What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Sneaky ...! [Solved]

40 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #61 last edited
I recognized them all except for the ones with my name on them, but once I looked at them under 'Scheduled Tasks' I found out they were all tasks made by my Seagate Backup drive (F:/) which needs to be reinstalled anyway so I erased them and the Real ones. Adobe, Avast, and Spybot tasks are all that remain.

Also, I rebooted to see what would happen, and it took a LONG time to boot, about 2 minutes or more. So I ran another HIjackThis scan, and the four Spybot 'Run Once' entries are baaaaaack….and there's a program opening a tiny window only big enough for the X box up in the upper lefthand corner of the screen.

One more thing that I actually forgot to mention that probably goes along with the fact my video card's driver was rolled back, that happened before this and was fixed by installing the most current driver, is that my monitor randomly freezes then goes black (doesn't turn off) and have to reboot in order to get it functioning again. Unfortunately the driver won't install (and reportedly the Windows driver is not sufficient), but I'm working on that. And am I finally clean enough to install Online Armor?

HIjackThis
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:41:31 PM, on 8/29/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\EPSON\EpsonPrinterStudy4\EPCP.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: avast! Ad Blocker - {FFCB3198-32F3-4E8B-9539-4324694ED663} - C:\Program Files\AVAST Software\avast! Ad Blocker IE\Adblocker32.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe /startup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DBAgent] "C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe" /WinStart
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck /autofix
O4 - HKLM\..\RunOnce: [SpybotDeletingA660] command.com /c del "C:\WINDOWS\SchedLgU.Txt"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3744] cmd.exe /c del "C:\WINDOWS\SchedLgU.Txt"
O4 - HKCU\..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB4501] command.com /c del "C:\WINDOWS\SchedLgU.Txt"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7500] cmd.exe /c del "C:\WINDOWS\SchedLgU.Txt"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: EpsonPrinterStudy4 - SEIKO EPSON CORPORATION - C:\Program Files\EPSON\EpsonPrinterStudy4\EPCP.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Seagate Dashboard Services - Seagate Technology LLC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe

–
End of file - 6177 bytes
Post #62
Well there is an easy way to fix this and this is just my opinion only mind you, but if you have Malwarebytes on your system you really don't need Spybot there as well at all. I have not used it in several years now myself, but remember this is just my opinion. Spybot is a decent program.
Post #63

Well there is an easy way to fix this and this is just my opinion only mind you, but if you have Malwarebytes on your system you really don't need Spybot there as well at all. I have not used it in several years now myself, but remember this is just my opinion. Spybot is a decent program.

Except that Malwarebytes didn't find jack when I had all those copies of Fraud.AVSecuritySuite, and Spybot DID. It found nothing at all in anything. I'm beginning to question whether I should keep it as other than just a backup.

So I guess this is a good time to install Online Armor or another firewall?
Post #64
Ok that is completely your choice of course. :) As for the firewall, you can go ahead and install that. Let me know how that goes for you.
Post #65
Other than the command windows still opening, and Spybot picking up logs and histories still, both of which seem to have no other effect, and having to reconfigure my telnet program a little, Online Armor seems to be working fine. And thank you again for taking so much time helping me with my virus problems. :)
Post #66
Hi, You are more than welcome and I appreciate your patience while I have been helping a family member return from the hospital for their "final days". Good to hear that something is at least working right… :) Run a Quick Scan with OTL and we will try to remove those crazy command windows from opening. Post the new log when you get it.
Post #67
I am sorry to hear about your relative, but that sounds like a good thing you are doing for them, even tho it is hard.

OTL
OTL logfile created on: 9/2/2013 7:10:49 PM - Run 10
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Christine\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 64.13% Memory free
5.09 Gb Paging File | 3.93 Gb Available in Paging File | 77.21% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 373.54 Gb Free Space | 80.20% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 930.26 Gb Free Space | 99.87% Space Free | Partition Type: NTFS

