Spyware / Malware / Virus Removal

No icon response [Solved]

18 min read

Looking for the outcome? Ask AI

krome8800 Topic Starter

Post #1August 18, 2013, 3:48 AM UTC last edited August 18, 2013, 4:30 PM UTC

Hi was was loading xsplit program not looking a hit wrong install think I may have installed virus.

No Icon will respond, now have weatherbug, pcfigther, and it saying I am have a oasrv.exe and playing call of duty I got kicked or a iw3mp.exe . Also something about iframe.dll. I tried to do system restore but that doesnt respond either..

Here logs below.

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 22:39:18.15 on Sat 08/17/2013
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 10.25.2
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2565 [GMT -5:00]
.
AV: AVG Anti-Virus Free *Disabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Online Armor Firewall *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Online Armor\OAcat.exe
C:\Program Files\Online Armor\oasrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
C:\ASUS.SYS\config\DVMExportService.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\ASUS\TurboV\TurboV.exe
C:\Program Files\ASUS\Turbo Key\TurboKey.exe
C:\Program Files\Razer\Tarantula\razerhid.exe
C:\Program Files\Razer\Copperhead\razerhid.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Razer\Copperhead\razerofa.exe
C:\Program Files\Online Armor\OAui.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Logitech\G35\G35.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Online Armor\OAhlp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Krome\My Documents\Downloads\OTL.exe
C:\Documents and Settings\Krome\My Documents\Downloads\dds.scr
.
============== Pseudo HJT Report ===============
.
mURLSearchHooks: H - No File
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\10.0.0.7\AVG Secure Search_toolbar.dll
BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\10.0.0.7\AVG Secure Search_toolbar.dll
TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [Steam] "c:\program files\steam\steam.exe" -silent
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
mRun: [Six Engine] "c:\program files\asus\epu-4 engine\FourEngine.exe" -b
mRun: [TurboV] "c:\program files\asus\turbov\TurboV.exe"
mRun: [QFan Help] "c:\program files\asus\ai suite\qfan3\QFanHelp.exe"
mRun: [Cpu Level Up help] "c:\program files\asus\ai suite\CpuLevelUpHelp.exe"
mRun: [Turbo Key] "c:\program files\asus\turbo key\TurboKey.exe"
mRun: [Tarantula] c:\program files\razer\tarantula\razerhid.exe
mRun: [razer] c:\program files\razer\copperhead\razerhid.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [@OnlineArmor GUI] "c:\program files\online armor\OAui.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [Logitech G35] c:\program files\logitech\g35\G35.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\10.0.6\ViProtocol.dll
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: OA Shell Helper: {4f07da45-8170-4859-9b5f-037ef2970034} - c:\progra~1\online~2\oaevent.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-1-25 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-1-25 314456]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2012-1-31 205864]
R1 oahlpXX;Online Armor helper driver;c:\windows\system32\drivers\oahlp32.sys [2012-1-31 40296]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2012-1-31 25192]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [2012-1-31 29464]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files\asus\assysctrlservice\1.00.02\AsSysCtrlService.exe [2010-4-3 90112]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-1-25 20568]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-1-25 44768]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [2009-4-10 294912]
R2 OAcat;Online Armor Helper Service;c:\program files\online armor\oacat.exe [2012-1-31 207936]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [2010-4-3 22016]
R2 SvcOnlineArmor;Online Armor;c:\program files\online armor\oasrv.exe [2012-1-31 4363040]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [2010-10-1 100368]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-8-17 40776]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-4-3 1374464]
S0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys –> c:\windows\system32\drivers\mv61xx.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-5-1 256904]
S3 LADF_DHP2;G35 DHP2 Filter Driver;c:\windows\system32\drivers\ladfDHP2i386.sys [2012-10-2 53976]
S3 LADF_SBVM;G35 SBVM Filter Driver;c:\windows\system32\drivers\ladfSBVMi386.sys [2012-10-2 335064]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-29 117656]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 Razerlow;Razer Copperhead Driver;c:\windows\system32\drivers\Razerlow.sys [2010-4-3 19020]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [2010-4-3 25984]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [2010-4-3 17408]
S3 TarFltr;Razer Tarantula USB Keyboard;c:\windows\system32\drivers\UsbFltr.sys [2010-4-3 44800]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys –> c:\windows\system32\drivers\wdcsam.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S3 XFDriver;XFDriver;c:\program files\xfire2\XFDriver.sys [2013-6-14 16648]
S4 AODService;AODService;c:\program files\amd\overdrive\AODAssist.exe [2009-4-22 124256]
SUnknown vToolbarUpdater;vToolbarUpdater; [x]
.
=============== Created Last 30 ================
.
2013-08-18 03:33:39 40776 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2013-08-18 03:24:35 ——– d—–w- c:\program files\CCleaner
2013-08-17 22:29:11 ——– d—–w- C:\Malwarebytes
2013-08-17 22:23:20 ——– d-sh–w- c:\windows\system32\AI_RecycleBin
2013-08-17 22:23:18 ——– d—–w- c:\program files\W3i
2013-08-17 22:23:18 ——– d—–w- c:\docume~1\alluse~1\applic~1\W3i
2013-08-17 22:23:06 ——– d—–w- c:\docume~1\krome\applic~1\Fighters
2013-08-17 22:22:48 ——– d—–w- c:\program files\Fighters
2013-08-17 22:22:48 ——– d—–w- c:\docume~1\alluse~1\applic~1\Fighters
2013-08-17 22:22:28 ——– d—–w- c:\docume~1\krome\locals~1\applic~1\WeatherBug
2013-08-17 22:22:26 ——– d—–w- c:\docume~1\krome\applic~1\WeatherBug
2013-08-17 22:22:23 ——– d—–w- c:\program files\AWS
2013-08-17 21:53:38 ——– d—–w- c:\program files\SplitMediaLabs
2013-08-17 21:51:39 ——– d—–w- c:\docume~1\krome\locals~1\applic~1\SplitMediaLabs
2013-08-17 21:50:41 ——– d—–w- c:\docume~1\alluse~1\applic~1\SplitMediaLabs
2013-08-17 21:43:08 ——– d—–w- c:\windows\system32\XPSViewer
2013-08-17 21:42:36 89088 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
2013-08-17 21:42:19 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2013-08-17 21:42:19 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2013-08-17 21:42:19 597504 ——w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2013-08-17 21:42:19 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2013-08-17 21:42:19 575488 ——w- c:\windows\system32\xpsshhdr.dll
2013-08-17 21:42:19 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2013-08-17 21:42:19 1676288 ——w- c:\windows\system32\xpssvcs.dll
2013-08-17 21:42:19 117760 ——w- c:\windows\system32\prntvpt.dll
2013-08-17 21:42:19 ——– d—–w- C:\6fe708be5a1534182269480d3fd8cf46
2013-08-17 21:38:35 ——– d—–w- c:\docume~1\krome\applic~1\SplitMediaLabs
2013-07-27 18:02:18 ——– d—–w- c:\docume~1\krome\applic~1\Day 1 Studios
2013-07-20 22:46:28 ——– d—–w- c:\program files\NVIDIA Corporation
2013-07-20 22:42:23 107888 —-a-w- c:\windows\system32\CmdLineExt.dll
.
==================== Find3M ====================
.
2013-08-17 22:12:28 281768 —-a-w- c:\windows\system32\PnkBstrB.xtr
2013-08-17 22:12:28 281768 —-a-w- c:\windows\system32\PnkBstrB.exe
2013-08-17 22:09:03 281768 —-a-w- c:\windows\system32\PnkBstrB.ex0
2013-07-19 00:44:21 76888 —-a-w- c:\windows\system32\PnkBstrA.exe
2013-07-13 20:54:55 22328 —-a-w- c:\docume~1\krome\applic~1\PnkBstrK.sys
2013-07-09 01:47:31 94632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-09 01:47:30 867240 —-a-w- c:\windows\system32\npdeployJava1.dll
2013-07-09 01:47:30 789416 —-a-w- c:\windows\system32\deployJava1.dll
2013-07-09 01:47:30 144896 —-a-w- c:\windows\system32\javacpl.cpl
2013-06-12 23:24:25 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-12 23:24:25 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
.
============= FINISH: 22:40:14.95 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/3/2010 6:15:20 AM
System Uptime: 8/17/2013 10:04:13 PM (0 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | M4A79XTD EVO
Processor: AMD Phenom™ II X4 955 Processor | AM3 | 3201/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 596 GiB total, 419.853 GiB free.
D: is CDROM ()
E: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP496: 5/22/2013 6:33:12 PM - System Checkpoint
RP497: 5/23/2013 6:59:28 PM - System Checkpoint
RP498: 5/26/2013 2:12:38 PM - System Checkpoint
RP499: 5/31/2013 6:11:35 PM - System Checkpoint
RP500: 6/6/2013 5:57:35 PM - System Checkpoint
RP501: 6/9/2013 3:13:00 PM - System Checkpoint
RP502: 6/10/2013 8:41:38 PM - System Checkpoint
RP503: 6/12/2013 7:45:07 PM - System Checkpoint
RP504: 6/14/2013 8:33:38 PM - System Checkpoint
RP505: 6/15/2013 9:03:34 PM - System Checkpoint
RP506: 6/23/2013 8:04:42 AM - System Checkpoint
RP507: 6/24/2013 6:03:19 PM - System Checkpoint
RP508: 6/27/2013 5:08:45 PM - System Checkpoint
RP509: 6/28/2013 5:53:22 PM - System Checkpoint
RP510: 6/30/2013 10:38:10 AM - System Checkpoint
RP511: 7/2/2013 5:42:29 PM - System Checkpoint
RP512: 7/4/2013 1:02:34 PM - System Checkpoint
RP513: 7/6/2013 4:01:46 PM - System Checkpoint
RP514: 7/8/2013 8:47:07 PM - Removed Java 7 Update 17
RP515: 7/8/2013 8:47:25 PM - Installed Java 7 Update 25
RP516: 7/11/2013 6:22:14 PM - System Checkpoint
RP517: 7/13/2013 8:10:41 AM - System Checkpoint
RP518: 7/13/2013 3:51:35 PM - Installed DirectX
RP519: 7/13/2013 3:56:33 PM - Installed Microsoft Visual C++ 2005 Redistributable
RP520: 7/13/2013 3:57:33 PM - Installed DirectX
RP521: 7/15/2013 8:25:42 PM - Installed AGEIA PhysX v7.07.09
RP522: 7/15/2013 8:26:20 PM - Installed Medal of Honor Airborne
RP523: 7/18/2013 6:07:34 PM - System Checkpoint
RP524: 7/18/2013 7:30:32 PM - Removed AGEIA PhysX v7.07.09
RP525: 7/18/2013 7:33:00 PM - Removed Microsoft Games for Windows - LIVE Redistributable
RP526: 7/18/2013 7:33:41 PM - Removed Microsoft Games for Windows Marketplace
RP527: 7/20/2013 5:46:27 PM - Installed NVIDIA PhysX
RP528: 7/21/2013 6:21:36 PM - System Checkpoint
RP529: 7/22/2013 7:08:58 PM - System Checkpoint
RP530: 7/24/2013 4:49:49 PM - System Checkpoint
RP531: 7/25/2013 7:01:51 PM - System Checkpoint
RP532: 7/26/2013 7:38:31 PM - System Checkpoint
RP533: 7/27/2013 1:01:58 PM - Installed DirectX
RP534: 7/30/2013 6:40:11 PM - System Checkpoint
RP535: 8/1/2013 6:18:17 PM - System Checkpoint
RP536: 8/2/2013 6:26:14 PM - System Checkpoint
RP537: 8/3/2013 8:20:15 PM - System Checkpoint
RP538: 8/5/2013 5:24:15 PM - System Checkpoint
RP539: 8/6/2013 6:50:38 PM - System Checkpoint
RP540: 8/7/2013 8:43:45 PM - System Checkpoint
RP541: 8/9/2013 5:11:46 PM - System Checkpoint
RP542: 8/10/2013 6:06:08 PM - System Checkpoint
RP543: 8/11/2013 6:08:17 PM - System Checkpoint
RP544: 8/12/2013 6:18:59 PM - System Checkpoint
RP545: 8/13/2013 6:27:14 PM - System Checkpoint
RP546: 8/16/2013 7:59:18 PM - System Checkpoint
RP547: 8/17/2013 4:25:21 PM - Installed Windows NLSDownlevelMapping.
RP548: 8/17/2013 4:25:33 PM - Installed Windows IDNMitigationAPIs.
RP549: 8/17/2013 4:26:34 PM - Installed Windows Internet Explorer 7.
RP550: 8/17/2013 4:42:25 PM - Installed Windows KB954550-v5.
RP551: 8/17/2013 4:42:33 PM - Printer Driver Microsoft XPS Document Writer Installed
RP552: 8/17/2013 4:42:38 PM - Printer Driver Microsoft XPS Document Writer Installed
RP553: 8/17/2013 4:50:33 PM - Installed XSplit
RP554: 8/17/2013 4:53:25 PM - Removed XSplit
RP555: 8/17/2013 4:53:36 PM - Installed XSplit
RP556: 8/17/2013 5:22:18 PM - Installed WeatherBug
RP557: 8/17/2013 10:38:18 PM - OTL Restore Point - 8/17/2013 10:38:16 PM
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.3
Adobe Shockwave Player 11.6
AI Suite
AMD APP SDK Runtime
AMD Catalyst Install Manager
AMD OverDrive
AMD Processor Driver
ASUS E-Green Uninstall
ATI AVIVO Codecs
ATI Catalyst Registration
ATI Problem Report Wizard
avast! Free Antivirus
Borderlands 2
Call of Duty® - World at War™
Call of Duty® - World at War™ 1.2 Patch
Call of Duty® - World at War™ 1.3 Patch
Call of Duty® - World at War™ 1.4 Patch
Call of Duty® - World at War™ 1.5 Patch
Call of Duty® - World at War™ 1.6 Patch
Call of Duty® - World at War™ 1.7 Patch
Call of Duty® 2
Call of Duty® 2 Patch 1.3
Call of Duty® 4 - Modern Warfare™
Call of Duty® 4 - Modern Warfare™ 1.6 Patch
Call of Duty® 4 - Modern Warfare™ 1.7 Patch
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCleaner
Cool & Quiet
Counter-Strike: Global Offensive
Counter-Strike: Source
Crysis 2 Demo
Day of Defeat
Day of Defeat: Source
Diagnostic Utility
EPU-4 Engine
Express Gate
F.E.A.R. 3
GRID
Half-Life 2: Episode One
Half-Life 2: Episode Two
High Definition Audio Driver Package - KB888111
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB981793)
HydraVision
Insurgency
Itibiti RTC
Java 7 Update 25
Java Auto Updater
Left 4 Dead 2
Left 4 Dead 2 Beta
Logitech G35
Malwarebytes Anti-Malware version 1.75.0.1300
Medal of Honor Airborne
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
mIRC
Mozilla Firefox 23.0.1 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 8 Essentials
neroxml
NNScript
NVIDIA PhysX
Online Armor 5.1
Opera 11.10
Opera 11.62
Origin
PlanetSide 2
Platform
Portal
Razer Copperhead
Razer Tarantula
RconMax(MW)
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Ricochet
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB982381)
Skype™ 4.2
SLOW-PCfighter
Steam
swMSM
Team Fortress 2
TeamSpeak 3 Client
The Lord of the Rings FREE Trial
Tom Clancy's Rainbow Six: Vegas 2
Turbo Key
TurboV
Tweak UI
Uninstall Helper
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Ventrilo Client
VIA Platform Device Manager
WeatherBug
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinZip 17.0
WOT for Internet Explorer
Xfire
Xfire 2.0
Xfire Codec (remove only)
XSplit
.
==== Event Viewer Messages From Past Week ========
.
8/17/2013 6:29:46 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
8/17/2013 6:29:42 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD AmdPPM AsIO aswRdr aswSnx aswSP aswTdi Fips IPSec MRxSmb NetBIOS NetBT OADevice oahlpXX OAmon OAnet RasAcd Rdbss Tcpip
8/17/2013 6:29:42 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
8/17/2013 6:29:42 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/17/2013 6:29:42 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/17/2013 6:29:42 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
8/17/2013 6:29:07 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/17/2013 6:28:59 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
8/17/2013 6:10:36 PM, error: System Error [1003] - Error code 100000d1, parameter1 a4608000, parameter2 00000002, parameter3 00000000, parameter4 a8b100d8.
8/17/2013 5:26:43 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
8/17/2013 4:47:30 PM, error: Service Control Manager [7000] - The vToolbarUpdater service failed to start due to the following error: The system cannot find the file specified.
.
==== End Of File ===========================

