Spyware / Malware / Virus Removal

Sneaky ...! [Solved]

40 min read

Looking for the outcome? Ask AI

Zhora

Post #16August 20, 2013, 11:36 PM UTC

OTL didn't reboot when it was finished, so I did a manual reboot.

OTL logfile created on: 8/20/2013 4:21:17 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Christine\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.26 Gb Available Physical Memory | 69.50% Memory free
5.09 Gb Paging File | 4.11 Gb Available in Paging File | 80.67% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 363.11 Gb Free Space | 77.96% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 851.35 Gb Free Space | 91.39% Space Free | Partition Type: NTFS

Computer Name: BIGBLUEMONSTER | User Name: Christine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Documents and Settings\Christine\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\Runservice.exe ()
PRC - C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\729ef05a2df18630db7f0a28dd0ec155\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c60957afdbe82f552f2db272afa719fc\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\53428f2f24507f75cc2df5dd0115b46d\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\286a517e1d3aae93daf46ca638856372\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\d756aec4dac356fb0dbfd15f5e07d012\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\918ce68a67ddb5558994e20dc3a74c8a\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\6c422db78c17838c3eb9f9fcc01ca63f\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6e0e5467e23a80c5c7d34f65dc7f87f2\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\58eb4f10504e035b673f8366d9be6881\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8927b576eb15c4a8f4bb04f05e7cc51e\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\b12cbfa020af0c619d8f58c6b665efc1\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\d083ee23a4c0d8cf76ae9e95e52d0388\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\332407a3f224f388f70120d33cb872d5\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\32800018747dbf43506ac49e697daea9\System.Xml.Linq.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4d277a8481c203a35c58bd277a2e71df\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\9e19102de729beac1a221cde49058d99\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\9b32857137a545633a4f303ec88d418c\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e205d971e9ffa1771cff3d3dde1c3c2b\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\a10f361c888b8b98f7ad1fa8d7a51516\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\107b8a28ba272e93556f0e2bfa2c4e16\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\608aa2db27d45e63a4863f1f1d06897a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\6405f08f877802703cfd956c072a4ad0\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\8f799a4688381624de3cfb1edbccb163\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\WINDOWS\mmfs.dll ()
MOD - C:\WINDOWS\Runservice.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3175.36923__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3156.17694__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3156.17689__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3156.17698__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3156.17722__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3156.17721__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3156.17682__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3156.17681__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3156.17682__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3156.17747__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3156.17703__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3156.17697__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3156.17689__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3156.17699__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3156.17703__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3156.17703__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3156.17694__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3156.17695__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3175.37106__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3175.37120__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3175.37069__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3175.36940__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3175.37078__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3175.36920__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3175.37075__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3175.36922__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3156.17689__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3156.17702__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3156.17702__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3175.36928__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3175.36921__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3175.36917__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3156.17692__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3175.37077__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll ()

========== Services (SafeList) ==========

SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) – C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (Seagate Dashboard Services) – C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (TabletServiceWacom) – C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV - (EpsonPrinterStudy4) – C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SetupNTGLM7X) – D:\NTGLM7X.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NTACCESS) – D:\NTACCESS.sys File not found
DRV - (MSICPL) – D:\install4\MSICPL.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (GMSIPCI) – D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) – C:\WINDOWS\system32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (wacmoumonitor) – C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (wacomvhid) – C:\WINDOWS\system32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (amdide) – C:\WINDOWS\system32\drivers\amdide.sys (Advanced Micro Devices)
DRV - (wacommousefilter) – C:\WINDOWS\system32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (incdrm) – C:\WINDOWS\System32\drivers\incdrm.sys (Ahead Software AG)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Startpage HTTPS"
FF - prefs.js..browser.search.selectedEngine: "Startpage HTTPS"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://forecast.weather.gov/MapClick.php?CityName=Bellingham&state;=WA&site;=SEW&textField1;=48.7597&textField2;=-122.487&e;=0"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.16
FF - prefs.js..extensions.enabledAddons: pbupload%40photobucket.com:1.3.9
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.17
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.3
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.11
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1rc2
FF - prefs.js..extensions.enabledAddons: %7Be7348bc0-16f6-11de-8c30-0800200c9a66%7D:15.0.25.04.12
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A72E0FE7-282F-4517-9C95-5B611103B925}: C:\Documents and Settings\Christine\Local Settings\Application Data\{A72E0FE7-282F-4517-9C95-5B611103B925}\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/01/22 21:14:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/17 10:11:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/18 15:25:57 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/08/06 22:33:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions
[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/08/18 15:25:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions
[2011/02/27 20:41:19 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2013/07/27 00:37:52 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/28 16:48:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/07/01 22:46:42 | 000,000,000 | —D | M] (Purple Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{3ffb7be0-8bde-11de-8a39-0800200c9a66}
[2009/10/10 19:46:14 | 000,000,000 | —D | M] (AvantGarde Rosepetal) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}
[2013/05/15 11:23:42 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/07/19 01:57:51 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/05/04 15:44:43 | 000,000,000 | —D | M] (Pink Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2012/11/25 00:20:11 | 000,021,428 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/06/25 18:25:35 | 000,027,521 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/08/15 11:48:09 | 000,534,320 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/06/15 12:25:30 | 000,868,738 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013/07/30 20:17:34 | 000,824,302 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/18 19:39:22 | 001,109,062 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}.xpi
[2013/08/03 00:51:12 | 000,275,449 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009/10/10 19:46:14 | 001,897,274 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp.xpi
[2013/08/20 10:42:23 | 000,005,472 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\searchplugins\startpage.xml
[2013/08/17 10:11:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/17 10:11:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - homepage: http://www.hulu.com/
CHR - default_search_provider: Ask (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url =
CHR - homepage: http://www.hulu.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: AmazonMP3DownloaderPlugin (Enabled) = C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files\TabletPlugins\npwacom.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Avira Toolbar = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.5.0_0\
CHR - Extension: YouTube = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Search = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Cutie Mark Crusaders Theme = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ekjkihbdiohibdhpopbfbhihndehlcap\1_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Gmail = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2013/08/20 12:04:18 | 000,449,839 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15468 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DBAgent] C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.25.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4A2C5A9-E429-494E-98CE-F10BCE688442}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/20 00:10:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/20 16:17:59 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2013/08/20 16:11:20 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/20 16:07:40 | 001,018,949 | —- | C] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 12:05:38 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Christine\Recent
[2013/08/20 11:47:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Avira
[2013/08/20 11:45:05 | 000,489,392 | —- | C] (Ask Partner Network) – C:\Documents and Settings\Christine\My Documents\APNSetup.exe
[2013/08/20 11:44:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Avira
[2013/08/20 11:44:12 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2013/08/20 11:44:09 | 000,135,136 | —- | C] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avipbb.sys
[2013/08/20 11:44:09 | 000,084,744 | —- | C] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2013/08/20 11:44:09 | 000,037,352 | —- | C] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avkmgr.sys
[2013/08/20 11:44:08 | 000,000,000 | —D | C] – C:\Program Files\Avira
[2013/08/19 18:40:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/18 17:30:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/18 17:28:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/18 17:28:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/18 17:28:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/18 17:28:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/18 17:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/18 17:22:46 | 005,105,231 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 13:59:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 11:08:42 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 10:11:13 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/08/06 22:33:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Thunderbird
[2013/08/05 13:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Nero
[2013/08/05 13:53:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Seagate Dashboard 2.0
[2013/08/05 13:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2013/08/05 13:53:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nero
[2013/08/05 13:53:04 | 000,000,000 | —D | C] – C:\Program Files\Seagate
[2013/08/05 13:45:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/05 13:45:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Seagate
[2013/08/05 13:41:43 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2013/08/02 10:56:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MRT

========== Files - Modified Within 30 Days ==========

[2013/08/20 16:17:12 | 000,001,876 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:34 | 003,858,143 | —- | M] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 16:07:23 | 001,018,949 | —- | M] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 15:36:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/20 15:32:01 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-813497703-839522115-1003UA.job
[2013/08/20 12:31:40 | 000,000,981 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 12:31:40 | 000,000,963 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/20 12:04:18 | 000,449,839 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/20 11:44:28 | 000,001,707 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Avira Control Center.lnk
[2013/08/20 11:43:32 | 000,028,520 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2013/08/20 11:43:31 | 000,135,136 | —- | M] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avipbb.sys
[2013/08/20 11:43:31 | 000,084,744 | —- | M] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2013/08/20 11:43:31 | 000,037,352 | —- | M] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avkmgr.sys
[2013/08/20 11:32:35 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/20 11:32:32 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/20 11:31:59 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2013/08/20 11:31:58 | 000,000,338 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2013/08/20 11:31:57 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/18 18:52:44 | 000,001,655 | —- | M] () – C:\WINDOWS\System32\Wacom_Tablet.dat
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120418.backup
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120228.backup
[2013/08/18 17:30:41 | 000,000,392 | RHS- | M] () – C:\boot.ini
[2013/08/18 17:22:49 | 005,105,231 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 15:06:18 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 14:11:40 | 000,666,633 | —- | M] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/18 14:07:19 | 000,000,616 | —- | M] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/18 14:07:17 | 000,000,604 | —- | M] () – C:\WINDOWS\tasks\Christine.job
[2013/08/18 11:08:39 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 21:32:00 | 000,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-813497703-839522115-1003Core.job
[2013/08/15 11:54:11 | 000,481,216 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/15 11:54:11 | 000,079,672 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/14 21:39:01 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/07 09:58:10 | 000,002,455 | —- | M] () – C:\Documents and Settings\Christine\Desktop\HiJackThis.lnk
[2013/08/05 15:46:52 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 15:29:40 | 000,000,412 | —- | M] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2013/08/03 02:27:49 | 000,449,839 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-130835.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093359.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093319.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183845.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183810.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-152248.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-150257.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-141503.backup
[2013/07/31 19:36:37 | 000,002,334 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/07/31 19:36:37 | 000,002,316 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Google Chrome.lnk
[2013/07/27 00:57:01 | 000,449,574 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130731-142401.backup
[2013/07/27 00:57:01 | 000,449,574 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130803-022749.backup
[2013/07/27 00:48:47 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/07/25 21:23:02 | 000,174,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ie4uinit.exe
[2013/07/25 21:23:02 | 000,174,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2013/07/25 18:47:17 | 001,215,488 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\urlmon.dll
[2013/07/25 18:47:17 | 000,920,064 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wininet.dll
[2013/07/25 18:47:17 | 000,759,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgx.dll
[2013/07/25 18:47:17 | 000,206,848 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\occache.dll
[2013/07/25 18:47:17 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\url.dll
[2013/07/25 18:47:17 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\url.dll
[2013/07/25 18:47:16 | 006,017,536 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/07/25 18:47:16 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mstime.dll
[2013/07/25 18:47:16 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstime.dll
[2013/07/25 18:47:16 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtmled.dll
[2013/07/25 18:47:14 | 000,630,272 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeeds.dll
[2013/07/25 18:47:14 | 000,630,272 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2013/07/25 18:47:14 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeedsbs.dll
[2013/07/25 18:47:14 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2013/07/25 18:47:13 | 000,522,240 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsdbgui.dll
[2013/07/25 18:47:13 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\licmgr10.dll
[2013/07/25 18:47:13 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\licmgr10.dll
[2013/07/25 18:47:13 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\jsproxy.dll
[2013/07/25 18:47:13 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsproxy.dll
[2013/07/25 18:47:12 | 002,005,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2013/07/25 18:47:12 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\inetcpl.cpl
[2013/07/25 18:47:12 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcpl.cpl
[2013/07/25 18:47:11 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iepeers.dll
[2013/07/25 18:47:11 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iepeers.dll
[2013/07/25 18:47:10 | 011,113,472 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2013/07/25 18:47:06 | 000,743,424 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2013/07/25 18:47:06 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iedkcs32.dll
[2013/07/25 18:47:06 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedkcs32.dll
[2013/07/25 07:52:59 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\html.iec

========== Files Created - No Company Name ==========

[2013/08/20 16:17:12 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:28 | 003,858,143 | —- | C] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 11:53:17 | 000,000,981 | —- | C] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 11:53:17 | 000,000,963 | —- | C] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/20 11:44:28 | 000,001,707 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Avira Control Center.lnk
[2013/08/18 17:28:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/18 17:28:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/18 17:28:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/18 17:28:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/18 17:28:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | C] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 14:11:43 | 000,666,633 | —- | C] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/05 15:47:21 | 000,465,224 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1229272821-813497703-839522115-1003-0.dat
[2013/08/05 15:47:20 | 000,428,818 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/08/05 13:58:37 | 000,000,616 | —- | C] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/05 13:58:24 | 000,000,604 | —- | C] () – C:\WINDOWS\tasks\Christine.job
[2013/08/05 13:54:37 | 000,000,396 | —- | C] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 13:54:05 | 000,000,412 | —- | C] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012/09/09 16:02:52 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2012/09/09 16:02:47 | 000,618,823 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2012/09/09 16:02:47 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2012/03/17 16:13:43 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/22 21:19:29 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/07/30 13:21:08 | 000,027,648 | —- | C] () – C:\Documents and Settings\Christine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/19 15:48:43 | 000,000,004 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2009/10/26 18:00:48 | 008,801,704 | —- | C] () – C:\Program Files\FLV PlayerATBSetup.exe

