What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Sneaky ...! [Solved]

40 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
[external image: Posted Image]

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Files
ifconfig /flushdns /c

:Reg
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer=-
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer=-

:Commands
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

After doing the instructions above, rerun Spybot and see if that has fixed you up.

Post the new OTL and Spybot logs and let me know how your system is running. :)
Post #47
Didn't work. Spybot still picked them up.

OTL
All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
< ifconfig /flushdns /c >
C:\Documents and Settings\Christine\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Christine\Desktop\cmd.txt deleted successfully.
========== REGISTRY ==========
Registry key Invalid\\HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer\ not found.
Registry key Invalid\\HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Christine
->Temp folder emptied: 590224 bytes
->Temporary Internet Files folder emptied: 65938 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 6722281 bytes
->Flash cache emptied: 57978 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 57472 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16867 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 7.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 08272013_074636

Files\Folders moved on Reboot…
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…
Post #50
I went back to Spybot's manual removal guide to see if I'd missed something, and discovered I'd done a couple steps wrong, mainly the how to change the ProxyServer settings and setting Search so that it saw hidden files…which turned up 78 copies of Fraud.AVSecuritySuite in SpyBot's own Restore files (gone now).

The registry changes were the same as the ones you told OTL to do, but manually going in and fixing them to 'http=' instead of totally blank actually worked without being reset/reloaded at reboot. A new SpyBot log is attached, as it did find OTHER things now that SecuritySuite is not hogging all the attention.

And a new OTL log:
OTL logfile created on: 8/27/2013 11:47:56 AM - Run 8
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Christine\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.27 Gb Available Physical Memory | 69.97% Memory free
5.09 Gb Paging File | 4.10 Gb Available in Paging File | 80.49% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 361.36 Gb Free Space | 77.59% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 851.14 Gb Free Space | 91.37% Space Free | Partition Type: NTFS

Computer Name: BIGBLUEMONSTER | User Name: Christine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Christine\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\Runservice.exe ()
PRC - C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13082700\algo.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\729ef05a2df18630db7f0a28dd0ec155\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c60957afdbe82f552f2db272afa719fc\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\53428f2f24507f75cc2df5dd0115b46d\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\286a517e1d3aae93daf46ca638856372\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\d756aec4dac356fb0dbfd15f5e07d012\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\918ce68a67ddb5558994e20dc3a74c8a\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\6c422db78c17838c3eb9f9fcc01ca63f\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6e0e5467e23a80c5c7d34f65dc7f87f2\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\58eb4f10504e035b673f8366d9be6881\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8927b576eb15c4a8f4bb04f05e7cc51e\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\b12cbfa020af0c619d8f58c6b665efc1\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\d083ee23a4c0d8cf76ae9e95e52d0388\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\332407a3f224f388f70120d33cb872d5\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\32800018747dbf43506ac49e697daea9\System.Xml.Linq.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4d277a8481c203a35c58bd277a2e71df\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\9e19102de729beac1a221cde49058d99\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\9b32857137a545633a4f303ec88d418c\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e205d971e9ffa1771cff3d3dde1c3c2b\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\a10f361c888b8b98f7ad1fa8d7a51516\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\107b8a28ba272e93556f0e2bfa2c4e16\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\608aa2db27d45e63a4863f1f1d06897a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\6405f08f877802703cfd956c072a4ad0\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\8f799a4688381624de3cfb1edbccb163\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\WINDOWS\mmfs.dll ()
MOD - C:\WINDOWS\Runservice.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3175.36923__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3156.17694__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3156.17689__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3156.17698__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3156.17722__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3156.17721__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3156.17682__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3156.17681__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3156.17682__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3156.17747__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3156.17703__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3156.17697__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3156.17689__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3156.17699__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3156.17703__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3156.17703__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3156.17694__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3156.17695__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3175.37106__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3175.37120__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3175.37069__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3175.36940__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3175.37078__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3175.36920__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3175.37075__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3175.36922__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3156.17689__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3156.17702__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3156.17702__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3175.36928__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3175.36921__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3175.36917__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3156.17692__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3175.37077__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\sqlite3.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\Fennel.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\Chai.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\Mate.dll ()
MOD - C:\Program Files\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll ()


