local\{96C90D5A-6D49-41F0-8C25-1CE012157FC5} folder moved successfully.
C:\Users\Zhi\AppData\Local\{D6D6ADAD-47BE-4818-8065-998F75AE5FCE} folder moved successfully.
C:\Users\Zhi\AppData\Local\{0E9EE9E6-E2A4-4AC8-A0AF-B12B86EC8F9B} folder moved successfully.
C:\Users\Zhi\AppData\Local\{E23AF6F5-8658-48E3-94F0-ECE76E3108DD} folder moved successfully.
C:\Users\Zhi\AppData\Local\{2DD3DD6E-6292-4D8C-8C6C-B7DE26659B6A} folder moved successfully.
C:\Users\Zhi\AppData\Local\{86130D19-2CDB-4417-BB40-3BFEDC63C6F1} folder moved successfully.
C:\Users\Zhi\AppData\Local\{E6233AE9-E6FB-4694-8F32-342CE6E2DE41} folder moved successfully.
C:\Users\Zhi\AppData\Local\{E54AC3C2-7D14-497F-AF9D-A952142EF809} folder moved successfully.
C:\Users\Zhi\AppData\Local\{2F820422-AB36-4545-9D5B-C48DE158B85B} folder moved successfully.
C:\Users\Zhi\AppData\Local\{50137556-89E6-484B-B7FE-5F470F961814} folder moved successfully.
C:\Users\Zhi\AppData\Local\{238E8125-4F85-4353-88BD-DCF80699FB18} folder moved successfully.
C:\Users\Zhi\AppData\Local\{FE87CE9E-9F19-4F8D-9100-EE71A63B5ABB} folder moved successfully.
C:\Users\Zhi\AppData\Local\{4B2EBF38-7F97-4776-B76F-28FA5F339224} folder moved successfully.
C:\Users\Zhi\AppData\Local\{D1932364-213E-4BBB-AB8C-B42C877C07CA} folder moved successfully.
C:\Users\Zhi\AppData\Local\{F1CBEFFD-A728-44E5-900A-D50181044812} folder moved successfully.
C:\Users\Zhi\AppData\Local\{2B7A5E38-BB89-4698-A9DC-3808CDF58AD4} folder moved successfully.
C:\Users\Zhi\AppData\Local\{296C2378-B51C-47B6-B4EE-320420D63961} folder moved successfully.
C:\Users\Zhi\AppData\Local\{2462D973-DA1C-449E-9CAB-336F520130EE} folder moved successfully.
C:\Users\Zhi\AppData\Local\{5216D6C4-AD99-4F41-A089-4735D27102B8} folder moved successfully.
C:\Users\Zhi\AppData\Local\{E0279D39-2F0E-47EB-95EA-FDA10272C4DB} folder moved successfully.
C:\Users\Zhi\AppData\Local\{D6C8234C-E103-4DA3-AEC8-110F31CCDC7A} folder moved successfully.
C:\Users\Zhi\AppData\Local\{7AC0A048-6774-422F-9AA6-F4A9CBCDB168} folder moved successfully.
C:\Users\Zhi\AppData\Local\{0BD209F3-5046-4EC9-A9D4-0C6B53B28D1A} folder moved successfully.
C:\Users\Zhi\AppData\Local\{A6024E16-30DC-4D81-8363-41208F59C21E} folder moved successfully.
C:\Users\Zhi\AppData\Local\{EA3E27F6-EFA4-4441-B105-C5E4BCE4E3F9} folder moved successfully.
C:\Users\Zhi\AppData\Local\{ED354377-A0D8-4458-AF6B-94490630832F} folder moved successfully.
C:\Users\Zhi\AppData\Local\{836C65B9-7E40-4B39-841B-4B3790083EE0} folder moved successfully.
C:\Users\Zhi\AppData\Local\{43B6B7E7-045C-4FF5-B531-5B63D2775B2E} folder moved successfully.
C:\Users\Zhi\AppData\Local\{26D39CB0-E2BC-49F7-9143-E9F2D711CC57} folder moved successfully.
C:\Users\Zhi\AppData\Local\{59B77B5E-DBD0-41F5-843C-F7399F32CEAB} folder moved successfully.
C:\Users\Zhi\AppData\Local\{7AD64828-B969-4C52-B3D2-EA79C46C7961} folder moved successfully.
ADS C:\ProgramData\TEMP:56E2E879 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 57472 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Zhi
->Temp folder emptied: 117571 bytes
->Temporary Internet Files folder emptied: 4808695 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 72557 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 36952 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42286734 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 45.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 07022013_230859