========== ZeroAccess Check ==========

[2009/09/20 00:21:28 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2009/07/18 08:05:06 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

< :Services >

< >

< :OTL >

< IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?} >

< IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC >

< IE - HKCU\..\SearchScopes\{A28FF2B8-4818-47A7-95A1-9DC39DEB842B}: "URL" = http://websearch.ask.com/redirect?client=i…2F-9625EC8A9EA4 >

< FF - prefs.js..browser.search.defaultenginename: "Startpage HTTPS" >

< FF - prefs.js..browser.search.selectedEngine: "Startpage HTTPS" >

< O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control) >
Invalid Switch: sw.cab (Shockwave ActiveX Control)

< O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.25.2) >
Invalid Switch: jinstall-…indows-i586.cab (Java Plug-in 10.25.2)

< O16 - DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Key error.) >
Invalid Switch: jinstall-…indows-i586.cab (Reg Error: Key error.)

< O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.25.2) >
Invalid Switch: jinstall-…indows-i586.cab (Java Plug-in 10.25.2)

< >

< :Files >

< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.

< >

< :Commands >

< [emptytemp] >

< [resethosts] >

< [start explorer] >

< [Reboot] >

< End of report >

jeffce

Post #17August 21, 2013, 11:25 AM UTC

Please run the instructions that I provided earlier about the fix with OTL but this time be sure to press the Run Fix button and then post the new log.

Zhora

Post #18August 21, 2013, 4:09 PM UTC

Oh jeez…I was so massively brain fried by that time…duh!

BTW, from what I can see, neither Avast nor Malwarebytes provides realtime web protection unless I pay.

I might just do the hack I found to get around Avira's toolbar install instead. This fix, btw, did seem to disable Spybot, which I have setup to run at system start.

OTL
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A28FF2B8-4818-47A7-95A1-9DC39DEB842B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A28FF2B8-4818-47A7-95A1-9DC39DEB842B}\ not found.
Prefs.js: "Startpage HTTPS" removed from browser.search.defaultenginename
Prefs.js: "Startpage HTTPS" removed from browser.search.selectedEngine
Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000}
C:\WINDOWS\Downloaded Program Files\swdir.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Christine\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Christine\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Christine
->Temp folder emptied: 590373 bytes
->Temporary Internet Files folder emptied: 262546 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 55281101 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 523 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16867 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 54.00 mb

File move failed. C:\WINDOWS\System32\drivers\etc\Hosts scheduled to be moved on reboot.
Error: Unble to create default HOSTS file!

OTL by OldTimer - Version 3.2.69.0 log created on 08212013_085655

Files\Folders moved on Reboot…
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

jeffce

Post #19August 21, 2013, 4:26 PM UTC

I might just do the hack I found to get around Avira's toolbar install instead.

What do you mean? What is the problem you are having with this?

As for Avast and Malwarebytes, those are the only security programs that I use and I use both of the free versions. What real-time web protection are you needing?

Nothing that we did should have reset Spybot??

How is your system running otherwise?

Zhora

Post #20August 21, 2013, 8:42 PM UTC

I might just do the hack I found to get around Avira's toolbar install instead.
What do you mean? What is the problem you are having with this?

Told you back in post #3 that Avira's realtime web protection has been disabled, and later that it was disabled every time I tried reinstalling it. I know now thanks to some Googling that it's because of the removal of (by the programs you were having me run) and my refusal to reinstall the Ask.com toolbar which Avira is now in bed with and losing business because of. I did come across a 'fix' on another tech website that circumvents the toolbar install, but don't know if I'm going to try it or not.

As for Avast and Malwarebytes, those are the only security programs that I use and I use both of the free versions. What real-time web protection are you needing?

The realtime web protection as well as the ability to set a schedule for automatic scans are two of the things I like about Avira. Basically, I was hoping for another program or group of programs that include those functions.

Nothing that we did should have reset Spybot??

I don't know what happened there, but I rebooted a second time and its functioning fine now.

How is your system running otherwise?

Seems to be fine…but I've said that before and been proven wrong soon after, so I'm always wary of making the claim that its all fixed.

jeffce

Post #21August 21, 2013, 11:24 PM UTC

Hi,

Let's check for anything else in there hiding….

[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
Close the ESET online scan, and let me know how things are now.

———-

Zhora

Post #22August 22, 2013, 2:54 AM UTC last edited August 22, 2013, 3:12 AM UTC

I must apologize for my attitude in the last post. I sounded ungrateful and I want you to know I'm not ungrateful for all the help you're giving me. Especially since this is obviously a big long process this time - had a lot of carp** in there, did I? Mind telling me what I did have?

MBAM
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.08.17.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Christine :: BIGBLUEMONSTER [administrator]

8/21/2013 4:46:22 PM
mbam-log-2013-08-21 (16-46-22).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 208312
Time elapsed: 6 minute(s), 11 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

ESET
C:\C\Temp\Programs&Updates\avira_free_antivirus_en.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\Program Files\Ask & Record Toolbar01\askSBarSetup.exe a variant of Win32/Bundled.Toolbar.Ask.A application
C:\Program Files\Avira\AntiVir Desktop\offercast_avirav7_.exe a variant of Win32/Bundled.Toolbar.Ask.D application
C:\System Volume Information\_restore{25237816-4FDE-4B99-96A8-791EC3BB5284}\RP442\A0124802.dll a variant of Win32/Bundled.Toolbar.Ask application
C:\System Volume Information\_restore{25237816-4FDE-4B99-96A8-791EC3BB5284}\RP442\A0124804.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\System Volume Information\_restore{25237816-4FDE-4B99-96A8-791EC3BB5284}\RP442\A0124939.exe a variant of Win32/Bundled.Toolbar.Ask.D application
C:\System Volume Information\_restore{25237816-4FDE-4B99-96A8-791EC3BB5284}\RP442\A0125258.exe a variant of Win32/Bundled.Toolbar.Ask.D application
C:\System Volume Information\_restore{25237816-4FDE-4B99-96A8-791EC3BB5284}\RP442\A0125484.exe a variant of Win32/Bundled.Toolbar.Ask.D application
F:\Seagate Dashboard 2.0\BIGBLUEMONSTER\Christine\Backup\8bef9838-9f21-481a-8c66-d85b6e9cda7c\20130805_135838_Christine\C\C\Temp\Programs&Updates\avira_free_antivirus_en.exe a variant of Win32/Bundled.Toolbar.Ask application