Computer Name: BIGBLUEMONSTER | User Name: Christine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Christine\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Documents and Settings\Christine\Local Settings\Application Data\AOL\AIM\aim.exe (AOL Inc.)
PRC - C:\Program Files\Online Armor\oasrv.exe (Emsisoft GmbH)
PRC - C:\Program Files\Online Armor\oaui.exe (Emsisoft GmbH)
PRC - C:\Program Files\Online Armor\oahlp.exe (Emsisoft GmbH)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsisoft GmbH)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\Runservice.exe ()
PRC - C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13090101\algo.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\729ef05a2df18630db7f0a28dd0ec155\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c60957afdbe82f552f2db272afa719fc\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\53428f2f24507f75cc2df5dd0115b46d\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\286a517e1d3aae93daf46ca638856372\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\d756aec4dac356fb0dbfd15f5e07d012\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\918ce68a67ddb5558994e20dc3a74c8a\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\6c422db78c17838c3eb9f9fcc01ca63f\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6e0e5467e23a80c5c7d34f65dc7f87f2\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\58eb4f10504e035b673f8366d9be6881\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8927b576eb15c4a8f4bb04f05e7cc51e\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\b12cbfa020af0c619d8f58c6b665efc1\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\d083ee23a4c0d8cf76ae9e95e52d0388\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\332407a3f224f388f70120d33cb872d5\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\32800018747dbf43506ac49e697daea9\System.Xml.Linq.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4d277a8481c203a35c58bd277a2e71df\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\9e19102de729beac1a221cde49058d99\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\9b32857137a545633a4f303ec88d418c\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e205d971e9ffa1771cff3d3dde1c3c2b\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\a10f361c888b8b98f7ad1fa8d7a51516\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\107b8a28ba272e93556f0e2bfa2c4e16\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\608aa2db27d45e63a4863f1f1d06897a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\6405f08f877802703cfd956c072a4ad0\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\mozjs.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldap32v60.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldappr32v60.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\8f799a4688381624de3cfb1edbccb163\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\Documents and Settings\Christine\Local Settings\Application Data\AOL\AIM\NPSWF32.dll ()
MOD - C:\Documents and Settings\Christine\Local Settings\Application Data\AOL\AIM\libcef.dll ()
MOD - C:\WINDOWS\mmfs.dll ()
MOD - C:\WINDOWS\Runservice.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3175.36923__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3156.17694__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3156.17689__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3156.17698__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3156.17722__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3156.17721__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3156.17682__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3156.17681__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3156.17682__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3156.17747__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3156.17703__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3156.17697__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3156.17689__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3156.17699__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3156.17703__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3156.17703__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3156.17694__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3156.17695__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3175.37106__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3175.37120__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3175.37069__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3175.36940__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3175.37078__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3175.36920__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3175.37075__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3175.36922__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3156.17689__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3156.17702__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3156.17702__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3175.36928__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3175.36921__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3175.36917__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3156.17692__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3175.37077__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll ()


========== Services (SafeList) ==========

SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (Seagate Dashboard Services) – C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsisoft GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\oacat.exe (Emsisoft GmbH)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (TabletServiceWacom) – C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV - (EpsonPrinterStudy4) – C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SetupNTGLM7X) – D:\NTGLM7X.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NTACCESS) – D:\NTACCESS.sys File not found
DRV - (MSICPL) – D:\install4\MSICPL.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (GMSIPCI) – D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (oahlpXX) – C:\WINDOWS\system32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Emsisoft)
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Emsisoft)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys ()
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (wacmoumonitor) – C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (wacomvhid) – C:\WINDOWS\system32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (amdide) – C:\WINDOWS\system32\drivers\amdide.sys (Advanced Micro Devices)
DRV - (wacommousefilter) – C:\WINDOWS\system32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (incdrm) – C:\WINDOWS\System32\drivers\incdrm.sys (Ahead Software AG)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://forecast.weather.gov/MapClick.php?CityName=Bellingham&state=WA&site=SEW&textField1=48.7597&textField2=-122.487&e=0"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.16
FF - prefs.js..extensions.enabledAddons: pbupload%40photobucket.com:1.3.9
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.11
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1rc2
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.21
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.5
FF - prefs.js..extensions.enabledAddons: %7Be7348bc0-16f6-11de-8c30-0800200c9a66%7D:15.0.25.04.12
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.8: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A72E0FE7-282F-4517-9C95-5B611103B925}: C:\Documents and Settings\Christine\Local Settings\Application Data\{A72E0FE7-282F-4517-9C95-5B611103B925}\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/01/22 21:14:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/08/22 14:41:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/17 10:11:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/23 15:47:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/08/06 22:33:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions
[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/08/27 19:34:12 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions
[2011/02/27 20:41:19 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2013/08/27 19:34:12 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/28 16:48:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/07/01 22:46:42 | 000,000,000 | —D | M] (Purple Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{3ffb7be0-8bde-11de-8a39-0800200c9a66}
[2009/10/10 19:46:14 | 000,000,000 | —D | M] (AvantGarde Rosepetal) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}
[2013/05/15 11:23:42 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/08/27 07:41:29 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/05/04 15:44:43 | 000,000,000 | —D | M] (Pink Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2013/08/21 10:44:27 | 000,057,732 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/06/25 18:25:35 | 000,027,521 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/08/15 11:48:09 | 000,534,320 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/06/15 12:25:30 | 000,868,738 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013/07/30 20:17:34 | 000,824,302 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/18 19:39:22 | 001,109,062 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}.xpi
[2013/08/03 00:51:12 | 000,275,449 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009/10/10 19:46:14 | 001,897,274 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp.xpi
[2013/09/01 22:48:19 | 000,005,472 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\searchplugins\startpage.xml
[2013/08/17 10:11:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/17 10:11:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/22 14:41:42 | 000,000,000 | —D | M] (avast! Online Security) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

O1 HOSTS File: ([2013/08/31 12:40:19 | 000,450,510 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15468 more lines…
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Ad Blocker) - {FFCB3198-32F3-4E8B-9539-4324694ED663} - C:\Program Files\AVAST Software\avast! Ad Blocker IE\Adblocker32.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\OAui.exe (Emsisoft GmbH)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DBAgent] C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - HKLM..\RunOnce: [SpybotDeletingA3639] C:\WINDOWS\System32\command.com ()
O4 - HKLM..\RunOnce: [SpybotDeletingC6667] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [SpybotDeletingB3810] C:\WINDOWS\System32\command.com ()
O4 - HKCU..\RunOnce: [SpybotDeletingD3016] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4A2C5A9-E429-494E-98CE-F10BCE688442}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Emsisoft GmbH)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/20 00:10:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/09/02 00:49:55 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Christine\Recent
[2013/08/31 12:32:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2013/08/31 12:18:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\OnlineArmor
[2013/08/31 12:18:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2013/08/31 12:17:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Online Armor
[2013/08/31 12:17:32 | 000,031,920 | —- | C] (Emsisoft) – C:\WINDOWS\System32\drivers\OAnet.sys
[2013/08/31 12:17:32 | 000,027,648 | —- | C] (Emsisoft) – C:\WINDOWS\System32\drivers\OAmon.sys
[2013/08/31 12:17:29 | 000,000,000 | —D | C] – C:\Program Files\Online Armor
[2013/08/29 17:47:03 | 000,103,040 | —- | C] (Advanced Micro Devices) – C:\WINDOWS\System32\drivers\AtihdXP3.sys
[2013/08/29 17:46:26 | 000,442,368 | —- | C] (Advanced Micro Devices, Inc.) – C:\WINDOWS\System32\ATIDEMGX.dll
[2013/08/29 17:46:25 | 000,307,200 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\atiiiexx.dll
[2013/08/29 17:46:00 | 000,000,000 | —D | C] – C:\Program Files\ATI
[2013/08/29 17:44:45 | 000,000,000 | —D | C] – C:\AMD
[2013/08/27 14:21:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\My Online Documents
[2013/08/24 14:39:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Desktop\RK_Quarantine
[2013/08/22 14:42:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/08/22 14:42:04 | 000,369,584 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:04 | 000,029,816 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/08/22 14:42:02 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/08/22 14:42:01 | 000,770,344 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:01 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/08/22 14:41:59 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/22 14:41:58 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/08/22 14:41:32 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/08/22 14:41:13 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/08/22 14:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/08/21 08:56:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/20 16:17:59 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2013/08/20 16:11:20 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/20 16:07:40 | 001,018,949 | —- | C] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/19 18:40:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/18 17:30:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/18 17:28:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/18 17:28:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/18 17:28:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/18 17:28:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/18 17:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/18 17:22:46 | 005,105,231 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 13:59:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 11:08:42 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 10:11:13 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/08/06 22:33:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Thunderbird
[2013/08/05 13:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Nero
[2013/08/05 13:53:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Seagate Dashboard 2.0
[2013/08/05 13:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2013/08/05 13:53:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nero
[2013/08/05 13:53:04 | 000,000,000 | —D | C] – C:\Program Files\Seagate
[2013/08/05 13:45:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/05 13:45:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Seagate
[2013/08/05 13:41:43 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET

========== Files - Modified Within 30 Days ==========

[2013/09/02 19:06:54 | 000,001,204 | —- | M] () – C:\WINDOWS\wininit.ini
[2013/09/02 19:05:03 | 000,000,370 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/09/02 19:04:54 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/09/02 19:04:27 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2013/09/02 19:04:19 | 000,000,338 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2013/09/02 19:04:08 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/09/02 19:03:57 | 000,875,944 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/09/02 00:36:01 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/31 12:40:19 | 000,450,510 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/31 12:26:42 | 000,001,655 | —- | M] () – C:\WINDOWS\System32\Wacom_Tablet.dat
[2013/08/31 12:17:48 | 000,474,930 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/31 12:17:48 | 000,077,440 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/31 12:11:08 | 000,000,604 | —- | M] () – C:\WINDOWS\tasks\Christine.job
[2013/08/31 12:09:25 | 000,002,419 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2013/08/29 15:39:30 | 000,002,455 | —- | M] () – C:\Documents and Settings\Christine\Desktop\HiJackThis.lnk
[2013/08/29 08:01:22 | 000,000,392 | RHS- | M] () – C:\boot.ini
[2013/08/28 10:23:22 | 000,450,510 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130831-124019.backup
[2013/08/28 09:57:55 | 000,044,623 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SpybotSD.Results.zip
[2013/08/28 00:13:04 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/08/27 13:07:21 | 000,450,510 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130828-102322.backup
[2013/08/26 06:54:34 | 000,000,698 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130827-130721.backup
[2013/08/24 19:34:20 | 000,459,002 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:43 | 000,211,421 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:12 | 000,139,264 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:07 | 000,923,136 | —- | M] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:08 | 000,369,584 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:08 | 000,175,176 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:41:59 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/08/20 16:17:12 | 000,001,876 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:34 | 003,858,143 | —- | M] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 16:07:23 | 001,018,949 | —- | M] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 12:31:40 | 000,000,981 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 12:31:40 | 000,000,963 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120418.backup
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120228.backup
[2013/08/18 17:22:49 | 005,105,231 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 15:06:18 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 14:11:40 | 000,666,633 | —- | M] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/18 11:08:39 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe

========== Files Created - No Company Name ==========

[2013/09/02 19:03:57 | 000,875,944 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/31 12:17:32 | 000,208,320 | —- | C] () – C:\WINDOWS\System32\drivers\OADriver.sys
[2013/08/31 12:17:32 | 000,044,992 | —- | C] () – C:\WINDOWS\System32\drivers\oahlp32.sys
[2013/08/31 12:11:08 | 000,000,604 | —- | C] () – C:\WINDOWS\tasks\Christine.job
[2013/08/29 17:46:26 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2013/08/29 17:46:26 | 000,246,000 | —- | C] () – C:\WINDOWS\System32\atiapfxx.blb
[2013/08/29 17:46:25 | 000,038,177 | —- | C] () – C:\WINDOWS\atiogl.xml
[2013/08/29 17:46:25 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2013/08/29 17:40:48 | 000,618,823 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2013/08/27 12:06:39 | 000,001,204 | —- | C] () – C:\WINDOWS\wininit.ini
[2013/08/26 09:31:34 | 000,044,623 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SpybotSD.Results.zip
[2013/08/24 19:34:20 | 000,459,002 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:37 | 000,211,421 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:20 | 000,139,264 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:11 | 000,923,136 | —- | C] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:42:01 | 000,175,176 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:00 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/22 14:42:00 | 000,000,370 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/20 16:17:12 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:28 | 003,858,143 | —- | C] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 11:53:17 | 000,000,981 | —- | C] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 11:53:17 | 000,000,963 | —- | C] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 17:28:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/18 17:28:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/18 17:28:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/18 17:28:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/18 17:28:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | C] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 14:11:43 | 000,666,633 | —- | C] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/05 15:47:21 | 000,650,896 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1229272821-813497703-839522115-1003-0.dat
[2013/08/05 15:47:20 | 000,428,818 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/08/05 13:53:39 | 000,002,419 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012/03/17 16:13:43 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/22 21:19:29 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/07/30 13:21:08 | 000,027,648 | —- | C] () – C:\Documents and Settings\Christine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/19 15:48:43 | 000,000,004 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2009/10/26 18:00:48 | 008,801,704 | —- | C] () – C:\Program Files\FLV PlayerATBSetup.exe

========== ZeroAccess Check ==========

[2009/09/20 00:21:28 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2009/07/18 08:05:06 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/10/09 17:17:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2013/08/22 14:41:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/03/10 13:45:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2013/08/31 12:29:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2013/08/05 13:45:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/31 14:10:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2013/03/10 15:54:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Western Digital
[2012/07/13 09:53:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}
[2009/10/09 17:18:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\acccore
[2010/12/07 22:07:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Amazon
[2009/12/17 18:16:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\CoreFTP
[2011/09/27 13:20:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\ElevatedDiagnostics
[2010/06/07 09:18:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\EPSON
[2010/03/11 07:10:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leader Technologies
[2010/03/10 13:53:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leadertech
[2013/08/31 12:18:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\OnlineArmor
[2012/09/02 15:09:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Safer Networking
[2013/08/05 13:45:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Seagate
[2012/09/01 11:50:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\TestApp
[2010/07/23 21:10:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Thunderbird

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 179 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:359B3BDA

< End of report >
Post #68
Hi,

Run through the Tweaking Registry Backup so we can get a new backup and then do the following….

[external image: Posted Image]

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

    :OTL
    O4 - HKLM..\RunOnce: [SpybotDeletingA3639] C:\WINDOWS\System32\command.com ()
    O4 - HKLM..\RunOnce: [SpybotDeletingC6667] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
    O4 - HKCU..\RunOnce: [SpybotDeletingB3810] C:\WINDOWS\System32\command.com ()
    O4 - HKCU..\RunOnce: [SpybotDeletingD3016] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
    [2013/09/02 19:04:27 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
    @Alternate Data Stream - 179 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:359B3BDA

    :Files
    ipconfig /flushdns /c

    :Commands
    [emptytemp]
    [start explorer]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Post the new OTL log and let me know how things are running.
Post #69
Okay, going to run what you asked in a minute, but before I do, I wanted to ask if you know what the heck this file is: C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FARNSFA.EXE ? Online Armor is has it marked 'OUT' on two ports, and I don't know what the heck it is (StartPage turned up no pages). Also, how do I make Online Armor load BEFORE my connection and antivirus start up, instead of after?

And after running the OTL fix, during the reboot (and the reboot after the reboot, too) the boot stops with the message "Windows cannot find command.com. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search", with an OK button. I click OK and it continues with the boot…which also still includes the command windows opening. And Spybot requests a change to SchedLgU.txt twice each boot.

OTL
OTL logfile created on: 9/3/2013 5:58:08 PM - Run 11
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Christine\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 65.22% Memory free
5.09 Gb Paging File | 4.06 Gb Available in Paging File | 79.72% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 373.29 Gb Free Space | 80.15% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 930.26 Gb Free Space | 99.87% Space Free | Partition Type: NTFS

Computer Name: BIGBLUEMONSTER | User Name: Christine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Christine\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Online Armor\oasrv.exe (Emsisoft GmbH)
PRC - C:\Program Files\Online Armor\oaui.exe (Emsisoft GmbH)
PRC - C:\Program Files\Online Armor\oahlp.exe (Emsisoft GmbH)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsisoft GmbH)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\Runservice.exe ()
PRC - C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13090301\algo.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\729ef05a2df18630db7f0a28dd0ec155\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c60957afdbe82f552f2db272afa719fc\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\53428f2f24507f75cc2df5dd0115b46d\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\286a517e1d3aae93daf46ca638856372\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\d756aec4dac356fb0dbfd15f5e07d012\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\918ce68a67ddb5558994e20dc3a74c8a\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\6c422db78c17838c3eb9f9fcc01ca63f\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6e0e5467e23a80c5c7d34f65dc7f87f2\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\58eb4f10504e035b673f8366d9be6881\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8927b576eb15c4a8f4bb04f05e7cc51e\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\b12cbfa020af0c619d8f58c6b665efc1\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\d083ee23a4c0d8cf76ae9e95e52d0388\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\332407a3f224f388f70120d33cb872d5\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\32800018747dbf43506ac49e697daea9\System.Xml.Linq.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4d277a8481c203a35c58bd277a2e71df\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\9e19102de729beac1a221cde49058d99\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e205d971e9ffa1771cff3d3dde1c3c2b\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\a10f361c888b8b98f7ad1fa8d7a51516\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\107b8a28ba272e93556f0e2bfa2c4e16\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\608aa2db27d45e63a4863f1f1d06897a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\6405f08f877802703cfd956c072a4ad0\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\mozjs.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldap32v60.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldappr32v60.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
MOD - C:\WINDOWS\mmfs.dll ()
MOD - C:\WINDOWS\Runservice.exe ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll ()


========== Services (SafeList) ==========

SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (Seagate Dashboard Services) – C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsisoft GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\oacat.exe (Emsisoft GmbH)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (TabletServiceWacom) – C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV - (EpsonPrinterStudy4) – C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SetupNTGLM7X) – D:\NTGLM7X.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NTACCESS) – D:\NTACCESS.sys File not found
DRV - (MSICPL) – D:\install4\MSICPL.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (GMSIPCI) – D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (oahlpXX) – C:\WINDOWS\system32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Emsisoft)
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Emsisoft)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys ()
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (wacmoumonitor) – C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (wacomvhid) – C:\WINDOWS\system32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (amdide) – C:\WINDOWS\system32\drivers\amdide.sys (Advanced Micro Devices)
DRV - (wacommousefilter) – C:\WINDOWS\system32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (incdrm) – C:\WINDOWS\System32\drivers\incdrm.sys (Ahead Software AG)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://forecast.weather.gov/MapClick.php?CityName=Bellingham&state=WA&site=SEW&textField1=48.7597&textField2=-122.487&e=0"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.16
FF - prefs.js..extensions.enabledAddons: pbupload%40photobucket.com:1.3.9
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.11
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1rc2
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.21
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.5
FF - prefs.js..extensions.enabledAddons: %7Be7348bc0-16f6-11de-8c30-0800200c9a66%7D:15.0.25.04.12
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.2.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.8: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/10/22 03:00:19 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A72E0FE7-282F-4517-9C95-5B611103B925}: C:\Documents and Settings\Christine\Local Settings\Application Data\{A72E0FE7-282F-4517-9C95-5B611103B925}\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/01/22 21:14:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/08/22 14:41:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/17 10:11:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/23 15:47:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/08/06 22:33:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions
[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/07/22 08:56:59 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2013/08/27 19:34:12 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions
[2011/02/27 20:41:19 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2013/08/27 19:34:12 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/28 16:48:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/07/01 22:46:42 | 000,000,000 | —D | M] (Purple Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{3ffb7be0-8bde-11de-8a39-0800200c9a66}
[2009/10/10 19:46:14 | 000,000,000 | —D | M] (AvantGarde Rosepetal) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}
[2013/05/15 11:23:42 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/08/27 07:41:29 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/05/04 15:44:43 | 000,000,000 | —D | M] (Pink Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2013/08/21 10:44:27 | 000,057,732 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/06/25 18:25:35 | 000,027,521 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/08/15 11:48:09 | 000,534,320 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/06/15 12:25:30 | 000,868,738 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013/07/30 20:17:34 | 000,824,302 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/18 19:39:22 | 001,109,062 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}.xpi
[2013/08/03 00:51:12 | 000,275,449 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009/10/10 19:46:14 | 001,897,274 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp.xpi
[2013/09/01 22:48:19 | 000,005,472 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\searchplugins\startpage.xml
[2013/08/17 10:11:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/17 10:11:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/22 14:41:42 | 000,000,000 | —D | M] (avast! Online Security) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2013/05/09 23:57:26 | 000,187,456 | —- | M] (Adobe Systems Inc.) – C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2012/01/22 21:14:55 | 000,150,696 | —- | M] (RealNetworks, Inc.) – C:\Program Files\mozilla firefox\plugins\nppl3260.dll
[2011/08/27 14:01:00 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2011/08/27 14:01:00 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2011/08/27 14:01:00 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2011/08/27 14:01:00 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2011/08/27 14:01:00 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2011/08/27 14:01:00 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2011/08/27 14:01:00 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2012/01/22 21:15:13 | 000,011,776 | —- | M] (RealNetworks, Inc.) – C:\Program Files\mozilla firefox\plugins\nprjplug.dll
[2012/01/22 21:14:19 | 000,108,544 | —- | M] (RealNetworks, Inc.) – C:\Program Files\mozilla firefox\plugins\nprpjplug.dll

O1 HOSTS File: ([2013/08/31 12:40:19 | 000,450,510 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15468 more lines…
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Ad Blocker) - {FFCB3198-32F3-4E8B-9539-4324694ED663} - C:\Program Files\AVAST Software\avast! Ad Blocker IE\Adblocker32.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\OAui.exe (Emsisoft GmbH)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DBAgent] C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Oracle Corporation)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4A2C5A9-E429-494E-98CE-F10BCE688442}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - (%SystemRoot%\System32\dimsntfy.dll) - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Online Armor\oaevent.dll (Emsisoft GmbH)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/20 00:10:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/09/03 01:52:42 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Christine\Recent
[2013/08/31 12:32:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2013/08/31 12:18:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\OnlineArmor
[2013/08/31 12:18:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2013/08/31 12:17:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Online Armor
[2013/08/31 12:17:32 | 000,031,920 | —- | C] (Emsisoft) – C:\WINDOWS\System32\drivers\OAnet.sys
[2013/08/31 12:17:32 | 000,027,648 | —- | C] (Emsisoft) – C:\WINDOWS\System32\drivers\OAmon.sys
[2013/08/31 12:17:29 | 000,000,000 | —D | C] – C:\Program Files\Online Armor
[2013/08/29 17:47:03 | 000,103,040 | —- | C] (Advanced Micro Devices) – C:\WINDOWS\System32\drivers\AtihdXP3.sys
[2013/08/29 17:46:26 | 000,442,368 | —- | C] (Advanced Micro Devices, Inc.) – C:\WINDOWS\System32\ATIDEMGX.dll
[2013/08/29 17:46:25 | 000,307,200 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\atiiiexx.dll
[2013/08/29 17:46:00 | 000,000,000 | —D | C] – C:\Program Files\ATI
[2013/08/29 17:44:45 | 000,000,000 | —D | C] – C:\AMD
[2013/08/27 14:21:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\My Online Documents
[2013/08/24 14:39:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Desktop\RK_Quarantine
[2013/08/22 14:42:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/08/22 14:42:04 | 000,369,584 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:04 | 000,029,816 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/08/22 14:42:02 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/08/22 14:42:01 | 000,770,344 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:01 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/08/22 14:41:59 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/22 14:41:58 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/08/22 14:41:32 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/08/22 14:41:13 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/08/22 14:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/08/21 08:56:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/20 16:17:59 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2013/08/20 16:11:20 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/20 16:07:40 | 001,018,949 | —- | C] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/19 18:40:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/18 17:30:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/18 17:28:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/18 17:28:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/18 17:28:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/18 17:28:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/18 17:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/18 17:22:46 | 005,105,231 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 13:59:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 11:08:42 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 10:11:13 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/08/06 22:33:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Thunderbird
[2013/08/05 13:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Nero
[2013/08/05 13:53:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Seagate Dashboard 2.0
[2013/08/05 13:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2013/08/05 13:53:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nero
[2013/08/05 13:53:04 | 000,000,000 | —D | C] – C:\Program Files\Seagate
[2013/08/05 13:45:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/05 13:45:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Seagate
[2013/08/05 13:41:43 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET

========== Files - Modified Within 30 Days ==========

[2013/09/03 17:45:24 | 000,001,339 | —- | M] () – C:\WINDOWS\wininit.ini
[2013/09/03 17:42:10 | 000,000,370 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/09/03 17:41:57 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/09/03 17:41:46 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2013/09/03 17:41:39 | 000,000,338 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2013/09/03 17:41:28 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/09/03 17:36:15 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/09/03 17:09:08 | 000,000,393 | RHS- | M] () – C:\boot.ini
[2013/09/03 17:04:29 | 000,875,944 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/31 12:40:19 | 000,450,510 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/31 12:26:42 | 000,001,655 | —- | M] () – C:\WINDOWS\System32\Wacom_Tablet.dat
[2013/08/31 12:17:48 | 000,474,930 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/31 12:17:48 | 000,077,440 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/31 12:11:08 | 000,000,604 | —- | M] () – C:\WINDOWS\tasks\Christine.job
[2013/08/31 12:09:25 | 000,002,419 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2013/08/29 15:39:30 | 000,002,455 | —- | M] () – C:\Documents and Settings\Christine\Desktop\HiJackThis.lnk
[2013/08/28 10:23:22 | 000,450,510 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130831-124019.backup
[2013/08/28 09:57:55 | 000,044,623 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SpybotSD.Results.zip
[2013/08/28 00:13:04 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/08/27 13:07:21 | 000,450,510 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130828-102322.backup
[2013/08/26 06:54:34 | 000,000,698 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130827-130721.backup
[2013/08/24 19:34:20 | 000,459,002 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:43 | 000,211,421 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:12 | 000,139,264 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:07 | 000,923,136 | —- | M] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:08 | 000,369,584 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:08 | 000,175,176 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:41:59 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/08/20 16:17:12 | 000,001,876 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:34 | 003,858,143 | —- | M] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 16:07:23 | 001,018,949 | —- | M] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 12:31:40 | 000,000,981 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 12:31:40 | 000,000,963 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120418.backup
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120228.backup
[2013/08/18 17:22:49 | 005,105,231 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 15:06:18 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 14:11:40 | 000,666,633 | —- | M] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/18 11:08:39 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe

========== Files Created - No Company Name ==========

[2013/09/03 17:35:30 | 000,000,561 | -HS- | C] () – C:\WINDOWS\System32\mmf.sys
[2013/09/03 17:04:29 | 000,875,944 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/31 12:17:32 | 000,208,320 | —- | C] () – C:\WINDOWS\System32\drivers\OADriver.sys
[2013/08/31 12:17:32 | 000,044,992 | —- | C] () – C:\WINDOWS\System32\drivers\oahlp32.sys
[2013/08/31 12:11:08 | 000,000,604 | —- | C] () – C:\WINDOWS\tasks\Christine.job
[2013/08/29 17:46:26 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2013/08/29 17:46:26 | 000,246,000 | —- | C] () – C:\WINDOWS\System32\atiapfxx.blb
[2013/08/29 17:46:25 | 000,038,177 | —- | C] () – C:\WINDOWS\atiogl.xml
[2013/08/29 17:46:25 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2013/08/29 17:40:48 | 000,618,823 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2013/08/27 12:06:39 | 000,001,339 | —- | C] () – C:\WINDOWS\wininit.ini
[2013/08/26 09:31:34 | 000,044,623 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SpybotSD.Results.zip
[2013/08/24 19:34:20 | 000,459,002 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:37 | 000,211,421 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:20 | 000,139,264 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:11 | 000,923,136 | —- | C] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:42:01 | 000,175,176 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:00 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/22 14:42:00 | 000,000,370 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/20 16:17:12 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:28 | 003,858,143 | —- | C] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 11:53:17 | 000,000,981 | —- | C] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 11:53:17 | 000,000,963 | —- | C] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 17:28:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/18 17:28:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/18 17:28:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/18 17:28:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/18 17:28:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | C] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 14:11:43 | 000,666,633 | —- | C] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/05 15:47:21 | 000,650,896 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1229272821-813497703-839522115-1003-0.dat
[2013/08/05 15:47:20 | 000,428,818 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/08/05 13:53:39 | 000,002,419 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012/03/17 16:13:43 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/22 21:19:29 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/07/30 13:21:08 | 000,027,648 | —- | C] () – C:\Documents and Settings\Christine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/19 15:48:43 | 000,000,004 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2009/10/26 18:00:48 | 008,801,704 | —- | C] () – C:\Program Files\FLV PlayerATBSetup.exe

========== ZeroAccess Check ==========

[2009/09/20 00:21:28 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2009/07/18 08:05:06 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
Post #70

And Spybot requests a change to SchedLgU.txt twice each boot.

From what I understand of SpyBot and what I have been reading, this is pretty much going to be normal. This isn't a problem….maybe a bit annoying but not a problem.

C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FARNSFA.EXE

This is a file for a printer…you have an Epson?
Post #71

And Spybot requests a change to SchedLgU.txt twice each boot.

From what I understand of SpyBot and what I have been reading, this is pretty much going to be normal. This isn't a problem….maybe a bit annoying but not a problem.

C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FARNSFA.EXE

This is a file for a printer…you have an Epson?

Yep, I do, and I did sign up for their study. I thought the file might be it, but was not familiar with the filename.
Post #72
How is your system running otherwise?? The problem that you are having with Spybot I am still searching on a definitive way to "fix" this. I may have to refer you to the Spybot Help Forums if I can't find anything.
Post #73

How is your system running otherwise?? The problem that you are having with Spybot I am still searching on a definitive way to "fix" this. I may have to refer you to the Spybot Help Forums if I can't find anything.

Okay, I think I may have forgot to tell you about this new problem. Since the last OTL fix, every time I boot, after I get past the user login to Windows I get this message prompt (which also stops the boot process): "Windows cannot find command.com. Make sure you typed the name correctly, and then try again. To Search for a file, click the Start button, and then click Search." and an OK button. I click OK, and the boot continues. Also, there are now 4 DOS command or cmd windows opening up, including one tiny one in the upper corner.

I may try just removing the entries that seem to cause the DOS windows via Spybot's tool for Startup management, tho since it didn't work when I removed them with HijackThis I'm pessimistic.
Post #75 last edited
Curiously, the problem I noted yesterday didn't happen today when I booted up, and Online Armor also booted up before the internet connection, like I wanted.

Now with this scan…I've used ZMUD for 15 years now, and this is the FIRST time anything has been 'suspicious' about it. Unfortunately I at least need to keep version 705, 'cause the later versions don't work so well with XP. I did have to redo the settings when Online Armor was installed, tho.

UPDATE: I went ahead and had Malwarbytes remove the items down below, and ZMUD still seems to be functioning fine.

MBAM
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.09.06.10

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Christine :: BIGBLUEMONSTER [administrator]

9/6/2013 7:21:38 PM
mbam-log-2013-08-21 (16-46-22).txt

Scan type: Full scan (C:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 313354
Time elapsed: 52 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 8
C:\Outland (D)\zMUD\zmud631.exe (Trojan.Utanioz) -> No action taken.
C:\Outland (D)\zMUD\zmud640.exe (Trojan.Utanioz) -> No action taken.
C:\zMUD\zmud631.exe (Trojan.Utanioz) -> No action taken.
C:\zMUD\zmud640.exe (Trojan.Utanioz) -> No action taken.
C:\C\Copy of zMUD\zmud631.exe (Trojan.Utanioz) -> No action taken.
C:\C\Copy of zMUD\zmud640.exe (Trojan.Utanioz) -> No action taken.
C:\C\Copy of zMUD\zmud655.exe (Trojan.Utanioz) -> No action taken.
C:\C\Copy of zMUD\zmud705.exe (Trojan.Utanioz) -> No action taken.

(end)

2ND LOG
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.09.06.10

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Christine :: BIGBLUEMONSTER [administrator]

9/6/2013 9:06:23 PM
mbam-log-2013-09-06 (21-06-23).txt

Scan type: Full scan (C:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 313008
Time elapsed: 52 minute(s), 1 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI