Spyware / Malware / Virus Removal

microsoft distribution service 3.0 and PUP [Solved]

28 min read

Looking for the outcome? Ask AI

jeffce

Post #31August 24, 2013, 9:18 PM UTC

SystemLook

For 32bit systems please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Right-click and Run as Administrator SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*8hbarsvc.exe
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

michellej

Post #32August 25, 2013, 12:49 AM UTC

hi i cannot log into administrator as i do not know the password so i ran it as USER SystemLook 30.07.11 by jpshortstuff Log created at 10:43 on 25/08/2013 by User Administrator - Elevation successful ========== filefind ========== Searching for "*8hbarsvc.exe" No files found. -= EOF =-

jeffce

Post #33August 26, 2013, 12:15 AM UTC

Hi,

Sorry for any delay…I have a family member in the hospital and have been there virtually all day.

[external image: Posted Image] Tweaking.com Registry Backup

Download the tool found here to your Desktop so it is easy to find.
Double click on the file you just downloaded to install it to your system.
Once the tool is installed, double-click on the Tweaking.com Registry Backup icon
**Note** The tool should automatically open to the Backup Registry tab.

[external image: Posted Image]
Press Backup Now
When the back up is complete, the tool will tell you that Successful */* Files Backed Up
You have now successfully backed up your Registry.

[external image: Posted Image]

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
SRV - (Allin1Convert_8hService) – C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbarsvc.exe File not found
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKLM\..\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}: "URL" = http://search.tb.ask.com/search/GGmain.jht…r={searchTerms}
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD23}: "URL" = http://search.shareazaweb.com//web?src=ieb…q={searchTerms}
IE - HKCU\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKCU\..\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}: "URL" = http://search.tb.ask.com/search/GGmain.jht…r={searchTerms}
FF - prefs.js..extensions.enabledAddons: 8hffxtbr%40Allin1Convert_8h.com:5.24.2.284
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\49ffxtbr@UtilityChest_49.com: C:\Program Files\UtilityChest_49\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\65ffxtbr@FromDocToPDF_65.com: C:\Program Files\FromDocToPDF_65\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\8hffxtbr@Allin1Convert_8h.com: C:\Program Files\Allin1Convert_8h\bar\1.bin [2013/08/22 11:55:52 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\FindLyrics\FF\
[2013/01/13 08:16:16 | 000,000,000 | —D | M] (Smiley Bar for Facebook) – C:\Documents and Settings\User\Application Data\Mozilla\Extensions\statuswinks@StatusWinks
[2013/03/20 17:02:41 | 000,000,000 | —D | M] (MixiDJ Toolbar) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed]
[2013/08/22 11:55:52 | 000,000,000 | —D | M] (Allin1Convert) – C:\PROGRAM FILES\ALLIN1CONVERT_8H\BAR\1.BIN
[2013/08/15 09:41:41 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Allin1Convert_8h
[2013/08/15 09:41:17 | 000,000,000 | —D | C] – C:\Program Files\Allin1Convert_8h
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2013/08/09 08:26:35 | 001,024,992 | —- | C] () – C:\Documents and Settings\User\Desktop\statuswinks.exe
[2013/08/19 06:50:54 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Allin1Convert_8h
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\User\Desktop\statuswinks.exe:SummaryInformation

:Files
ipconfig /flushdns /c

:Commands
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Post the new OTL log and then let me know how your system is running.

michellej

Post #34August 26, 2013, 10:37 PM UTC

Hi Jeff i ran the registry back up and copied the code into OTL and clicked run FIX but after hrs nothing seems to be happening their was a note on the bottom saying Killing processes do not interupt , seems like it is frozen , the only way i could close it was to cut the power button (again) i tried to run this 2 times both times the same , do you still want me to run just the scan ?? seems like im not having much luck here?? the computer is browser takes a long time to load , pages come up pretty quick, my curser was going like jagged , lagging, sound is still very bad when it dos close down propely it is still slow to do so

jeffce

Post #35August 27, 2013, 11:38 AM UTC

Go ahead and boot to Safe Mode and run OTL from there and see if it will run through. If it does, please post the log that is created and also let me know how your system is running.