OTL logfile created on: 8/17/2013 10:36:45 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Krome\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.53 Gb Available Physical Memory | 77.83% Memory free
5.09 Gb Paging File | 4.50 Gb Available in Paging File | 88.35% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 596.16 Gb Total Space | 419.87 Gb Free Space | 70.43% Space Free | Partition Type: NTFS
Drive E: | 1.81 Gb Total Space | 1.79 Gb Free Space | 99.28% Space Free | Partition Type: FAT

Computer Name: KEITH | User Name: Krome | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Krome\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Online Armor\oaui.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oahlp.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
PRC - C:\Program Files\Logitech\G35\G35.exe (Logitech©)
PRC - C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
PRC - C:\Program Files\ASUS\TurboV\TurboV.exe ()
PRC - C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
PRC - C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM)
PRC - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
PRC - C:\WINDOWS\system32\regsvr32.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Razer\Tarantula\razerhid.exe ()
PRC - C:\Program Files\Razer\Copperhead\razerhid.exe ()
PRC - C:\Program Files\Razer\Copperhead\razerofa.exe (Razer Inc.)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()
MOD - C:\Program Files\AVAST Software\Avast\defs\13081701\algo.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
MOD - C:\Program Files\ASUS\TurboV\TurboV.exe ()
MOD - C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
MOD - C:\Program Files\ASUS\Turbo Key\pngio.dll ()
MOD - C:\Program Files\ASUS\Turbo Key\AiNap.dll ()
MOD - C:\Program Files\ASUS\TurboV\OcProfile.dll ()
MOD - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\AsSpindownTimeout.dll ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\pngio.dll ()
MOD - C:\Program Files\ASUS\TurboV\TvOcLib.dll ()
MOD - C:\Program Files\ASUS\TurboV\pngio.dll ()
MOD - C:\Program Files\Razer\Tarantula\razerhid.exe ()
MOD - C:\WINDOWS\system32\AsIO.dll ()
MOD - C:\Program Files\Razer\Copperhead\razerhid.exe ()
MOD - C:\Program Files\Razer\Copperhead\download.dll ()

========== Services (SafeList) ==========

SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
SRV - (AODService) – C:\Program Files\AMD\OverDrive\AODAssist.exe ()
SRV - (DvmMDES) – C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM)
SRV - (AsSysCtrlService) – C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
SRV - (spupdsvc) – C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (WDC_SAM) – system32\DRIVERS\wdcsam.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (PciCon) – D:\PciCon.sys File not found
DRV - (mv61xx) – system32\DRIVERS\mv61xx.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (XFDriver) – C:\Program Files\Xfire2\XFDriver.sys (XFire)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (oahlpXX) – C:\WINDOWS\system32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Emsisoft)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys ()
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Emsisoft)
DRV - (LADF_SBVM) – C:\WINDOWS\system32\drivers\ladfSBVMi386.sys (Logitech)
DRV - (LADF_DHP2) – C:\WINDOWS\system32\drivers\ladfDHP2i386.sys (Logitech)
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (RtNdPt5x) – C:\WINDOWS\system32\drivers\RtNdPt5x.sys (Realtek Semiconductor Corporation )
DRV - (RTLVLAN) – C:\WINDOWS\system32\drivers\RTLVLAN.SYS (Realtek Semiconductor Corporation )
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (RTLTEAMING) – C:\WINDOWS\system32\drivers\RTLTEAMING.SYS (Realtek Semiconductor Corporation)
DRV - (AsIO) – C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (TarFltr) – C:\WINDOWS\system32\drivers\UsbFltr.sys (Waytech Development, Inc.)
DRV - (Razerlow) – C:\WINDOWS\system32\drivers\Razerlow.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={C016D7D…mp;d=2011-12-13 17:19:33&v;=9.0.0.18&sap;=dsp&q;={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "WWW.YAHOO.COM"
FF - prefs.js..extensions.enabledAddons: %7B27c60876-b5c9-4335-b4f3-52b26782220c%7D:0.9.4
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:6.0.1367
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4bc0a51c&v;=6.103.018.001&i;=23&tp;=ab&iy;=&ychte;=us&lng;=en-US&q;="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\10.0.0.7\ [2012/01/19 19:21:01 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/01/25 19:15:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/16 20:17:26 | 000,000,000 | —D | M]

[2010/05/16 15:17:47 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Extensions
[2013/08/16 20:02:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions
[2013/05/14 17:43:53 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013/05/15 19:03:15 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/01/13 20:11:23 | 000,007,532 | —- | M] () (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi
[2013/08/16 20:02:18 | 000,534,203 | —- | M] () (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013/08/16 20:17:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/16 20:17:34 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/01/25 19:15:29 | 000,000,000 | —D | M] (avast! WebRep) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/01/19 19:20:55 | 000,003,766 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml

O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll ()
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\OAui.exe (Emsi Software GmbH)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [Logitech G35] C:\Program Files\Logitech\G35\G35.exe (Logitech©)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QFan Help] C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe ()
O4 - HKLM..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe ()
O4 - HKLM..\Run: [Six Engine] C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Tarantula] C:\Program Files\Razer\Tarantula\razerhid.exe ()
O4 - HKLM..\Run: [Turbo Key] C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
O4 - HKLM..\Run: [TurboV] C:\Program Files\ASUS\TurboV\TurboV.exe ()
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D3F7724-5D24-41AB-886B-5181B5927C79}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\mhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\10.0.6\ViProtocol.dll ()
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Emsi Software GmbH)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/03 06:14:13 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XFR1 - C:\WINDOWS\System32\xfcodec.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/08/17 22:33:39 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/17 22:25:42 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Krome\Recent
[2013/08/17 22:24:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2013/08/17 22:24:35 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2013/08/17 17:29:11 | 000,000,000 | —D | C] – C:\Malwarebytes
[2013/08/17 17:27:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Desktop\backups
[2013/08/17 17:23:20 | 000,000,000 | -HSD | C] – C:\WINDOWS\System32\AI_RecycleBin
[2013/08/17 17:23:18 | 000,000,000 | —D | C] – C:\Program Files\W3i
[2013/08/17 17:23:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\W3i
[2013/08/17 17:23:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Uninstall Helper
[2013/08/17 17:23:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\Fighters
[2013/08/17 17:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Fighters
[2013/08/17 17:22:48 | 000,000,000 | —D | C] – C:\Program Files\Fighters
[2013/08/17 17:22:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Fighters
[2013/08/17 17:22:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Local Settings\Application Data\WeatherBug
[2013/08/17 17:22:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\WeatherBug
[2013/08/17 17:22:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Start Menu\Programs\WeatherBug
[2013/08/17 17:22:23 | 000,000,000 | —D | C] – C:\Program Files\AWS
[2013/08/17 16:53:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\XSplit
[2013/08/17 16:53:38 | 000,000,000 | —D | C] – C:\Program Files\SplitMediaLabs
[2013/08/17 16:51:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Local Settings\Application Data\SplitMediaLabs
[2013/08/17 16:50:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SplitMediaLabs
[2013/08/17 16:43:08 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2013/08/17 16:43:04 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2013/08/17 16:42:55 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2013/08/17 16:42:19 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2013/08/17 16:42:19 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2013/08/17 16:42:19 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2013/08/17 16:42:19 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2013/08/17 16:42:19 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2013/08/17 16:42:19 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2013/08/17 16:42:19 | 000,000,000 | —D | C] – C:\6fe708be5a1534182269480d3fd8cf46
[2013/08/17 16:38:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\SplitMediaLabs
[2013/08/17 16:26:44 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2013/08/17 16:25:39 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie7
[2013/08/17 16:25:30 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[2013/08/17 16:25:18 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[2013/08/16 20:17:24 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/07/27 13:02:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\Day 1 Studios
[2013/07/20 17:46:28 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2013/07/20 17:46:28 | 000,000,000 | —D | C] – C:\Program Files\AGEIA Technologies
[2013/07/20 17:42:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\My Documents\EA Games
[2013/07/20 17:42:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Krome\Application Data\SecuROM
[2013/07/20 17:42:23 | 000,107,888 | —- | C] (Sony DADC Austria AG.) – C:\WINDOWS\System32\CmdLineExt.dll
[2010/06/03 19:13:41 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Krome\Application Data\pcouffin.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/08/17 22:33:49 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/17 22:24:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/17 22:15:12 | 000,000,177 | -H– | M] () – C:\dvmexp.idx
[2013/08/17 22:09:15 | 000,466,276 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/17 22:09:15 | 000,073,298 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/17 22:08:29 | 000,000,378 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Startup.job
[2013/08/17 22:05:04 | 000,000,384 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Notification.job
[2013/08/17 22:04:24 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/17 17:53:55 | 000,000,075 | —- | M] () – C:\Documents and Settings\Krome\Application Data\mbam.context.scan
[2013/08/17 17:12:38 | 000,139,832 | —- | M] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2013/08/17 17:12:28 | 000,281,768 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.xtr
[2013/08/17 17:09:03 | 000,281,768 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.ex0
[2013/08/17 16:46:53 | 000,098,256 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/17 16:28:35 | 000,000,815 | —- | M] () – C:\Documents and Settings\Krome\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/17 16:26:51 | 000,000,759 | —- | M] () – C:\WINDOWS\System32\spupdsvc.inf
[2013/08/16 19:31:12 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/07/20 17:42:23 | 000,107,888 | —- | M] (Sony DADC Austria AG.) – C:\WINDOWS\System32\CmdLineExt.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/08/17 17:53:55 | 000,000,075 | —- | C] () – C:\Documents and Settings\Krome\Application Data\mbam.context.scan
[2013/08/17 17:23:07 | 000,000,384 | —- | C] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Notification.job
[2013/08/17 17:23:07 | 000,000,378 | —- | C] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Startup.job
[2013/08/17 16:43:27 | 000,063,584 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2013/08/17 16:26:51 | 000,000,759 | —- | C] () – C:\WINDOWS\System32\spupdsvc.inf
[2013/07/18 19:45:06 | 000,139,832 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2013/07/18 19:45:01 | 000,281,768 | —- | C] () – C:\WINDOWS\System32\PnkBstrB.exe
[2013/07/18 19:44:21 | 000,076,888 | —- | C] () – C:\WINDOWS\System32\PnkBstrA.exe
[2013/07/13 19:33:52 | 000,085,246 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/07/13 19:33:52 | 000,085,246 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1004336348-1606980848-839522115-1004-0.dat
[2013/03/20 23:10:16 | 000,042,880 | —- | C] () – C:\WINDOWS\System32\xfcodec.dll
[2013/02/07 23:06:29 | 000,013,132 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/10/02 19:40:26 | 000,075,096 | —- | C] () – C:\WINDOWS\System32\LADFCoinst_i386.dll
[2012/01/31 22:02:35 | 000,205,864 | —- | C] () – C:\WINDOWS\System32\drivers\OADriver.sys
[2012/01/31 22:02:35 | 000,040,296 | —- | C] () – C:\WINDOWS\System32\drivers\oahlp32.sys
[2010/06/22 19:25:11 | 000,004,608 | —- | C] () – C:\Documents and Settings\Krome\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/03 19:13:41 | 000,087,608 | —- | C] () – C:\Documents and Settings\Krome\Application Data\inst.exe
[2010/06/03 19:13:41 | 000,007,887 | —- | C] () – C:\Documents and Settings\Krome\Application Data\pcouffin.cat
[2010/06/03 19:13:41 | 000,001,144 | —- | C] () – C:\Documents and Settings\Krome\Application Data\pcouffin.inf
[2010/04/03 07:29:36 | 000,022,328 | —- | C] () – C:\Documents and Settings\Krome\Application Data\PnkBstrK.sys