========== Services (SafeList) ==========

SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (Seagate Dashboard Services) – C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (TabletServiceWacom) – C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV - (EpsonPrinterStudy4) – C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SetupNTGLM7X) – D:\NTGLM7X.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NTACCESS) – D:\NTACCESS.sys File not found
DRV - (MSICPL) – D:\install4\MSICPL.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (GMSIPCI) – D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (wacmoumonitor) – C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (wacomvhid) – C:\WINDOWS\system32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (amdide) – C:\WINDOWS\system32\drivers\amdide.sys (Advanced Micro Devices)
DRV - (wacommousefilter) – C:\WINDOWS\system32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (incdrm) – C:\WINDOWS\System32\drivers\incdrm.sys (Ahead Software AG)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://forecast.weather.gov/MapClick.php?CityName=Bellingham&state=WA&site=SEW&textField1=48.7597&textField2=-122.487&e=0"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.16
FF - prefs.js..extensions.enabledAddons: pbupload%40photobucket.com:1.3.9
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.3
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.11
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1rc2
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.21
FF - prefs.js..extensions.enabledAddons: %7Be7348bc0-16f6-11de-8c30-0800200c9a66%7D:15.0.25.04.12
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.8: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A72E0FE7-282F-4517-9C95-5B611103B925}: C:\Documents and Settings\Christine\Local Settings\Application Data\{A72E0FE7-282F-4517-9C95-5B611103B925}\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/01/22 21:14:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/08/22 14:41:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/17 10:11:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/23 15:47:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/08/06 22:33:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions
[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/08/27 07:41:29 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions
[2011/02/27 20:41:19 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2013/07/27 00:37:52 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/28 16:48:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/07/01 22:46:42 | 000,000,000 | —D | M] (Purple Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{3ffb7be0-8bde-11de-8a39-0800200c9a66}
[2009/10/10 19:46:14 | 000,000,000 | —D | M] (AvantGarde Rosepetal) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}
[2013/05/15 11:23:42 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/08/27 07:41:29 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/05/04 15:44:43 | 000,000,000 | —D | M] (Pink Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2013/08/21 10:44:27 | 000,057,732 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/06/25 18:25:35 | 000,027,521 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/08/15 11:48:09 | 000,534,320 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/06/15 12:25:30 | 000,868,738 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013/07/30 20:17:34 | 000,824,302 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/18 19:39:22 | 001,109,062 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}.xpi
[2013/08/03 00:51:12 | 000,275,449 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009/10/10 19:46:14 | 001,897,274 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp.xpi
[2013/08/26 13:53:36 | 000,005,472 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\searchplugins\startpage.xml
[2013/08/17 10:11:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/17 10:11:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/22 14:41:42 | 000,000,000 | —D | M] (avast! Online Security) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

O1 HOSTS File: ([2013/08/26 06:54:34 | 000,000,698 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Ad Blocker) - {FFCB3198-32F3-4E8B-9539-4324694ED663} - C:\Program Files\AVAST Software\avast! Ad Blocker IE\Adblocker32.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DBAgent] C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4A2C5A9-E429-494E-98CE-F10BCE688442}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/20 00:10:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/26 21:54:13 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Christine\Recent
[2013/08/24 14:39:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Desktop\RK_Quarantine
[2013/08/22 14:42:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/08/22 14:42:04 | 000,369,584 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:04 | 000,029,816 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/08/22 14:42:02 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/08/22 14:42:01 | 000,770,344 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:01 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/08/22 14:41:59 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/22 14:41:58 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/08/22 14:41:32 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/08/22 14:41:13 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/08/22 14:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/08/21 08:56:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/20 16:17:59 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2013/08/20 16:11:20 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/20 16:07:40 | 001,018,949 | —- | C] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/19 18:40:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/18 17:30:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/18 17:28:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/18 17:28:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/18 17:28:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/18 17:28:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/18 17:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/18 17:22:46 | 005,105,231 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 13:59:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 11:08:42 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 10:11:13 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/08/06 22:33:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Thunderbird
[2013/08/05 13:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Nero
[2013/08/05 13:53:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Seagate Dashboard 2.0
[2013/08/05 13:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2013/08/05 13:53:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nero
[2013/08/05 13:53:04 | 000,000,000 | —D | C] – C:\Program Files\Seagate
[2013/08/05 13:45:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/05 13:45:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Seagate
[2013/08/05 13:41:43 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2013/08/02 10:56:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MRT