Files\Folders moved on Reboot…
File\Folder C:\Users\Zhi\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File\Folder C:\Users\Zhi\AppData\Local\Temp\~DF256817A94280BCBE.TMP not found!
File\Folder C:\Users\Zhi\AppData\Local\Temp\~DF47A746A1BD9B0CD8.TMP not found!
File\Folder C:\Users\Zhi\AppData\Local\Temp\~DF48EAD5D3B64C2E02.TMP not found!
File\Folder C:\Users\Zhi\AppData\Local\Temp\~DF563B04320A8BE1DB.TMP not found!
File\Folder C:\Users\Zhi\AppData\Local\Temp\~DFE2FE8AD2EBCED596.TMP not found!
File\Folder C:\Users\Zhi\AppData\Local\Temp\~DFF29B5054CEB2FC73.TMP not found!
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunkCA67CU07.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunkCADBBEF1.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunkCAJME7LV.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunkCAQEFNG9.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunkCATZULF3.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunkCAUWHKXI.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunk[11].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\push[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X2KDSFL5\push[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\ads[4].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\al[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\al[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\api[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\api[3].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCA1MFRFB.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCA79LU8A.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCA9TURWY.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAJ44MQT.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAKE1ZYT.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAORFT2O.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAOSUUT9.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAOXZWKR.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCARPZW8D.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAUS7H60.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAV8BDWX.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAWNTUPB.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAZQZCNM.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunkCAZT2DW2.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunk[10].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunk[11].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W5IEHQXN\track[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\ads[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\advert[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunkCA0I23LU.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunkCA3P4MWZ.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunkCAIXIPKG.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunkCAKH2ZIH.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunkCAPE78SH.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunkCAYBVMQ9.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunk[11].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\iframe[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VM7574KC\takeover[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\ads[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\ads[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\ads[3].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunkCADM1BIQ.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunkCAS01BXP.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunk[10].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunk[11].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunk[5].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunk[6].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunk[7].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunk[8].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\chunk[9].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\context[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UGNX8DP8\iframe[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\ads[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\ads[4].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\api[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\api[3].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\api[4].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\api[5].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunkCAA9WLPT.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunkCADRDFS7.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunkCAMQ3EZO.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunkCAT65T29.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunk[10].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunk[11].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\chunk[9].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TZELBWZ5\iframe[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\al[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\al[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\chunkCA1E0HUD.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\chunkCARFA4BP.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\chunkCAT3EP7O.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\chunkCAWVLCNK.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\chunk[4].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\index[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LP8WA41U\red_pjson[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\ads[3].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\api[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\api[4].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunkCAL8FTY7.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunkCANWA9OW.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunkCANWC923.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunkCAVQHLSP.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunkCAYX6TCQ.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunk[10].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunk[11].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LG81QRHB\chunk[4].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\al[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\api[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\chunkCA8M4V6B.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\chunkCAGP1CEQ.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\chunk[11].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\chunk[4].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\context[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\iframe[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\iframe[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KSBJ6END\iframe[3].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\api[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunkCA1P00F1.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunkCA2N33D6.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunkCAE8827P.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunkCAN1PKUS.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunkCAPE4L32.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunkCASUWNL0.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunkCAU50B9G.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunk[4].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\chunk[5].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\index[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A3550T1C\zrt_lookup[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8WH2MHDN\al[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8WH2MHDN\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\api[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunkCA0XJHUZ.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunkCA335BX3.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunkCA4DN5T5.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunkCA4GA4PI.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunkCA70H2WY.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunkCAIO6P2C.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunkCAT6LA9E.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunkCAZJ6I4Z.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunk[4].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5GWTJURB\chunk[5].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\al[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunkCA111NEV.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunkCA5CGWBH.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunkCA7WEVB4.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunkCA9965CA.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunkCADAK0XN.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunkCAW12Q3S.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunkCAYMKMAK.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunk[10].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunk[11].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3K56CTVJ\s[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\api[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\api[2].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunkCA02NF5H.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunkCA3BB1MU.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunkCAE4V1YL.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunkCAI4RBA0.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunkCALFCS3D.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunkCAYVRM1Y.js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunk[1].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunk[2].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunk[3].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\chunk[4].js moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3D2AIMYG\iframe[1].htm moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\7A7E08C8-3FF5-45F2-873D-A84D669DC82F.dat moved successfully.
C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Users\Zhi\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Checkup.txt

Results of screen317's Security Check version 0.99.68
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton 360
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Secunia PSI (3.0.0.6005)
Adobe Reader 10.1.7 Adobe Reader out of Date!
Google Chrome 18.0.1025.142
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Symantec Norton Online Backup NOBuAgent.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 11% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

Satchfan

Post #6July 2, 2013, 8:57 PM UTC

If you haven’t uninstalled Emisoft, run it again and “Delete” what is found. If you have uninstalled it, the file will be gone anyway.

Windows Firewall

You should not have Windows Firewall on when you have another firewall enabled. 1. Open Windows Firewall by clicking Start, Control Panel, and then click Windows Firewall.
2. On the left, click Turn Windows Firewall on or off. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
3. Click Off (not recommended) , and then OK.
Do you have any outstanding problems?

Satchfan

Satchfan

Post #7July 5, 2013, 1:23 PM UTC

Hi Edd12 It has been a few days since I asked if all is now OK. If I don't hear from you within the next 24 hours I will assume that all is well and close this topic. Satchfan

Edd12

Post #8July 7, 2013, 1:08 PM UTC last edited July 7, 2013, 1:12 PM UTC

Hi Satchfan, Sorry,I have been late again. I am not able to press Turn Windows Firewall on or off, because it says there that the settings are managed by Norton 360. Check the picture I have attached. Maybe it has been turned off by Norton.? 📎firewall.png

Satchfan

Post #9July 7, 2013, 9:20 PM UTC

That seems to be OK. Are there any outstanding problems?

Satchfan

Post #10July 8, 2013, 9:51 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

altshell.ini? Threat? [Solved]

✨ Ask AI

Ask AI