========== ZeroAccess Check ==========

[2010/04/03 06:21:25 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/04/16 11:09:07 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 07:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 19:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2010/04/03 07:04:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ASUS OC Profiles
[2012/01/25 19:15:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/01/19 19:21:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2012/01/25 19:10:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2012/01/25 19:14:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2013/07/14 14:01:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Codemasters
[2011/03/14 17:57:48 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2013/06/18 20:46:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2013/08/17 17:22:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fighters
[2012/01/31 22:12:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2013/06/18 20:48:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Origin
[2013/08/17 16:50:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SplitMediaLabs
[2013/08/17 17:23:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\W3i
[2013/04/14 20:40:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/12/17 15:56:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\AVG Secure Search
[2010/04/12 17:51:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\AVG9
[2013/07/27 13:02:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\Day 1 Studios
[2013/08/17 17:23:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\Fighters
[2013/01/28 20:22:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\FileZilla
[2012/10/02 19:40:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\Leadertech
[2013/05/05 14:51:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\NoNameScript
[2012/01/31 22:02:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\OnlineArmor
[2013/01/11 18:38:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\OpenCandy
[2011/08/25 18:24:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\Opera
[2013/06/23 15:48:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\Origin
[2013/08/17 16:38:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\SplitMediaLabs
[2012/06/18 21:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\TeamViewer
[2013/08/17 22:26:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\TS3Client
[2010/06/03 19:13:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\Vso
[2013/08/17 17:22:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Krome\Application Data\WeatherBug

========== Purity Check ==========

========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004/08/04 07:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: EXPLORER.ICO >
[2006/02/01 05:19:30 | 000,000,894 | —- | M] () MD5=94BD1A2B94C0E307F781EA5C0BD156EB – C:\Documents and Settings\Krome\Application Data\NoNameScript\iconsets\megapack\explorer.ico
[2006/02/01 05:18:32 | 000,000,894 | —- | M] () MD5=A17571325E1B61B63B8A7007462440C0 – C:\Documents and Settings\Krome\Application Data\NoNameScript\iconsets\jaffa\Explorer.ico
[2006/02/01 05:20:44 | 000,000,894 | —- | M] () MD5=FCB9388526267BF7601C3FED3C3FBB67 – C:\Documents and Settings\Krome\Application Data\NoNameScript\iconsets\moonshine\Explorer.ico

< MD5 for: EXPLORER.SCF >
[2004/08/04 07:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CHM >
[2004/08/04 07:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie7\iexplore.chm
[2006/09/01 08:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\WINDOWS\Help\iexplore.chm

< MD5 for: IEXPLORE.EXE >
[2008/04/13 19:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ie7\iexplore.exe
[2008/04/13 19:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2007/08/13 18:43:56 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=DE49B348A18369B4626FBA1D49B07FB4 – C:\Program Files\Internet Explorer\iexplore.exe
[2007/08/13 18:43:56 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=DE49B348A18369B4626FBA1D49B07FB4 – C:\WINDOWS\system32\dllcache\iexplore.exe
[2004/08/04 07:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\$NtServicePackUninstall$\iexplore.exe

< MD5 for: IEXPLORE.EXE.EXP.LOG >
[2010/04/10 16:02:18 | 000,012,370 | —- | M] () MD5=4A1519446F8BADF70DBCF4FB53E5956B – C:\Program Files\Internet Explorer\IEXPLORE.EXE.exp.log

< MD5 for: IEXPLORE.EXE.MUI >
[2007/08/13 18:43:36 | 000,573,440 | —- | M] (Microsoft Corporation) MD5=B58D8A1C7EE0E922EC7D2616DA136FC3 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

< MD5 for: IEXPLORE.HLP >
[2004/08/04 07:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: SERVICES >
[2004/08/04 07:00:00 | 000,007,116 | —- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A – C:\WINDOWS\system32\drivers\etc\services

< MD5 for: SERVICES.EXE >
[2009/02/06 06:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/13 19:12:34 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\$NtUninstallKB956572$\services.exe
[2008/04/13 19:12:34 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\ServicePackFiles\i386\services.exe
[2009/02/06 06:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 06:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\services.exe
[2004/08/04 07:00:00 | 000,108,032 | —- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 – C:\WINDOWS\$NtServicePackUninstall$\services.exe

< MD5 for: SERVICES.LNK >
[2012/02/04 10:40:31 | 000,001,602 | —- | M] () MD5=028C7D4E861B22E4C1F6E445116EBFB5 – C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk

< MD5 for: SERVICES.MSC >
[2004/08/04 07:00:00 | 000,033,464 | —- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 – C:\WINDOWS\system32\services.msc

< MD5 for: WINLOGON.EXE >
[2004/08/04 07:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %SYSTEMDRIVE%\*.* >
[2012/06/29 18:27:34 | 000,000,058 | —- | M] () – C:\aswBoot.log
[2010/04/03 06:14:13 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/04/03 06:52:54 | 000,000,223 | RHS- | M] () – C:\boot.ini
[2010/04/03 06:14:13 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2013/08/17 22:15:12 | 000,000,177 | -H– | M] () – C:\dvmexp.idx
[2010/04/03 06:14:13 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/04/03 06:14:13 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/06/03 19:31:20 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/04/19 17:44:34 | 000,003,736 | —- | M] () – C:\output.txt
[2013/08/17 22:04:19 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2010/04/03 07:00:15 | 000,000,057 | -H– | M] () – C:\splash.idx
[2009/06/24 16:50:40 | 000,009,392 | -H– | M] () – C:\version

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/04/03 06:13:58 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/11/28 13:01:25 | 000,041,184 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C has no label.
Volume Serial Number is 7C34-5136
Directory of C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices
08/17/2013 04:41 PM 2.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Directory of C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote
08/17/2013 04:41 PM 2.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Directory of C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices
07/13/2013 03:59 PM v4.0_4.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
3 Dir(s) 450,813,366,272 bytes free

< %systemroot%\System32\config\*.sav >
[2010/04/02 22:01:05 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2010/04/02 22:01:05 | 000,634,880 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2010/04/02 22:01:04 | 000,913,408 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/06/03 19:35:07 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/06/03 19:48:11 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Krome\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/04/03 06:17:03 | 000,000,079 | —- | M] () – C:\Documents and Settings\Krome\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2012/03/22 20:27:43 | 000,792,704 | —- | M] (AMD) – C:\Documents and Settings\Krome\Desktop\amddriverdownloader.exe
[2010/05/16 15:21:59 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Krome\Desktop\ATF_Cleaner.exe
[2008/01/16 13:03:02 | 000,327,680 | —- | M] (CyboPat) – C:\Documents and Settings\Krome\Desktop\cod4player.exe
[2012/01/22 13:58:07 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Krome\Desktop\HiJackThis(1).exe
[2008/11/12 16:10:00 | 000,846,336 | —- | M] () – C:\Documents and Settings\Krome\Desktop\pbsetup.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

OTL Extras logfile created on: 8/17/2013 10:36:45 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Krome\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.53 Gb Available Physical Memory | 77.83% Memory free
5.09 Gb Paging File | 4.50 Gb Available in Paging File | 88.35% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 596.16 Gb Total Space | 419.87 Gb Free Space | 70.43% Space Free | Partition Type: NTFS
Drive E: | 1.81 Gb Total Space | 1.79 Gb Free Space | 99.28% Space Free | Partition Type: FAT