========== Files - Modified Within 30 Days ==========

[2013/08/27 11:48:35 | 000,044,398 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SpybotSD.Results.zip
[2013/08/27 11:36:20 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/27 11:36:14 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/27 11:36:08 | 000,000,370 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/27 11:36:06 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/27 11:35:29 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2013/08/27 11:35:21 | 000,000,338 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2013/08/27 11:35:14 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/26 21:59:03 | 000,875,944 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/26 06:54:34 | 000,000,698 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/25 14:06:06 | 000,000,616 | —- | M] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/25 14:06:04 | 000,000,604 | —- | M] () – C:\WINDOWS\tasks\Christine.job
[2013/08/24 19:34:20 | 000,459,002 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:43 | 000,211,421 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:12 | 000,139,264 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:07 | 000,923,136 | —- | M] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:08 | 000,369,584 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:08 | 000,175,176 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:41:59 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/08/21 21:39:01 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/20 16:17:12 | 000,001,876 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:34 | 003,858,143 | —- | M] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 16:07:23 | 001,018,949 | —- | M] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 12:31:40 | 000,000,981 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 12:31:40 | 000,000,963 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 18:52:44 | 000,001,655 | —- | M] () – C:\WINDOWS\System32\Wacom_Tablet.dat
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120418.backup
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120228.backup
[2013/08/18 17:30:41 | 000,000,392 | RHS- | M] () – C:\boot.ini
[2013/08/18 17:22:49 | 005,105,231 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 15:06:18 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 14:11:40 | 000,666,633 | —- | M] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/18 11:08:39 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/15 11:54:11 | 000,481,216 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/15 11:54:11 | 000,079,672 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/07 09:58:10 | 000,002,455 | —- | M] () – C:\Documents and Settings\Christine\Desktop\HiJackThis.lnk
[2013/08/05 15:46:52 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 15:29:40 | 000,000,412 | —- | M] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2013/08/03 02:27:49 | 000,449,839 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-130835.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093359.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093319.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183845.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183810.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-152248.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-150257.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-141503.backup

========== Files Created - No Company Name ==========

[2013/08/26 21:59:03 | 000,875,944 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/26 09:31:34 | 000,044,398 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SpybotSD.Results.zip
[2013/08/24 19:34:20 | 000,459,002 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:37 | 000,211,421 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:20 | 000,139,264 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:11 | 000,923,136 | —- | C] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:42:01 | 000,175,176 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:00 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/22 14:42:00 | 000,000,370 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/20 16:17:12 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:28 | 003,858,143 | —- | C] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 11:53:17 | 000,000,981 | —- | C] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 11:53:17 | 000,000,963 | —- | C] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 17:28:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/18 17:28:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/18 17:28:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/18 17:28:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/18 17:28:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | C] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 14:11:43 | 000,666,633 | —- | C] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/05 15:47:21 | 000,650,896 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1229272821-813497703-839522115-1003-0.dat
[2013/08/05 15:47:20 | 000,428,818 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/08/05 13:58:37 | 000,000,616 | —- | C] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/05 13:58:24 | 000,000,604 | —- | C] () – C:\WINDOWS\tasks\Christine.job
[2013/08/05 13:54:37 | 000,000,396 | —- | C] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 13:54:05 | 000,000,412 | —- | C] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012/09/09 16:02:52 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2012/09/09 16:02:47 | 000,618,823 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2012/09/09 16:02:47 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2012/03/17 16:13:43 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/22 21:19:29 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/07/30 13:21:08 | 000,027,648 | —- | C] () – C:\Documents and Settings\Christine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/19 15:48:43 | 000,000,004 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2009/10/26 18:00:48 | 008,801,704 | —- | C] () – C:\Program Files\FLV PlayerATBSetup.exe