So, looks like uninstalling Avira and erasing the 'Ask & Record Toolbar01' folder won't be sufficient, tho I will be doing that once you tell me to. What else do we need to do to erase all these copies of that dayam Ask toolbar? Also, I went ahead and cleared as much as possible from F: \ as its my Seagate Backup drive and any uninstall likely wouldn't affect the copies of Avira and Ask & Record Toolbar on it.

jeffce

Post #23August 22, 2013, 11:41 AM UTC

Hi,

No need to apologize. This is a frustrating process that can take time to complete. I have been in your shoes and know exactly how you feel. That is how I got into doing this now.

Let's remove some of the files that ESET found (some of them we don't need to worry about) and then let me know how your system is running.

[external image: Posted Image]

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Files
ipconfig /flushdns /c
C:\C\Temp\Programs&Updates\avira_free_antivirus_en.exe 
C:\Program Files\Ask & Record Toolbar01
C:\Program Files\Avira\AntiVir Desktop\offercast_avirav7_.exe 
F:\Seagate Dashboard 2.0\BIGBLUEMONSTER\Christine\Backup\8bef9838-9f21-481a-8c66-d85b6e9cda7c\20130805_135838_Christine\C\C\Temp\Programs&Updates\avira_free_antivirus_en.exe 

:Commands
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Zhora

Post #24August 22, 2013, 6:59 PM UTC

Okay, first thing - on cold boot I got the message 'SpybotSD.exe has generated errors' and that Windows was shutting the program down. When OTL rebooted my system, it was fine, tho. However, Avira is being a problem - I had to run the OTL fix twice because Avira downloaded files AFTER the first fix, and upon the reboot I had to disable Avira 2-3 times before it actually was disabled and didn't download more files. I tried using Hijack This to erase the Avira startup entries…but was blocked by Avira from removing them! Can I uninstall the &$#! thing yet?

OTL
OTL logfile created on: 8/22/2013 11:43:59 AM - Run 5
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Christine\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.18 Gb Available Physical Memory | 67.20% Memory free
5.09 Gb Paging File | 4.11 Gb Available in Paging File | 80.72% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 362.95 Gb Free Space | 77.93% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 853.51 Gb Free Space | 91.63% Space Free | Partition Type: NTFS

Computer Name: BIGBLUEMONSTER | User Name: Christine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Documents and Settings\Christine\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\Runservice.exe ()
PRC - C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\729ef05a2df18630db7f0a28dd0ec155\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c60957afdbe82f552f2db272afa719fc\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\53428f2f24507f75cc2df5dd0115b46d\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\286a517e1d3aae93daf46ca638856372\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\d756aec4dac356fb0dbfd15f5e07d012\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\918ce68a67ddb5558994e20dc3a74c8a\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\6c422db78c17838c3eb9f9fcc01ca63f\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6e0e5467e23a80c5c7d34f65dc7f87f2\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\58eb4f10504e035b673f8366d9be6881\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8927b576eb15c4a8f4bb04f05e7cc51e\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\b12cbfa020af0c619d8f58c6b665efc1\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\d083ee23a4c0d8cf76ae9e95e52d0388\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\332407a3f224f388f70120d33cb872d5\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\32800018747dbf43506ac49e697daea9\System.Xml.Linq.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4d277a8481c203a35c58bd277a2e71df\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\9e19102de729beac1a221cde49058d99\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\9b32857137a545633a4f303ec88d418c\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e205d971e9ffa1771cff3d3dde1c3c2b\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\a10f361c888b8b98f7ad1fa8d7a51516\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\107b8a28ba272e93556f0e2bfa2c4e16\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\608aa2db27d45e63a4863f1f1d06897a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\6405f08f877802703cfd956c072a4ad0\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\8f799a4688381624de3cfb1edbccb163\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\WINDOWS\mmfs.dll ()
MOD - C:\WINDOWS\Runservice.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3175.36923__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3156.17694__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3156.17689__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3156.17698__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3156.17722__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3156.17721__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3156.17682__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3156.17681__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3156.17682__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3156.17747__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3156.17703__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3156.17697__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3156.17689__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3156.17699__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3156.17703__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3156.17703__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3156.17694__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3156.17695__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3175.37106__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3175.37120__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3175.37069__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3175.36940__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3175.37078__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3175.36920__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3175.37075__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3175.36922__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3156.17689__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3156.17702__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3156.17702__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3175.36928__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3175.36921__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3175.36917__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3156.17692__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3175.37077__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\sqlite3.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\Fennel.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\Chai.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\Mate.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll ()

========== Services (SafeList) ==========

SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) – C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (Seagate Dashboard Services) – C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (TabletServiceWacom) – C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV - (EpsonPrinterStudy4) – C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SetupNTGLM7X) – D:\NTGLM7X.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NTACCESS) – D:\NTACCESS.sys File not found
DRV - (MSICPL) – D:\install4\MSICPL.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (GMSIPCI) – D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) – C:\WINDOWS\system32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (wacmoumonitor) – C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (wacomvhid) – C:\WINDOWS\system32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (amdide) – C:\WINDOWS\system32\drivers\amdide.sys (Advanced Micro Devices)
DRV - (wacommousefilter) – C:\WINDOWS\system32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (incdrm) – C:\WINDOWS\System32\drivers\incdrm.sys (Ahead Software AG)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://forecast.weather.gov/MapClick.php?CityName=Bellingham&state;=WA&site;=SEW&textField1;=48.7597&textField2;=-122.487&e;=0"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.16
FF - prefs.js..extensions.enabledAddons: pbupload%40photobucket.com:1.3.9
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.17
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.3
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.11
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1rc2
FF - prefs.js..extensions.enabledAddons: %7Be7348bc0-16f6-11de-8c30-0800200c9a66%7D:15.0.25.04.12
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A72E0FE7-282F-4517-9C95-5B611103B925}: C:\Documents and Settings\Christine\Local Settings\Application Data\{A72E0FE7-282F-4517-9C95-5B611103B925}\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/01/22 21:14:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/17 10:11:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/18 15:25:57 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/08/06 22:33:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions
[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/08/21 10:44:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions
[2011/02/27 20:41:19 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2013/07/27 00:37:52 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/28 16:48:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/07/01 22:46:42 | 000,000,000 | —D | M] (Purple Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{3ffb7be0-8bde-11de-8a39-0800200c9a66}
[2009/10/10 19:46:14 | 000,000,000 | —D | M] (AvantGarde Rosepetal) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}
[2013/05/15 11:23:42 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/07/19 01:57:51 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/05/04 15:44:43 | 000,000,000 | —D | M] (Pink Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2013/08/21 10:44:27 | 000,057,732 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/06/25 18:25:35 | 000,027,521 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/08/15 11:48:09 | 000,534,320 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/06/15 12:25:30 | 000,868,738 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013/07/30 20:17:34 | 000,824,302 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/18 19:39:22 | 001,109,062 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}.xpi
[2013/08/03 00:51:12 | 000,275,449 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009/10/10 19:46:14 | 001,897,274 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp.xpi
[2013/08/20 10:42:23 | 000,005,472 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\searchplugins\startpage.xml
[2013/08/17 10:11:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/17 10:11:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - homepage: http://www.hulu.com/
CHR - default_search_provider: Ask (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url =
CHR - homepage: http://www.hulu.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: AmazonMP3DownloaderPlugin (Enabled) = C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files\TabletPlugins\npwacom.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Avira Toolbar = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.5.0_0\
CHR - Extension: YouTube = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Search = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Cutie Mark Crusaders Theme = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ekjkihbdiohibdhpopbfbhihndehlcap\1_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Gmail = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

Hosts file not found
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DBAgent] C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4A2C5A9-E429-494E-98CE-F10BCE688442}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/20 00:10:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/22 00:18:50 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Christine\Recent
[2013/08/21 08:56:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/20 16:17:59 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2013/08/20 16:11:20 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/20 16:07:40 | 001,018,949 | —- | C] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 11:47:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Avira
[2013/08/20 11:44:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Avira
[2013/08/20 11:44:12 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2013/08/20 11:44:09 | 000,135,136 | —- | C] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avipbb.sys
[2013/08/20 11:44:09 | 000,084,744 | —- | C] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2013/08/20 11:44:09 | 000,037,352 | —- | C] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avkmgr.sys
[2013/08/20 11:44:08 | 000,000,000 | —D | C] – C:\Program Files\Avira
[2013/08/19 18:40:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/18 17:30:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/18 17:28:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/18 17:28:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/18 17:28:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/18 17:28:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/18 17:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/18 17:22:46 | 005,105,231 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 13:59:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 11:08:42 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 10:11:13 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/08/06 22:33:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Thunderbird
[2013/08/05 13:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Nero
[2013/08/05 13:53:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Seagate Dashboard 2.0
[2013/08/05 13:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2013/08/05 13:53:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nero
[2013/08/05 13:53:04 | 000,000,000 | —D | C] – C:\Program Files\Seagate
[2013/08/05 13:45:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/05 13:45:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Seagate
[2013/08/05 13:41:43 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2013/08/02 10:56:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MRT

========== Files - Modified Within 30 Days ==========

[2013/08/22 11:41:53 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/22 11:41:02 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/22 11:40:59 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2013/08/22 11:40:55 | 000,000,338 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2013/08/22 11:40:49 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/22 11:36:16 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/22 11:32:04 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-813497703-839522115-1003UA.job
[2013/08/22 11:23:24 | 000,875,944 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/21 21:39:01 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/21 21:32:00 | 000,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-813497703-839522115-1003Core.job
[2013/08/21 09:37:16 | 000,002,334 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/08/21 09:37:16 | 000,002,316 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Google Chrome.lnk
[2013/08/20 16:17:12 | 000,001,876 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:34 | 003,858,143 | —- | M] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 16:07:23 | 001,018,949 | —- | M] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 12:31:40 | 000,000,981 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 12:31:40 | 000,000,963 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/20 11:44:28 | 000,001,707 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Avira Control Center.lnk
[2013/08/20 11:43:32 | 000,028,520 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2013/08/20 11:43:31 | 000,135,136 | —- | M] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avipbb.sys
[2013/08/20 11:43:31 | 000,084,744 | —- | M] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2013/08/20 11:43:31 | 000,037,352 | —- | M] (Avira Operations GmbH & Co. KG) – C:\WINDOWS\System32\drivers\avkmgr.sys
[2013/08/18 18:52:44 | 000,001,655 | —- | M] () – C:\WINDOWS\System32\Wacom_Tablet.dat
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120418.backup
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120228.backup
[2013/08/18 17:30:41 | 000,000,392 | RHS- | M] () – C:\boot.ini
[2013/08/18 17:22:49 | 005,105,231 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 15:06:18 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 14:11:40 | 000,666,633 | —- | M] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/18 14:07:19 | 000,000,616 | —- | M] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/18 14:07:17 | 000,000,604 | —- | M] () – C:\WINDOWS\tasks\Christine.job
[2013/08/18 11:08:39 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/15 11:54:11 | 000,481,216 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/15 11:54:11 | 000,079,672 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/07 09:58:10 | 000,002,455 | —- | M] () – C:\Documents and Settings\Christine\Desktop\HiJackThis.lnk
[2013/08/05 15:46:52 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 15:29:40 | 000,000,412 | —- | M] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2013/08/03 02:27:49 | 000,449,839 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-130835.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093359.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093319.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183845.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183810.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-152248.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-150257.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-141503.backup
[2013/07/27 00:57:01 | 000,449,574 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130731-142401.backup
[2013/07/27 00:57:01 | 000,449,574 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130803-022749.backup
[2013/07/27 00:48:47 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/07/25 21:23:02 | 000,174,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ie4uinit.exe
[2013/07/25 21:23:02 | 000,174,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2013/07/25 18:47:17 | 001,215,488 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\urlmon.dll
[2013/07/25 18:47:17 | 000,920,064 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wininet.dll
[2013/07/25 18:47:17 | 000,759,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgx.dll
[2013/07/25 18:47:17 | 000,206,848 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\occache.dll
[2013/07/25 18:47:17 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\url.dll
[2013/07/25 18:47:17 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\url.dll
[2013/07/25 18:47:16 | 006,017,536 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/07/25 18:47:16 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mstime.dll
[2013/07/25 18:47:16 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstime.dll
[2013/07/25 18:47:16 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtmled.dll
[2013/07/25 18:47:14 | 000,630,272 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeeds.dll
[2013/07/25 18:47:14 | 000,630,272 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2013/07/25 18:47:14 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeedsbs.dll
[2013/07/25 18:47:14 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2013/07/25 18:47:13 | 000,522,240 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsdbgui.dll
[2013/07/25 18:47:13 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\licmgr10.dll
[2013/07/25 18:47:13 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\licmgr10.dll
[2013/07/25 18:47:13 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\jsproxy.dll
[2013/07/25 18:47:13 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsproxy.dll
[2013/07/25 18:47:12 | 002,005,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2013/07/25 18:47:12 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\inetcpl.cpl
[2013/07/25 18:47:12 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcpl.cpl
[2013/07/25 18:47:11 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iepeers.dll
[2013/07/25 18:47:11 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iepeers.dll
[2013/07/25 18:47:10 | 011,113,472 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2013/07/25 18:47:06 | 000,743,424 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2013/07/25 18:47:06 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iedkcs32.dll
[2013/07/25 18:47:06 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedkcs32.dll
[2013/07/25 07:52:59 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\html.iec