Computer Name: KEITH | User Name: Krome | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] – C:\Program Files\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – Reg Error: Key error.
htmlfile [opennew] – Reg Error: Key error.
http [open] – "C:\Program Files\Opera\opera.exe" (Opera Software)
https [open] – "C:\Program Files\Opera\opera.exe" (Opera Software)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"C:\Program Files\Ventrilo\Ventrilo.exe" = C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe – (Flagship Industries, Inc.)
"C:\WINDOWS\system32\PnkBstrA.exe" = C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA – ()
"C:\WINDOWS\system32\PnkBstrB.exe" = C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB – ()
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager – (Skype Technologies)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\Xfire\Xfire.exe" = C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire – (Xfire Inc.)
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe" = C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare™ – ()
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe" = C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe:*:Enabled:Call of Duty® - World at War™ – (Activision Blizzard, Inc.)
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe" = C:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty® - World at War™ – (Activision Blizzard, Inc.)
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam – (Valve Corporation)
"C:\Program Files\Steam\steamapps\krome8800\team fortress 2\hl2.exe" = C:\Program Files\Steam\steamapps\krome8800\team fortress 2\hl2.exe:*:Enabled:hl2
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe" = C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s – ()
"C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC – (mIRC Co. Ltd.)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"C:\Program Files\Steam\steamapps\krome8800\counter-strike source\hl2.exe" = C:\Program Files\Steam\steamapps\krome8800\counter-strike source\hl2.exe:*:Enabled:Counter-Strike: Source
"C:\Program Files\Steam\steamapps\common\crysis 2 - demo\Bin32\Crysis2Demo.exe" = C:\Program Files\Steam\steamapps\common\crysis 2 - demo\Bin32\Crysis2Demo.exe:*:Enabled:Crysis 2 Demo – (Crytek GmbH)
"C:\Program Files\Steam\steamapps\common\amd driver updater, xp, 32 bit\Setup.exe" = C:\Program Files\Steam\steamapps\common\amd driver updater, xp, 32 bit\Setup.exe:*:Enabled:AMD Driver Updater, XP, 32 bit
"C:\Program Files\Steam\steamapps\krome8800\ricochet\hl.exe" = C:\Program Files\Steam\steamapps\krome8800\ricochet\hl.exe:*:Enabled:Ricochet – (Valve)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
"C:\Program Files\Steam\steamapps\common\raceroom racing experience\RRRLauncher.exe" = C:\Program Files\Steam\steamapps\common\raceroom racing experience\RRRLauncher.exe:*:Enabled:RaceRoom Racing Experience
"C:\Program Files\Steam\steamapps\common\PlanetSide 2\LaunchPad.exe" = C:\Program Files\Steam\steamapps\common\PlanetSide 2\LaunchPad.exe:*:Enabled:PlanetSide 2 – (Sony Online Entertainment)
"C:\Program Files\Steam\steamapps\krome8800\day of defeat source\hl2.exe" = C:\Program Files\Steam\steamapps\krome8800\day of defeat source\hl2.exe:*:Enabled:Day of Defeat: Source
"C:\Program Files\Steam\steamapps\krome8800\half-life\hl.exe" = C:\Program Files\Steam\steamapps\krome8800\half-life\hl.exe:*:Enabled:Half-Life – (Valve)
"C:\Program Files\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe" = C:\Program Files\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe:*:Enabled:Counter-Strike: Global Offensive – ()
"C:\Program Files\Xfire2\Xfire.exe" = C:\Program Files\Xfire2\Xfire.exe:*:Enabled:Xfire – (Xfire Inc.)
"C:\Program Files\Steam\steamapps\common\Counter-Strike Source\hl2.exe" = C:\Program Files\Steam\steamapps\common\Counter-Strike Source\hl2.exe:*:Enabled:Counter-Strike: Source – ()
"C:\Program Files\Steam\steamapps\common\F.E.A.R. 3\F.E.A.R. 3.exe" = C:\Program Files\Steam\steamapps\common\F.E.A.R. 3\F.E.A.R. 3.exe:*:Enabled:F.E.A.R. 3 – (Day 1 Studios, LLC)
"C:\Program Files\Steam\steamapps\common\Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe" = C:\Program Files\Steam\steamapps\common\Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe:*:Enabled:Tom Clancy's Rainbow Six: Vegas 2 – ()
"C:\Program Files\Steam\steamapps\common\Grid\grid.exe" = C:\Program Files\Steam\steamapps\common\Grid\grid.exe:*:Enabled:GRID – (Codemasters)
"C:\Program Files\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe" = C:\Program Files\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe:*:Enabled:Borderlands Game – (Take-Two Interactive Software, Inc.)
"C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe" = C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\Binaries\MOHA.exe:*:Enabled:Medal of Honor Airborne – (Electronic Arts Inc.)
"C:\Program Files\Steam\steamapps\common\Day of Defeat Source\hl2.exe" = C:\Program Files\Steam\steamapps\common\Day of Defeat Source\hl2.exe:*:Enabled:Day of Defeat: Source – ()
"C:\Program Files\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe" = C:\Program Files\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe:*:Enabled:Borderlands 2 – (Gearbox Software)
"C:\Program Files\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe" = C:\Program Files\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe:*:Enabled:Left 4 Dead 2 – ()
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{053A8677-8139-6869-0157-21F36368B5B2}" = CCC Help Danish
"{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty® - World at War™ 1.6 Patch
"{08ED1CD1-1CB1-B7CE-677E-110D0A118590}" = AMD Catalyst Install Manager
"{09713414-6CBB-F885-8784-E3202514A97D}" = CCC Help Chinese Traditional
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{149464D9-B06F-4505-9968-FD1206F67AD3}" = Call of Duty® - World at War™ 1.3 Patch
"{15D4E2C6-0E18-E9C0-B8D6-BBE0B916BD3D}" = HydraVision
"{16EB8FB7-A791-B483-FBF2-81E56AD1E936}" = Catalyst Control Center Localization All
"{1A47E3FB-A5FE-C27E-B080-8EAF73B782AC}" = Catalyst Control Center
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{207DE839-8CE6-F8E7-6E0A-D75AD84C1629}" = CCC Help Spanish
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{21659FCD-EA29-ABE9-2E19-0EA64C9FB37B}" = CCC Help Swedish
"{221F93A5-4ABE-BFB5-781E-E1E38A7102DB}" = CCC Help Portuguese
"{25F28E39-FDBB-11DB-8314-0800200C9A66}" = Medal of Honor Airborne
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{297DCADA-86A1-4A42-8A13-66B7D7A09FD2}" = WeatherBug
"{2B4041FE-0E77-BE39-D31A-057B2F7F4CFF}" = CCC Help Chinese Standard
"{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty® - World at War™ 1.2 Patch
"{2C7946AF-8AE9-6369-0075-7A3419F59441}" = Catalyst Control Center InstallProxy
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{3282FBE1-35FC-48D8-98CA-115A5EF1F9B4}" = NVIDIA PhysX
"{33AEE368-3F04-27E3-39C2-F41E1C4611B6}" = CCC Help English
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{436BD6D1-707C-43D3-BF99-24ED23291033}" = Nero 8 Essentials
"{43ADAE00-A4ED-4379-A76D-A1FF5D9D334A}_is1" = Xfire 2.0
"{46192793-5011-565F-41A3-3712B5EC0608}" = CCC Help Finnish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59279982-86E2-4C2A-8060-A3E77575CD8B}" = Logitech G35
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{655B9514-3963-490B-9EE1-431E80444889}" = Razer Tarantula
"{7236672F-6430-439E-9B27-27EDEAF1D676}" = Diagnostic Utility
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{730E03E4-350E-48E5-9D3E-4329903D454D}" = Itibiti RTC
"{750C87B8-AF19-4C3C-B791-50D9C83AE572}" = Call of Duty® - World at War™ 1.7 Patch
"{7648D847-AEBC-4DEF-ADA2-F93314A5F4F2}" = SLOW-PCfighter
"{76AFBB49-1402-0FD2-E324-9B86A8029CA6}" = CCC Help Japanese
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty® 2 Patch 1.3
"{7EB0954B-30A8-8414-092B-792BA3A82F20}" = ccc-utility
"{82BF2C5E-79A7-4A13-B508-D5E64A5B141E}" = Uninstall Helper
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8BD89760-6B5D-4A3C-8B0D-CDB93BEFC0F6}" = XSplit
"{8CF61023-24BD-1356-8B84-75863E711DA2}" = CCC Help Czech
"{8EE0102A-1D61-8631-B4B2-CDF6BDF2BDF6}" = CCC Help Thai
"{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}" = EPU-4 Engine
"{903C704F-B35E-CB0C-6475-A851A82FE00E}" = CCC Help Hungarian
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"{99AD9D6D-A456-49EE-8360-F22EE7AA1272}" = Express Gate
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty® - World at War™ 1.4 Patch
"{9F0C2B61-2958-EC02-1852-83FBE7BF2992}" = CCC Help Dutch
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A31951C5-DCD8-4DFE-A525-CFC701F54792}" = TurboV
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A85AD707-781F-2B73-E134-38084AACB5D5}" = ATI AVIVO Codecs
"{AB23A8EF-1246-9E17-0C87-477B2C089E2B}" = CCC Help German
"{AC35BEC3-AC61-F2F5-217A-70FA16DFD3C8}" = Catalyst Control Center Graphics Previews Common
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{B5ACA897-3570-F936-43DD-7E6B736B1A6F}" = CCC Help Korean
"{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}" = Turbo Key
"{B8CB7B7D-C106-A95E-9E93-203BD81F4D4F}" = CCC Help Russian
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0DA129B-1E45-494D-A362-5CD0109C306B}" = WOT for Internet Explorer
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}" = Call of Duty® - World at War™ 1.5 Patch
"{C927F550-AAAE-5653-73C0-F523951417B8}" = CCC Help French
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240D8}" = WinZip 17.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty® 2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D6D5CFB3-7095-4073-B6B7-B7E909838C57}" = Razer Copperhead
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty® - World at War™
"{D86F3EA6-93A3-D020-0D77-204AB1696067}" = ATI Problem Report Wizard
"{DDE3EF07-816C-7D76-F7F1-E16262D4439F}" = CCC Help Italian
"{E167EA39-6D3B-D947-F8C4-2FCEEE41F803}" = CCC Help Polish
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"{E6C1F38E-5B39-4155-A92B-61DFF16351AC}" = RconMax(MW)
"{EB0F4554-AD4F-4C8C-9764-66AC2CF8D184}" = AMD OverDrive
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F7FEEF47-4D61-93DB-5926-D9656DCC03CE}" = CCC Help Norwegian
"{F8EF8AC9-0CD7-56BF-B42A-8DFB9E85448E}" = CCC Help Turkish
"{FB150FB5-B153-6866-918D-3865C73152E5}" = CCC Help Greek
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"EGREEN" = ASUS E-Green Uninstall
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty® - World at War™ 1.6 Patch
"InstallShield_{149464D9-B06F-4505-9968-FD1206F67AD3}" = Call of Duty® - World at War™ 1.3 Patch
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty® - World at War™ 1.2 Patch
"InstallShield_{750C87B8-AF19-4C3C-B791-50D9C83AE572}" = Call of Duty® - World at War™ 1.7 Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"InstallShield_{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty® - World at War™ 1.4 Patch
"InstallShield_{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}" = Call of Duty® - World at War™ 1.5 Patch
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty® 2
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty® - World at War™
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"mIRC" = mIRC
"Mozilla Firefox 23.0.1 (x86 en-US)" = Mozilla Firefox 23.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OnlineArmor_is1" = Online Armor 5.1
"Opera 11.10.2092" = Opera 11.10
"Opera 11.62.1347" = Opera 11.62
"Origin" = Origin
"SLOW-PCfighter" = SLOW-PCfighter
"Steam App 12750" = GRID
"Steam App 15120" = Tom Clancy's Rainbow Six: Vegas 2
"Steam App 17700" = Insurgency
"Steam App 21100" = F.E.A.R. 3
"Steam App 218230" = PlanetSide 2
"Steam App 223530" = Left 4 Dead 2 Beta
"Steam App 240" = Counter-Strike: Source
"Steam App 30" = Day of Defeat
"Steam App 300" = Day of Defeat: Source
"Steam App 380" = Half-Life 2: Episode One
"Steam App 400" = Portal
"Steam App 420" = Half-Life 2: Episode Two
"Steam App 440" = Team Fortress 2
"Steam App 49520" = Borderlands 2
"Steam App 550" = Left 4 Dead 2
"Steam App 60" = Ricochet
"Steam App 730" = Counter-Strike: Global Offensive
"Steam App 99850" = Crysis 2 Demo
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Tweak UI 2.10" = Tweak UI
"Uninstall Helper 2.0.1.0" = Uninstall Helper
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xfire" = Xfire
"XfireCodec" = Xfire Codec (remove only)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"NoNameScript" = NNScript

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/12/2013 9:00:27 PM | Computer Name = KEITH | Source = Application Hang | ID = 1002
Description = Hanging application hl2.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/12/2013 9:00:32 PM | Computer Name = KEITH | Source = Application Hang | ID = 1001
Description = Fault bucket 34341278.

Error - 8/17/2013 5:23:03 PM | Computer Name = KEITH | Source = Application Hang | ID = 1002
Description = Hanging application setup.exe, version 9.0.30729.1, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/17/2013 5:24:15 PM | Computer Name = KEITH | Source = Application Hang | ID = 1002
Description = Hanging application iesetup.exe, version 7.0.5730.13, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/17/2013 5:24:15 PM | Computer Name = KEITH | Source = Application Hang | ID = 1002
Description = Hanging application iesetup.exe, version 7.0.5730.13, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/17/2013 5:34:02 PM | Computer Name = KEITH | Source = VS Setup Watson Report | ID = 1000
Description =

Error - 8/17/2013 5:35:56 PM | Computer Name = KEITH | Source = Application Error | ID = 1000
Description = Faulting application iw3mp.exe, version 0.0.0.0, faulting module iw3mp.exe,
version 0.0.0.0, fault address 0x00276732.

Error - 8/17/2013 5:48:57 PM | Computer Name = KEITH | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown

Error - 8/17/2013 6:12:05 PM | Computer Name = KEITH | Source = Application Error | ID = 1000
Description = Faulting application iw3mp.exe, version 0.0.0.0, faulting module pbcl.dll,
version 0.0.0.0, fault address 0x000d7697.

Error - 8/17/2013 11:44:13 PM | Computer Name = KEITH | Source = Application Error | ID = 1000
Description = Faulting application oasrv.exe, version 5.1.1.1395, faulting module
oasrv.exe, version 5.1.1.1395, fault address 0x00007456.

[ System Events ]
Error - 8/17/2013 7:29:03 PM | Computer Name = KEITH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 8/17/2013 7:29:07 PM | Computer Name = KEITH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 8/17/2013 7:29:42 PM | Computer Name = KEITH | Source = Service Control Manager | ID = 7001
Description = The DHCP Client service depends on the NetBios over Tcpip service
which failed to start because of the following error: %%31

Error - 8/17/2013 7:29:42 PM | Computer Name = KEITH | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 8/17/2013 7:29:42 PM | Computer Name = KEITH | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the AFD service which
failed to start because of the following error: %%31

Error - 8/17/2013 7:29:42 PM | Computer Name = KEITH | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 8/17/2013 7:29:42 PM | Computer Name = KEITH | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Aavmker4 AFD AmdPPM AsIO aswRdr aswSnx aswSP aswTdi Fips IPSec MRxSmb NetBIOS NetBT OADevice
oahlpXX
OAmon
OAnet
RasAcd
Rdbss
Tcpip

Error - 8/17/2013 7:29:46 PM | Computer Name = KEITH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 8/17/2013 7:41:35 PM | Computer Name = KEITH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 8/17/2013 11:05:14 PM | Computer Name = KEITH | Source = Service Control Manager | ID = 7000
Description = The vToolbarUpdater service failed to start due to the following error:
%%2

< End of report >

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:46:47 PM, on 8/17/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Online Armor\OAcat.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
C:\ASUS.SYS\config\DVMExportService.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe
C:\Program Files\ASUS\TurboV\TurboV.exe
C:\Program Files\ASUS\Turbo Key\TurboKey.exe
C:\Program Files\Razer\Tarantula\razerhid.exe
C:\Program Files\Razer\Copperhead\razerhid.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Razer\Copperhead\razerofa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Logitech\G35\G35.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Krome\My Documents\Downloads\OTL.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Documents and Settings\Krome\Desktop\HiJackThis(1).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe" -b
O4 - HKLM\..\Run: [TurboV] "C:\Program Files\ASUS\TurboV\TurboV.exe"
O4 - HKLM\..\Run: [QFan Help] "C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] "C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe"
O4 - HKLM\..\Run: [Turbo Key] "C:\Program Files\ASUS\Turbo Key\TurboKey.exe"
O4 - HKLM\..\Run: [Tarantula] C:\Program Files\Razer\Tarantula\razerhid.exe
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Online Armor\OAui.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Logitech G35] C:\Program Files\Logitech\G35\G35.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\10.0.6\ViProtocol.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM - C:\ASUS.SYS\config\DVMExportService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Online Armor Helper Service (OAcat) - Unknown owner - C:\Program Files\Online Armor\OAcat.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Unknown owner - C:\Program Files\Online Armor\oasrv.exe

–
End of file - 7849 bytes

OCD

Post #2August 19, 2013, 4:39 PM UTC

Hi krome8800,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Important Note for Vista and Windows 7 & 8 users:

These tools MUST be run from the executable.(.exe) every time you run them with Admin Rights (Right click, choose "Run as Administrator")

Please stay with this topic until I let you know that your system appears to be "All Clear"

=========================

[external image: Posted Image] Multiple Anti-Virus Programs Installed

I notice that you have both AVG Anti-Virus Free and avast! Antivirus installed at the same time. Having more than one antivirus program running at the same time can seriously degrade the performance of your system.

Please uninstall either AVG Anti-Virus Free or avast! Antivirus (which ever you prefer) using either the provided uninstall feature that is part of the antivirus program or through Add/Remove Programs (for Vista and Win 7 users to go to Programs and Features in the Control Panel). As a rule of thumb one should run one firewall, one antivirus program in memory, and one anti-spyware utility in memory. It's fine to have other security tools available on an as-needed or on-demand basis, but when multiple tools simultaneously perform the same function, you're asking for trouble.

=========================

[external image: Posted Image] Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

AVG Security Toolbar
WeatherBug
SLOW-PCfighter

=========================

[external image: Posted Image] AdwCleaner

Download AdwCleaner to your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

=========================

[external image: Posted Image] Junkware Removal Tool

Download Junkware Removal Tool to your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Shut down your protection software now to avoid potential conflicts.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

=========================

[external image: Posted Image] Re-run OTL (it should be located on your desktop).

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Uncheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open one notepad window. OTL.Txt. (No Extras.txt will be produced)
Note:The log can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of the file, and post it with your next reply.

=========================

In your next post please provide the following:
AdwCleaner.txt
JRT.txt
Fresh OTL.txt
What symptoms are you experiencing?

krome8800

Post #3August 19, 2013, 9:49 PM UTC

Hey OCD,

Really good to see you bud been a while. Hope everything is good with yourself.

My computer is acting weird, things it doing if my online armor firewall is up I cant log on to the net. I have to close it altogether to be able to get on a browser. Also I tried to uninstall PCFighter, weatherbug and saying the window installer couldnt be accessed. this can occur if your are running window in safe mode, or if the window installer is not correctly installed. Also any icon on the computer i have to right click and select open in order for it to open. Avast recently shut down and wont open back up along with Malwarebytes. I couldnt find AVG toolbar in the Add/Remove list so I couldnt deleted it. Also notice if i click start all programs they now have a uninstaller help listed too. OTL was deleted off my screen for some reason and had to install it.

Logs below:

# AdwCleaner v2.306 - Logfile created 08/19/2013 at 16:23:22
# Updated 19/07/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Krome - KEITH
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Krome\Desktop\AdwCleaner.exe
# Option [Delete]

***** [Services] *****

Stopped & Deleted : DvmMDES

***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
Folder Deleted : C:\Documents and Settings\Krome\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Krome\Application Data\OpenCandy
Folder Deleted : C:\Documents and Settings\Krome\Local Settings\Application Data\AVG

Security Toolbar
Folder Deleted : C:\Program Files\AVG Secure Search
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search

***** [Registry] *****

Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted :

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933

233}
Key Deleted : HKCU\Software\pc optimizer pro
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\Software\Classes\Installer\Features\D6D9DA99654AEE9438062FE27EAA2127
Key Deleted : HKLM\Software\Classes\Installer\Products\D6D9DA99654AEE9438062FE27EAA2127
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\Software\DeviceVM
Key Deleted : HKLM\Software\InstallIQ
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App

Management\ARPCache\{99AD9D6D-A456-49EE-8360-F22EE7AA1272}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper

Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted :

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C

697C44CDC}
Key Deleted :

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E90

21F207706}
Key Deleted :

HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D6D9DA9

9654AEE9438062FE27EAA2127
Key Deleted :

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99AD9D6D-A456-49EE-8360-F22EE7AA1

272}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser

[{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar

[{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.5730.13

[OK] Registry is clean.

-\\ Mozilla Firefox v23.0.1 (en-US)

File : C:\Documents and Settings\Krome\Application

Data\Mozilla\Firefox\Profiles\zncvoa68.default\prefs.js

C:\Documents and Settings\Krome\Application

Data\Mozilla\Firefox\Profiles\zncvoa68.default\user.js … Deleted !

Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");

-\\ Opera v11.64.1403.0

File : C:\Documents and Settings\Krome\Application Data\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [4888 octets] - [19/08/2013 16:23:22]

########## EOF - C:\AdwCleaner[S1].txt - [4948 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.0 (08.18.2013:1)
OS: Microsoft Windows XP x86
Ran by [removed] on Mon 08/19/2013 at 16:35:34.00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\fighters"
Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\w3i"
Successfully deleted: [Folder] "C:\Documents and Settings\Krome\Application Data\fighters"
Successfully deleted: [Folder] "C:\Program Files\fighters"
Successfully deleted: [Folder] "C:\Program Files\w3i"
Successfully deleted: [Folder] "C:\WINDOWS\system32\ai_recyclebin"

~~~ FireFox

Successfully deleted the following from C:\Documents and Settings\Krome\Application Data\mozilla\firefox\profiles\zncvoa68.default\prefs.js

user_pref("keyword.URL", "hxxp://search.avg.com/route/?d=4bc0a51c&v=6.103.018.001&i=23&tp=ab&iy=&ychte=us&lng=en-US&q=");
Emptied folder: C:\Documents and Settings\Krome\Application Data\mozilla\firefox\profiles\zncvoa68.default\minidumps [2 files]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 08/19/2013 at 16:38:26.90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

OTL logfile created on: 8/19/2013 4:45:34 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Krome\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.67 Gb Available Physical Memory | 82.10% Memory free
5.09 Gb Paging File | 4.48 Gb Available in Paging File | 88.12% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 596.16 Gb Total Space | 419.61 Gb Free Space | 70.39% Space Free | Partition Type: NTFS
Drive E: | 1.81 Gb Total Space | 1.79 Gb Free Space | 99.28% Space Free | Partition Type: FAT

Computer Name: KEITH | User Name: Krome | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Krome\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Opera\opera.exe (Opera Software)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
PRC - C:\Program Files\Logitech\G35\G35.exe (Logitech©)
PRC - C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
PRC - C:\Program Files\ASUS\TurboV\TurboV.exe ()
PRC - C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
PRC - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
PRC - C:\WINDOWS\system32\regsvr32.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Razer\Tarantula\razerhid.exe ()
PRC - C:\Program Files\Razer\Copperhead\razerhid.exe ()
PRC - C:\Program Files\Razer\Copperhead\razerofa.exe (Razer Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13081900\algo.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
MOD - C:\Program Files\ASUS\TurboV\TurboV.exe ()
MOD - C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
MOD - C:\Program Files\ASUS\Turbo Key\pngio.dll ()
MOD - C:\Program Files\ASUS\Turbo Key\AiNap.dll ()
MOD - C:\Program Files\ASUS\TurboV\OcProfile.dll ()
MOD - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\pngio.dll ()
MOD - C:\Program Files\ASUS\TurboV\TvOcLib.dll ()
MOD - C:\Program Files\ASUS\TurboV\pngio.dll ()
MOD - C:\Program Files\Razer\Tarantula\razerhid.exe ()
MOD - C:\WINDOWS\system32\AsIO.dll ()
MOD - C:\Program Files\Razer\Copperhead\razerhid.exe ()
MOD - C:\Program Files\Razer\Copperhead\download.dll ()

========== Services (SafeList) ==========

SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
SRV - (AODService) – C:\Program Files\AMD\OverDrive\AODAssist.exe ()
SRV - (AsSysCtrlService) – C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
SRV - (spupdsvc) – C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (WDC_SAM) – system32\DRIVERS\wdcsam.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (PciCon) – D:\PciCon.sys File not found
DRV - (mv61xx) – system32\DRIVERS\mv61xx.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (XFDriver) – C:\Program Files\Xfire2\XFDriver.sys (XFire)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (oahlpXX) – C:\WINDOWS\system32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Emsisoft)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys ()
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Emsisoft)
DRV - (LADF_SBVM) – C:\WINDOWS\system32\drivers\ladfSBVMi386.sys (Logitech)
DRV - (LADF_DHP2) – C:\WINDOWS\system32\drivers\ladfDHP2i386.sys (Logitech)
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (RtNdPt5x) – C:\WINDOWS\system32\drivers\RtNdPt5x.sys (Realtek Semiconductor Corporation )
DRV - (RTLVLAN) – C:\WINDOWS\system32\drivers\RTLVLAN.SYS (Realtek Semiconductor Corporation )
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (RTLTEAMING) – C:\WINDOWS\system32\drivers\RTLTEAMING.SYS (Realtek Semiconductor Corporation)
DRV - (AsIO) – C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (TarFltr) – C:\WINDOWS\system32\drivers\UsbFltr.sys (Waytech Development, Inc.)
DRV - (Razerlow) – C:\WINDOWS\system32\drivers\Razerlow.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search

IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "WWW.YAHOO.COM"
FF - prefs.js..extensions.enabledAddons: %7B27c60876-b5c9-4335-b4f3-52b26782220c%7D:0.9.4
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:[removed]
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/08/18 16:44:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/16 20:17:26 | 000,000,000 | —D | M]

[2010/05/16 15:17:47 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Extensions
[2013/08/16 20:02:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions
[2013/05/14 17:43:53 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013/05/15 19:03:15 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/01/13 20:11:23 | 000,007,532 | —- | M] () (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi
[2013/08/16 20:02:18 | 000,534,203 | —- | M] () (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013/08/16 20:17:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/16 20:17:34 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/18 16:44:48 | 000,000,000 | —D | M] (avast! Online Security) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKCU\..\Toolbar\ShellBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\OAui.exe (Emsi Software GmbH)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [Logitech G35] C:\Program Files\Logitech\G35\G35.exe (Logitech©)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QFan Help] C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe ()
O4 - HKLM..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe ()
O4 - HKLM..\Run: [Six Engine] C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Tarantula] C:\Program Files\Razer\Tarantula\razerhid.exe ()
O4 - HKLM..\Run: [Turbo Key] C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
O4 - HKLM..\Run: [TurboV] C:\Program Files\ASUS\TurboV\TurboV.exe ()
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D3F7724-5D24-41AB-886B-5181B5927C79}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\mhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Emsi Software GmbH)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/03 06:14:13 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/19 16:44:34 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Krome\Desktop\OTL.exe
[2013/08/19 16:35:32 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/19 16:35:20 | 001,018,305 | —- | C] (Thisisu) – C:\Documents and Settings\Krome\Desktop\JRT.exe
[2013/08/18 16:44:54 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/17 22:33:39 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/17 22:25:42 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Krome\Recent
[2013/08/17 22:24:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2013/08/17 22:24:35 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2013/08/17 17:29:11 | 000,000,000 | —D | C] – C:\Malwarebytes
[2013/08/17 17:27:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Desktop\backups
[2013/08/17 17:23:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Uninstall Helper
[2013/08/17 17:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Fighters
[2013/08/17 17:22:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Local Settings\Application Data\WeatherBug
[2013/08/17 17:22:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\WeatherBug
[2013/08/17 17:22:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Start Menu\Programs\WeatherBug
[2013/08/17 17:22:23 | 000,000,000 | —D | C] – C:\Program Files\AWS
[2013/08/17 16:53:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\XSplit
[2013/08/17 16:53:38 | 000,000,000 | —D | C] – C:\Program Files\SplitMediaLabs
[2013/08/17 16:51:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Local Settings\Application Data\SplitMediaLabs
[2013/08/17 16:50:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SplitMediaLabs
[2013/08/17 16:43:08 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2013/08/17 16:43:04 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2013/08/17 16:42:55 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2013/08/17 16:42:19 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2013/08/17 16:42:19 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2013/08/17 16:42:19 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2013/08/17 16:42:19 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2013/08/17 16:42:19 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2013/08/17 16:42:19 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2013/08/17 16:42:19 | 000,000,000 | —D | C] – C:\6fe708be5a1534182269480d3fd8cf46
[2013/08/17 16:38:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\SplitMediaLabs
[2013/08/17 16:26:44 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2013/08/17 16:25:39 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie7
[2013/08/17 16:25:30 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[2013/08/17 16:25:18 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[2013/08/16 20:17:24 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/07/27 13:02:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\Day 1 Studios
[2013/07/20 17:46:28 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2013/07/20 17:46:28 | 000,000,000 | —D | C] – C:\Program Files\AGEIA Technologies
[2013/07/20 17:42:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\My Documents\EA Games
[2013/07/20 17:42:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Krome\Application Data\SecuROM
[2013/07/20 17:42:23 | 000,107,888 | —- | C] (Sony DADC Austria AG.) – C:\WINDOWS\System32\CmdLineExt.dll
[2010/06/03 19:13:41 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Krome\Application Data\pcouffin.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/08/19 16:44:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Krome\Desktop\OTL.exe
[2013/08/19 16:44:00 | 000,000,316 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/19 16:35:20 | 001,018,305 | —- | M] (Thisisu) – C:\Documents and Settings\Krome\Desktop\JRT.exe
[2013/08/19 16:30:25 | 000,466,276 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/19 16:30:25 | 000,073,298 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/19 16:29:58 | 000,000,378 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Startup.job
[2013/08/19 16:25:57 | 000,000,384 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Notification.job
[2013/08/19 16:25:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/19 16:24:15 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/19 16:23:23 | 000,000,177 | -H– | M] () – C:\dvmexp.idx
[2013/08/19 16:22:53 | 000,666,633 | —- | M] () – C:\Documents and Settings\Krome\Desktop\AdwCleaner.exe
[2013/08/19 05:50:53 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/19 05:50:46 | 000,098,256 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/18 16:45:01 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/18 16:45:01 | 000,369,584 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/18 16:45:01 | 000,175,176 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/18 16:44:54 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/08/18 11:29:51 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/17 17:53:55 | 000,000,075 | —- | M] () – C:\Documents and Settings\Krome\Application Data\mbam.context.scan
[2013/08/17 17:12:38 | 000,139,832 | —- | M] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2013/08/17 17:12:28 | 000,281,768 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.xtr
[2013/08/17 17:09:03 | 000,281,768 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.ex0
[2013/08/17 16:28:35 | 000,000,815 | —- | M] () – C:\Documents and Settings\Krome\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/17 16:26:51 | 000,000,759 | —- | M] () – C:\WINDOWS\System32\spupdsvc.inf
[2013/07/20 17:42:23 | 000,107,888 | —- | M] (Sony DADC Austria AG.) – C:\WINDOWS\System32\CmdLineExt.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/08/19 16:22:53 | 000,666,633 | —- | C] () – C:\Documents and Settings\Krome\Desktop\AdwCleaner.exe
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/18 16:44:55 | 000,175,176 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/18 16:44:54 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/18 16:44:54 | 000,000,316 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/17 17:53:55 | 000,000,075 | —- | C] () – C:\Documents and Settings\Krome\Application Data\mbam.context.scan
[2013/08/17 17:23:07 | 000,000,384 | —- | C] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Notification.job
[2013/08/17 17:23:07 | 000,000,378 | —- | C] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Startup.job
[2013/08/17 16:43:27 | 000,063,584 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2013/08/17 16:26:51 | 000,000,759 | —- | C] () – C:\WINDOWS\System32\spupdsvc.inf
[2013/07/18 19:45:06 | 000,139,832 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2013/07/18 19:45:01 | 000,281,768 | —- | C] () – C:\WINDOWS\System32\PnkBstrB.exe
[2013/07/18 19:44:21 | 000,076,888 | —- | C] () – C:\WINDOWS\System32\PnkBstrA.exe
[2013/07/13 19:33:52 | 000,085,246 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/07/13 19:33:52 | 000,085,246 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1004336348-1606980848-839522115-1004-0.dat
[2013/03/20 23:10:16 | 000,042,880 | —- | C] () – C:\WINDOWS\System32\xfcodec.dll
[2013/02/07 23:06:29 | 000,013,132 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/10/02 19:40:26 | 000,075,096 | —- | C] () – C:\WINDOWS\System32\LADFCoinst_i386.dll
[2012/01/31 22:02:35 | 000,205,864 | —- | C] () – C:\WINDOWS\System32\drivers\OADriver.sys
[2012/01/31 22:02:35 | 000,040,296 | —- | C] () – C:\WINDOWS\System32\drivers\oahlp32.sys
[2010/06/22 19:25:11 | 000,004,608 | —- | C] () – C:\Documents and Settings\Krome\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/03 19:13:41 | 000,087,608 | —- | C] () – C:\Documents and Settings\Krome\Application Data\inst.exe
[2010/06/03 19:13:41 | 000,007,887 | —- | C] () – C:\Documents and Settings\Krome\Application Data\pcouffin.cat
[2010/06/03 19:13:41 | 000,001,144 | —- | C] () – C:\Documents and Settings\Krome\Application Data\pcouffin.inf
[2010/04/03 07:29:36 | 000,022,328 | —- | C] () – C:\Documents and Settings\Krome\Application Data\PnkBstrK.sys

========== ZeroAccess Check ==========

[2010/04/03 06:21:25 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/04/16 11:09:07 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 07:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 19:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

OTL logfile created on: 8/19/2013 4:45:34 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Krome\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.67 Gb Available Physical Memory | 82.10% Memory free
5.09 Gb Paging File | 4.48 Gb Available in Paging File | 88.12% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 596.16 Gb Total Space | 419.61 Gb Free Space | 70.39% Space Free | Partition Type: NTFS
Drive E: | 1.81 Gb Total Space | 1.79 Gb Free Space | 99.28% Space Free | Partition Type: FAT

Computer Name: KEITH | User Name: Krome | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Krome\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Opera\opera.exe (Opera Software)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
PRC - C:\Program Files\Logitech\G35\G35.exe (Logitech©)
PRC - C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
PRC - C:\Program Files\ASUS\TurboV\TurboV.exe ()
PRC - C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
PRC - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
PRC - C:\WINDOWS\system32\regsvr32.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Razer\Tarantula\razerhid.exe ()
PRC - C:\Program Files\Razer\Copperhead\razerhid.exe ()
PRC - C:\Program Files\Razer\Copperhead\razerofa.exe (Razer Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13081900\algo.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
MOD - C:\Program Files\ASUS\TurboV\TurboV.exe ()
MOD - C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
MOD - C:\Program Files\ASUS\Turbo Key\pngio.dll ()
MOD - C:\Program Files\ASUS\Turbo Key\AiNap.dll ()
MOD - C:\Program Files\ASUS\TurboV\OcProfile.dll ()
MOD - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\pngio.dll ()
MOD - C:\Program Files\ASUS\TurboV\TvOcLib.dll ()
MOD - C:\Program Files\ASUS\TurboV\pngio.dll ()
MOD - C:\Program Files\Razer\Tarantula\razerhid.exe ()
MOD - C:\WINDOWS\system32\AsIO.dll ()
MOD - C:\Program Files\Razer\Copperhead\razerhid.exe ()
MOD - C:\Program Files\Razer\Copperhead\download.dll ()

========== Services (SafeList) ==========

SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
SRV - (AODService) – C:\Program Files\AMD\OverDrive\AODAssist.exe ()
SRV - (AsSysCtrlService) – C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
SRV - (spupdsvc) – C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (WDC_SAM) – system32\DRIVERS\wdcsam.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (PciCon) – D:\PciCon.sys File not found
DRV - (mv61xx) – system32\DRIVERS\mv61xx.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (XFDriver) – C:\Program Files\Xfire2\XFDriver.sys (XFire)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (oahlpXX) – C:\WINDOWS\system32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Emsisoft)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys ()
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Emsisoft)
DRV - (LADF_SBVM) – C:\WINDOWS\system32\drivers\ladfSBVMi386.sys (Logitech)
DRV - (LADF_DHP2) – C:\WINDOWS\system32\drivers\ladfDHP2i386.sys (Logitech)
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (RtNdPt5x) – C:\WINDOWS\system32\drivers\RtNdPt5x.sys (Realtek Semiconductor Corporation )
DRV - (RTLVLAN) – C:\WINDOWS\system32\drivers\RTLVLAN.SYS (Realtek Semiconductor Corporation )
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (RTLTEAMING) – C:\WINDOWS\system32\drivers\RTLTEAMING.SYS (Realtek Semiconductor Corporation)
DRV - (AsIO) – C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (TarFltr) – C:\WINDOWS\system32\drivers\UsbFltr.sys (Waytech Development, Inc.)
DRV - (Razerlow) – C:\WINDOWS\system32\drivers\Razerlow.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search

IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "WWW.YAHOO.COM"
FF - prefs.js..extensions.enabledAddons: %7B27c60876-b5c9-4335-b4f3-52b26782220c%7D:0.9.4
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:[removed]
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/08/18 16:44:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/16 20:17:26 | 000,000,000 | —D | M]

[2010/05/16 15:17:47 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Extensions
[2013/08/16 20:02:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions
[2013/05/14 17:43:53 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013/05/15 19:03:15 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/01/13 20:11:23 | 000,007,532 | —- | M] () (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi
[2013/08/16 20:02:18 | 000,534,203 | —- | M] () (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013/08/16 20:17:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/16 20:17:34 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/18 16:44:48 | 000,000,000 | —D | M] (avast! Online Security) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKCU\..\Toolbar\ShellBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\OAui.exe (Emsi Software GmbH)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [Logitech G35] C:\Program Files\Logitech\G35\G35.exe (Logitech©)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QFan Help] C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe ()
O4 - HKLM..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe ()
O4 - HKLM..\Run: [Six Engine] C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Tarantula] C:\Program Files\Razer\Tarantula\razerhid.exe ()
O4 - HKLM..\Run: [Turbo Key] C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
O4 - HKLM..\Run: [TurboV] C:\Program Files\ASUS\TurboV\TurboV.exe ()
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D3F7724-5D24-41AB-886B-5181B5927C79}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\mhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Emsi Software GmbH)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/03 06:14:13 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/19 16:44:34 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Krome\Desktop\OTL.exe
[2013/08/19 16:35:32 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/19 16:35:20 | 001,018,305 | —- | C] (Thisisu) – C:\Documents and Settings\Krome\Desktop\JRT.exe
[2013/08/18 16:44:54 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/17 22:33:39 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/17 22:25:42 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Krome\Recent
[2013/08/17 22:24:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2013/08/17 22:24:35 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2013/08/17 17:29:11 | 000,000,000 | —D | C] – C:\Malwarebytes
[2013/08/17 17:27:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Desktop\backups
[2013/08/17 17:23:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Uninstall Helper
[2013/08/17 17:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Fighters
[2013/08/17 17:22:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Local Settings\Application Data\WeatherBug
[2013/08/17 17:22:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\WeatherBug
[2013/08/17 17:22:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Start Menu\Programs\WeatherBug
[2013/08/17 17:22:23 | 000,000,000 | —D | C] – C:\Program Files\AWS
[2013/08/17 16:53:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\XSplit
[2013/08/17 16:53:38 | 000,000,000 | —D | C] – C:\Program Files\SplitMediaLabs
[2013/08/17 16:51:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Local Settings\Application Data\SplitMediaLabs
[2013/08/17 16:50:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SplitMediaLabs
[2013/08/17 16:43:08 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2013/08/17 16:43:04 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2013/08/17 16:42:55 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2013/08/17 16:42:19 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2013/08/17 16:42:19 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2013/08/17 16:42:19 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2013/08/17 16:42:19 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2013/08/17 16:42:19 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2013/08/17 16:42:19 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2013/08/17 16:42:19 | 000,000,000 | —D | C] – C:\6fe708be5a1534182269480d3fd8cf46
[2013/08/17 16:38:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\SplitMediaLabs
[2013/08/17 16:26:44 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2013/08/17 16:25:39 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie7
[2013/08/17 16:25:30 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[2013/08/17 16:25:18 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[2013/08/16 20:17:24 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/07/27 13:02:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\Day 1 Studios
[2013/07/20 17:46:28 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2013/07/20 17:46:28 | 000,000,000 | —D | C] – C:\Program Files\AGEIA Technologies
[2013/07/20 17:42:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\My Documents\EA Games
[2013/07/20 17:42:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Krome\Application Data\SecuROM
[2013/07/20 17:42:23 | 000,107,888 | —- | C] (Sony DADC Austria AG.) – C:\WINDOWS\System32\CmdLineExt.dll
[2010/06/03 19:13:41 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Krome\Application Data\pcouffin.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/08/19 16:44:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Krome\Desktop\OTL.exe
[2013/08/19 16:44:00 | 000,000,316 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/19 16:35:20 | 001,018,305 | —- | M] (Thisisu) – C:\Documents and Settings\Krome\Desktop\JRT.exe
[2013/08/19 16:30:25 | 000,466,276 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/19 16:30:25 | 000,073,298 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/19 16:29:58 | 000,000,378 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Startup.job
[2013/08/19 16:25:57 | 000,000,384 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Notification.job
[2013/08/19 16:25:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/19 16:24:15 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/19 16:23:23 | 000,000,177 | -H– | M] () – C:\dvmexp.idx
[2013/08/19 16:22:53 | 000,666,633 | —- | M] () – C:\Documents and Settings\Krome\Desktop\AdwCleaner.exe
[2013/08/19 05:50:53 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/19 05:50:46 | 000,098,256 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/18 16:45:01 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/18 16:45:01 | 000,369,584 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/18 16:45:01 | 000,175,176 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/18 16:44:54 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/08/18 11:29:51 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/17 17:53:55 | 000,000,075 | —- | M] () – C:\Documents and Settings\Krome\Application Data\mbam.context.scan
[2013/08/17 17:12:38 | 000,139,832 | —- | M] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2013/08/17 17:12:28 | 000,281,768 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.xtr
[2013/08/17 17:09:03 | 000,281,768 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.ex0
[2013/08/17 16:28:35 | 000,000,815 | —- | M] () – C:\Documents and Settings\Krome\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/17 16:26:51 | 000,000,759 | —- | M] () – C:\WINDOWS\System32\spupdsvc.inf
[2013/07/20 17:42:23 | 000,107,888 | —- | M] (Sony DADC Austria AG.) – C:\WINDOWS\System32\CmdLineExt.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/08/19 16:22:53 | 000,666,633 | —- | C] () – C:\Documents and Settings\Krome\Desktop\AdwCleaner.exe
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/18 16:44:55 | 000,175,176 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/18 16:44:54 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/18 16:44:54 | 000,000,316 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/17 17:53:55 | 000,000,075 | —- | C] () – C:\Documents and Settings\Krome\Application Data\mbam.context.scan
[2013/08/17 17:23:07 | 000,000,384 | —- | C] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Notification.job
[2013/08/17 17:23:07 | 000,000,378 | —- | C] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Startup.job
[2013/08/17 16:43:27 | 000,063,584 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2013/08/17 16:26:51 | 000,000,759 | —- | C] () – C:\WINDOWS\System32\spupdsvc.inf
[2013/07/18 19:45:06 | 000,139,832 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2013/07/18 19:45:01 | 000,281,768 | —- | C] () – C:\WINDOWS\System32\PnkBstrB.exe
[2013/07/18 19:44:21 | 000,076,888 | —- | C] () – C:\WINDOWS\System32\PnkBstrA.exe
[2013/07/13 19:33:52 | 000,085,246 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/07/13 19:33:52 | 000,085,246 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1004336348-1606980848-839522115-1004-0.dat
[2013/03/20 23:10:16 | 000,042,880 | —- | C] () – C:\WINDOWS\System32\xfcodec.dll
[2013/02/07 23:06:29 | 000,013,132 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/10/02 19:40:26 | 000,075,096 | —- | C] () – C:\WINDOWS\System32\LADFCoinst_i386.dll
[2012/01/31 22:02:35 | 000,205,864 | —- | C] () – C:\WINDOWS\System32\drivers\OADriver.sys
[2012/01/31 22:02:35 | 000,040,296 | —- | C] () – C:\WINDOWS\System32\drivers\oahlp32.sys
[2010/06/22 19:25:11 | 000,004,608 | —- | C] () – C:\Documents and Settings\Krome\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/03 19:13:41 | 000,087,608 | —- | C] () – C:\Documents and Settings\Krome\Application Data\inst.exe
[2010/06/03 19:13:41 | 000,007,887 | —- | C] () – C:\Documents and Settings\Krome\Application Data\pcouffin.cat
[2010/06/03 19:13:41 | 000,001,144 | —- | C] () – C:\Documents and Settings\Krome\Application Data\pcouffin.inf
[2010/04/03 07:29:36 | 000,022,328 | —- | C] () – C:\Documents and Settings\Krome\Application Data\PnkBstrK.sys

========== ZeroAccess Check ==========

[2010/04/03 06:21:25 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/04/16 11:09:07 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 07:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 19:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

OCD

Post #4August 20, 2013, 1:12 AM UTC

Hi krome8800,

things it doing if my online armor firewall is up I cant log on to the net. I have to close it altogether to be able to get on a browser.

Which AV did you keep? It's generally a good idea to just exclude your AV under Options -> Exclusions as it can prevent conflicts with OA

Also any icon on the computer i have to right click and select open in order for it to open.

Have you tried going into the Control Panel > Folder Options > General > Make sure the radio button is selected for "Double-click to open an item".

=========================

[external image: Posted Image] Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

Uninstall Helper 2.0.1.0
Malwarebytes Anti-Malware (do not reinstall for now)

=========================

[external image: Posted Image] Run OTL.exe

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared
[2013/08/17 17:23:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Uninstall Helper
[2013/08/17 17:22:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Fighters
[2013/08/17 17:22:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Local Settings\Application Data\WeatherBug
[2013/08/17 17:22:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\WeatherBug
[2013/08/17 17:22:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Start Menu\Programs\WeatherBug
[2013/08/19 16:29:58 | 000,000,378 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Startup.job
[2013/08/19 16:25:57 | 000,000,384 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Krome-Notification.job

:Files
ipconfig /flushdns /c

:Commands
[purity]
[createrestorepoint]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then re-run OTL and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

=========================

In your next post please provide the following:
OTL.txt
Update on symptoms.

krome8800

Post #5August 20, 2013, 2:03 AM UTC

Which AV did you keep? It's generally a good idea to just exclude your AV under Options -> Exclusions as it can prevent conflicts with OA

I want to only keep avast. I do not see AVG on the anywhere on computer.

Have you tried going into the Control Panel > Folder Options > General > Make sure the radio button is selected for "Double-click to open an item".

Yes I did this and when I double click the icon fade and it does not open, I have to right click and select open.

I tried to remove items and it open let saying about safe mode or the installer is wrong.

krome8800

Post #6August 20, 2013, 2:17 AM UTC last edited August 20, 2013, 2:21 AM UTC

Ran the fix it restarted. It the same if online amor is on cant access the net through any brower. Still have to right click on icon to open it. Also cant uninstall anything.

Malwarebtyes uninstall did not work say : Run-time error 372 fail to loadk control webbrowser from ieframe.dll. you version of ieframe.dll may be outdated. make sure you are using the version of the control that was provided with your applications.

here is fresh OTL log

OTL logfile created on: 8/19/2013 9:11:39 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Krome\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.61 Gb Available Physical Memory | 80.39% Memory free
5.09 Gb Paging File | 4.54 Gb Available in Paging File | 89.14% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 596.16 Gb Total Space | 419.58 Gb Free Space | 70.38% Space Free | Partition Type: NTFS
Drive E: | 1.81 Gb Total Space | 1.79 Gb Free Space | 99.28% Space Free | Partition Type: FAT

Computer Name: KEITH | User Name: Krome | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Krome\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Online Armor\oaui.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oahlp.exe (Emsi Software GmbH)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
PRC - C:\Program Files\Logitech\G35\G35.exe (Logitech©)
PRC - C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
PRC - C:\Program Files\ASUS\TurboV\TurboV.exe ()
PRC - C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
PRC - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
PRC - C:\WINDOWS\system32\regsvr32.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Razer\Tarantula\razerhid.exe ()
PRC - C:\Program Files\Razer\Copperhead\razerhid.exe ()
PRC - C:\Program Files\Razer\Copperhead\razerofa.exe (Razer Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13081900\algo.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
MOD - C:\Program Files\ASUS\TurboV\TurboV.exe ()
MOD - C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
MOD - C:\Program Files\ASUS\Turbo Key\pngio.dll ()
MOD - C:\Program Files\ASUS\Turbo Key\AiNap.dll ()
MOD - C:\Program Files\ASUS\TurboV\OcProfile.dll ()
MOD - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\AsSpindownTimeout.dll ()
MOD - C:\Program Files\ASUS\EPU-4 Engine\pngio.dll ()
MOD - C:\Program Files\ASUS\TurboV\TvOcLib.dll ()
MOD - C:\Program Files\ASUS\TurboV\pngio.dll ()
MOD - C:\Program Files\Razer\Tarantula\razerhid.exe ()
MOD - C:\WINDOWS\system32\AsIO.dll ()
MOD - C:\Program Files\Razer\Copperhead\razerhid.exe ()
MOD - C:\Program Files\Razer\Copperhead\download.dll ()

========== Services (SafeList) ==========

SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
SRV - (AODService) – C:\Program Files\AMD\OverDrive\AODAssist.exe ()
SRV - (AsSysCtrlService) – C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe ()
SRV - (spupdsvc) – C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (WDC_SAM) – system32\DRIVERS\wdcsam.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (PciCon) – D:\PciCon.sys File not found
DRV - (mv61xx) – system32\DRIVERS\mv61xx.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (XFDriver) – C:\Program Files\Xfire2\XFDriver.sys (XFire)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (oahlpXX) – C:\WINDOWS\system32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Emsisoft)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys ()
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Emsisoft)
DRV - (LADF_SBVM) – C:\WINDOWS\system32\drivers\ladfSBVMi386.sys (Logitech)
DRV - (LADF_DHP2) – C:\WINDOWS\system32\drivers\ladfDHP2i386.sys (Logitech)
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (RtNdPt5x) – C:\WINDOWS\system32\drivers\RtNdPt5x.sys (Realtek Semiconductor Corporation )
DRV - (RTLVLAN) – C:\WINDOWS\system32\drivers\RTLVLAN.SYS (Realtek Semiconductor Corporation )
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (RTLTEAMING) – C:\WINDOWS\system32\drivers\RTLTEAMING.SYS (Realtek Semiconductor Corporation)
DRV - (AsIO) – C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (TarFltr) – C:\WINDOWS\system32\drivers\UsbFltr.sys (Waytech Development, Inc.)
DRV - (Razerlow) – C:\WINDOWS\system32\drivers\Razerlow.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search

IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "WWW.YAHOO.COM"
FF - prefs.js..extensions.enabledAddons: %7B27c60876-b5c9-4335-b4f3-52b26782220c%7D:0.9.4
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:[removed]
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/08/18 16:44:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/16 20:17:26 | 000,000,000 | —D | M]

[2010/05/16 15:17:47 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Extensions
[2013/08/16 20:02:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions
[2013/05/14 17:43:53 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013/05/15 19:03:15 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/01/13 20:11:23 | 000,007,532 | —- | M] () (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c}.xpi
[2013/08/16 20:02:18 | 000,534,203 | —- | M] () (No name found) – C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Profiles\zncvoa68.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/08/16 20:17:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013/08/16 20:17:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/16 20:17:34 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/18 16:44:48 | 000,000,000 | —D | M] (avast! Online Security) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKCU\..\Toolbar\ShellBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\OAui.exe (Emsi Software GmbH)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [Logitech G35] C:\Program Files\Logitech\G35\G35.exe (Logitech©)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QFan Help] C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe ()
O4 - HKLM..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe ()
O4 - HKLM..\Run: [Six Engine] C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Tarantula] C:\Program Files\Razer\Tarantula\razerhid.exe ()
O4 - HKLM..\Run: [Turbo Key] C:\Program Files\ASUS\Turbo Key\TurboKey.exe ()
O4 - HKLM..\Run: [TurboV] C:\Program Files\ASUS\TurboV\TurboV.exe ()
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D3F7724-5D24-41AB-886B-5181B5927C79}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\mhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Krome\Application Data\Mozilla\Firefox\Desktop Background.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Emsi Software GmbH)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/03 06:14:13 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/19 21:06:14 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/19 16:44:34 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Krome\Desktop\OTL.exe
[2013/08/19 16:35:32 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/19 16:35:20 | 001,018,305 | —- | C] (Thisisu) – C:\Documents and Settings\Krome\Desktop\JRT.exe
[2013/08/18 16:44:54 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/17 22:33:39 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/17 22:25:42 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Krome\Recent
[2013/08/17 22:24:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2013/08/17 22:24:35 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2013/08/17 17:29:11 | 000,000,000 | —D | C] – C:\Malwarebytes
[2013/08/17 17:27:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Desktop\backups
[2013/08/17 17:22:23 | 000,000,000 | —D | C] – C:\Program Files\AWS
[2013/08/17 16:53:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\XSplit
[2013/08/17 16:53:38 | 000,000,000 | —D | C] – C:\Program Files\SplitMediaLabs
[2013/08/17 16:51:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Local Settings\Application Data\SplitMediaLabs
[2013/08/17 16:50:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SplitMediaLabs
[2013/08/17 16:43:08 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2013/08/17 16:43:04 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2013/08/17 16:42:55 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2013/08/17 16:42:19 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2013/08/17 16:42:19 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2013/08/17 16:42:19 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2013/08/17 16:42:19 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2013/08/17 16:42:19 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2013/08/17 16:42:19 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2013/08/17 16:42:19 | 000,000,000 | —D | C] – C:\6fe708be5a1534182269480d3fd8cf46
[2013/08/17 16:38:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\SplitMediaLabs
[2013/08/17 16:26:44 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2013/08/17 16:25:39 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie7
[2013/08/17 16:25:30 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[2013/08/17 16:25:18 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[2013/08/16 20:17:24 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/07/27 13:02:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Krome\Application Data\Day 1 Studios
[2010/06/03 19:13:41 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Krome\Application Data\pcouffin.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/08/19 21:12:32 | 000,466,276 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/19 21:12:32 | 000,073,298 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/19 21:08:05 | 000,000,316 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/19 21:07:59 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/19 20:24:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/19 16:44:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Krome\Desktop\OTL.exe
[2013/08/19 16:35:20 | 001,018,305 | —- | M] (Thisisu) – C:\Documents and Settings\Krome\Desktop\JRT.exe
[2013/08/19 16:23:23 | 000,000,177 | -H– | M] () – C:\dvmexp.idx
[2013/08/19 16:22:53 | 000,666,633 | —- | M] () – C:\Documents and Settings\Krome\Desktop\AdwCleaner.exe
[2013/08/19 05:50:53 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/19 05:50:46 | 000,098,256 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/18 16:45:01 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/18 16:45:01 | 000,369,584 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/18 16:45:01 | 000,175,176 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/18 16:44:54 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/08/18 11:29:51 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/17 17:53:55 | 000,000,075 | —- | M] () – C:\Documents and Settings\Krome\Application Data\mbam.context.scan
[2013/08/17 17:12:38 | 000,139,832 | —- | M] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2013/08/17 17:12:28 | 000,281,768 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.xtr
[2013/08/17 17:09:03 | 000,281,768 | —- | M] () – C:\WINDOWS\System32\PnkBstrB.ex0
[2013/08/17 16:28:35 | 000,000,815 | —- | M] () – C:\Documents and Settings\Krome\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/17 16:26:51 | 000,000,759 | —- | M] () – C:\WINDOWS\System32\spupdsvc.inf
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/08/19 16:22:53 | 000,666,633 | —- | C] () – C:\Documents and Settings\Krome\Desktop\AdwCleaner.exe
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/18 16:45:01 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/18 16:44:55 | 000,175,176 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/18 16:44:54 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/18 16:44:54 | 000,000,316 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/17 17:53:55 | 000,000,075 | —- | C] () – C:\Documents and Settings\Krome\Application Data\mbam.context.scan
[2013/08/17 16:43:27 | 000,063,584 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2013/08/17 16:26:51 | 000,000,759 | —- | C] () – C:\WINDOWS\System32\spupdsvc.inf
[2013/07/18 19:45:06 | 000,139,832 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2013/07/18 19:45:01 | 000,281,768 | —- | C] () – C:\WINDOWS\System32\PnkBstrB.exe
[2013/07/18 19:44:21 | 000,076,888 | —- | C] () – C:\WINDOWS\System32\PnkBstrA.exe
[2013/07/13 19:33:52 | 000,085,246 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/07/13 19:33:52 | 000,085,246 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1004336348-1606980848-839522115-1004-0.dat
[2013/03/20 23:10:16 | 000,042,880 | —- | C] () – C:\WINDOWS\System32\xfcodec.dll
[2013/02/07 23:06:29 | 000,013,132 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/10/02 19:40:26 | 000,075,096 | —- | C] () – C:\WINDOWS\System32\LADFCoinst_i386.dll
[2012/01/31 22:02:35 | 000,205,864 | —- | C] () – C:\WINDOWS\System32\drivers\OADriver.sys
[2012/01/31 22:02:35 | 000,040,296 | —- | C] () – C:\WINDOWS\System32\drivers\oahlp32.sys
[2010/06/22 19:25:11 | 000,004,608 | —- | C] () – C:\Documents and Settings\Krome\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/03 19:13:41 | 000,087,608 | —- | C] () – C:\Documents and Settings\Krome\Application Data\inst.exe
[2010/06/03 19:13:41 | 000,007,887 | —- | C] () – C:\Documents and Settings\Krome\Application Data\pcouffin.cat
[2010/06/03 19:13:41 | 000,001,144 | —- | C] () – C:\Documents and Settings\Krome\Application Data\pcouffin.inf
[2010/04/03 07:29:36 | 000,022,328 | —- | C] () – C:\Documents and Settings\Krome\Application Data\PnkBstrK.sys

========== ZeroAccess Check ==========

[2010/04/03 06:21:25 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/04/16 11:09:07 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 07:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/13 19:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

OCD

Post #7August 20, 2013, 4:02 AM UTC

Hi krome8800,

I want to only keep avast. I do not see AVG on the anywhere on computer.

Did you set Online Armour to exclude avast?

=========================

[external image: Posted Image] RogueKiller

Download to your desktop RogueKiller (by tigzy)

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Quit all programs
Wait until Prescan has finished …
Click on Scan, Do Not Fix Anything at this point.
Click the Report button, save the report to your desktop

=========================

[external image: Posted Image] ComboFix

Refer to the ComboFix User's Guide

Download ComboFix from the following location:

Link

* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

———————————————————————————————
Ensure your AntiVirus and AntiSpyware applications are re-enabled.
———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

=========================

In your next post please provide the following:
RogueKiller log
ComboFix.txt

krome8800

Post #8August 20, 2013, 11:13 AM UTC

Yes I told OA to allow Avast .

RogueKiller V8.6.6 [Aug 19 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Krome [Admin rights]
Mode : Scan – Date : 08/20/2013 05:55:42
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤
[HJ POL] HKCU\[…]\System : DisableTaskMgr (0) -> FOUND
[HJ POL] HKCU\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD6400AAKS-00E4A0 +++++
— User —
[MBR] add65e835e34b0b1f08667ee1c34addc
[BSP] 16a9cb98160a4c455a711dbc99175b9a : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 610469 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive1: WDC WD6400AAKS-00E4A0 +++++
— User —
[MBR] c085444e7b136b4f22e8e5f19141d546
[BSP] eef4bedaaeeca7011e3d6cb0fa89152a : MBR Code unknown
Partition table:
0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 778135908 | Size: 557377 Mo
1 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 168689522 | Size: 945326 Mo
2 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1869881465 | Size: 945326 Mo
3 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 0 | Size: 1775989 Mo
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[0]_S_08202013_055542.txt >>

krome8800

Post #9August 20, 2013, 11:24 AM UTC

ComboFix 13-08-19.02 - Krome 08/20/2013 6:19.1.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2502 [GMT -5:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus Free *Disabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: Online Armor Firewall *Disabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Krome\Application Data\inst.exe
c:\documents and settings\Krome\Application Data\mIRC\logs\status.log
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\cacc4551ade82ef2.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\SET187.tmp
c:\windows\system32\SET18C.tmp
.
.
((((((((((((((((((((((((( Files Created from 2013-07-20 to 2013-08-20 )))))))))))))))))))))))))))))))
.
.
2013-08-20 10:54 . 2013-08-20 10:54 15616 —-a-w- c:\windows\system32\TrueSight.sys
2013-08-20 02:06 . 2013-08-20 02:06 ——– d—–w- C:\_OTL
2013-08-19 21:35 . 2013-08-19 21:35 ——– d—–w- c:\windows\ERUNT
2013-08-18 21:44 . 2013-08-18 21:45 175176 —-a-w- c:\windows\system32\drivers\aswVmm.sys
2013-08-18 21:44 . 2013-05-09 08:59 49376 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-08-18 21:44 . 2013-05-09 08:59 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-08-18 03:24 . 2013-08-18 03:24 ——– d—–w- c:\program files\CCleaner
2013-08-17 22:29 . 2013-08-17 22:29 ——– d—–w- C:\Malwarebytes
2013-08-17 22:22 . 2013-08-17 22:22 ——– d—–w- c:\program files\AWS
2013-08-17 21:53 . 2013-08-17 21:53 ——– d—–w- c:\program files\SplitMediaLabs
2013-08-17 21:51 . 2013-08-17 21:51 ——– d—–w- c:\documents and settings\Krome\Local Settings\Application Data\SplitMediaLabs
2013-08-17 21:50 . 2013-08-17 21:50 ——– d—–w- c:\documents and settings\All Users\Application Data\SplitMediaLabs
2013-08-17 21:43 . 2013-08-17 21:43 ——– d—–w- c:\windows\system32\XPSViewer
2013-08-17 21:43 . 2013-08-17 21:43 ——– d—–w- c:\program files\MSBuild
2013-08-17 21:42 . 2013-08-17 21:42 ——– d—–w- c:\program files\Reference Assemblies
2013-08-17 21:42 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2013-08-17 21:42 . 2013-08-17 21:42 ——– d—–w- C:\6fe708be5a1534182269480d3fd8cf46
2013-08-17 21:42 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2013-08-17 21:42 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2013-08-17 21:42 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2013-08-17 21:42 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2013-08-17 21:42 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2013-08-17 21:42 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2013-08-17 21:42 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2013-08-17 21:42 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2013-08-17 21:38 . 2013-08-17 21:38 ——– d—–w- c:\documents and settings\Krome\Application Data\SplitMediaLabs
2013-07-27 18:02 . 2013-07-27 18:02 ——– d—–w- c:\documents and settings\Krome\Application Data\Day 1 Studios
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-18 21:45 . 2012-01-26 00:15 369584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2013-08-18 21:45 . 2012-01-26 00:15 770344 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2013-08-17 22:12 . 2013-07-19 00:45 139832 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2013-08-17 22:12 . 2013-07-19 00:45 281768 —-a-w- c:\windows\system32\PnkBstrB.exe
2013-08-17 22:12 . 2010-04-02 11:11 281768 —-a-w- c:\windows\system32\PnkBstrB.xtr
2013-08-17 22:09 . 2013-07-19 00:45 281768 —-a-w- c:\windows\system32\PnkBstrB.ex0
2013-07-20 22:42 . 2013-07-20 22:42 107888 —-a-w- c:\windows\system32\CmdLineExt.dll
2013-07-19 00:44 . 2013-07-19 00:44 76888 —-a-w- c:\windows\system32\PnkBstrA.exe
2013-07-13 20:54 . 2010-04-03 12:29 22328 —-a-w- c:\documents and settings\Krome\Application Data\PnkBstrK.sys
2013-07-09 01:47 . 2013-07-09 01:47 94632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-09 01:47 . 2013-07-09 01:47 144896 —-a-w- c:\windows\system32\javacpl.cpl
2013-07-09 01:47 . 2012-08-23 23:50 867240 —-a-w- c:\windows\system32\npdeployJava1.dll
2013-07-09 01:47 . 2010-05-12 22:23 789416 —-a-w- c:\windows\system32\deployJava1.dll
2013-06-12 23:24 . 2012-05-01 23:38 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-12 23:24 . 2011-07-23 20:32 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\steam.exe" [2013-07-26 1807272]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-07-09 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-06-05 33628160]
"Six Engine"="c:\program files\ASUS\EPU-4 Engine\FourEngine.exe" [2009-06-25 5782528]
"TurboV"="c:\program files\ASUS\TurboV\TurboV.exe" [2009-05-25 5391872]
"QFan Help"="c:\program files\ASUS\AI Suite\QFan3\QFanHelp.exe" [2009-04-30 598528]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-12-01 881152]
"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-05-25 1768960]
"Tarantula"="c:\program files\Razer\Tarantula\razerhid.exe" [2006-09-30 176128]
"razer"="c:\program files\Razer\Copperhead\razerhid.exe" [2005-10-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"@OnlineArmor GUI"="c:\program files\Online Armor\OAui.exe" [2011-11-01 2531104]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-02-15 98304]
"Logitech G35"="c:\program files\Logitech\G35\G35.exe" [2010-10-05 1811800]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\ONLINE~2\oaevent.dll" [2011-11-01 358840]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\crysis 2 - demo\\Bin32\\Crysis2Demo.exe"=
"c:\\Program Files\\Steam\\steamapps\\krome8800\\ricochet\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\PlanetSide 2\\LaunchPad.exe"=
"c:\\Program Files\\Steam\\steamapps\\krome8800\\half-life\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Counter-Strike Global Offensive\\csgo.exe"=
"c:\\Program Files\\Xfire2\\Xfire.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\F.E.A.R. 3\\F.E.A.R. 3.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Grid\\grid.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Borderlands 2\\Binaries\\Win32\\Borderlands2.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Day of Defeat Source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Borderlands 2\\Binaries\\Win32\\Launcher.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Left 4 Dead 2\\left4dead2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [8/18/2013 4:44 PM 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [8/18/2013 4:44 PM 175176]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1/25/2012 7:15 PM 770344]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1/25/2012 7:15 PM 369584]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [1/31/2012 10:02 PM 205864]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [1/31/2012 10:02 PM 25192]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [1/31/2012 10:02 PM 29464]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/25/2012 7:15 PM 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [8/18/2013 4:44 PM 66336]
R2 OAcat;Online Armor Helper Service;c:\program files\Online Armor\oacat.exe [1/31/2012 10:02 PM 207936]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [4/3/2010 6:56 AM 22016]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [10/1/2010 6:46 PM 100368]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [6/3/2010 7:13 PM 47360]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [4/3/2010 6:53 AM 1374464]
S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys –> c:\windows\system32\DRIVERS\mv61xx.sys [?]
S1 oahlpXX;Online Armor helper driver;c:\windows\system32\drivers\oahlp32.sys [1/31/2012 10:02 PM 40296]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [4/3/2010 6:58 AM 90112]
S2 SvcOnlineArmor;Online Armor;c:\program files\Online Armor\oasrv.exe [1/31/2012 10:02 PM 4363040]
S3 LADF_DHP2;G35 DHP2 Filter Driver;c:\windows\system32\drivers\ladfDHP2i386.sys [10/2/2012 7:40 PM 53976]
S3 LADF_SBVM;G35 SBVM Filter Driver;c:\windows\system32\drivers\ladfSBVMi386.sys [10/2/2012 7:40 PM 335064]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 Razerlow;Razer Copperhead Driver;c:\windows\system32\drivers\Razerlow.sys [4/3/2010 7:07 AM 19020]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [4/3/2010 6:56 AM 25984]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [4/3/2010 6:56 AM 17408]
S3 TarFltr;Razer Tarantula USB Keyboard;c:\windows\system32\drivers\UsbFltr.sys [4/3/2010 7:06 AM 44800]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys –> c:\windows\system32\DRIVERS\wdcsam.sys [?]
S3 XFDriver;XFDriver;c:\program files\Xfire2\XFDriver.sys [6/14/2013 5:17 PM 16648]
S4 AODService;AODService;c:\program files\AMD\OverDrive\AODAssist.exe [4/22/2009 3:01 PM 124256]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - TRUESIGHT
*Deregistered* - TrueSight
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 23:24]
.
2013-08-20 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-18 08:58]
.
.
——- Supplementary Scan ——-
.
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-08-20 06:22
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(516)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Completion time: 2013-08-20 06:23:24
ComboFix-quarantined-files.txt 2013-08-20 11:23
.
Pre-Run: 450,161,790,976 bytes free
Post-Run: 450,188,718,080 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 7EE814D37E249117911B4F4BCA9BB576
8F558EB6672622401DA993E1E865C861

OCD

Post #10August 20, 2013, 2:29 PM UTC

Hi krome8800,

Have you installed any new software or hardware just prior to these issues presenting themselves?
Would you consider changing your Firewall? As it appears to be blocking your Internet access, or having a conflict with other software.

=========================

Let's try this program to try and remove any remnants of AVG

[external image: Posted Image] Revo Uninstaller Pro

Please download Revo Uninstaller Pro and save it to your desktop.
(This version is a fully functional, 30 day free trial)

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
From the list of programs click on
- AVG
Chose "Uninstall". When prompted click Yes.
Make sure the advanced option is checked… then click Next.
The program will run, when prompted… click Yes… then Next.
Once the program has searched for leftovers click Next.
Check ONLY the bolded items on the list then… click Next… then Yes.
When done click Finish.

=========================

In your next post please provide the following:
Results of the above steps

krome8800

Post #11August 20, 2013, 9:26 PM UTC last edited August 21, 2013, 12:50 AM UTC

Have you installed any new software or hardware just prior to these issues presenting themselves?

I tried to install xsplit and I download the wrong link and after I installed is when I had all these new issues

Would you consider changing your Firewall? As it appears to be blocking your Internet access, or having a conflict with other software.

Yes I have no attachment to online armor.

That installer wouldnt work had a bunch of error pop up during install. After it downloaded it just brought me to a website saying thank you for downloading.. there is not program that downloaded.

Would a restore bring my computer back ?

OCD

Post #12August 21, 2013, 3:01 AM UTC

Hi krome8800,

Would a restore bring my computer back ?

You stated previously you couldn't access System Restore. Has that situation changed?

Did you successfully install xsplit? If so, uninstall it for now.

=========================

[external image: Posted Image] Uninstall via Add/Remove Programs

Please go to Start > Control Panel > Add Remove Programs.
Locate the following programs: (if present)
Online Armor
Click Remove and allow Windows to completely remove each one in turn.
Then reboot your computer to complete this part of the process.

=========================

[external image: Posted Image] Reboot

=========================

[external image: Posted Image] Enable Windows Firewall in XP

Click Start, click Run, type Firewall.cpl, and then click OK.
On the General tab, click On (recommended).
Click OK.

=========================

[external image: Posted Image] Reset TCP/IP stack to installation defaults

You must run the command prompt as an administrator or in an "elevated mode".

Start menu, in the search bar type "cmd"
Right-click the cmd icon, select "run as administrator"
- If you have user account control (UAC) set up it may prompt you to accept that action.
Then type in "netsh int ip reset reset.log" then hit Enter

=========================

In your next post please provide the following:
Update on performance, any changes?

krome8800

Post #13August 22, 2013, 3:18 PM UTC

Sorry OCD Kid had football past two days…. After I did the last instructions the Restore Function was back… Tonight I will do these instructions.

krome8800

Post #14August 22, 2013, 10:17 PM UTC last edited August 23, 2013, 2:10 AM UTC

Hi OCD, Was able to uninstall online Online Armor, and enable Windows Firewall. Everything is still the same have to right click on icons to open them cant uninstall pc figther weatherbug or few other thing that installed. Now as far as uninstalling programs it will not let me.

OCD

Post #15August 23, 2013, 3:05 AM UTC

Hi krome8800,

Now as far as uninstalling programs it will not let me.

Is this any/all programs, or just the ones you have been trying to uninstall?

=========================

Go here and click on the Run Now button and follow the onscreen directions.
http://support.microsoft.com/mats/program_…_and_uninstall/

Reboot when you are done.

Check if there is any change in the ability to remove a program.

=========================

Try this to resolve the icon situation.

Click Start > Run > type "regsvr32 /i shell32" (without quotes)

If this does not help, download the .lnk file association fix from here and
apply it: LNK (Shortcut) File Association Fix (Restores Default Shortcut Behavior)

=========================

Status update

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

No icon response [Solved]

✨ Ask AI

Ask AI