========== ZeroAccess Check ==========

[2009/09/20 00:21:28 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2009/07/18 08:05:06 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/10/09 17:17:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2013/08/22 14:41:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/03/10 13:45:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2013/08/05 13:45:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/03/10 15:54:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Western Digital
[2012/07/13 09:53:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}
[2009/10/09 17:18:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\acccore
[2010/12/07 22:07:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Amazon
[2009/12/17 18:16:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\CoreFTP
[2011/09/27 13:20:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\ElevatedDiagnostics
[2010/06/07 09:18:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\EPSON
[2010/03/11 07:10:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leader Technologies
[2010/03/10 13:53:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leadertech
[2012/09/02 15:09:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Safer Networking
[2013/08/05 13:45:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Seagate
[2012/09/01 11:50:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\TestApp
[2010/07/23 21:10:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Thunderbird

========== Purity Check ==========



< End of report >

Attachments:

  • [attachment removed: SpybotSD.Results.zip]
Post #51
Hi,

[external image: Posted Image]

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

    :Reg
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
    "ProxyServer"=-
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
    "ProxyServer"=-

    :Commands
    [emptytemp]
    [start explorer]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Give Spybot a new run and then post both the OTL log and the Spybot log to your next reply and let me know how your system is running. :)
Post #52
Upon reboot, two DOS windows opened briefly and closed. Also, I checked to see if Spybot needed an update (it didn't) and the Immunization status, which surprisingly showed over 60 thousand items un-immunized, where previously the number had been 0. They are 'Immunized' now. Spybot still keeps finding usage tracks and history logs, which hopefully you should see in the attached report.

When we're done, I'd appreciate it if the topic stayed open for a couple extra days just in case…and I hope I'll be clean enough to install Online Armor or other recommended firewall.

OTL
All processes killed
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer deleted successfully.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Christine
->Temp folder emptied: 596059 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 7418720 bytes
->Flash cache emptied: 291 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 8.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 08272013_125618

Files\Folders moved on Reboot…
File\Folder C:\WINDOWS\temp\_avast_\Webshlock.txt not found!

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Attachments:

  • [attachment removed: SpybotSD.Results.zip]
Post #53
That log looks much better…. :) Go ahead and give your computer a good run around like you normally would and let me know how it is running. I have classes tonight so I won't be back until the morning (for me).
Post #54 last edited
Okay, there is something I'm fairly concerned about: upon booting or rebooting, something is opening 'cmd.exe' and 'command.com' DOS windows for a few seconds. This is NEW, and started after the last OTL fix, which I believe I did note. Also NEW is that Spybot keeps picking up logs that need to be fixed (report attached), some the same (like SchedLGU.tx, which I tried to fix using Microsoft's directions), and some different each time.

Other things, which probably are more because of the viruses being finally fixed: all of my Windows views have been set to 'Details' instead of 'icons', my graphics card driver was set back to a previous installation. And (this one is a good thing!) my bootup sequence is considerably shortened, as is the scan time for Spybot. Oh, and there's something missing from the area of my Start Menu that contains the links to Control Panel, Set programs…, and Printers…but for the life of me I can't remember what it was.

Things I have done since yesterday: re-downloaded the driver, fully formatted of F:/, unsuccessfully used Microsoft's instructions to try and get rid of the SchedLGU.txt Spybot keeps picking up, and downloaded and installed this morning's critical Windows update.

