Spyware / Malware / Virus Removal

VIRUS? YES OR NO? [Solved]

25 min read

Looking for the outcome? Ask AI

compudodo Topic Starter

Post #1July 28, 2013, 1:43 AM UTC last edited July 28, 2013, 1:47 AM UTC

SO…… I downloaded social fixer on facebook and about two days later, i noticed i did not have to press tab enter to post a comment…huh? and i also started getting this box pop up every time i logged in….. box says javascript application error: evalInSandbox: Error:Permission denied for to create a wrapper for object of class unnamed class. even though i no longer have to press tab enter, social fixer supposedly was running on my computer, then it disappeared i think, who knows? it won't show up in my control panel will it? does it? should it? no…it's just an app…. oh i don't know…… but it was there for a day or two and then it was not….. now i have this javascript error thing. i ran scans on malwarebytes, had 4 minor ad thingies, then i did a full Avast scan…nothing, it found absolutely nothing, then I tried to download Hitman and it wouldn't download…..then I tried to download adaware, which i had tried to download about 3 weeks ago, and it wouldn't download, but this time it did….and adaware said i had 3 infection, 2 minor, one a trojan in that always Win 32 file, but supposedly they cleaned it out and quarantined it…… but i still have this java script pop up….oh…… and i don't know if this is related at all, but the social fixer disappeared almost directly after i downloaded Skype. which i don't know why i downloaded, not like a have anyone to skype and it makes my computer boot up really slow and even though i went into control panel to get of that OT shot I'll never use, those stupid boxes are still popping up like the program is still there. Now why does that happen ok, i went off topic there. i know, this is a malware forum. sorry. so….. that javascript error box that only pops up on facebook…… is this a virus or some glitch somewhere? thank you….. oh. ps. edit: i did go into control panel, uninstalled Java and then reinstalled it once i found out you can't read emails without java, who knew? but i did disintall/reinstall it.

OCD

Post #2July 28, 2013, 3:39 PM UTC

Hello compudodo,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Please stay with this topic until I let you know that your system appears to be "All Clear"

Important: All tools MUST be run from the Desktop.

=========================

1. Security Check

Download Security Check by screen317 from here or here.

Save it to your Desktop.
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

2. aswMBR

Download aswMBR.exe and save it to your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When asked if you want to download Avast's virus definitions please select Yes.
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

=========================

3. OTL

Download OTL to your desktop.

Make sure all other windows are closed and to let it run uninterrupted.
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
services.*
/md5stop
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
BASESERVICES
DRIVES
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
- You may need two posts to fit them both in.

=========================

In your next post please provide the following:
checkup.txt
aswMBR.txt
attach MBR.zip
OTL.txt
Extras.txt

compudodo

Post #3July 28, 2013, 10:53 PM UTC last edited July 29, 2013, 12:02 AM UTC

see??????? right from the get go this geezer can't do it right

you have to bear with me.

i've been here before, but every time i can't do it right.

there was NO indication of getting the download onto my desk top. i clicked on the system check "HERE" or "HERE"…… a box pops up that says do you want to save this file. my only option is to the save the file or cancel. so i save it. then i go into the download files, find it, click on it, it opens immediately as administrator and starts doing it's thing.

so……. how do i get these things onto my desktop first? EDit: I'VE GOT A FRIEND ON FACEBOOK, I'LL ASK HIM HOW TO DO IT AND TRY TO REPOST SHORTLY

here is that first check, but it was NOT run from the desktop:

Results of screen317's Security Check version 0.99.71
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Lavasoft Ad-Aware
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Ad-Aware
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 25
Adobe Flash Player 11.8.800.94
Mozilla Firefox 20.0.1 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Ad-Aware Antivirus AdAwareService.exe
Ad-Aware Antivirus SBAMSvc.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 3%
````````````````````End of Log``````````````````````

WELL. THOUGHT I'D NEVER SAY THIS: THANK THE GAWDS FOR FACEBOOK. LOL…. HERE IS THE SYSTEM CHECK RUN FROM DESKTOP, THE REST WILL FOLLOW :

Results of screen317's Security Check version 0.99.71
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Lavasoft Ad-Aware
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Ad-Aware
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 25
Adobe Flash Player 11.8.800.94
Mozilla Firefox 20.0.1 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Ad-Aware Antivirus AdAwareService.exe
Ad-Aware Antivirus SBAMSvc.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 3%
````````````````````End of Log``````````````````````

lol just as i start to think i will be on a roll: i send the download to the desktop, i click on the icon, and click on run as administrator and it says it is not a valid win 32 application ……… when i just click on it normally, it won't open at all, wants to know where to run it from and i never know how to answer that question. so completely botched the second report, i'll move on to the third and try again.

OTL logfile created on: 7/28/2013 7:32:55 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\owner\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 2.21 Gb Available Physical Memory | 58.23% Memory free
7.60 Gb Paging File | 5.64 Gb Available in Paging File | 74.26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 297.99 Gb Total Space | 260.68 Gb Free Space | 87.48% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\owner\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\ProgramData\Search Protection\SearchProtection.exe (Lavasoft)
PRC - C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Ad-Aware Antivirus\AdAware.exe (Lavasoft Limited)
PRC - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\OtShot\otshot.exe ()
PRC - C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
PRC - C:\Program Files (x86)\Astra Jigsaw Art III\astra_art3.exe ()
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\OtShot\otshot.exe ()
MOD - C:\Program Files (x86)\Astra Jigsaw Art III\astra_art3.exe ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\Astra Jigsaw Art III\unrar.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Ad-Aware Service) – C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (SBAMSvc) – C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (gfibto) – C:\Windows\SysNative\drivers\gfibto.sys (GFI Software)
DRV:64bit: - (aswSnx) – C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) – C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswVmm) – C:\Windows\SysNative\drivers\aswVmm.sys ()
DRV:64bit: - (aswRdr) – C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswRvrt) – C:\Windows\SysNative\drivers\aswRvrt.sys ()
DRV:64bit: - (aswTdi) – C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) – C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (RTL8192Ce) – C:\Windows\SysNative\drivers\rtl8192ce.sys (Realtek Semiconductor Corporation )
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (HECIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (netr7364) – C:\Windows\SysNative\drivers\netr7364.sys (Ralink Technology, Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {280D065B-90D3-4527-9C38-6C567E404296}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securedsearch2.lavasoft.com/index.p…39B5051F1A053CB
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DE 9E 21 BB AC 51 CE 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://search.conduit.com/Results.aspx?cti…q={SearchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\..\SearchScopes\{280D065B-90D3-4527-9C38-6C567E404296}: "URL" = http://search.conduit.com/ResultsExt.aspx?…252137&UM=2
IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = http://securedsearch2.lavasoft.com/results…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..CT3304781.browser.search.defaultthis.engineName: "true"
FF - prefs.js..browser.search.defaultenginename: "KeyBar 1.8 Customized Web Search"
FF - prefs.js..browser.search.defaultthis.engineName: "KeyBar 1.8 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3304781&CUI=UN15895754273315154&UM=2&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "http://msn.com"
FF - prefs.js..extensions.enabledAddons: socialfixer%40mattkruse.com:7.501
FF - prefs.js..extensions.enabledAddons: %7B9ed31f84-c8b3-4926-b950-dff74047ff79%7D:10.16.7.25
FF - prefs.js..extensions.enabledAddons: grammar.plugin%40grammarly.com:2.32
FF - prefs.js..extensions.enabledAddons: %7B87934c42-161d-45bc-8cef-ef18abe2a30c%7D:3.1
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3304781&SearchSource=2&CUI=UN15895754273315154&UM=2&q="

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.7: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/21 03:58:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/25 18:02:12 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/25 18:02:12 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2013/07/25 14:13:21 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Extensions
[2013/07/25 18:01:50 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions
[2013/07/25 18:01:54 | 000,000,000 | —D | M] (Ad-Aware Security Add-on) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
[2013/07/23 00:50:54 | 000,000,000 | —D | M] (KeyBar 1.8) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\{9ed31f84-c8b3-4926-b950-dff74047ff79}
[2013/04/21 04:14:03 | 000,000,000 | —D | M] ("Solid Savings") – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\[removed]
[2013/07/24 06:20:27 | 000,278,419 | —- | M] () (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\[removed]
[2013/04/19 20:56:17 | 000,155,983 | —- | M] () (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\[removed]
[2013/07/23 00:50:55 | 000,000,997 | —- | M] () – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\searchplugins\conduit.xml
[2013/07/24 06:51:22 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/07/24 06:51:22 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/04/14 08:47:48 | 000,263,064 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013/06/13 10:33:50 | 000,000,644 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\adawaretb.xml

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Ad-Aware Security Add-on) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Ad-Aware Security Add-on) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll ()
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [Ad-Aware Antivirus] C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher.exe (Lavasoft Limited)
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [OtShot] C:\Program Files (x86)\OtShot\otshot.exe ()
O4 - HKLM..\Run: [Search Protection] C:\ProgramData\Search Protection\SearchProtection.exe (Lavasoft)
O4 - Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{773E654E-71FA-4F13-B9F6-809E179C3484}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FEDF8DC9-0324-4BB3-8DCC-FEC5B6413B11}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/07/27 22:11:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013/07/26 22:48:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013/07/25 18:06:50 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\LavasoftStatistics
[2013/07/25 18:06:31 | 000,000,000 | —D | C] – C:\ProgramData\Ad-Aware Antivirus

OTL Extras logfile created on: 7/28/2013 7:32:55 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\owner\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 2.21 Gb Available Physical Memory | 58.23% Memory free
7.60 Gb Paging File | 5.64 Gb Available in Paging File | 74.26% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 297.99 Gb Total Space | 260.68 Gb Free Space | 87.48% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" (VideoLAN)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" (VideoLAN)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" (VideoLAN)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" (VideoLAN)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0753CB07-D611-4579-9504-A6C216ABBE89}" = protocol=17 | dir=in | app=c:\program files (x86)\adawaretb\dtuser.exe |
"{99CA09BF-7776-492C-8E99-A8C2A8D0E15C}" = protocol=6 | dir=in | app=c:\program files (x86)\adawaretb\dtuser.exe |
"{FEC8DAAE-8FCE-4952-B654-E7077BB95430}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{26A24AE4-039D-4CA4-87B4-2F86417025FF}" = Java 7 Update 25 (64-bit)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A5B39D2-7ED6-4779-BCC9-37F381139DB3}" = Adobe AIR
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{944167EA-7F89-4705-8DCD-1D63B53141B0}" = Ad-Aware Antivirus
"{96AD3B61-EAE2-11E2-9E72-B8AC6F98CCE3}" = Google Earth
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D3D8C60-A55F-4fed-B2B9-173001290E16}" = Realtek WLAN Driver
"{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}" = OpenOffice.org 3.4.1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"adawaretb" = Ad-Aware Security Add-on
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"Astra Jigsaw Art Edition_is1" = Astra Jigsaw Art Edition version 1.25
"Astra Jigsaw Art III_is1" = Astra Jigsaw Art III version 1.25
"Astra Jigsaw France and UK_is1" = Astra Jigsaw France and UK version 1.25
"Astra Jigsaw Italy and Spain_is1" = Astra Jigsaw Italy and Spain version 1.25
"Astra Jigsaw My Favorite Things II_is1" = Astra Jigsaw My Favorite Things II version 1.26
"avast" = avast! Free Antivirus
"BFG-Bricks of Atlantis" = Bricks of Atlantis
"BFG-Bricks of Egypt 2" = Bricks of Egypt 2
"BFGC" = Big Fish Games: Game Manager
"BigJig_is1" = BigJig version 8.21
"Desktop Taipei_is1" = Desktop Taipei version 2.3
"Foxit Reader_is1" = Foxit Reader
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"VLC media player" = VLC media player 2.0.7

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 7/25/2013 11:47:57 AM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/25/2013 1:59:07 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/25/2013 2:18:08 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/25/2013 2:22:00 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/25/2013 9:57:53 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/26/2013 1:11:39 AM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/26/2013 2:41:46 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/26/2013 10:02:30 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/27/2013 4:22:48 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/28/2013 3:44:21 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 5/17/2013 10:41:27 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 10:41:27 AM - Failed to retrieve SportsSchedule (Error: The request
failed with HTTP status 403: Forbidden.)

Error - 5/17/2013 10:41:46 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 10:41:40 AM - Failed to retrieve Broadband (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 11:42:01 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 11:42:00 AM - Failed to retrieve NetTV (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 11:42:01 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 11:42:01 AM - Failed to retrieve MCEClientUX (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 11:42:03 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 11:42:02 AM - Failed to retrieve SportsSchedule (Error: The request
failed with HTTP status 403: Forbidden.)

Error - 5/17/2013 11:42:06 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 11:42:03 AM - Failed to retrieve Broadband (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 12:42:26 PM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 12:42:26 PM - Failed to retrieve NetTV (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 12:42:27 PM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 12:42:27 PM - Failed to retrieve MCEClientUX (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 12:42:28 PM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 12:42:27 PM - Failed to retrieve SportsSchedule (Error: The request
failed with HTTP status 403: Forbidden.)

Error - 5/17/2013 12:42:30 PM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 12:42:29 PM - Failed to retrieve Broadband (Error: The request failed
with HTTP status 403: Forbidden.)

[ System Events ]
Error - 6/21/2013 10:37:12 AM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 6/28/2013 3:51:15 AM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 7/7/2013 4:40:43 AM | Computer Name = owner-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 12:59:07 AM on ?7/?7/?2013 was unexpected.

Error - 7/11/2013 3:33:58 AM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 7/11/2013 12:25:41 PM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 7/22/2013 10:59:29 AM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 7/24/2013 3:47:21 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 7/24/2013 3:47:52 PM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 7/24/2013 3:47:51 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the BITS service.

Error - 7/24/2013 3:48:11 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7031
Description = The avast! Antivirus service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.

< End of report >

CAN YOU HELP ME WITH THAT 2nd REPORT YOU WANTED? I HAVE TO TELL YOU, I CANNOT DO A ZIP FILE , I NEVER COULD

OCD

Post #4July 29, 2013, 3:02 AM UTC

Hi compudodo,

You're doing just fine.

=========================

1. AdwCleaner

Download AdwCleaner to your desktop.

Right click and select "Run as Administrator".

Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

=========================

2. Run OTL.exe

Windows Vista and Windows 7 users Right Click and select "Run as Administrator"

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://search.conduit.com/Results.aspx?cti…q={SearchTerms}
IE - HKCU\..\SearchScopes\{280D065B-90D3-4527-9C38-6C567E404296}: "URL" = http://search.conduit.com/ResultsExt.aspx?…252137&UM;=2
IE - HKLM\..\SearchScopes,DefaultScope = {280D065B-90D3-4527-9C38-6C567E404296}
FF - prefs.js..browser.search.defaultenginename: "KeyBar 1.8 Customized Web Search"
FF - prefs.js..browser.search.defaultthis.engineName: "KeyBar 1.8 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3304781&CUI;=UN15895754273315154&UM;=2&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3304781&SearchSource;=2&CUI;=UN15895754273315154&UM;=2&q;="
[2013/07/23 00:50:54 | 000,000,000 | —D | M] (KeyBar 1.8) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\{9ed31f84-c8b3-4926-b950-dff74047ff79}
[2013/04/21 04:14:03 | 000,000,000 | —D | M] ("Solid Savings") – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\[removed]
[2013/07/23 00:50:55 | 000,000,997 | —- | M] () – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\searchplugins\conduit.xml


:Commands
[purity]
[createrestorepoint]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

=========================

Try this scan in place of the one you had difficulty running. If this one won't run either just skip and go to the last step.

=========================

1. Malwarebytes Anti-Rootkit

Download Malwarebytes Anti-Rootkit
Once the file has been downloaded, right click on the downloaded file and select the Extract all menu option.
Follow the instructions to extract the ZIP file to a folder called mbar-versionnumber on your desktop.
Once the ZIP file has been extracted, open the folder and when that folder opens, double-click on the mbar folder.
Double-click on the mbar.exe file to launch Malwarebytes Anti-Rootkit.
After you double-click on the mbar.exe file, you may receive a User Account Control (UAC) message if you are sure you wish to allow the program to run. Please allow to start Malwarebytes Anti-Rootkit correctly.
Malwarebytes Anti-Rootkit will now install necessary drivers that are required for the program to operate correctly.
If you receive a DDA driver message like could not load DDA driver, click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer and will start automatically.

[external image: Posted Image]

Please click by the introduction screen on the Next button to continue.

[external image: Posted Image]

Next you will see the Update Database screen.
Click on the Update button so Malwarebytes Anti-Rootkit can download the latest definition updates.

[external image: Posted Image]

When the update has finished, click on the Next button.

[external image: Posted Image]

Next you can select some basic scanning options. Make sure the Drivers, Sectors, and System scan targets are selected before you click on the Scan button.
Malwarebytes Anti-Rootkit will now start scanning your computer for rootkits. This scan can take some time, so please be patient.

[external image: Posted Image]

When the scan with Malwarebytes Anti-Rootkit is finished, the program will display a screen with the results from the scan.
Make sure everything is selected and that the option to create a restore point is checked.
Next click on the Cleanup button. Malwarebytes Anti-Rootkit will then prompt you to reboot your computer.
Click on Yes button to restart your computer.

There will now be two log files created in the mbar folder called system-log.txt and one that starts with mbar-log.
The mbar-log file will always start with mbar-log, but the rest will be named using a timestamp indicating the time it was run.
- For example, mbar-log-2012-11-12 (19-13-32).txt corresponds to mbar-log-year-month-day (hour-minute-second).txt.
The system-log.txt contains information about each time you have run MBAR and contains diagnostic information from the program.

=========================

4. Re-run OTL (it should be located on your desktop).

Windows Vista and Windows 7 & 8 users Right Click and select "Run as Administrator" on the icon to run it.

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Uncheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open one notepad window. OTL.Txt. (No Extras.txt will be produced)
Note:The log can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of the file, and post it with your next reply.

=========================

In your next post please provide the following:
AdwCleaner[S1].txt
OTL fix log
mbar-log
system-log.txt
Fresh OTL.txt log

compudodo

Post #5July 29, 2013, 11:06 AM UTC

# AdwCleaner v2.306 - Logfile created 07/29/2013 at 06:25:39 # Updated 19/07/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : owner - OWNER-PC # Boot Mode : Normal # Running from : C:\Users\owner\Downloads\AdwCleaner.exe # Option [Delete] # Switch Used : /DisableAskDetection , /DisableIEDetection , /DisableFFDetection , /DisableChromeDetection , /DisableOperaDetection , /DisableProxyDetection ***** [Services] ***** ***** [Files / Folders] ***** File Deleted : C:\END File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\adawaretb.xml File Deleted : C:\Users\owner\AppData\Local\Temp\Uninstall.exe File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\searchplugins\Conduit.xml Folder Deleted : C:\Program Files (x86)\adawaretb Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\ProgramData\blekko toolbars Folder Deleted : C:\ProgramData\search protection Folder Deleted : C:\ProgramData\Tarma Installer Folder Deleted : C:\Users\owner\AppData\Local\Conduit Folder Deleted : C:\Users\owner\AppData\LocalLow\adawaretb Folder Deleted : C:\Users\owner\AppData\LocalLow\Conduit Folder Deleted : C:\Users\owner\AppData\LocalLow\PriceGong Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\adawaretb Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\CT3304781 Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\{9ed31f84-c8b3-4926-b950-dff74047ff79} Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\Smartbar ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} Key Deleted : HKLM\Software\adawaretb Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3304782 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS Key Deleted : HKLM\Software\PIP Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\adawaretb Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Tarma Installer Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}] ***** [Internet Browsers] ***** ************************* AdwCleaner[R1].txt - [3701 octets] - [29/07/2013 06:23:44] AdwCleaner[S1].txt - [3567 octets] - [29/07/2013 06:25:39] ########## EOF - C:\AdwCleaner[S1].txt - [3627 octets] ########## THEN I RAN Step 2. THE OTL, I copied the stuff into the box, clicked run fix…….. it rebooted and two tiny two line documents were on the desktop, do you want to see those? THEN YOU LOST ME. I am totally at sea again….. i downloaded it to the desktop….i think that is the problem, it just won't open. i will try again just downloading and running. I will come back. i forgot to save the reports, they were lost in the reboots…so had to do everything all over again. i'm posting this portion now. will be back again hopefully i got thru this malwarebytes root thing…… oh, and i checked my facebook page, that stupid javascript error box is still popping up. this whole process is such agony for a stupid error box, but a friend on facebook did say that there is a java virus going around, so i am trying to remain calm and endure this torture, lol….can you tell i totally hate computers????

compudodo

Post #6July 29, 2013, 11:11 AM UTC

nope. can't open a zip file. i just don't know what to do. i download the file, it goes to a folder…… i click on the folder, i get a list of all kinds of other folders holding all kinds of applications. have no clue. i am screaming here. can you hear me?

OCD

Post #7July 29, 2013, 4:15 PM UTC

Hi compudodo,

Let's try a slightly different approach. Skip all previous instructions and continue with what is outlined below.

THEN I RAN Step 2. THE OTL, I copied the stuff into the box, clicked run fix…….. it rebooted and two tiny two line documents were on the desktop, do you want to see those?

Yes I do.

=========================

1. Update Firefox

At the top of the Firefox window, click the Firefox button, go over to the Help sub-menu
Click the Check for Updates button
Follow the onscreen instructions to update
Firefox will close and be reset. Close when finished,

=========================

2. Do you have a Firefox Add-On/ Plugin named: Social Fixer

=========================

3. Update Social Fixer (if installed)

At the top of the Firefox window, click on the Firefox button (Tools menu in Windows XP), and then click Add-ons. The Add-ons Manager tab will open.
In the Add-ons Manager tab, select the Extensions or Plugins panel.
Select the add-on you wish to disable.
- Social Fixer
Click the Update button.
Click Restart now if it pops up. Your tabs will be saved and restored after the restart.

=========================

3. Flush the FireFox Cache

(these directions are specific to Firefox 19, if you have a different version the exact steps might be slightly different)

In Firefox, Options
Select Options
Select Privacy tab
Find the section that reads: You might want to clear your recent history or remove individual cookies
Select clear your recent history
Click the Details drop-down arrow
Make sure a check mark is placed in the following boxes:

Cookies
Cache
Next select the Time Range to Clear drop-down menu
Select Everything (this will only delete all the cookies and cache, and will save the other items not selected)
Click Clear Now

=========================

Check the status to see if the Java Script Error is still present.

In your next post please provide the following:
OTL logs previously generated
Update on the Java Script Error

compudodo

Post #8July 30, 2013, 3:11 AM UTC last edited July 30, 2013, 3:14 AM UTC

ok.

old lady here and i have no reserves left. none. i just can't do this.

i don't have the firefox homepage, i went to the firefox website to see if i could just find an update button. nothing. i have to go into options and click on restore to default….unfortunately, default turned out to be ask.com which was the last program automatically added when i downloaded adaware or mawarebytes, or updated my adobe or my java, who knows? i think skype added a conduit home page i had to get rid of. Oh sure, I can do it, i can go in and hopefully just type www. https://firefoxhomepage.com and hope and pray that does it, but rght now, i have no way of retrieving it without totally unstalling and then reinstalling the whole program……and that could wipe out my favorites, it has happened before and it could happen again, cause who knows what happens with these machines…. heck, one minute i'm fine, next minute the computer screens are all minimized,, or miraculously there is now a side bar window on the right that popped out and how? why? my bottom tool bar used to have many more helpful icons, where did they all go? do you have any idea how many hours it takes to find my upper tool bar, cause it periodically goes awol too……. there isn't a book that can teach you where to find everything because half the time, i don't know what to call the thing i lost …..

this is so humiliating and frustrating and impossible.

look, it has to be associated with the social fixer thing that now has totally disappeared…. i mean, how? how did that happen. What could a finger of mine hit? because social fixer is still on my homepage, but the feature i wanted it for, that tab enter thing, no longer works….. and i can't find a way to uninstall that either. makes sense to me, it's there, it sends me messages and updates, but for only two days did I have to click tab then enter…… then it all went poof and the java error popped up.

is this a virus? prolly not. right? can i live with this? most likely.

but i can't even find a button on the mozilla firefox page to update my program because it is only on the firefox homepage that i can't access it is not the default browser thanks to the ridiculous ASK.com thing that came with that adaware or one of these recent downloads.

can you guarantee me that if i uninstall then reinstall mozilla that i will NOT lose my favorites this time? i have a memory stick somewhere. I never used it. it don't know how. is there a way to save my favorites and get it stored in the memory stick?

you all out there can laugh it up all you want. i'm not saying you are OCD….but people come here and read this stuff and they must be rolling in the aisles over my stupidity and frustration…but wait, someday you will old and injured and have some brain damage due to lots of concussions and let's not forget the agingt brain syndrome that just happens and i don't have medical insurance to deal with….so really….. laugh laugh laugh….

or teach me how to open a zip file.

or teach me how to get my favorites into a memory stick

or just let me sit here and sob. whatever.

I know i'm sounding mean, i don't mean to be OCD, this is not addressed at you per se…..there are other people reading this and truly have no clue how hard this is for some people. like me.

so here are those two little logs left on my desktop. i'd really rather try to learn to open those zip files, can that be possible? or at least tell me what i did wrong. I download them, they are there in my download file. when i click on it nothing happens but another box pops up with lines and lines of other file folders to open which also do nothing or need me to pick a program to open them with, which hello? why would I be using Windows Media Player to open a program? I don't get it.

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21799

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183

OCD

Post #9July 30, 2013, 6:13 AM UTC last edited July 30, 2013, 6:15 AM UTC

Hi compudodo,

This whole process seems to be a bit overwhelming for you. Just try and take a deep breath and relax, we can get you through this. We will just take it a step at a time.

First let's get Firefox updated to the most current version, then reset the homepage.

Close all programs before you proceed.

Update Firefox

Locate the Mozilla Firefox icon [external image: Posted Image], double click to launch the Firefox browser.
It is not important at this point what your home page is set to.
In the upper left corner of your monitor screen you will see an orange Firefox button [external image: Posted Image]
Click the white downward arrow, slide your mouse cursor over to the Help sub menu.
Wait for the Help menu to expand, then click on About Firefox
A small window will open similar to the one below.

[external image: Posted Image]

Click on the Update button as shown in the image above.
Allow Mozilla Firefox to update, reboot if instructed to do so.

=========================

Reset Firefox Homepage

Click on the Firefox drop down arrow in the upper left corner of your browser.
Select Options, the select Options again.
On the General tab, locate the Home Page field.
Enter the URL you would like to use as your home page (ie: http://www.google.com ), or select the Restore to Default button.
Click OK

In your next post please provide the following:

Just let me know if you were able to complete the above steps successfully.

compudodo

Post #10July 30, 2013, 2:29 PM UTC last edited July 30, 2013, 9:40 PM UTC

it's kinda hard not to be totally frustrated . i can't even make myself understood. i will try again.
….
I DOUBLE LEFT CLICK ON THE MOZILLA ICON…… IT TAKES ME TO MY msn HOMEPAGE….. THERE IS A TEENYTINY MOZILLA ICON UP IN THE LEFT HAND CORNER, WHETHER YOU LEFT OR RIGHT CLICK ON IT, YOU JUST GET A BOX WITH THE OPTIONS : RESTORE OR MINIMIZE OR CLOSE. ( THE OPTIONS MOVE, SIZE AND MAXIMIZE ARE WHITED OUT AND CAN'T BE CLICKED ON). .

I REPEAT. THESE STEPS FORTY THOUSAND TIMES. THERE IS NO RECTANGULAR ORANGE BOX ANYWHERE TO BE SEEN. SO :
i went to TOOLS. OPTIONS. GENERAL AND I TYPED INTO THE HOMEPAGE BOX: HTTP//:WWW. MOZILLAFIREFOX.COM ….. I now can access firefox. It gives me two options and two options only. An Android option or a desktop option, i click on the desktop tab. and the page declares in big bold letters: HOORAY, YOUR FIREFOX IS UP TO DATE! See how the new features in firefox help you browse faster and more efficiently.

You can click on the tour ….. or you again can click on the android option. Or you can click on the beta firefox option. OR you can click on NEED A FRESH COPY? and you can click on the download option

nowhere was there ever a rectangular orange firefox box, no where are there options to get to a menu of any kind. no way to get a sub menu, a help menu or check for updates. Mozilla had already congratulated me on having the updated version. So ???? HUH????? I am not un-installing and then installing firefox all over again….it says i am up to date.

Same problem on facebook…….. social fixer is no where to be found, so it finally dawned on me to join the social fixer forum problem page there….and I have a post there now and will get a reply sometime today I am sure.

I don't know why i do not have any orange rectangular box anywhere nor do i have the Firefox drop down arrow in the upper left corner of my browser.

I swear. it is not there…. what is in my browser box is: there is an arrow just to the left of box pointing left…it takes you back to the previous page. there is also a little arrow that will take you back to where you just were…. then there is the browser long white rectangular box….. there is no firefox drop down arrow anywhere

the social fixer problem forum sent me a link to download the latest version of social fixer….. they said that java application box was a glitch in the old version and the new version won't have it. i have to reboot to see if this is the case. I will go now to reboot. I WILL REPOST ONCE I AM REBOOTED. When I come back, can you at least explain to me why why why NOTHING you say is on my computer screen is actually on my computer screen????? And can i please find out what i did wrong with those files I could not open, or why there were no directions on how to open a zip file? I really want to know. thanks.

OK. there is no longer any error box appearing on my facebook page. NOW there is an ERROR BOX from Ad-AWARE!!!!!!!!! IT SAYS:
Ad-Aware Free Antivirus+(Not Activated) Error: cannot open http://www.lavasoft.com/external/activatio…version=AdAware Free Antivirus Trust & inter=homepage

See? what did i do wrong?? Oh yeah, i changed my homepage from msn.com to http//:mozillafirefox.com. I will now go into tools again and options and change the homepage back to msn.com and see if the error box disappears when i reboot. i'll be back.

Soooooooooooooooooooooo now i am back 4 minutes later and of course the error box is still there even though i went back to msn as my homepage and never clicked on anything else but still my computer now decides i have to live with this NEW ERROR BOX.

AAAAAAAAAAAAAAAAAAAARRRRRRRRRRRRRRRRRRRRRGGGGGGGGGGGGGGGGGGGGGGHHHHHHHHHHHHHHHHH
HHHHHHHHH!!!!!!!!!!!

DOUBLE ARGH, TRIPLE ARGH AND hello? you want me not to be frustrated???? what the heck did i do wrong? why does my computer go off on me constantly? please don't tell me i have to un-install and re-install adaware again and have to go thru trying to get rid of all their garbage they try to pile onto my computer. yes, I hit custom installation, but always some other tool bar is added or i get another homepage. i am so sick of this. really.

OCD

Post #11July 31, 2013, 4:15 AM UTC

Hi compudodo,

I apologize if I am having some difficulty fully understanding your description of what is going wrong with your computer. But please try and be patient, we are in this together and I will do my very best to help you get this straightened out as quickly as we can.

That being said there are many different ways to configure and make personal settings to both how your computer and the software installed on it function and appear to the user.

I have spent some time going over you description of what is wrong and after tweaking the options on my computer related to the Firefox browser I think I have made some headway.

So let's focus on the Firefox browser and getting it set-up how you want it.

Open your Firefox browser. Is this the menu you see at the top left hand corner? If so please continue, if not let me know.

[external image: Posted Image]

Next click on the View menu, the move your cursor to Toolbars.

There you will see 3 options:

Menu Bar
Navigation Bar
Bookmarks Bar

If any of these options have a check mark in the box, try removing the check mark and see how it changes how the features of the browser appearance.
Adjust these settings until you have the browser features you would like displayed, and the options you don't want displayed hidden.

If you have a Side Bar displayed that you don't want, under the View Menu also is a Side Bar sub menu with these options

Bookmarks
History

Adjust these settings also to your liking.

When you have finished, let me know and we will move onto setting the homepage to your web site of choice.

In your next reply let me know what homepage you would like.

If you have any questions please ask.

compudodo

Post #12July 31, 2013, 8:38 AM UTC last edited July 31, 2013, 9:22 AM UTC

yes, everything WAS…. and still is exactly how your picture is. there are no problems now, i knew how to go into tools, options, general to change homepages, it was the only way to find any kind of access to firefox that might have those blue arrows and orange boxes you said my firefox page should have. i don't like the firefox page, it is confusing to me, so i use msn, the page i got when i first bought my first computer 13 years ago. i know how to navigate it. but then i have no way of doing any updates with firefox. oh well. that is what caused all the trauma here. that and those zip files i didn't need anyway because there was ultimately no virus. I am taking up valuable time here for no reason and that distresses me. that javascript error box had nothing to do with a virus….and we both had to spend hours we shouldn't have had to ….. you guys are so busy here. yes, my navigation bar and menu bar are there, i know how to do that. I unchecked all the other stupid bars that were downloaded when i downloaded adaware, malwarebytes, java, you name it, every program now bombards you with 10 other things they want you to use. I COULD HAVE SWORN after the conduit fiasco i was denying automatic installations and only choosing CUSTOM, but obviously some things got by me. I will go over to the windows forum and ask them more stupid questions about the stuff everyone seems to know but me…… but also could you post me a link to the page where I can make a donation for all this wasted time. it is unconscionable to be so stupid and have it take time away from hundreds of people who do have serious problems. i am wracked with guilt. i am so sorry EDIT: I wanted to get rid of all those icons on my desktop but i was warned that if i delete those two tiny files named desktop ini….something about shell class…. it could harm my computer…windows or other programs may not work. oh no. can i delete these two reports or not? or do these icons for these two reports stay on my desktop forever?

OCD

Post #13July 31, 2013, 2:45 PM UTC

Hi compudodo,

Before you run off to the Windows forum, let's make sure you don't have any malware since we have already started the process.

For the record you should feel no guilt about any of this. The helpers here at WTT and many other forums volunteer their time to help because we enjoy assisting others with their computer problems. We have no problem working with each person until we get their computer back working as a well oiled machine.

From your last post you seem to be using sound practices when downloading software

, but sometimes the maker of the software will add "little extras" along the way during installation. Even though you choose Custom, watch for small boxes that are checked by default during the installation process. These will almost always be those pesky tool-bars you want to stay away from.

Hold off on deleting those two (2) files on your desktop, let me do some research before we address those.

=========================

So … let's continue.

You seem to have your browser and homepage set up the way you like it, great.

I'm going to keep this very short and sweet. I just want you to run one (1) scan with OTL so I can make sure there is nothing suspicious on your computer. You have run this tool before, but please read through the directions and pay special note to the text highlighted in red, that will generate an additional log for review.

1. Re-run OTL (it should be located on your desktop).

Windows Vista and Windows 7 & 8 users Right Click and select "Run as Administrator" on the icon to run it.

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Uncheck the boxes beside LOP Check and Purity Check.
Under Extra Registry section, select Use SafeList <– important
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Note:The log can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of the file, and post it with your next reply.

=========================

In your next post please provide the following:
OTL.txt
Extras.txt

compudodo

Post #14July 31, 2013, 11:51 PM UTC last edited August 1, 2013, 12:03 AM UTC

OTL logfile created on: 7/31/2013 7:35:34 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\owner\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 2.99 Gb Available Physical Memory | 78.72% Memory free
7.60 Gb Paging File | 6.32 Gb Available in Paging File | 83.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 297.99 Gb Total Space | 262.88 Gb Free Space | 88.22% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\owner\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Ad-Aware Antivirus\AdAware.exe (Lavasoft Limited)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\OtShot\otshot.exe ()
PRC - C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\OtShot\otshot.exe ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Ad-Aware Service) – C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (SBAMSvc) – C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (gfibto) – C:\Windows\SysNative\drivers\gfibto.sys (GFI Software)
DRV:64bit: - (aswSnx) – C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) – C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswVmm) – C:\Windows\SysNative\drivers\aswVmm.sys ()
DRV:64bit: - (aswRdr) – C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswRvrt) – C:\Windows\SysNative\drivers\aswRvrt.sys ()
DRV:64bit: - (aswTdi) – C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) – C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (RTL8192Ce) – C:\Windows\SysNative\drivers\rtl8192ce.sys (Realtek Semiconductor Corporation )
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (HECIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (netr7364) – C:\Windows\SysNative\drivers\netr7364.sys (Ralink Technology, Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securedsearch2.lavasoft.com/index.p…39B5051F1A053CB
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DE 9E 21 BB AC 51 CE 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..CT3304781.browser.search.defaultthis.engineName: "true"
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.startup.homepage: "http://www.msn.com"
FF - prefs.js..extensions.enabledAddons: grammar.plugin%40grammarly.com:2.32
FF - prefs.js..extensions.enabledAddons: %7B87934c42-161d-45bc-8cef-ef18abe2a30c%7D:3.1
FF - prefs.js..extensions.enabledAddons: socialfixer%40mattkruse.com:7.711
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.7: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/21 03:58:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/25 18:02:12 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/25 18:02:12 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2013/07/25 14:13:21 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Extensions
[2013/07/30 10:49:05 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions
[2013/07/25 18:01:54 | 000,000,000 | —D | M] (Ad-Aware Security Add-on) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
[2013/07/24 06:20:27 | 000,278,419 | —- | M] () (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\[removed]
[2013/07/30 10:49:05 | 000,160,628 | —- | M] () (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\zx6b9hs7.default\extensions\[removed]
[2013/07/24 06:51:22 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/07/24 06:51:22 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/04/14 08:47:48 | 000,263,064 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [Ad-Aware Antivirus] C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher.exe (Lavasoft Limited)
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [OtShot] C:\Program Files (x86)\OtShot\otshot.exe ()
O4 - Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{773E654E-71FA-4F13-B9F6-809E179C3484}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FEDF8DC9-0324-4BB3-8DCC-FEC5B6413B11}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/07/29 06:36:43 | 000,000,000 | —D | C] – C:\_OTL
[2013/07/27 22:11:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013/07/26 22:48:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013/07/25 18:06:50 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\LavasoftStatistics
[2013/07/25 18:06:31 | 000,000,000 | —D | C] – C:\ProgramData\Ad-Aware Antivirus
[2013/07/25 18:02:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
[2013/07/25 18:02:29 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2013/07/25 18:02:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Ad-Aware Antivirus
[2013/07/25 18:02:12 | 000,000,000 | —D | C] – C:\ProgramData\Downloaded Installations
[2013/07/25 18:02:10 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Local\adawarebp
[2013/07/25 18:02:08 | 000,000,000 | —D | C] – C:\ProgramData\Ad-Aware Browsing Protection
[2013/07/25 18:02:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\Toolbar Cleaner
[2013/07/25 18:01:07 | 000,047,496 | —- | C] (GFI Software) – C:\Windows\SysNative\sbbd.exe
[2013/07/25 18:01:07 | 000,014,456 | —- | C] (GFI Software) – C:\Windows\SysNative\drivers\gfibto.sys
[2013/07/25 18:01:05 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\Ad-Aware Antivirus
[2013/07/25 13:26:40 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\Malwarebytes
[2013/07/25 13:26:19 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/07/25 13:26:18 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2013/07/25 13:26:17 | 000,025,928 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2013/07/25 13:26:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/07/25 13:21:58 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
[2013/07/25 13:21:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013/07/25 13:20:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn
[2013/07/25 13:19:42 | 000,312,232 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\javaws.exe
[2013/07/25 13:19:38 | 000,189,352 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\javaw.exe
[2013/07/25 13:19:38 | 000,188,840 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\java.exe
[2013/07/25 13:19:38 | 000,108,968 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013/07/25 13:19:19 | 000,000,000 | —D | C] – C:\Program Files\Java
[2013/07/25 13:19:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/07/25 13:18:57 | 000,263,592 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/07/25 13:18:50 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/07/25 13:18:50 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/07/25 13:18:50 | 000,096,168 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/07/25 12:01:28 | 000,000,000 | —D | C] – C:\ProgramData\HitmanPro
[2013/07/24 23:38:46 | 000,000,000 | -HSD | C] – C:\Windows\SysWow64\AI_RecycleBin
[2013/07/24 23:38:28 | 000,000,000 | -HSD | C] – C:\AI_RecycleBin
[2013/07/24 23:38:25 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\Strongvault
[2013/07/24 06:51:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013/07/23 00:52:27 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\Skype
[2013/07/23 00:52:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013/07/23 00:52:10 | 000,000,000 | R–D | C] – C:\Program Files (x86)\Skype
[2013/07/23 00:52:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2013/07/23 00:52:00 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2013/07/23 00:50:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OtShot
[2013/07/23 00:50:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\OtShot
[2013/07/11 03:09:31 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/07/11 03:09:31 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/07/11 03:09:29 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013/07/11 03:09:29 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013/07/11 03:09:29 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013/07/11 03:09:28 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013/07/11 03:09:28 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013/07/11 03:09:28 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/07/11 03:09:28 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/07/11 03:09:28 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013/07/11 03:09:28 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013/07/11 03:09:26 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/07/11 03:09:25 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/07/11 03:09:25 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/07/11 03:09:24 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/07/10 18:50:35 | 000,624,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\qedit.dll
[2013/07/10 18:50:35 | 000,509,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\qedit.dll
[2013/07/10 18:50:34 | 001,887,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WMVDECOD.DLL
[2013/07/10 18:50:33 | 001,620,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WMVDECOD.DLL
[2013/07/10 18:49:59 | 001,643,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll

========== Files - Modified Within 30 Days ==========

[2013/07/31 19:30:25 | 000,001,057 | —- | M] () – C:\Users\owner\Desktop\OTL.exe - Shortcut.lnk
[2013/07/31 19:25:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/07/31 18:47:00 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/31 17:47:00 | 000,000,892 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/31 15:42:42 | 000,022,736 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/31 15:42:42 | 000,022,736 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/31 15:35:26 | 000,001,868 | —- | M] () – C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
[2013/07/31 15:34:34 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/07/31 15:34:26 | 3059,748,864 | -HS- | M] () – C:\hiberfil.sys
[2013/07/31 05:28:35 | 000,034,664 | —- | M] () – C:\Users\owner\Documents\cc_20130731_052801.reg
[2013/07/30 17:24:56 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/07/30 17:24:56 | 000,624,178 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/07/30 17:24:56 | 000,106,522 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/07/29 06:21:32 | 000,001,126 | —- | M] () – C:\Users\owner\Desktop\AdwCleaner - Shortcut.lnk
[2013/07/28 18:58:34 | 000,000,734 | —- | M] () – C:\Users\owner\Desktop\SecurityCheck - Shortcut.lnk
[2013/07/26 22:48:47 | 000,002,212 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2013/07/26 22:10:36 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/07/26 22:10:36 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/07/25 18:01:06 | 000,047,496 | —- | M] (GFI Software) – C:\Windows\SysNative\sbbd.exe
[2013/07/25 18:01:06 | 000,014,456 | —- | M] (GFI Software) – C:\Windows\SysNative\drivers\gfibto.sys
[2013/07/25 13:26:19 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/25 13:22:01 | 000,002,074 | —- | M] () – C:\Users\owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2013/07/25 13:22:01 | 000,002,050 | —- | M] () – C:\Users\Public\Desktop\Foxit Reader.lnk
[2013/07/25 13:21:07 | 000,001,066 | —- | M] () – C:\Users\Public\Desktop\VLC media player.lnk
[2013/07/25 13:20:21 | 000,001,865 | —- | M] () – C:\Users\Public\Desktop\ImgBurn.lnk
[2013/07/25 13:19:22 | 000,108,968 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013/07/25 13:19:21 | 001,093,032 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\npDeployJava1.dll
[2013/07/25 13:19:21 | 000,972,712 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\deployJava1.dll
[2013/07/25 13:19:21 | 000,312,232 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\javaws.exe
[2013/07/25 13:19:21 | 000,189,352 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\javaw.exe
[2013/07/25 13:19:21 | 000,188,840 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\java.exe
[2013/07/25 13:18:46 | 000,096,168 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/07/25 13:18:45 | 000,867,240 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2013/07/25 13:18:45 | 000,789,416 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2013/07/25 13:18:45 | 000,263,592 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/07/25 13:18:45 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/07/25 13:18:45 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/07/23 00:52:11 | 000,002,515 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk
[2013/07/11 03:35:59 | 000,294,024 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2013/07/31 19:30:25 | 000,001,057 | —- | C] () – C:\Users\owner\Desktop\OTL.exe - Shortcut.lnk
[2013/07/31 05:28:11 | 000,034,664 | —- | C] () – C:\Users\owner\Documents\cc_20130731_052801.reg
[2013/07/29 06:21:32 | 000,001,126 | —- | C] () – C:\Users\owner\Desktop\AdwCleaner - Shortcut.lnk
[2013/07/28 18:58:34 | 000,000,734 | —- | C] () – C:\Users\owner\Desktop\SecurityCheck - Shortcut.lnk
[2013/07/26 22:48:47 | 000,002,212 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2013/07/25 18:02:37 | 000,001,868 | —- | C] () – C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
[2013/07/25 13:26:19 | 000,001,109 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/25 13:22:01 | 000,002,074 | —- | C] () – C:\Users\owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2013/07/25 13:22:01 | 000,002,050 | —- | C] () – C:\Users\Public\Desktop\Foxit Reader.lnk
[2013/07/25 13:21:58 | 000,216,064 | —- | C] () – C:\Windows\SysWow64\gcapi_dll.dll
[2013/07/25 13:21:07 | 000,001,066 | —- | C] () – C:\Users\Public\Desktop\VLC media player.lnk
[2013/07/23 00:52:11 | 000,002,515 | —- | C] () – C:\Users\Public\Desktop\Skype.lnk
[2013/07/23 00:50:25 | 000,000,991 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OtShot.lnk
[2013/01/24 11:42:15 | 000,451,072 | —- | C] () – C:\Windows\SysWow64\ISSRemoveSP.exe
[2012/01/10 23:27:26 | 000,867,020 | —- | C] () – C:\Windows\SysWow64\igkrng575.bin
[2012/01/10 23:27:26 | 000,128,204 | —- | C] () – C:\Windows\SysWow64\igcompkrng575.bin
[2012/01/10 23:27:26 | 000,105,608 | —- | C] () – C:\Windows\SysWow64\igfcg575m.bin
[2012/01/10 22:29:54 | 013,904,384 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013/02/27 01:52:56 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/02/27 00:55:05 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 21:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 23:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 21:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Alternate Data Streams ==========

@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:E5D4F1EB
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:B0B6888E

< End of report >

OTL Extras logfile created on: 7/31/2013 7:35:34 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\owner\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.80 Gb Total Physical Memory | 2.99 Gb Available Physical Memory | 78.72% Memory free
7.60 Gb Paging File | 6.32 Gb Available in Paging File | 83.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 297.99 Gb Total Space | 262.88 Gb Free Space | 88.22% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" (VideoLAN)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" (VideoLAN)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" (VideoLAN)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" (VideoLAN)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{FEC8DAAE-8FCE-4952-B654-E7077BB95430}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{26A24AE4-039D-4CA4-87B4-2F86417025FF}" = Java 7 Update 25 (64-bit)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A5B39D2-7ED6-4779-BCC9-37F381139DB3}" = Adobe AIR
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{944167EA-7F89-4705-8DCD-1D63B53141B0}" = Ad-Aware Antivirus
"{96AD3B61-EAE2-11E2-9E72-B8AC6F98CCE3}" = Google Earth
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D3D8C60-A55F-4fed-B2B9-173001290E16}" = Realtek WLAN Driver
"{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}" = OpenOffice.org 3.4.1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"Astra Jigsaw Art Edition_is1" = Astra Jigsaw Art Edition version 1.25
"Astra Jigsaw Art III_is1" = Astra Jigsaw Art III version 1.25
"Astra Jigsaw France and UK_is1" = Astra Jigsaw France and UK version 1.25
"Astra Jigsaw Italy and Spain_is1" = Astra Jigsaw Italy and Spain version 1.25
"Astra Jigsaw My Favorite Things II_is1" = Astra Jigsaw My Favorite Things II version 1.26
"avast" = avast! Free Antivirus
"BFG-Bricks of Atlantis" = Bricks of Atlantis
"BFG-Bricks of Egypt 2" = Bricks of Egypt 2
"BFGC" = Big Fish Games: Game Manager
"BigJig_is1" = BigJig version 8.21
"Desktop Taipei_is1" = Desktop Taipei version 2.3
"Foxit Reader_is1" = Foxit Reader
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"VLC media player" = VLC media player 2.0.7

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 7/27/2013 4:22:48 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/28/2013 3:44:21 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/29/2013 6:29:09 AM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/29/2013 6:40:28 AM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/29/2013 12:46:54 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/30/2013 10:48:24 AM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/30/2013 4:55:55 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/30/2013 5:22:23 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/31/2013 3:36:20 PM | Computer Name = owner-PC | Source = WinMgmt | ID = 10
Description =

Error - 7/31/2013 3:39:49 PM | Computer Name = owner-PC | Source = Application Error | ID = 1000
Description = Faulting application name: adawarebp.exe, version: 1.0.1.106, time
stamp: 0x5190eea6 Faulting module name: ntdll.dll, version: 6.1.7601.17725, time
stamp: 0x4ec49b8f Exception code: 0xc0000005 Fault offset: 0x000343d0 Faulting process
id: 0x7c0 Faulting application start time: 0x01ce8e251582e4bb Faulting application
path: C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe Faulting module
path: C:\Windows\SysWOW64\ntdll.dll Report Id: f600f887-fa18-11e2-a69c-1c75088989b8

[ Media Center Events ]
Error - 5/17/2013 10:41:27 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 10:41:27 AM - Failed to retrieve SportsSchedule (Error: The request
failed with HTTP status 403: Forbidden.)

Error - 5/17/2013 10:41:46 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 10:41:40 AM - Failed to retrieve Broadband (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 11:42:01 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 11:42:00 AM - Failed to retrieve NetTV (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 11:42:01 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 11:42:01 AM - Failed to retrieve MCEClientUX (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 11:42:03 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 11:42:02 AM - Failed to retrieve SportsSchedule (Error: The request
failed with HTTP status 403: Forbidden.)

Error - 5/17/2013 11:42:06 AM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 11:42:03 AM - Failed to retrieve Broadband (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 12:42:26 PM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 12:42:26 PM - Failed to retrieve NetTV (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 12:42:27 PM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 12:42:27 PM - Failed to retrieve MCEClientUX (Error: The request failed
with HTTP status 403: Forbidden.)

Error - 5/17/2013 12:42:28 PM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 12:42:27 PM - Failed to retrieve SportsSchedule (Error: The request
failed with HTTP status 403: Forbidden.)

Error - 5/17/2013 12:42:30 PM | Computer Name = owner-PC | Source = MCUpdate | ID = 0
Description = 12:42:29 PM - Failed to retrieve Broadband (Error: The request failed
with HTTP status 403: Forbidden.)

[ System Events ]
Error - 6/21/2013 10:37:12 AM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 6/28/2013 3:51:15 AM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 7/7/2013 4:40:43 AM | Computer Name = owner-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 12:59:07 AM on ?7/?7/?2013 was unexpected.

Error - 7/11/2013 3:33:58 AM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 7/11/2013 12:25:41 PM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 7/22/2013 10:59:29 AM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 7/24/2013 3:47:21 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 7/24/2013 3:47:52 PM | Computer Name = owner-PC | Source = DCOM | ID = 10010
Description =

Error - 7/24/2013 3:47:51 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the BITS service.

Error - 7/24/2013 3:48:11 PM | Computer Name = owner-PC | Source = Service Control Manager | ID = 7031
Description = The avast! Antivirus service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
Restart the service.

< End of report >

quick question: why does OT shot keep showing up and the otshot boxes keep popping up at start up even after i uninstalled from the control panel? also, these 2 comments took almost 5 minutes to type, computer running so so slow

OCD

Post #15August 1, 2013, 5:22 AM UTC

Hi compudodo,

quick question: why does OT shot keep showing up and the otshot boxes keep popping up at start up even after i uninstalled from the control panel?

I take it from your statement you would like to remove OtShot completely. If so complete step 1

these 2 comments took almost 5 minutes to type, computer running so so slow

=========================

1. Run OTL.exe

Windows Vista and Windows 7 users Right Click and select "Run as Administrator"

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\Program Files (x86)\OtShot\otshot.exe ()
MOD - C:\Program Files (x86)\OtShot\otshot.exe ()
O4 - HKLM..\Run: [OtShot] C:\Program Files (x86)\OtShot\otshot.exe ()
[2013/07/23 00:50:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\OtShot
[2013/07/31 19:30:25 | 000,001,057 | —- | M] () – C:\Users\owner\Desktop\OTL.exe - Shortcut.lnk

:Files
C:\Program Files (x86)\OtShot

:Commands
[purity]
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

=========================

Disk Defragmenter in Windows 7

Click on the Start button, and type in "disk defragmenter" in the search window at the bottom.
"Disk Defragmenter" should appear at the top of the search results, click to open.

(a window similar to the one below will open)

[external image: Posted Image]

Locate your primary hard drive (usually C:), and select it.

[external image: Posted Image]

Next select the Defragment Disk button. Monitor the progress if you choose.

[external image: Posted Image]

Close when the defrag process has been completed.

= = = = = = = = = =

You can also Schedule the Disk Defragmenter to run on a predetermined schedule.

From the main Disk Defragmenter window

[external image: Posted Image]

Select the Configure / Schedule button

[external image: Posted Image]

Select a date and time that best suits your needs.
Close when finished.

=========================

In your next post please provide the following:
OTL fix log
How is the computer running?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

VIRUS? YES OR NO? [Solved]

✨ Ask AI

Ask AI