michellej

Post #36August 27, 2013, 9:48 PM UTC

safe mode run fix report now doing a scan
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Service Allin1Convert_8hService stopped successfully!
Service Allin1Convert_8hService deleted successfully!
File C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbarsvc.exe File not found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD23}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD23}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}\ not found.
Prefs.js: 8hffxtbr%40Allin1Convert_8h.com:5.24.2.284 removed from extensions.enabledAddons
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\49ffxtbr@UtilityChest_49.com deleted successfully.
File C:\Program Files\UtilityChest_49\bar\1.bin not found.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\65ffxtbr@FromDocToPDF_65.com deleted successfully.
File C:\Program Files\FromDocToPDF_65\bar\1.bin not found.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\8hffxtbr@Allin1Convert_8h.com deleted successfully.
C:\Program Files\Allin1Convert_8h\bar\1.bin\chrome folder moved successfully.
C:\Program Files\Allin1Convert_8h\bar\1.bin folder moved successfully.
Registry value HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed] deleted successfully.
File C:\Program Files\FindLyrics\FF not found.
C:\Documents and Settings\User\Application Data\Mozilla\Extensions\statuswinks@StatusWinks\chrome\skin folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Extensions\statuswinks@StatusWinks\chrome\content\mz folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Extensions\statuswinks@StatusWinks\chrome\content folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Extensions\statuswinks@StatusWinks\chrome folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Extensions\statuswinks@StatusWinks folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed]\META-INF folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed]\content\imgs\flgs folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed]\content\imgs folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed]\content folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed]\components folder moved successfully.
C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed] folder moved successfully.
Folder C:\PROGRAM FILES\ALLIN1CONVERT_8H\BAR\1.BIN\ not found.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\js folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images\weather folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\images folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\fonts folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2\css folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\e437a5256462a30d394f92ef7f9b66af4601a2bd\1.1.2 folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\e437a5256462a30d394f92ef7f9b66af4601a2bd folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\b0981697533a5cd3bdf6a6a7e459354869aac2bb\1.0.3\swf folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\b0981697533a5cd3bdf6a6a7e459354869aac2bb\1.0.3\js folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\b0981697533a5cd3bdf6a6a7e459354869aac2bb\1.0.3\images folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\b0981697533a5cd3bdf6a6a7e459354869aac2bb\1.0.3\fonts folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\b0981697533a5cd3bdf6a6a7e459354869aac2bb\1.0.3\css folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\b0981697533a5cd3bdf6a6a7e459354869aac2bb\1.0.3 folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\b0981697533a5cd3bdf6a6a7e459354869aac2bb folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\js folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images\icons folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\images folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3\css folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\91fbdd335935d6fab2f0f46ec3451b3a18a24a23\1.2.3 folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\91fbdd335935d6fab2f0f46ec3451b3a18a24a23 folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\797dfd9eb93263233c4e3ce640063ed097d07d31\1.0\js folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\797dfd9eb93263233c4e3ce640063ed097d07d31\1.0\images folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\797dfd9eb93263233c4e3ce640063ed097d07d31\1.0\css folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\797dfd9eb93263233c4e3ce640063ed097d07d31\1.0 folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\797dfd9eb93263233c4e3ce640063ed097d07d31 folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\685902e9e41f55407510e329211a1ea9170d5637\1.0.1\js folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\685902e9e41f55407510e329211a1ea9170d5637\1.0.1\images folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\685902e9e41f55407510e329211a1ea9170d5637\1.0.1\fonts folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\685902e9e41f55407510e329211a1ea9170d5637\1.0.1\css folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\685902e9e41f55407510e329211a1ea9170d5637\1.0.1 folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h\685902e9e41f55407510e329211a1ea9170d5637 folder moved successfully.
C:\Documents and Settings\User\Application Data\Allin1Convert_8h folder moved successfully.
C:\Program Files\Allin1Convert_8h\bar\Settings folder moved successfully.
C:\Program Files\Allin1Convert_8h\bar\Message folder moved successfully.
C:\Program Files\Allin1Convert_8h\bar\IE9Mesg folder moved successfully.
C:\Program Files\Allin1Convert_8h\bar\History folder moved successfully.
C:\Program Files\Allin1Convert_8h\bar\gen1 folder moved successfully.
C:\Program Files\Allin1Convert_8h\bar\Cache folder moved successfully.
C:\Program Files\Allin1Convert_8h\bar folder moved successfully.
C:\Program Files\Allin1Convert_8h folder moved successfully.
C:\WINDOWS\CD95F661A5C444F5A6AAECDD91C240D8.TMP folder deleted successfully.
C:\WINDOWS\LastGood.Tmp\system32\DRIVERS\SWDUMon.sys deleted successfully.
C:\WINDOWS\LastGood.Tmp\system32\DRIVERS folder deleted successfully.
C:\WINDOWS\LastGood.Tmp\system32 folder deleted successfully.
C:\WINDOWS\LastGood.Tmp folder deleted successfully.
C:\WINDOWS\LMIED.tmp folder deleted successfully.
C:\WINDOWS\LMIEE.tmp folder deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\Documents and Settings\User\Desktop\statuswinks.exe moved successfully.
Folder C:\Documents and Settings\User\Application Data\Allin1Convert_8h\ not found.
Unable to delete ADS C:\Documents and Settings\User\Desktop\statuswinks.exe:SummaryInformation .
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\User\Desktop\Diognosing\cmd.bat deleted successfully.
C:\Documents and Settings\User\Desktop\Diognosing\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 294871 bytes
->FireFox cache emptied: 19674174 bytes
->Flash cache emptied: 58264 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 58264 bytes

User: GRAHAMS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 26828923 bytes
->Flash cache emptied: 456 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: User
->Temp folder emptied: 20222547 bytes
->Temporary Internet Files folder emptied: 2169593 bytes
->Java cache emptied: 704320 bytes
->FireFox cache emptied: 128208135 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 2425 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 20580 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 2652226 bytes

Total Files Cleaned = 192.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 08282013_070656

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\User\Local Settings\Temp\WER55f4.dir00\appcompat.txt not found!
File\Folder C:\Documents and Settings\User\Local Settings\Temp\WER55f4.dir00\avgmfapx.exe.hdmp not found!
File\Folder C:\Documents and Settings\User\Local Settings\Temp\WER55f4.dir00\avgmfapx.exe.mdmp not found!
File\Folder C:\Documents and Settings\User\Local Settings\Temp\WER55f4.dir00\manifest.txt not found!
File\Folder C:\Documents and Settings\User\Local Settings\Temp\WER3cce.dir00\appcompat.txt not found!
File\Folder C:\Documents and Settings\User\Local Settings\Temp\WER3cce.dir00\avgmfapx.exe.hdmp not found!
File\Folder C:\Documents and Settings\User\Local Settings\Temp\WER3cce.dir00\avgmfapx.exe.mdmp not found!
File\Folder C:\Documents and Settings\User\Local Settings\Temp\WER3cce.dir00\manifest.txt not found!

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

michellej

Post #37August 27, 2013, 11:11 PM UTC last edited August 28, 2013, 12:53 AM UTC

OTL logfile created on: 28/08/2013 7:50:37 AM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\User\Desktop\Diognosing
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.00 Gb Total Physical Memory | 2.06 Gb Available Physical Memory | 68.55% Memory free
4.84 Gb Paging File | 4.04 Gb Available in Paging File | 83.38% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 7.85 Gb Free Space | 7.03% Space Free | Partition Type: NTFS

Computer Name: ACER_TM6460 | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\User\Local Settings\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\HitmanPro\hmpsched.exe (SurfRight B.V.)
PRC - C:\Documents and Settings\User\Desktop\Diognosing\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files\MyPC Backup\BackupStack.exe (Just Develop It)
PRC - C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
PRC - C:\Program Files\DriverUpdate\DriverUpdate.exe (SlimWare Utilities, Inc.)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe (RealNetworks, Inc.)
PRC - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\ControlCenter4\BrCcUxSys.exe (Brother Industries, Ltd.)
PRC - C:\Program Files\ControlCenter4\BrCtrlCntr.exe (Brother Industries, Ltd.)
PRC - C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
PRC - C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe (TP-LINK TECHNOLOGIES CO., LTD.)
PRC - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\972dcf9830a64e9802aaca3a83cae24b\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\b01bf82d99cca42b8140884fb833583d\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\15fd2d2f4e709154b44187a6915db244\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\cf3c9d1496acdcb836853e59fe20223b\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\9c02362e677418460c52569019a266e4\System.EnterpriseServices.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\14d1a28674a9f78c5759e7dcf74a13fd\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\5013900c3c0610c88059fcb8f1f4acb4\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\Program Files\MyPC Backup\MPCBIconOverlays.dll ()
MOD - C:\Program Files\MyPC Backup\GetText.dll ()
MOD - C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll ()
MOD - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Brother\BrUtilities\BrLogAPI.dll ()
MOD - C:\Program Files\Intel\Wireless\Bin\Libeay32.dll ()
MOD - C:\Program Files\Intel\Wireless\Bin\iWMSProv.dll ()
MOD - C:\Program Files\Intel\Wireless\Bin\IntStngs.dll ()
MOD - C:\Program Files\Intel\Wireless\Bin\acAuth.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll ()

========== Services (SafeList) ==========

SRV - (vToolbarUpdater15.4.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe File not found
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe File not found
SRV - (ACDaemon) – File not found
SRV - (HitmanProScheduler) – C:\Program Files\HitmanPro\hmpsched.exe (SurfRight B.V.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Skype C2C Service) – C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (BackupStack) – C:\Program Files\MyPC Backup\BackupStack.exe (Just Develop It)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (RealNetworks Downloader Resolver Service) – C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (rpcapd) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (PDFProFiltSrvPP) – C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (BrYNSvc) – C:\Program Files\Browny02\BrYNSvc.exe (Brother Industries, Ltd.)
SRV - (WebUpdate4) – C:\WINDOWS\system32\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)
SRV - (O2Flash) – C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (MpKsle033037d) – c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{996C69FE-556B-47DA-AD95-1E462181B36C}\MpKsle033037d.sys File not found
DRV - (MpFilter) – system32\DRIVERS\MpFilter.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (hwdatacard) – File not found
DRV - (GAGPDrv) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\User\LOCALS~1\Temp\catchme.sys File not found
DRV - (SWDUMon) – C:\WINDOWS\system32\drivers\SWDUMon.sys ()
DRV - (avgtp) – C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (Apowersoft_AudioDevice) – C:\WINDOWS\system32\drivers\Apowersoft_AudioDevice.sys (Wondershare)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (tap0901) – C:\WINDOWS\system32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (smihlp) – C:\Program Files\Protector Suite QL\smihlp.sys (UPEK Inc.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTSERIAL) – C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (btwhid) – C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)
DRV - (ipasintf) – C:\WINDOWS\system32\drivers\pas2k.sys ()
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (w39n51) – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMSC)
DRV - (RT73) – C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (UIUSys) – C:\WINDOWS\system32\drivers\UIUSYS.SYS (Conexant Systems, Inc)
DRV - (IFXTPM) – C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (GVCplDrv) – C:\WINDOWS\System32\drivers\GVCplDrv.sys ()
DRV - (atirage3) – C:\WINDOWS\system32\drivers\atimpae.sys (ATI Technologies Inc.)
DRV - (NETwLx32) – C:\WINDOWS\system32\drivers\NETwLx32.sys (Intel Corporation)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (O2SCBUS) – C:\WINDOWS\system32\drivers\ozscr.sys (O2Micro)
DRV - (O2MDRDR) – C:\WINDOWS\system32\drivers\o2media.sys (O2Micro )
DRV - (O2SDRDR) – C:\WINDOWS\system32\drivers\o2sd.sys (O2Micro )

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.au/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.google.com.au/"
FF - prefs.js..extensions.enabledAddons: %7Be001c731-5e37-4538-a5cb-8168736a2360%7D:0.9.9.119
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: testpilot%40labs.mozilla.com:1.2.2
FF - prefs.js..extensions.enabledAddons: %7BFCE04E1F-9378-4f39-96F6-5689A9159E45%7D:1.3.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@Allin1Convert_8h.com/Plugin: C:\Program Files\Allin1Convert_8h\bar\1.bin\NP8hStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@FromDocToPDF_65.com/Plugin: C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.2.32: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.2: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.2: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.2: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.2.32: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@UtilityChest_49.com/Plugin: C:\Program Files\UtilityChest_49\bar\1.bin\NP49Stub.dll File not found
FF - HKLM\Software\MozillaPlugins\@VideoDownloadConverter_4z.com/Plugin: C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@citrixonline.com/appdetectorplugin: C:\Documents and Settings\User\Local Settings\Application Data\Citrix\Plugins\97\npappdetector.dll (Citrix Online)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\User\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/06/20 08:04:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FCE04E1F-9378-4f39-96F6-5689A9159E45}: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/06/20 08:04:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\4zffxtbr@VideoDownloadConverter_4z.com: C:\Program Files\VideoDownloadConverter_4z\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2013/08/18 07:12:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/03 21:42:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/11 10:53:31 | 000,000,000 | —D | M]

[2013/03/21 22:36:02 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2013/08/20 19:06:37 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions
[2012/12/10 15:00:23 | 000,000,000 | —D | M] (Bitdefender QuickScan) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/11/11 08:33:39 | 000,000,000 | —D | M] (AVG Security Toolbar) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\avg@toolbar(2)
[2011/11/11 08:33:32 | 000,000,000 | —D | M] (Cooliris) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\piclens@cooliris(2).com
[2013/04/28 14:17:27 | 000,615,445 | —- | M] () (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed]
[2013/07/28 14:18:41 | 000,012,103 | —- | M] () (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
[2013/02/13 17:42:07 | 000,001,145 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\searchplugins\urlcom.xml
[2013/05/18 10:03:24 | 000,001,492 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\searchplugins\web-search-powered-by-google.xml
[2013/03/21 22:36:02 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/07/24 22:32:31 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/04/28 14:16:08 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/07/24 22:32:31 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/08/18 07:26:29 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/05/25 08:38:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\distribution\extensions
[2013/06/20 08:04:48 | 000,000,000 | —D | M] (RealDownloader) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2010/10/27 10:45:15 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/01/03 05:40:28 | 000,104,448 | —- | M] (Crawler, LLC) – C:\Program Files\mozilla firefox\plugins\NPCrwPd.dll
[2013/06/20 08:03:22 | 000,124,504 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:in
s
tantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Documents and Settings\User\Application Data\Mozilla\plugins\np-mswmp.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\User\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Crawler Products Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPCrwPd.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: RealNetworks™ RealDownloader Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll
CHR - plugin: RealNetworks™ RealDownloader HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
CHR - plugin: RealNetworks™ RealDownloader PepperFlashVideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll
CHR - plugin: RealDownloader Plugin (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll
CHR - plugin: Citrix Online Web Deployment Plugin 1.0.0.97 (Enabled) = C:\Documents and Settings\User\Local Settings\Application Data\Citrix\Plugins\97\npappdetector.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U13 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: RealDownloader = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0\
CHR - Extension: Torch Share = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof\1.0.0.2504_0\
CHR - Extension: Skype Click to Call = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.10.0.13089_0\

O1 HOSTS File: ([2013/08/22 23:54:06 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome\Application\29.0.1547.57\npchrome_frame.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe (Intel Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [PPort12reminder] C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Adobe Reader Synchronizer] C:\Program Files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [DriverUpdate] C:\Program Files\DriverUpdate\DriverUpdate.exe (SlimWare Utilities, Inc.)
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe (TP-LINK TECHNOLOGIES CO., LTD.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\MyPC Backup.lnk = C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RoboForm Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1364512205890 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8BA44A5F-843B-4E98-BDC6-56E16580901F}: DhcpNameServer = 192.168.0.1 192.168.1.1
O18 - Protocol\Handler\gcf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome\Application\29.0.1547.57\npchrome_frame.dll (Google Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\psfus: DllName - (psqlpwd.dll) - C:\WINDOWS\System32\psqlpwd.dll (UPEK Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/10/11 20:34:05 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2011/10/31 17:28:00 | 000,000,000 | —D | M] - C:\AutoSave SoundsAndMusic 1 – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/28 07:39:08 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2013/08/27 06:19:44 | 000,000,000 | —D | C] – C:\Program Files\MyPC Backup
[2013/08/26 10:48:52 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/26 10:41:55 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/26 10:41:10 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Start Menu\Programs\Tweaking.com
[2013/08/26 10:41:08 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/26 08:29:11 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\26 indemand products mrr
[2013/08/25 12:18:52 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\(16) John Jonas - Outsource To The Philippines on Facebook_files
[2013/08/24 16:29:32 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\5FigureDay.com.htm look_files
[2013/08/24 15:15:33 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/22 09:56:39 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Firefox takes a long time to start up _ Firefox Help_files
[2013/08/22 00:12:20 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/21 17:20:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/21 17:20:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/21 17:20:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/21 17:20:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/21 17:15:45 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\IAC
[2013/08/21 16:56:44 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/21 16:55:25 | 000,000,000 | —D | C] – C:\WINDOWS\erdnt
[2013/08/19 07:20:48 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Diognosing
[2013/08/18 23:56:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Social Lead Fox
[2013/08/18 23:55:35 | 000,000,000 | —D | C] – C:\WINDOWS\Social Lead Fox
[2013/08/18 23:55:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
[2013/08/18 23:55:06 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2013/08/18 23:51:41 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2013/08/18 23:51:40 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2013/08/18 23:46:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Visual Studio 2005
[2013/08/18 23:46:04 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Microsoft Help
[2013/08/18 23:45:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PowerISO
[2013/08/18 23:44:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\HitmanPro
[2013/08/18 23:44:21 | 000,000,000 | —D | C] – C:\Program Files\HitmanPro
[2013/08/18 14:27:38 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2013/08/17 20:00:40 | 000,000,000 | —D | C] – C:\Avenger
[2013/08/17 19:18:22 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Malwarebytes Solve Your Malware Problems With Our Help_files
[2013/08/17 18:55:26 | 000,204,496 | —- | C] (Malwarebytes) – C:\Documents and Settings\User\Desktop\startuplite-setup-1.07.exe
[2013/08/16 07:50:47 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\New Folder
[2013/08/11 14:27:53 | 000,000,000 | —D | C] – C:\Program Files\SocialLeadFox
[2013/08/11 10:55:16 | 000,029,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mdimon.dll
[2013/08/11 10:48:50 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 8
[2013/08/11 10:47:56 | 000,000,000 | —D | C] – C:\WINDOWS\SHELLNEW
[2013/08/11 10:47:05 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2013/08/11 10:47:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2013/08/11 10:46:23 | 000,000,000 | R–D | C] – C:\MSOCache
[2013/08/11 10:19:23 | 000,000,000 | —D | C] – C:\Program Files\PowerISO
[2013/08/09 22:53:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\HitmanPro
[2013/08/09 08:54:38 | 009,167,352 | —- | C] (SurfRight B.V.) – C:\Documents and Settings\User\Desktop\HitmanPro.exe
[2013/08/09 07:52:35 | 013,391,216 | —- | C] (Siber Systems) – C:\Documents and Settings\User\Desktop\RoboForm-Setup.exe
[2013/08/08 13:57:31 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\converted PDFs
[2013/08/08 13:42:28 | 000,000,000 | —D | C] – C:\Program Files\UPDF
[2013/08/04 15:44:49 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\AWeber Communications_files
[2013/08/04 13:59:10 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\OpenOffice.org
[2013/08/04 13:43:18 | 000,000,000 | –SD | C] – C:\Documents and Settings\User\Start Menu\Programs\OpenOffice.org 3.4.1
[2013/08/04 13:42:13 | 000,000,000 | —D | C] – C:\Program Files\OpenOffice.org 3
[2013/08/04 13:39:56 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\OpenOffice.org 3.4.1 (en-US) Installation Files
[2013/08/04 13:14:55 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Realplaer recordings
[2013/08/02 22:54:40 | 000,000,000 | R–D | C] – C:\Documents and Settings\User\Desktop\New Briefcase
[2013/08/01 15:17:10 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\Leadskimmer
[2013/08/01 14:01:10 | 000,000,000 | —D | C] – C:\Program Files\Zula Games
[2013/08/01 12:57:18 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\zulagames
[2013/08/01 12:57:11 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\SUPERAntiSpyware.com
[2013/08/01 12:56:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2013/08/01 12:56:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2013/08/01 12:56:53 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2013/08/01 09:55:59 | 000,255,488 | R— | C] (Ralink Technology Inc.) – C:\WINDOWS\System32\drivers\netr73.sys
[2013/07/31 15:53:17 | 000,000,000 | —D | C] – C:\Documents and Settings\User\My Documents\BANNERS
[2013/07/31 08:29:01 | 000,238,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe

========== Files - Modified Within 30 Days ==========

[2013/08/28 07:59:01 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/28 07:58:03 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/08/28 07:38:19 | 000,013,464 | —- | M] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/08/28 07:35:00 | 000,000,306 | —- | M] () – C:\WINDOWS\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/28 07:31:18 | 000,000,298 | —- | M] () – C:\WINDOWS\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/28 07:31:11 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/28 07:31:09 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/28 07:31:07 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/08/28 07:27:20 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/28 06:14:49 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003UA.job
[2013/08/27 16:46:51 | 000,409,660 | —- | M] () – C:\Documents and Settings\User\Desktop\outsourcing-your-life.pdf
[2013/08/27 16:34:27 | 000,000,778 | —- | M] () – C:\Documents and Settings\User\Desktop\MyPC Backup.lnk
[2013/08/27 16:34:27 | 000,000,764 | —- | M] () – C:\Documents and Settings\User\Start Menu\Programs\Startup\MyPC Backup.lnk
[2013/08/27 16:33:28 | 010,340,624 | —- | M] () – C:\Documents and Settings\User\Desktop\MyPCBackup_Setup.exe
[2013/08/27 16:15:27 | 000,001,549 | —- | M] () – C:\Documents and Settings\User\Desktop\Sync Folder.lnk
[2013/08/27 12:14:00 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003Core.job
[2013/08/26 14:53:13 | 000,001,892 | —- | M] () – C:\Documents and Settings\User\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/26 08:51:43 | 000,001,626 | —- | M] () – C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
[2013/08/26 08:19:53 | 000,161,507 | —- | M] () – C:\Documents and Settings\User\Desktop\work.jpg
[2013/08/26 08:16:35 | 000,114,688 | —- | M] () – C:\Documents and Settings\User\Desktop\Work.htm
[2013/08/25 10:42:57 | 000,139,264 | —- | M] () – C:\Documents and Settings\User\Desktop\SystemLook.exe
[2013/08/24 16:29:34 | 000,008,566 | —- | M] () – C:\Documents and Settings\User\Desktop\5FigureDay.com.htm look.htm
[2013/08/24 12:50:10 | 000,807,326 | —- | M] () – C:\Documents and Settings\User\Desktop\freesalesfunnel.pdf
[2013/08/23 13:43:40 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/22 23:54:06 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/22 09:56:46 | 000,033,793 | —- | M] () – C:\Documents and Settings\User\Desktop\Firefox takes a long time to start up _ Firefox Help.htm
[2013/08/22 07:14:12 | 000,001,829 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/08/22 00:12:34 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2013/08/21 12:00:44 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/08/21 12:00:43 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/08/17 19:18:25 | 000,014,236 | —- | M] () – C:\Documents and Settings\User\Desktop\Malwarebytes Solve Your Malware Problems With Our Help.htm
[2013/08/17 18:55:31 | 000,204,496 | —- | M] (Malwarebytes) – C:\Documents and Settings\User\Desktop\startuplite-setup-1.07.exe
[2013/08/15 16:36:45 | 000,772,868 | —- | M] () – C:\Documents and Settings\User\Desktop\Module+1.pdf
[2013/08/15 13:43:37 | 000,000,448 | —- | M] () – C:\0
[2013/08/15 10:47:23 | 000,000,144 | —- | M] () – C:\WINDOWS\ANS2000.INI
[2013/08/15 09:19:27 | 000,397,353 | —- | M] () – C:\Documents and Settings\User\Desktop\3-Steps-2-Profit.pdf
[2013/08/15 08:37:20 | 034,162,021 | —- | M] () – C:\Documents and Settings\User\Desktop\mijacko_1080p video mttb.mp4
[2013/08/15 08:28:07 | 034,162,021 | —- | M] () – C:\Documents and Settings\User\Desktop\mijacko_1080p.mp4
[2013/08/14 16:48:32 | 000,505,862 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/14 16:48:32 | 000,089,542 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/12 21:06:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/08/12 07:48:58 | 000,360,136 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/11 14:27:58 | 000,001,644 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Social Lead Fox.lnk
[2013/08/11 10:19:24 | 000,000,698 | —- | M] () – C:\Documents and Settings\All Users\Desktop\PowerISO.lnk
[2013/08/10 07:50:24 | 000,001,996 | —- | M] () – C:\WINDOWS\System32\.crusader
[2013/08/09 19:02:01 | 000,000,324 | —- | M] () – C:\WINDOWS\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/09 08:57:51 | 009,167,352 | —- | M] (SurfRight B.V.) – C:\Documents and Settings\User\Desktop\HitmanPro.exe
[2013/08/09 07:57:44 | 013,391,216 | —- | M] (Siber Systems) – C:\Documents and Settings\User\Desktop\RoboForm-Setup.exe
[2013/08/08 13:58:11 | 000,000,000 | —- | M] () – C:\Documents and Settings\User\Application Data\pdfperformer
[2013/08/06 17:31:45 | 004,476,508 | —- | M] () – C:\Documents and Settings\User\Desktop\wordpress-3.6.zip
[2013/08/05 18:06:14 | 000,015,593 | —- | M] () – C:\Documents and Settings\User\Desktop\Top Tier imabe.jpg
[2013/08/04 15:44:50 | 000,067,589 | —- | M] () – C:\Documents and Settings\User\Desktop\AWeber Communications.htm
[2013/08/04 15:22:58 | 000,001,186 | —- | M] () – C:\Documents and Settings\User\Desktop\29Leadsources.htm
[2013/08/04 14:59:40 | 002,014,159 | —- | M] () – C:\Documents and Settings\User\My Documents\MY PAGE power pont.odp
[2013/08/04 14:26:11 | 000,008,860 | —- | M] () – C:\Documents and Settings\User\My Documents\A Test Test traffic costs ect.ods
[2013/08/04 13:43:22 | 000,000,933 | —- | M] () – C:\Documents and Settings\User\Desktop\OpenOffice.org 3.4.1.lnk
[2013/08/03 22:31:04 | 000,000,758 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/08/03 22:31:04 | 000,000,740 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/08/03 10:07:42 | 000,025,521 | —- | M] () – C:\Documents and Settings\User\My Documents\TrafficExchangeSecrets-PLR.zip
[2013/08/01 14:00:56 | 000,001,130 | —- | M] () – C:\Documents and Settings\User\Desktop\SpeedAnalysis.lnk
[2013/08/01 12:56:59 | 000,001,694 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013/08/01 11:42:44 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif
[2013/07/30 15:11:28 | 000,003,715 | —- | M] () – C:\Program Files\Mozilla Firefoxavg-secure-search.xml
[2013/07/30 15:11:10 | 000,037,664 | —- | M] (AVG Technologies) – C:\WINDOWS\System32\drivers\avgtpx86.sys

========== Files Created - No Company Name ==========

[2013/08/27 16:46:50 | 000,409,660 | —- | C] () – C:\Documents and Settings\User\Desktop\outsourcing-your-life.pdf
[2013/08/27 06:20:13 | 000,000,764 | —- | C] () – C:\Documents and Settings\User\Start Menu\Programs\Startup\MyPC Backup.lnk
[2013/08/26 10:41:10 | 000,001,892 | —- | C] () – C:\Documents and Settings\User\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/26 08:19:49 | 000,161,507 | —- | C] () – C:\Documents and Settings\User\Desktop\work.jpg
[2013/08/26 08:16:34 | 000,114,688 | —- | C] () – C:\Documents and Settings\User\Desktop\Work.htm
[2013/08/25 14:00:37 | 010,340,624 | —- | C] () – C:\Documents and Settings\User\Desktop\MyPCBackup_Setup.exe
[2013/08/25 10:42:56 | 000,139,264 | —- | C] () – C:\Documents and Settings\User\Desktop\SystemLook.exe
[2013/08/24 16:29:31 | 000,008,566 | —- | C] () – C:\Documents and Settings\User\Desktop\5FigureDay.com.htm look.htm
[2013/08/24 12:50:08 | 000,807,326 | —- | C] () – C:\Documents and Settings\User\Desktop\freesalesfunnel.pdf
[2013/08/22 09:56:37 | 000,033,793 | —- | C] () – C:\Documents and Settings\User\Desktop\Firefox takes a long time to start up _ Firefox Help.htm
[2013/08/22 07:21:09 | 000,000,276 | —- | C] () – C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/22 00:12:33 | 000,000,211 | —- | C] () – C:\Boot.bak
[2013/08/22 00:12:28 | 000,260,272 | RHS- | C] () – C:\cmldr
[2013/08/21 17:20:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/21 17:20:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/21 17:20:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/21 17:20:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/21 17:20:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/17 19:18:22 | 000,014,236 | —- | C] () – C:\Documents and Settings\User\Desktop\Malwarebytes Solve Your Malware Problems With Our Help.htm
[2013/08/15 16:36:36 | 000,772,868 | —- | C] () – C:\Documents and Settings\User\Desktop\Module+1.pdf
[2013/08/15 09:19:25 | 000,397,353 | —- | C] () – C:\Documents and Settings\User\Desktop\3-Steps-2-Profit.pdf
[2013/08/15 08:29:42 | 034,162,021 | —- | C] () – C:\Documents and Settings\User\Desktop\mijacko_1080p video mttb.mp4
[2013/08/15 08:21:34 | 034,162,021 | —- | C] () – C:\Documents and Settings\User\Desktop\mijacko_1080p.mp4
[2013/08/11 14:27:58 | 000,001,650 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Social Lead Fox.lnk
[2013/08/11 14:27:58 | 000,001,644 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Social Lead Fox.lnk
[2013/08/11 10:19:24 | 000,000,698 | —- | C] () – C:\Documents and Settings\All Users\Desktop\PowerISO.lnk
[2013/08/10 07:50:24 | 000,001,996 | —- | C] () – C:\WINDOWS\System32\.crusader
[2013/08/09 22:56:02 | 000,001,626 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
[2013/08/08 13:58:11 | 000,000,000 | —- | C] () – C:\Documents and Settings\User\Application Data\pdfperformer
[2013/08/06 17:31:03 | 004,476,508 | —- | C] () – C:\Documents and Settings\User\Desktop\wordpress-3.6.zip
[2013/08/05 18:06:12 | 000,015,593 | —- | C] () – C:\Documents and Settings\User\Desktop\Top Tier imabe.jpg
[2013/08/04 15:44:49 | 000,067,589 | —- | C] () – C:\Documents and Settings\User\Desktop\AWeber Communications.htm
[2013/08/04 15:22:56 | 000,001,186 | —- | C] () – C:\Documents and Settings\User\Desktop\29Leadsources.htm
[2013/08/04 14:50:20 | 002,014,159 | —- | C] () – C:\Documents and Settings\User\My Documents\MY PAGE power pont.odp
[2013/08/04 14:01:49 | 000,008,860 | —- | C] () – C:\Documents and Settings\User\My Documents\A Test Test traffic costs ect.ods
[2013/08/04 13:43:22 | 000,000,933 | —- | C] () – C:\Documents and Settings\User\Desktop\OpenOffice.org 3.4.1.lnk
[2013/08/03 12:25:49 | 000,025,521 | —- | C] () – C:\Documents and Settings\User\My Documents\TrafficExchangeSecrets-PLR.zip
[2013/08/01 12:57:07 | 000,001,130 | —- | C] () – C:\Documents and Settings\User\Desktop\SpeedAnalysis.lnk
[2013/08/01 12:56:59 | 000,001,694 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2013/07/31 08:24:28 | 000,001,945 | —- | C] () – C:\WINDOWS\epplauncher.mif
[2013/05/21 08:50:17 | 000,003,715 | —- | C] () – C:\Program Files\Mozilla Firefoxavg-secure-search.xml
[2013/04/20 12:16:37 | 000,000,049 | —- | C] () – C:\WINDOWS\DictionaryServiceProxy.INI
[2013/03/21 23:56:16 | 000,000,008 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\~wmrg
[2013/02/24 14:22:40 | 000,000,205 | —- | C] () – C:\WINDOWS\hbcikrnl.ini
[2013/02/24 11:19:23 | 000,025,816 | —- | C] () – C:\WINDOWS\System32\drivers\RTAIODAT.DAT
[2013/02/24 09:33:54 | 000,013,464 | —- | C] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2012/12/25 09:07:54 | 000,000,234 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2012/12/25 09:07:54 | 000,000,094 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2012/12/25 09:07:36 | 000,003,311 | —- | C] () – C:\WINDOWS\BRPARAM.INI
[2012/12/25 09:06:20 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2012/12/25 09:05:34 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2012/12/25 09:05:20 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2012/11/09 11:08:54 | 000,319,312 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1960408961-1409082233-725345543-1003-0.dat
[2012/10/11 06:18:49 | 000,000,031 | —- | C] () – C:\WINDOWS\WebUpdateSvc4.INI
[2012/10/11 06:18:03 | 000,047,631 | —- | C] () – C:\WINDOWS\System32\wuwuninst.exe
[2012/10/09 21:30:31 | 000,134,682 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/08/16 15:20:47 | 000,027,520 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\dt.dat
[2012/02/16 14:43:20 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/10/27 08:16:39 | 000,000,138 | —- | C] () – C:\WINDOWS\TomsRegistration.INI
[2011/03/16 07:09:18 | 000,096,768 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/06 07:37:33 | 000,000,127 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\fusioncache.dat

========== ZeroAccess Check ==========

[2010/10/12 10:09:44 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/04/17 02:09:07 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 22:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/14 10:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

firefox browser is coming up instantly , but some pages come up slow . Crom loaded instantly,pages pretty quick,
sound is still no good , even the windows sound is dragging , real player is dragging and stalling , some videos have a Skin could not be loaded
skin not a valid file type message ( i need those videos to play )
i will let you know if it still takes a long time to shut down, after i send this

ok
on shutting down i got a message
c2c_service.exe-Application Error ( not the first time for this message)
The Instruction at "0x0000000 Referenced at 0x0000000- the memory could not be "read"
click on ok to terminate the program
or
click on cancel to debugg the program
i pressed cancel to debugg thhe program

then it continued shutting down
it took 15 minutes to close then
it took 5 mins to get the log in stage of opening

jeffce

Post #38August 28, 2013, 2:33 AM UTC

c2c_service.exe-Application Error

This is normally associated with Skype. You might try to uninstall (save all of your data first) Skype and then reinstall and see if you still have that error.

Let me know how it goes.

michellej

Post #39August 28, 2013, 5:07 AM UTC

Hi jeff i removed skype , and closed computer down still taking over 15 mins to shutdown and no error message this time the computer is still running like a heep of stuff (excuse me ) the browser takes about a minute to come up first time asked , and then not so long pages still take some time i did a malawarebytes scan earlier and come up with 8 pup.optional.DeltaA reg keys 1 x mixedDJToolbar.A 1x pup.optional.speedAnalysis2.A File C/Doc+settings/user/applicationdata/speedAnalyisis .ico

michellej

Post #40August 28, 2013, 5:22 AM UTC

jeffce

Post #41August 28, 2013, 11:32 AM UTC

Hi,

[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Full Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
Close the ESET online scan, and let me know how things are now.

———-

michellej

Post #42August 29, 2013, 1:03 AM UTC last edited August 29, 2013, 5:22 AM UTC

Hi Jeff
i ran malawarebyts and found no results

i cannot turn of microsoft security essentials, so it is still running, , removed avg previously,
i have Hitman pro also , but do not know how to turn it off , 10 days left on free trial ?? so maybe will need to remove it if you say so ??

i have to go out rite now so will do the new scan next when i return
see if you have anything more to say before i run it ??

i also removed all in 1 toolbar from programs

back now

i let Hitman pro do a scan while i was away and it come up with a lot of cookies , Question should i delet cookies ???
im posting this report so you can see the first 2
that are not cookies
i have not done anything with this report ,just closed it
now i will run ESET

HitmanPro 3.7.7.205
www.hitmanpro.com

   Computer name . . . . : ACER_TM6460
   Windows . . . . . . . : 5.1.3.2600.X86/2
   User name . . . . . . : ACER_TM6460\User
   License . . . . . . . : Trial (10 days left)

   Scan date . . . . . . : 2013-08-29 10:50:39
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 1h 47m 17s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 325

   Objects scanned . . . : 917,955
   Files scanned . . . . : 31,357
   Remnants scanned  . . : 310,236 files / 576,362 keys

Suspicious files ____________________________________________________________

   C:\WINDOWS\system32\authorize.dll
	  Size . . . . . . . : 635,392 bytes
	  Age  . . . . . . . : 882.2 days (2011-03-31 06:17:22)
	  Entropy  . . . . . : 7.9
	  SHA-256  . . . . . : BAE8DFD3F31336DB79081DAF9970284D0A698FE9AE6288C0B5573E53540A68B7
	  Fuzzy  . . . . . . : 24.0
		 Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
		 The .rsrc (resources) section in this program is set to executable. This is an indication of malware infection.
		 Program contains PE structure anomalies. This is not typical for most programs.
		 Authors name is missing in version info. This is not common to most programs.
		 Version control is missing. This file is probably created by an individual. This is not typical for most programs.
		 The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.


Potential Unwanted Programs _________________________________________________

   HKLM\SOFTWARE\babylontoolbar\ (Babylon)

Cookies _____________________________________________________________________

   C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\d0ot3tyw.default\cookies.sqlite:atdmt.com
   C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\d0ot3tyw.default\cookies.sqlite:c1.atdmt.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:2o7.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:ad-ace.doubleclick.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:ad.360yield.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:ad.yieldmanager.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:adclick.g.doubleclick.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:ads.pubmatic.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:adtechus.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:advertising.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:apmebf.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:atdmt.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:bs.serving-sys.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:bxformula.cashblurbs.hop.clickbank.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:c1.atdmt.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:casalemedia.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:cba.122.2o7.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:clickbank.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:dmtracker.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:doubleclick.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:fastclick.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:getclicky.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:googleads.g.doubleclick.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:in.getclicky.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:invitemedia.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:kontera.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:media6degrees.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:mediaplex.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:paypal.112.2o7.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:pool-eu-ie.creative-serving.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:revsci.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:serving-sys.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:ssl.clickbank.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:stats.adotube.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:stats.paypal.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:statse.webtrendslive.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:track.adform.net
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:track.safe-swaps.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:tribalfusion.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:view.atdmt.com
   C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\cookies.sqlite:www.googleadservices.com
   C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
   C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:serving-sys.com
   C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:tribalfusion.com

jeffce

Post #43August 29, 2013, 11:38 AM UTC

Thanks for posting that. We will address the cookies later but that Babylon toolbar entry we will need to remove….later.

Let's see what ESET says and then we will go from there. Great Job!

michellej

Post #44August 29, 2013, 11:35 PM UTC

hello jeff this scan takes a real long time , its found 16 threats so far , iv got 1 concern , when setting it up i couldnt find any tab to stop it from removing what it finds , hope that is ok i tried to make this message from another computer but it wouldnt let me and gave a error message and had to log in but says no user on data michellej, i dont want to close this window on sick computer just in case i cannot get logged back in

jeffce

Post #45August 30, 2013, 1:35 AM UTC

Hi,

If the scan removes the files that is ok…not great but ok. When the log is created please go ahead and post it.

and gave a error message and had to log in but says no user on data michellej,
i dont want to close this window on sick computer just in case i cannot get logged back in

Not sure what you mean by this….Is ESET still running?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

microsoft distribution service 3.0 and PUP [Solved]

✨ Ask AI

Ask AI