Attachments:

  • [attachment removed: SpybotSD.Results.zip]
Post #55
Here's a new Hijackthis log…

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:54:55 AM, on 8/28/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\EPSON\EpsonPrinterStudy4\EPCP.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: avast! Ad Blocker - {FFCB3198-32F3-4E8B-9539-4324694ED663} - C:\Program Files\AVAST Software\avast! Ad Blocker IE\Adblocker32.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe /startup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DBAgent] "C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe" /WinStart
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck /autofix
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [SpybotDeletingA1601] command.com /c del "C:\WINDOWS\SchedLgU.Txt"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9324] cmd.exe /c del "C:\WINDOWS\SchedLgU.Txt"
O4 - HKCU\..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB7711] command.com /c del "C:\WINDOWS\SchedLgU.Txt"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5644] cmd.exe /c del "C:\WINDOWS\SchedLgU.Txt"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: EpsonPrinterStudy4 - SEIKO EPSON CORPORATION - C:\Program Files\EPSON\EpsonPrinterStudy4\EPCP.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Seagate Dashboard Services - Seagate Technology LLC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe

–
End of file - 6611 bytes
Post #56
Hi, Sorry for any delay…I have been traveling to and from a hospital for the past two weeks visiting a family member. Ok… Some of the things you are experiencing are normal where things were reset to default. I do see some things that have been shaken loose in the HJT log but I would like a more thorough view. Please run a Quick Scan with OTL and post the new OTL log. Don't worry about that .txt file Spybot is finding nor the command prompts you said were opening. We will get rid of those too.
Post #57
Its Malware Whack-a-Mole (or Whack-a-Mal!)!

I got rid of the DOS windows that were popping up by eliminating the 'Run Once' entries in HijackThis. I also attempted the Microsoft fix for SchedLgu.txt again, but got an 'Access Denied error' saying that I needed to log in as Administrator - when I AM.

OTL
OTL logfile created on: 8/29/2013 8:13:02 AM - Run 9
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Christine\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.29 Gb Available Physical Memory | 70.36% Memory free
5.09 Gb Paging File | 4.18 Gb Available in Paging File | 82.13% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 372.75 Gb Free Space | 80.03% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 930.26 Gb Free Space | 99.87% Space Free | Partition Type: NTFS

Computer Name: BIGBLUEMONSTER | User Name: Christine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Christine\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\Runservice.exe ()
PRC - C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13082900\algo.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\729ef05a2df18630db7f0a28dd0ec155\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c60957afdbe82f552f2db272afa719fc\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\53428f2f24507f75cc2df5dd0115b46d\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\286a517e1d3aae93daf46ca638856372\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\d756aec4dac356fb0dbfd15f5e07d012\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\918ce68a67ddb5558994e20dc3a74c8a\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\6c422db78c17838c3eb9f9fcc01ca63f\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6e0e5467e23a80c5c7d34f65dc7f87f2\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\58eb4f10504e035b673f8366d9be6881\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8927b576eb15c4a8f4bb04f05e7cc51e\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\b12cbfa020af0c619d8f58c6b665efc1\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\d083ee23a4c0d8cf76ae9e95e52d0388\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\332407a3f224f388f70120d33cb872d5\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\32800018747dbf43506ac49e697daea9\System.Xml.Linq.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4d277a8481c203a35c58bd277a2e71df\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\9e19102de729beac1a221cde49058d99\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\9b32857137a545633a4f303ec88d418c\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e205d971e9ffa1771cff3d3dde1c3c2b\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\a10f361c888b8b98f7ad1fa8d7a51516\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\107b8a28ba272e93556f0e2bfa2c4e16\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\608aa2db27d45e63a4863f1f1d06897a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\6405f08f877802703cfd956c072a4ad0\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\mozjs.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldap32v60.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldappr32v60.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\8f799a4688381624de3cfb1edbccb163\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\WINDOWS\mmfs.dll ()
MOD - C:\WINDOWS\Runservice.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3175.36923__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3156.17694__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3156.17689__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3156.17698__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3156.17722__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3156.17721__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3156.17682__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3156.17681__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3156.17682__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3156.17747__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3156.17703__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3156.17697__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3156.17689__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3156.17699__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3156.17703__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3156.17703__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3156.17694__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3156.17695__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3175.37106__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3175.37120__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3175.37069__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3175.36940__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3175.37078__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3175.36920__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3175.37075__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3175.36922__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3156.17689__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3156.17702__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3156.17702__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3175.36928__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3175.36921__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3175.36917__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3156.17692__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3175.37077__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll ()