========== Files Created - No Company Name ==========

[2013/08/22 11:23:24 | 000,875,944 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/20 16:17:12 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:28 | 003,858,143 | —- | C] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 11:53:17 | 000,000,981 | —- | C] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 11:53:17 | 000,000,963 | —- | C] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/20 11:44:28 | 000,001,707 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Avira Control Center.lnk
[2013/08/18 17:28:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/18 17:28:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/18 17:28:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/18 17:28:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/18 17:28:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | C] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 14:11:43 | 000,666,633 | —- | C] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/05 15:47:21 | 000,465,224 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1229272821-813497703-839522115-1003-0.dat
[2013/08/05 15:47:20 | 000,428,818 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/08/05 13:58:37 | 000,000,616 | —- | C] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/05 13:58:24 | 000,000,604 | —- | C] () – C:\WINDOWS\tasks\Christine.job
[2013/08/05 13:54:37 | 000,000,396 | —- | C] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 13:54:05 | 000,000,412 | —- | C] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012/09/09 16:02:52 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2012/09/09 16:02:47 | 000,618,823 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2012/09/09 16:02:47 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2012/03/17 16:13:43 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/22 21:19:29 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/07/30 13:21:08 | 000,027,648 | —- | C] () – C:\Documents and Settings\Christine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/19 15:48:43 | 000,000,004 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2009/10/26 18:00:48 | 008,801,704 | —- | C] () – C:\Program Files\FLV PlayerATBSetup.exe

========== ZeroAccess Check ==========

[2009/09/20 00:21:28 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2009/07/18 08:05:06 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

jeffce

Post #25August 22, 2013, 7:14 PM UTC

Hi,

Here is the removal tool for Avira antivirus if you want to use it.

Once removed, please run OTL again and post that new log.

Zhora

Post #26August 22, 2013, 9:39 PM UTC last edited August 22, 2013, 10:20 PM UTC

Sad when an antivirus developer embraces the dark side.

The removal tool found 509 keys, tho about 20 could not be removed until I uninstalled Avira, so out it went. However according to Avira's 'Help' Ask & Record Toolbar may not be. And Spybot is still finding and fixing 2 instances of Fraud.AVSecurity Suite upon cold boot. I'm going to install Avast now.

UPDATE: Avast now installed and working fine as far as I can tell. Turns out it does have the web blockers I wanted, so thank you for the recommendation.

OTL
OTL logfile created on: 8/22/2013 2:25:02 PM - Run 6
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Christine\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.68 Gb Available Physical Memory | 82.35% Memory free
5.09 Gb Paging File | 4.65 Gb Available in Paging File | 91.39% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 363.35 Gb Free Space | 78.01% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 853.51 Gb Free Space | 91.63% Space Free | Partition Type: NTFS

Computer Name: BIGBLUEMONSTER | User Name: Christine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Christine\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Program Files\Adobe\Reader 10.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\Runservice.exe ()
PRC - C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\729ef05a2df18630db7f0a28dd0ec155\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c60957afdbe82f552f2db272afa719fc\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\53428f2f24507f75cc2df5dd0115b46d\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\286a517e1d3aae93daf46ca638856372\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\d756aec4dac356fb0dbfd15f5e07d012\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\918ce68a67ddb5558994e20dc3a74c8a\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\6c422db78c17838c3eb9f9fcc01ca63f\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6e0e5467e23a80c5c7d34f65dc7f87f2\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\58eb4f10504e035b673f8366d9be6881\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8927b576eb15c4a8f4bb04f05e7cc51e\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\b12cbfa020af0c619d8f58c6b665efc1\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\d083ee23a4c0d8cf76ae9e95e52d0388\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\332407a3f224f388f70120d33cb872d5\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\32800018747dbf43506ac49e697daea9\System.Xml.Linq.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4d277a8481c203a35c58bd277a2e71df\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\9e19102de729beac1a221cde49058d99\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\9b32857137a545633a4f303ec88d418c\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e205d971e9ffa1771cff3d3dde1c3c2b\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\a10f361c888b8b98f7ad1fa8d7a51516\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\107b8a28ba272e93556f0e2bfa2c4e16\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\608aa2db27d45e63a4863f1f1d06897a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\6405f08f877802703cfd956c072a4ad0\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\WINDOWS\mmfs.dll ()
MOD - C:\WINDOWS\Runservice.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3156.17682__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3156.17681__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3156.17747__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3156.17699__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3175.37078__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3175.37075__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3175.36922__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3156.17689__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3156.17702__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3175.37077__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\sqlite3.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\Fennel.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\Chai.dll ()

========== Services (SafeList) ==========

SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (Seagate Dashboard Services) – C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (TabletServiceWacom) – C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV - (EpsonPrinterStudy4) – C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SetupNTGLM7X) – D:\NTGLM7X.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NTACCESS) – D:\NTACCESS.sys File not found
DRV - (MSICPL) – D:\install4\MSICPL.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (GMSIPCI) – D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (wacmoumonitor) – C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (wacomvhid) – C:\WINDOWS\system32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (amdide) – C:\WINDOWS\system32\drivers\amdide.sys (Advanced Micro Devices)
DRV - (wacommousefilter) – C:\WINDOWS\system32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (incdrm) – C:\WINDOWS\System32\drivers\incdrm.sys (Ahead Software AG)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://forecast.weather.gov/MapClick.php?CityName=Bellingham&state;=WA&site;=SEW&textField1;=48.7597&textField2;=-122.487&e;=0"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.16
FF - prefs.js..extensions.enabledAddons: pbupload%40photobucket.com:1.3.9
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.17
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.3
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.11
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1rc2
FF - prefs.js..extensions.enabledAddons: %7Be7348bc0-16f6-11de-8c30-0800200c9a66%7D:15.0.25.04.12
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A72E0FE7-282F-4517-9C95-5B611103B925}: C:\Documents and Settings\Christine\Local Settings\Application Data\{A72E0FE7-282F-4517-9C95-5B611103B925}\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/01/22 21:14:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/17 10:11:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/18 15:25:57 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/08/06 22:33:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions
[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/08/21 10:44:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions
[2011/02/27 20:41:19 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2013/07/27 00:37:52 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/28 16:48:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/07/01 22:46:42 | 000,000,000 | —D | M] (Purple Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{3ffb7be0-8bde-11de-8a39-0800200c9a66}
[2009/10/10 19:46:14 | 000,000,000 | —D | M] (AvantGarde Rosepetal) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}
[2013/05/15 11:23:42 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/07/19 01:57:51 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/05/04 15:44:43 | 000,000,000 | —D | M] (Pink Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2013/08/21 10:44:27 | 000,057,732 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/06/25 18:25:35 | 000,027,521 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/08/15 11:48:09 | 000,534,320 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/06/15 12:25:30 | 000,868,738 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013/07/30 20:17:34 | 000,824,302 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/18 19:39:22 | 001,109,062 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}.xpi
[2013/08/03 00:51:12 | 000,275,449 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009/10/10 19:46:14 | 001,897,274 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp.xpi
[2013/08/20 10:42:23 | 000,005,472 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\searchplugins\startpage.xml
[2013/08/17 10:11:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/17 10:11:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - homepage: http://www.hulu.com/
CHR - default_search_provider: Ask (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url =
CHR - homepage: http://www.hulu.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: AmazonMP3DownloaderPlugin (Enabled) = C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files\TabletPlugins\npwacom.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Avira Toolbar = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.5.0_0\
CHR - Extension: YouTube = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Search = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Cutie Mark Crusaders Theme = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ekjkihbdiohibdhpopbfbhihndehlcap\1_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Gmail = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Gmail = C:\Documents and Settings\Christine\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2013/08/22 14:08:35 | 000,449,812 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 15467 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [DBAgent] C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4A2C5A9-E429-494E-98CE-F10BCE688442}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/20 00:10:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/22 00:18:50 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Christine\Recent
[2013/08/21 08:56:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/20 16:17:59 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2013/08/20 16:11:20 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/20 16:07:40 | 001,018,949 | —- | C] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/19 18:40:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/18 17:30:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/18 17:28:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/18 17:28:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/18 17:28:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/18 17:28:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/18 17:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/18 17:22:46 | 005,105,231 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 13:59:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 11:08:42 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 10:11:13 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/08/06 22:33:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Thunderbird
[2013/08/05 13:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Nero
[2013/08/05 13:53:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Seagate Dashboard 2.0
[2013/08/05 13:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2013/08/05 13:53:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nero
[2013/08/05 13:53:04 | 000,000,000 | —D | C] – C:\Program Files\Seagate
[2013/08/05 13:45:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/05 13:45:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Seagate
[2013/08/05 13:41:43 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2013/08/02 10:56:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MRT

========== Files - Modified Within 30 Days ==========

[2013/08/22 14:24:32 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/22 14:24:29 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/22 14:24:20 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2013/08/22 14:24:18 | 000,000,338 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2013/08/22 14:24:13 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/22 14:08:35 | 000,449,812 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/22 13:36:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/22 13:32:00 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-813497703-839522115-1003UA.job
[2013/08/22 11:23:24 | 000,875,944 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/21 21:39:01 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/21 21:32:00 | 000,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-813497703-839522115-1003Core.job
[2013/08/21 09:37:16 | 000,002,334 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/08/21 09:37:16 | 000,002,316 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Google Chrome.lnk
[2013/08/20 16:17:12 | 000,001,876 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:34 | 003,858,143 | —- | M] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 16:07:23 | 001,018,949 | —- | M] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 12:31:40 | 000,000,981 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 12:31:40 | 000,000,963 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 18:52:44 | 000,001,655 | —- | M] () – C:\WINDOWS\System32\Wacom_Tablet.dat
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120418.backup
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120228.backup
[2013/08/18 17:30:41 | 000,000,392 | RHS- | M] () – C:\boot.ini
[2013/08/18 17:22:49 | 005,105,231 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 15:06:18 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 14:11:40 | 000,666,633 | —- | M] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/18 14:07:19 | 000,000,616 | —- | M] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/18 14:07:17 | 000,000,604 | —- | M] () – C:\WINDOWS\tasks\Christine.job
[2013/08/18 11:08:39 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/15 11:54:11 | 000,481,216 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/15 11:54:11 | 000,079,672 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/07 09:58:10 | 000,002,455 | —- | M] () – C:\Documents and Settings\Christine\Desktop\HiJackThis.lnk
[2013/08/05 15:46:52 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 15:29:40 | 000,000,412 | —- | M] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2013/08/03 02:27:49 | 000,449,839 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-130835.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093359.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093319.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183845.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183810.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-152248.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-150257.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-141503.backup
[2013/07/27 00:57:01 | 000,449,574 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130731-142401.backup
[2013/07/27 00:57:01 | 000,449,574 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130803-022749.backup
[2013/07/27 00:48:47 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/07/25 21:23:02 | 000,174,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ie4uinit.exe
[2013/07/25 21:23:02 | 000,174,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2013/07/25 18:47:17 | 001,215,488 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\urlmon.dll
[2013/07/25 18:47:17 | 000,920,064 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wininet.dll
[2013/07/25 18:47:17 | 000,759,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgx.dll
[2013/07/25 18:47:17 | 000,206,848 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\occache.dll
[2013/07/25 18:47:17 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\url.dll
[2013/07/25 18:47:17 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\url.dll
[2013/07/25 18:47:16 | 006,017,536 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2013/07/25 18:47:16 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mstime.dll
[2013/07/25 18:47:16 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstime.dll
[2013/07/25 18:47:16 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtmled.dll
[2013/07/25 18:47:14 | 000,630,272 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeeds.dll
[2013/07/25 18:47:14 | 000,630,272 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2013/07/25 18:47:14 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeedsbs.dll
[2013/07/25 18:47:14 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2013/07/25 18:47:13 | 000,522,240 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsdbgui.dll
[2013/07/25 18:47:13 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\licmgr10.dll
[2013/07/25 18:47:13 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\licmgr10.dll
[2013/07/25 18:47:13 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\jsproxy.dll
[2013/07/25 18:47:13 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsproxy.dll
[2013/07/25 18:47:12 | 002,005,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2013/07/25 18:47:12 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\inetcpl.cpl
[2013/07/25 18:47:12 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcpl.cpl
[2013/07/25 18:47:11 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iepeers.dll
[2013/07/25 18:47:11 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iepeers.dll
[2013/07/25 18:47:10 | 011,113,472 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2013/07/25 18:47:06 | 000,743,424 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2013/07/25 18:47:06 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iedkcs32.dll
[2013/07/25 18:47:06 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedkcs32.dll
[2013/07/25 07:52:59 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\html.iec

========== Files Created - No Company Name ==========

[2013/08/22 11:23:24 | 000,875,944 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/20 16:17:12 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:28 | 003,858,143 | —- | C] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 11:53:17 | 000,000,981 | —- | C] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 11:53:17 | 000,000,963 | —- | C] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 17:28:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/18 17:28:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/18 17:28:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/18 17:28:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/18 17:28:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | C] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 14:11:43 | 000,666,633 | —- | C] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/05 15:47:21 | 000,465,224 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1229272821-813497703-839522115-1003-0.dat
[2013/08/05 15:47:20 | 000,428,818 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/08/05 13:58:37 | 000,000,616 | —- | C] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/05 13:58:24 | 000,000,604 | —- | C] () – C:\WINDOWS\tasks\Christine.job
[2013/08/05 13:54:37 | 000,000,396 | —- | C] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 13:54:05 | 000,000,412 | —- | C] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012/09/09 16:02:52 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2012/09/09 16:02:47 | 000,618,823 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2012/09/09 16:02:47 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2012/03/17 16:13:43 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/22 21:19:29 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/07/30 13:21:08 | 000,027,648 | —- | C] () – C:\Documents and Settings\Christine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/19 15:48:43 | 000,000,004 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2009/10/26 18:00:48 | 008,801,704 | —- | C] () – C:\Program Files\FLV PlayerATBSetup.exe

========== ZeroAccess Check ==========

[2009/09/20 00:21:28 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2009/07/18 08:05:06 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/10/09 17:17:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/03/10 13:45:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2013/08/05 13:45:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/03/10 15:54:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Western Digital
[2012/07/13 09:53:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}
[2009/10/09 17:18:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\acccore
[2010/12/07 22:07:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Amazon
[2009/12/17 18:16:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\CoreFTP
[2011/09/27 13:20:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\ElevatedDiagnostics
[2010/06/07 09:18:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\EPSON
[2010/03/11 07:10:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leader Technologies
[2010/03/10 13:53:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leadertech
[2012/09/02 15:09:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Safer Networking
[2013/08/05 13:45:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Seagate
[2012/09/01 11:50:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\TestApp
[2010/07/23 21:10:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Thunderbird

========== Purity Check ==========

< End of report >

jeffce

Post #27August 23, 2013, 2:13 AM UTC

Hi, Are you having any problems with your browser(s)? If so which one??

Zhora

Post #28August 23, 2013, 2:37 AM UTC last edited August 23, 2013, 4:54 AM UTC

Briefly with Chrome when installing avast! a window popped up telling me that some file of Chrome's was corrupted, I forget what. But since I use Firefox almost exclusively (save for updating Windows since it doesn't like to play with Firefox…that's the ONLY reason IE8 is still on my machine), I just uninstalled Chrome with 'Add/Remove Programs'.

What about what Spybot found earlier?

UPDATE @ 9:20 PST: Two registry values for Fraud.AVSecuritySuite show up in Spybot even after fixing, and they're there now. I do notice just now that some of the tiny folder icons on WhattheTech forum have an 'x' instead of the icon, and on another forum I have some difficulty with the 'multiquote' forum button. The administrators say there's no known issue with it and they're pretty on top of these things. Think Firefox is compromised?

UPDATE @ 9:45: Googling whether there's a link between Firefox, Avira, & AVSecuritySuite I came across something that might be helpful or at least interesting, a Mozilla bug report with comments from an Avira employee. Apparently Avira has been causing Firefox problems for a few months now, and they are blaming the nebulous extra programs the Ask toolbar includes. And they even admit it may not be an easy fix. Clearly…we're not done yet.

jeffce

Post #29August 23, 2013, 11:38 AM UTC

Hi,

Ok thank you. Please do the following….

With Google Chrome the fastest and easiest way to fix that is just with complete uninstall and then reinstall. Did I understand that you did that already?

Please run a Full Scan with Malwarebytes and then post the new log so we can get a look please.

Zhora

Post #30August 23, 2013, 10:22 PM UTC

I uninstalled Chrome and don't have any intention of reinstalling. Like I said, I run Firefox. Chrome was a temporary replacement for Firefox when Firefox wasn't running videos well.

Some stuff I need to tell you before I post the Malwarebytes scan.

I did a full scan with Avast last night, and it found 20 or so 'system cannot find file' errors; this morning I did a bootscan, and it told me many of my archived (ZIP, etc) files were corrupted - I assume this is just because I did not click the option for scanning deep into them? After my computer was finished with the scan and bootup, I ran a Search for *avira*.* and there are MORE avira files beyond the ones OTL moved. I also did the same with *ask*.* I've erased as much as I can, but these four puzzle me:

2 Applications called 'AviraBrowserSecurity' and 2 Application Extensions called 'AviraCallingIDHelper.dll' are all listed as located in in 'Programs/Ask.com'. NOT under a drive, JUST 'Programs/Ask.com' with a forward slash. I see nothing in my C:\Program Files folder for any of them. However clicking 'Open Containing Folder' seems to have found them - in Spybot's Recovery files on both C\: & F:\ !! AND 'npAviraCallingID.dll' in the backup of Firefox's plugins. Ugh, I'm getting a headache…

And Spybot is still finding the 2 Fraud.AVSecuritySuite registry entries.

I hope that all made sense…I'm thinking just erasing all the backups on F:\ and re-backing up once everything is clean would be a good idea on top of whatever else you ask me to do.

Malwarebytes
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.08.22.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Christine :: BIGBLUEMONSTER [administrator]

8/23/2013 1:56:20 PM
mbam-log-2013-08-23 (13-56-20).txt

Scan type: Full scan (C:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 371415
Time elapsed: 1 hour(s), 20 minute(s), 57 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Sneaky ...! [Solved]

✨ Ask AI

Ask AI