========== Services (SafeList) ==========

SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (Seagate Dashboard Services) – C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (TabletServiceWacom) – C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV - (EpsonPrinterStudy4) – C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SetupNTGLM7X) – D:\NTGLM7X.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NTACCESS) – D:\NTACCESS.sys File not found
DRV - (MSICPL) – D:\install4\MSICPL.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (GMSIPCI) – D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (wacmoumonitor) – C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (wacomvhid) – C:\WINDOWS\system32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (amdide) – C:\WINDOWS\system32\drivers\amdide.sys (Advanced Micro Devices)
DRV - (wacommousefilter) – C:\WINDOWS\system32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (incdrm) – C:\WINDOWS\System32\drivers\incdrm.sys (Ahead Software AG)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://forecast.weather.gov/MapClick.php?CityName=Bellingham&state=WA&site=SEW&textField1=48.7597&textField2=-122.487&e=0"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.16
FF - prefs.js..extensions.enabledAddons: pbupload%40photobucket.com:1.3.9
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.11
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1rc2
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.21
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.5
FF - prefs.js..extensions.enabledAddons: %7Be7348bc0-16f6-11de-8c30-0800200c9a66%7D:15.0.25.04.12
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.8: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A72E0FE7-282F-4517-9C95-5B611103B925}: C:\Documents and Settings\Christine\Local Settings\Application Data\{A72E0FE7-282F-4517-9C95-5B611103B925}\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/01/22 21:14:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/08/22 14:41:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/17 10:11:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/23 15:47:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/08/06 22:33:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions
[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/08/27 19:34:12 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions
[2011/02/27 20:41:19 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2013/08/27 19:34:12 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/28 16:48:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/07/01 22:46:42 | 000,000,000 | —D | M] (Purple Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{3ffb7be0-8bde-11de-8a39-0800200c9a66}
[2009/10/10 19:46:14 | 000,000,000 | —D | M] (AvantGarde Rosepetal) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}
[2013/05/15 11:23:42 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/08/27 07:41:29 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/05/04 15:44:43 | 000,000,000 | —D | M] (Pink Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2013/08/21 10:44:27 | 000,057,732 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/06/25 18:25:35 | 000,027,521 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/08/15 11:48:09 | 000,534,320 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/06/15 12:25:30 | 000,868,738 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013/07/30 20:17:34 | 000,824,302 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/18 19:39:22 | 001,109,062 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}.xpi
[2013/08/03 00:51:12 | 000,275,449 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009/10/10 19:46:14 | 001,897,274 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp.xpi
[2013/08/26 13:53:36 | 000,005,472 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\searchplugins\startpage.xml
[2013/08/17 10:11:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/17 10:11:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/22 14:41:42 | 000,000,000 | —D | M] (avast! Online Security) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

O1 HOSTS File: ([2013/08/28 10:23:22 | 000,450,510 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15468 more lines…
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Ad Blocker) - {FFCB3198-32F3-4E8B-9539-4324694ED663} - C:\Program Files\AVAST Software\avast! Ad Blocker IE\Adblocker32.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DBAgent] C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4A2C5A9-E429-494E-98CE-F10BCE688442}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/20 00:10:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/29 00:22:14 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Christine\Recent
[2013/08/28 10:39:41 | 000,103,040 | —- | C] (Advanced Micro Devices) – C:\WINDOWS\System32\drivers\AtihdXP3.sys
[2013/08/28 10:39:05 | 000,442,368 | —- | C] (Advanced Micro Devices, Inc.) – C:\WINDOWS\System32\ATIDEMGX.dll
[2013/08/28 10:39:01 | 000,307,200 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\atiiiexx.dll
[2013/08/27 14:21:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\My Online Documents
[2013/08/24 14:39:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Desktop\RK_Quarantine
[2013/08/22 14:42:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/08/22 14:42:04 | 000,369,584 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:04 | 000,029,816 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/08/22 14:42:02 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/08/22 14:42:01 | 000,770,344 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:01 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/08/22 14:41:59 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/22 14:41:58 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/08/22 14:41:32 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/08/22 14:41:13 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/08/22 14:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/08/21 08:56:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/20 16:17:59 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2013/08/20 16:11:20 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/20 16:07:40 | 001,018,949 | —- | C] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/19 18:40:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/18 17:30:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/18 17:28:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/18 17:28:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/18 17:28:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/18 17:28:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/18 17:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/18 17:22:46 | 005,105,231 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 13:59:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 11:08:42 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 10:11:13 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/08/06 22:33:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Thunderbird
[2013/08/05 13:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Nero
[2013/08/05 13:53:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Seagate Dashboard 2.0
[2013/08/05 13:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2013/08/05 13:53:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nero
[2013/08/05 13:53:04 | 000,000,000 | —D | C] – C:\Program Files\Seagate
[2013/08/05 13:45:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/05 13:45:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Seagate
[2013/08/05 13:41:43 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2013/08/02 10:56:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MRT

========== Files - Modified Within 30 Days ==========

[2013/08/29 08:06:03 | 000,002,455 | —- | M] () – C:\Documents and Settings\Christine\Desktop\HiJackThis.lnk
[2013/08/29 08:05:50 | 000,000,800 | —- | M] () – C:\WINDOWS\wininit.ini
[2013/08/29 08:04:02 | 000,000,370 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/29 08:03:53 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/29 08:03:45 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/29 08:03:27 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2013/08/29 08:03:26 | 000,000,338 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2013/08/29 08:03:19 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/29 08:01:22 | 000,000,392 | RHS- | M] () – C:\boot.ini
[2013/08/29 07:40:34 | 000,875,944 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/28 23:36:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/28 21:39:00 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/28 10:23:22 | 000,450,510 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/28 09:57:55 | 000,044,623 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SpybotSD.Results.zip
[2013/08/28 00:13:04 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/08/27 14:21:53 | 000,000,604 | —- | M] () – C:\WINDOWS\tasks\Christine.job
[2013/08/27 14:21:04 | 000,002,419 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2013/08/27 13:07:21 | 000,450,510 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130828-102322.backup
[2013/08/26 06:54:34 | 000,000,698 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130827-130721.backup
[2013/08/25 14:06:06 | 000,000,616 | —- | M] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/24 19:34:20 | 000,459,002 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:43 | 000,211,421 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:12 | 000,139,264 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:07 | 000,923,136 | —- | M] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:08 | 000,369,584 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:08 | 000,175,176 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:41:59 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/08/20 16:17:12 | 000,001,876 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:34 | 003,858,143 | —- | M] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 16:07:23 | 001,018,949 | —- | M] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 12:31:40 | 000,000,981 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 12:31:40 | 000,000,963 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 18:52:44 | 000,001,655 | —- | M] () – C:\WINDOWS\System32\Wacom_Tablet.dat
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120418.backup
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120228.backup
[2013/08/18 17:22:49 | 005,105,231 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 15:06:18 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 14:11:40 | 000,666,633 | —- | M] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/18 11:08:39 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/15 11:54:11 | 000,481,216 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/15 11:54:11 | 000,079,672 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/05 15:46:52 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 15:29:40 | 000,000,412 | —- | M] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/03 14:18:38 | 001,543,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\wmvdecod.dll
[2013/08/03 02:27:49 | 000,449,839 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-130835.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093359.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093319.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183845.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183810.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-152248.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-150257.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-141503.backup

========== Files Created - No Company Name ==========

[2013/08/29 07:40:34 | 000,875,944 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/28 10:39:06 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2013/08/28 10:39:04 | 000,246,000 | —- | C] () – C:\WINDOWS\System32\atiapfxx.blb
[2013/08/28 10:39:04 | 000,038,177 | —- | C] () – C:\WINDOWS\atiogl.xml
[2013/08/28 10:39:01 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2013/08/28 10:34:30 | 000,618,823 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2013/08/27 12:06:39 | 000,000,800 | —- | C] () – C:\WINDOWS\wininit.ini
[2013/08/26 09:31:34 | 000,044,623 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SpybotSD.Results.zip
[2013/08/24 19:34:20 | 000,459,002 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:37 | 000,211,421 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:20 | 000,139,264 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:11 | 000,923,136 | —- | C] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:42:01 | 000,175,176 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:00 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/22 14:42:00 | 000,000,370 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/20 16:17:12 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:28 | 003,858,143 | —- | C] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 11:53:17 | 000,000,981 | —- | C] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 11:53:17 | 000,000,963 | —- | C] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 17:28:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/18 17:28:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/18 17:28:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/18 17:28:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/18 17:28:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | C] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 14:11:43 | 000,666,633 | —- | C] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/05 15:47:21 | 000,650,896 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1229272821-813497703-839522115-1003-0.dat
[2013/08/05 15:47:20 | 000,428,818 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/08/05 13:58:37 | 000,000,616 | —- | C] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/05 13:58:24 | 000,000,604 | —- | C] () – C:\WINDOWS\tasks\Christine.job
[2013/08/05 13:54:37 | 000,000,396 | —- | C] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 13:54:05 | 000,000,412 | —- | C] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,002,419 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012/03/17 16:13:43 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/22 21:19:29 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/07/30 13:21:08 | 000,027,648 | —- | C] () – C:\Documents and Settings\Christine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/19 15:48:43 | 000,000,004 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2009/10/26 18:00:48 | 008,801,704 | —- | C] () – C:\Program Files\FLV PlayerATBSetup.exe

========== ZeroAccess Check ==========

[2009/09/20 00:21:28 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2009/07/18 08:05:06 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/10/09 17:17:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2013/08/22 14:41:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/03/10 13:45:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2013/08/05 13:45:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/03/10 15:54:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Western Digital
[2012/07/13 09:53:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}
[2009/10/09 17:18:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\acccore
[2010/12/07 22:07:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Amazon
[2009/12/17 18:16:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\CoreFTP
[2011/09/27 13:20:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\ElevatedDiagnostics
[2010/06/07 09:18:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\EPSON
[2010/03/11 07:10:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leader Technologies
[2010/03/10 13:53:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leadertech
[2012/09/02 15:09:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Safer Networking
[2013/08/05 13:45:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Seagate
[2012/09/01 11:50:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\TestApp
[2010/07/23 21:10:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Thunderbird

========== Purity Check ==========



< End of report >
Post #58
This file you keep seeing is really nothing wrong but is actually just showing you that a scheduled task has been run and that activity is changed.

Open HijackThis, click Config | Misc Tools
Select: "Generate StartupList log" (button)

Scroll down to: "Enumerating Task Scheduler jobs:"
Paste what's listed in that section …
Post #59
Enumerating Task Scheduler jobs: Adobe Flash Player Updater.job avast! Emergency Update.job Christine DBAgent 2 0.job Christine Merge.job Christine.job RealUpgradeLogonTaskS-1-5-21-1229272821-813497703-839522115-1003.job RealUpgradeScheduledTaskS-1-5-21-1229272821-813497703-839522115-1003.job Seagate_Install_Launch.job Spybot - Search & Destroy - Scheduled Task.job
Post #60
Ok do you recognize any of these? If they are of no use to you go to Control Panel > Scheduled Tasks > Advanced (select View Log) and this should tell you more about these. If you don't need them go ahead and remove them as tasks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI