Hi Jeff
Have done as requested. When I ran OTL with the new code I let it reboot on its own, which it did into normal mode. But I was unable to do anything in normal mode so rebooted back into safe mode. Located the 2 logs which are listed below.
All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Service AdvancedSystemCareService6 stopped successfully!
Service AdvancedSystemCareService6 deleted successfully!
C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe moved successfully.
Prefs.js: ascsurfingprotection%40iobit.com:1.0 removed from extensions.enabledAddons
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\[removed]\chrome\content folder moved successfully.
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\[removed]\chrome folder moved successfully.
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\[removed] folder moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
C:\Documents and Settings\All Users\Application Data\xmlF6.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\xmlF7.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\xmlF8.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\xmlF9.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\lbp6r35x3f07xf1a5 moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Application Data\lbp6r35x3f07xf1a5 moved successfully.
C:\Documents and Settings\All Users\Application Data\lbp6r35x3f07xf1a5 moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\lbp6r35x3f07xf1a5 moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap Games\.system folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PopCap Games folder moved successfully.
C:\Documents and Settings\Owner\Application Data\GetRightToGo folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.
C:\Documents and Settings\Owner\Desktop\OTL\cmd.bat deleted successfully.
C:\Documents and Settings\Owner\Desktop\OTL\cmd.txt deleted successfully.
< dir "C:\Documents and Settings\All Users\Application Data\REGSERVO" /s /c >
Volume in drive C has no label.
Volume Serial Number is 5CFD-2754
Directory of C:\Documents and Settings\All Users\Application Data\REGSERVO
26/08/2013 17:01 .
26/08/2013 17:01 ..
26/08/2013 17:01 LOGS
0 File(s) 0 bytes
Directory of C:\Documents and Settings\All Users\Application Data\REGSERVO\LOGS
26/08/2013 17:01 .
26/08/2013 17:01 ..
26/08/2013 17:10 291,545 LOGS_08_26_2013_17_01_55_PM.log
1 File(s) 291,545 bytes
Total Files Listed:
1 File(s) 291,545 bytes
5 Dir(s) 19,342,811,136 bytes free
C:\Documents and Settings\Owner\Desktop\OTL\cmd.bat deleted successfully.
C:\Documents and Settings\Owner\Desktop\OTL\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: All Users
User: Default User
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 83 bytes
User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 39596279 bytes
->Flash cache emptied: 488 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 7915 bytes
User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 9961 bytes
->Flash cache emptied: 7804 bytes
User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Owner
->Temp folder emptied: 32958431 bytes
->Temporary Internet Files folder emptied: 2880126 bytes
->FireFox cache emptied: 66016994 bytes
->Google Chrome cache emptied: 51978605 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 523 bytes
User: Owner.HOME-1FRNIZ2HGX
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7723 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 197688925 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 373.00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 09082013_103504
OTL logfile created on: 08/09/2013 11:21:12 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Owner\Desktop\OTL
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
1023.49 Mb Total Physical Memory | 595.77 Mb Available Physical Memory | 58.21% Memory free
2.40 Gb Paging File | 2.18 Gb Available in Paging File | 90.59% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.32 Gb Total Space | 18.29 Gb Free Space | 23.97% Space Free | Partition Type: NTFS
Computer Name: HOME-1FRNIZ2HGX | User Name: Owner | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Owner\Desktop\OTL\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
========== Modules (No Company Name) ==========
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
========== Services (SafeList) ==========
SRV - (KService) – File not found
SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (vsmon) – C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
SRV - (PCPitstop Scheduling) – C:\Program Files\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)
SRV - (ioloSystemService) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (ioloFileInfoList) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)
========== Driver Services (SafeList) ==========
DRV - (WDICA) – File not found
DRV - (srescan) – system32\ZoneLabs\srescan.sys File not found
DRV - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\WNt500x86\Sandra.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (Netaapl) – system32\DRIVERS\netaapl.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (Lbd) – system32\DRIVERS\Lbd.sys File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (mbamchameleon) – C:\WINDOWS\system32\drivers\mbamchameleon.sys (MalwareBytes)
DRV - (Avglogx) – C:\WINDOWS\system32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSHX) – C:\WINDOWS\system32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (SmartDefragDriver) – C:\WINDOWS\system32\drivers\SmartDefragDriver.sys ()
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (INQ1usbser) – C:\WINDOWS\system32\drivers\INQ1usbser.sys (AMOI Incorporated)
DRV - (PAC7302) – C:\WINDOWS\system32\drivers\PAC7302.SYS (PixArt Imaging Inc.)
DRV - (qcusbser6k) – C:\WINDOWS\system32\drivers\qcusbser6k.sys (QUALCOMM Incorporated)
DRV - (qcusbpcsync) – C:\WINDOWS\system32\drivers\qcusbpcsync.sys (QUALCOMM Incorporated)
DRV - (qcusbnmea) – C:\WINDOWS\system32\drivers\qcusbnmea.sys (QUALCOMM Incorporated)
DRV - (qcusbmdm6k) – C:\WINDOWS\system32\drivers\qcusbmdm6k.sys (QUALCOMM Incorporated)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\hcf_msft.sys (Conexant)
DRV - (BsUDF) – C:\WINDOWS\System32\drivers\bsudf.sys (ahead software)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (U81xmgmt) – C:\WINDOWS\system32\drivers\u81xmgmt.sys (MCCI)
DRV - (U81xbus) – C:\WINDOWS\system32\drivers\u81xbus.sys (MCCI)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\afs2k.sys (Oak Technology Inc.)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (ousb2hub) – C:\WINDOWS\system32\drivers\ousb2hub.sys (OrangeWare Corporation)
DRV - (ousbehci) – C:\WINDOWS\system32\drivers\ousbehci.sys (OrangeWare Corporation)
DRV - (ip100xp) – C:\WINDOWS\system32\drivers\ipfnd51.sys (IC Plus Corp. )
DRV - (U81xmdm) – C:\WINDOWS\system32\drivers\U81xmdm.sys (MCCI)
DRV - (U81xobex) – C:\WINDOWS\system32\drivers\U81xobex.sys (MCCI)
DRV - (U81xmdfl) – C:\WINDOWS\system32\drivers\U81xmdfl.sys (MCCI)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (VIAudio) – C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (BsStor) – C:\WINDOWS\system32\drivers\bsstor.sys (B.H.A Co.,Ltd.)
DRV - (AEILAB) – C:\WINDOWS\system32\drivers\AEILAB.SYS (USB2LAN Provider)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL =
http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{2FB59B57-73E2-4AD8-B90E-801994DB81F4}: "URL" =
http://uk.search.yahoo.com/search?fr=chr-g…p={searchTerms}
IE - HKCU\..\SearchScopes\{9029491B-0F7A-45C6-B595-96056670086B}: "URL" =
http://www.google.com/search?q={searchTerm…;rlz=1I7GGLR_en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "
http://www.google.com"
FF - prefs.js..extensions.enabledAddons: %7B66E978CD-981F-47DF-AC42-E3CF417C1467%7D:0.4.3
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.2: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2629: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: File not found
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/09/06 17:58:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2013/02/02 22:01:43 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/07/27 15:48:09 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/25 00:04:14 | 000,000,000 | —D | M]
[2012/11/26 15:43:19 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2013/08/19 18:36:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions
[2012/10/08 15:59:32 | 000,000,000 | —D | M] (Forecastfox) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2010/06/26 22:45:02 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/11/24 00:36:49 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(3)
[2010/01/28 16:33:32 | 000,000,000 | —D | M] (Clipmarks) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{e1170235-2845-420c-acc3-42261a29dd46}
[2012/09/06 18:38:00 | 000,003,793 | —- | M] () (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi
[2013/07/26 01:43:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/07/26 01:43:56 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2013/07/26 01:43:52 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/07/26 01:44:35 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/09/08 11:16:08 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\updated\extensions
[2013/09/08 11:16:10 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\updated\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2013/09/08 11:16:08 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2013/09/08 11:16:27 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/09/06 17:58:22 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2006/03/27 10:01:04 | 000,065,610 | —- | M] (Superscape) – C:\Program Files\mozilla firefox\plugins\NPVISLITE.dll
[2009/10/15 21:04:48 | 000,003,700 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fast.png
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncodin
g}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter}
CHR - homepage: http://google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: VisLite for Netscape (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPVISLITE.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: npFFApi (Enabled) = C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll
CHR - plugin: DivX\u00AE Content Upload Plugin (Enabled) = C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: Yahoo! activeX Plug-in Bridge (Enabled) = C:\Program Files\Yahoo!\Common\npyaxmpb.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Java Deployment Toolkit 7.0.250.16 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Google Docs = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Advanced SystemCare Surfing Protection = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_0\
CHR - Extension: Chrome In-App Payments service = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Gmail = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2013/08/26 11:26:35 | 000,000,202 | –S- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u File not found
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell; Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM File not found
O8 - Extra context menu item: Check &Spelling; - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM File not found
O9 - Extra Button: Casino-on-Net - {3015DB92-158E-4b77-9020-85C8E311FBB5} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089}
http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (Reg Error: Value error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} http://www.lizardtech.com/download/files/w…ntrol_en_US.cab (DjVuCtl Class)
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} http://www.ipix.com/viewers/ipixx.cab (iPIX ActiveX Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Value error.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E}
http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (Reg Error: Value error.)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258}
http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B}
http://sib1.od2.com/common/Member/ClientIn…6/OCI/setup.exe (InstallShield Setup Player 2K2)
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4}
http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab (Reg Error: Value error.)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab (Reg Error: Value error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://update.microsoft.com/microsoftupdat…b?1151858104609 (MUWebControl Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F}
http://v4.windowsupdate.microsoft.com/CAB/…8121.3895949074 (Reg Error: Key error.)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}
http://game09.zylom.com/activex/zylomgamesplayer.cab (Reg Error: Value error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2}
https://signin3.valueactive.com/Register/Br…OCX/flashax.cab (FlashXControl Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} http://www2.incredimail.com/contents/setup…er/imloader.cab (IMDownloader Class)
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} http://chat.msn.com/bin/msnchat45.cab (MSN Chat Control 4.5)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9AF050FC-7C1F-43B3-932C-22E23A57BAF3}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CA209DC0-5D11-472E-BD4C-830239E65930}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D25F6DD9-BD30-40E7-8A96-AAD5F5AE08D7}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/05/14 01:40:09 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013/09/08 10:35:04 | 000,000,000 | —D | C] – C:\_OTL
[2013/09/08 10:26:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2013/09/08 10:22:59 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\Owner\Desktop\erunt-setup.exe
[2013/09/07 20:15:58 | 000,000,000 | —D | C] – C:\RegBackup
[2013/09/07 20:13:35 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/09/07 20:13:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Tweaking.com
[2013/09/07 19:10:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\AdwClean
[2013/09/07 19:09:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\TDSSKiller
[2013/09/07 19:08:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\DDS
[2013/09/07 19:07:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\OTL
[2013/09/06 13:46:25 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2013/09/06 13:33:51 | 005,120,615 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2013/09/05 18:05:21 | 000,000,000 | —D | C] – C:\AdwCleaner
[2013/09/05 17:32:57 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner\PrintHood
[2013/08/28 14:29:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2013/08/28 14:29:13 | 000,000,000 | —D | C] – C:\Program Files\PCPitstop
[2013/08/28 12:28:37 | 000,000,000 | —D | C] – C:\d1ace7db504644782a52
[2013/08/28 11:54:22 | 000,000,000 | —D | C] – C:\25975afc8c90166dc896b5199e5d
[2013/08/28 11:52:59 | 000,000,000 | —D | C] – C:\8c089cfbe127b64e26f526c724
[2013/08/28 07:27:00 | 000,000,000 | —D | C] – C:\Program Files\ACW
[2013/08/28 07:26:59 | 000,000,000 | —D | C] – C:\6d2b869eead137affd16f5c452e3
[2013/08/28 05:33:56 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner\Recent
[2013/08/28 04:14:58 | 000,048,728 | —- | C] (MalwareBytes) – C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/08/28 04:10:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\Rootkit
[2013/08/28 01:26:41 | 000,000,000 | —D | C] – C:\9529e31a4099252e24206a2911e3
[2013/08/27 15:18:12 | 000,347,424 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Owner\Desktop\MicrosoftFixit.WinFileFolder.FISC.33301043773215625.1.1.Run.exe
[2013/08/26 17:01:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\REGSERVO
[2013/08/26 17:01:31 | 000,000,000 | —D | C] – C:\Program Files\REGSERVO
[2013/08/26 12:53:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\PC MightyMax 2013
[2013/08/26 02:30:31 | 000,256,904 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2013/08/25 00:27:44 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot_bak
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Program Files\MetaTrader 4
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IDM
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\DMCache
[2013/08/25 00:01:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\ElevatedDiagnostics
[2013/08/23 14:48:22 | 000,000,000 | —D | C] – C:\a839a845978f22927a
[2013/08/23 13:27:03 | 000,000,000 | —D | C] – C:\82a67d6b8f7c069c65c656
[2013/08/23 12:03:02 | 000,000,000 | —D | C] – C:\WINDOWS\SP3
[2013/08/23 09:34:06 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2013/08/22 22:18:17 | 000,012,160 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brfiltlo.sys
[2013/08/22 22:18:16 | 000,002,944 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brfilt.sys
[2013/08/22 22:18:15 | 000,012,800 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brevif.dll
[2013/08/22 22:18:14 | 000,019,456 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brbidiif.dll
[2013/08/22 22:18:14 | 000,009,728 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brcoinst.dll
[2013/08/22 22:18:06 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\binlsvc.dll
[2013/08/22 22:12:40 | 000,871,388 | —- | C] (BCM) – C:\WINDOWS\System32\dllcache\bcmdm.sys
[2013/08/22 22:12:39 | 000,026,568 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\bcm4e5.sys
[2013/08/22 22:12:38 | 000,066,557 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\bcm42u.sys
[2013/08/22 22:12:38 | 000,054,271 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\bcm42xx5.sys
[2013/08/22 22:12:36 | 000,014,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\battc.sys
[2013/08/22 22:12:35 | 000,036,128 | —- | C] (3Dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\banshee.sys
[2013/08/22 22:12:34 | 000,342,336 | —- | C] (3Dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\banshee.dll
[2013/08/22 22:12:33 | 000,096,640 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\b57xp32.sys
[2013/08/22 22:12:33 | 000,089,952 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\b1cbase.sys
[2013/08/22 22:12:32 | 000,036,992 | —- | C] (Aztech Systems Ltd) – C:\WINDOWS\System32\dllcache\aztw2320.sys
[2013/08/22 22:12:31 | 000,037,568 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmwan.sys
[2013/08/22 22:12:30 | 000,144,384 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmenum.dll
[2013/08/22 22:12:29 | 000,087,552 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2013/08/22 22:12:27 | 000,013,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avcstrm.sys
[2013/08/22 22:12:26 | 000,036,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avcaudio.sys
[2013/08/22 22:12:25 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avc.sys
[2013/08/22 22:12:13 | 000,070,528 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atiragem.sys
[2013/08/22 22:12:12 | 000,104,832 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atiraged.dll
[2013/08/22 22:12:09 | 000,281,600 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimtai.sys
[2013/08/22 22:12:09 | 000,075,136 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimpae.sys
[2013/08/22 22:12:08 | 000,289,664 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimpab.sys
[2013/08/22 22:12:07 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atievxx.exe
[2013/08/22 22:12:06 | 000,268,160 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidvai.dll
[2013/08/22 22:12:06 | 000,137,216 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidrae.dll
[2013/08/22 22:12:05 | 000,382,592 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidrab.dll
[2013/08/22 22:12:00 | 000,077,568 | —- | C] (ATI Technologies, Inc.) – C:\WINDOWS\System32\dllcache\ati.sys
[2013/08/22 22:11:59 | 000,096,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ati.dll
[2013/08/22 22:11:58 | 000,097,354 | —- | C] (Bay Networks, Inc.) – C:\WINDOWS\System32\dllcache\aspndis3.sys
[2013/08/22 22:11:56 | 000,022,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asc3350p.sys
[2013/08/22 22:11:56 | 000,014,848 | —- | C] (Advanced System Products, Inc.) – C:\WINDOWS\System32\dllcache\asc3550.sys
[2013/08/22 22:11:55 | 000,026,496 | —- | C] (Advanced System Products, Inc.) – C:\WINDOWS\System32\dllcache\asc.sys
[2013/08/22 21:37:31 | 000,006,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\apmbatt.sys
[2013/08/22 21:37:30 | 000,036,224 | —- | C] (ADMtek Incorporated.) – C:\WINDOWS\System32\dllcache\an983.sys
[2013/08/22 21:37:29 | 000,012,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\amsint.sys
[2013/08/22 21:37:28 | 000,016,969 | —- | C] (AmbiCom, Inc.) – C:\WINDOWS\System32\dllcache\amb8002.sys
[2013/08/22 21:37:26 | 000,026,624 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\alifir.sys
[2013/08/22 21:37:26 | 000,005,248 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\aliide.sys
[2013/08/22 21:37:25 | 000,027,678 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\ali5261.sys
[2013/08/22 21:37:24 | 000,056,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aic78xx.sys
[2013/08/22 21:37:23 | 000,055,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aic78u2.sys
[2013/08/22 21:37:23 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aha154x.sys
[2013/08/22 21:37:11 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agcgauge.ax
[2013/08/22 21:37:08 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_adsiisex.dll
[2013/08/22 21:34:36 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adpu160m.sys
[2013/08/22 21:34:36 | 000,046,112 | —- | C] (Adaptec, Inc ) – C:\WINDOWS\System32\dllcache\adptsf50.sys
[2013/08/22 21:34:34 | 000,010,880 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\admjoy.sys
[2013/08/22 21:34:33 | 000,747,392 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8830.sys
[2013/08/22 21:34:33 | 000,553,984 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8820.sys
[2013/08/22 21:34:32 | 000,584,448 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8810.sys
[2013/08/22 21:34:31 | 000,020,160 | —- | C] (ADMtek Incorporated) – C:\WINDOWS\System32\dllcache\adm8511.sys
[2013/08/22 21:34:30 | 000,007,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adicvls.sys
[2013/08/22 21:34:27 | 000,061,440 | —- | C] (Color Flatbed Scanner) – C:\WINDOWS\System32\dllcache\acerscad.dll
[2013/08/22 21:34:26 | 000,297,728 | —- | C] (Silicon Integrated Systems Corp.) – C:\WINDOWS\System32\dllcache\ac97sis.sys
[2013/08/22 21:34:25 | 000,096,256 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ac97intc.sys
[2013/08/22 21:34:23 | 000,231,552 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\ac97ali.sys
[2013/08/22 21:34:23 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\abp480n5.sys
[2013/08/22 21:34:22 | 000,462,848 | —- | C] (Aureal Inc.) – C:\WINDOWS\System32\dllcache\a3dapi.dll
[2013/08/22 21:34:21 | 000,098,304 | —- | C] (Aureal Semiconductor) – C:\WINDOWS\System32\dllcache\a3d.dll
[2013/08/22 21:34:20 | 000,038,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\8514a.dll
[2013/08/22 21:34:19 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\61883.sys
[2013/08/22 21:34:18 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\4mmdat.sys
[2013/08/22 21:34:17 | 000,148,352 | —- | C] (3dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2013/08/22 21:34:16 | 000,762,780 | —- | C] (3Com, Inc.) – C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2013/08/22 21:34:16 | 000,689,216 | —- | C] (3dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2013/08/22 21:34:15 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\1394vdbg.sys
[2013/08/22 21:34:13 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\1394bus.sys
[2013/08/22 21:33:45 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\s3legacy.dll
[2013/08/22 13:59:23 | 000,000,000 | —D | C] – C:\Program Files\DependencyWalker
[2013/08/22 13:14:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\ForceField Shared Files
[2013/08/21 13:25:09 | 000,488,408 | —- | C] (MetaQuotes Software Corp.) – C:\Documents and Settings\Owner\Desktop\mt4setup.exe
[2013/08/20 03:41:23 | 000,000,000 | —D | C] – C:\MATS
[2009/01/13 17:49:04 | 004,004,827 | —- | C] (Promotion And Display T) – C:\Program Files\SISetup.ex
[2003/06/13 13:21:36 | 000,005,632 | —- | C] (Niksoft Computer-Service) – C:\Program Files\disabled.exe
[1999/12/10 13:00:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Program Files\psapi.dll
[1996/01/12 01:00:00 | 000,348,672 | —- | C] (Microsoft Corporation) – C:\Program Files\vb40032.dll
[1996/01/12 01:00:00 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Program Files\vb4de32.dll
========== Files - Modified Within 30 Days ==========
[2013/09/08 10:43:22 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/09/08 10:43:13 | 078,626,816 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2013/09/08 10:27:13 | 000,000,767 | —- | M] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2013/09/08 10:26:39 | 000,000,611 | —- | M] () – C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2013/09/08 10:26:39 | 000,000,592 | —- | M] () – C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2013/09/08 10:23:00 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\Owner\Desktop\erunt-setup.exe
[2013/09/07 21:04:31 | 000,005,754 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/09/07 20:13:35 | 000,001,876 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Tweaking.com - Registry Backup.lnk
[2013/09/07 20:10:58 | 003,851,089 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tweaking.com_registry_backup_setup.exe
[2013/09/06 18:11:41 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2013/09/06 13:33:54 | 005,120,615 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2013/09/05 19:37:52 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/08/29 00:51:52 | 000,000,134 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Fix it.url
[2013/08/28 14:29:31 | 000,001,626 | —- | M] () – C:\Documents and Settings\Owner\Desktop\PC Pitstop Optimize3.lnk
[2013/08/28 12:47:34 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2013/08/28 04:14:58 | 000,048,728 | —- | M] (MalwareBytes) – C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/08/27 15:18:19 | 000,347,424 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Owner\Desktop\MicrosoftFixit.WinFileFolder.FISC.33301043773215625.1.1.Run.exe
[2013/08/26 23:02:15 | 000,275,181 | —- | M] () – C:\Documents and Settings\Owner\Desktop\WindowsUpdateDiagnostic.diagcab
[2013/08/26 17:24:03 | 000,000,071 | —- | M] () – C:\WINDOWS\System32\1377534243.(null)
[2013/08/26 13:14:42 | 000,000,072 | —- | M] () – C:\WINDOWS\System32\1377519282.(null)
[2013/08/26 11:26:35 | 000,000,202 | –S- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/26 03:16:50 | 000,178,469 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\census.cache
[2013/08/26 03:16:39 | 000,202,396 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\ars.cache
[2013/08/23 15:10:00 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/08/23 15:06:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/23 14:19:00 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2013/08/23 09:40:51 | 000,481,492 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/23 09:40:51 | 000,086,304 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/23 09:36:35 | 000,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2013/08/23 09:36:35 | 000,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2013/08/23 09:34:26 | 000,000,815 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/23 09:27:28 | 000,239,144 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/23 04:54:18 | 000,250,032 | RHS- | M] () – C:\ntldr
[2013/08/22 14:33:08 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/08/22 00:23:03 | 000,001,734 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk
[2013/08/21 13:25:11 | 000,488,408 | —- | M] (MetaQuotes Software Corp.) – C:\Documents and Settings\Owner\Desktop\mt4setup.exe
[2013/08/21 02:06:40 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/08/21 02:06:39 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/08/20 00:58:07 | 000,445,511 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-010221.backup
[2013/08/18 16:19:04 | 000,203,264 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/08/12 23:54:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
========== Files Created - No Company Name ==========
[2013/09/08 10:27:13 | 000,000,767 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2013/09/08 10:26:39 | 000,000,611 | —- | C] () – C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk
[2013/09/08 10:26:39 | 000,000,592 | —- | C] () – C:\Documents and Settings\Owner\Desktop\ERUNT.lnk
[2013/09/07 20:13:35 | 000,001,876 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Tweaking.com - Registry Backup.lnk
[2013/09/07 20:10:57 | 003,851,089 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/28 14:29:30 | 000,001,626 | —- | C] () – C:\Documents and Settings\Owner\Desktop\PC Pitstop Optimize3.lnk
[2013/08/27 19:16:42 | 078,626,816 | —- | C] () – C:\WINDOWS\MEMORY.DMP
[2013/08/26 23:02:08 | 000,275,181 | —- | C] () – C:\Documents and Settings\Owner\Desktop\WindowsUpdateDiagnostic.diagcab
[2013/08/26 17:24:03 | 000,000,071 | —- | C] () – C:\WINDOWS\System32\1377534243.(null)
[2013/08/26 13:14:42 | 000,000,072 | —- | C] () – C:\WINDOWS\System32\1377519282.(null)
[2013/08/26 10:30:08 | 000,000,134 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Microsoft Fix it.url
[2013/08/26 03:16:50 | 000,178,469 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\census.cache
[2013/08/26 03:16:39 | 000,202,396 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\ars.cache
[2013/08/23 09:34:26 | 000,000,815 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/23 09:34:26 | 000,000,803 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Internet Explorer.lnk
[2013/08/22 22:12:19 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\dllcache\atixbar.sys
[2013/08/22 22:12:18 | 000,026,624 | —- | C] () – C:\WINDOWS\System32\dllcache\ativxbar.sys
[2013/08/22 22:12:17 | 000,019,456 | —- | C] () – C:\WINDOWS\System32\dllcache\ativttxx.sys
[2013/08/22 22:12:16 | 000,017,152 | —- | C] () – C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2013/08/22 22:12:16 | 000,009,472 | —- | C] () – C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2013/08/22 22:12:15 | 000,017,152 | —- | C] () – C:\WINDOWS\System32\dllcache\atitunep.sys
[2013/08/22 22:12:14 | 000,049,920 | —- | C] () – C:\WINDOWS\System32\dllcache\atirtcap.sys
[2013/08/22 22:12:14 | 000,026,880 | —- | C] () – C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2013/08/22 22:12:12 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2013/08/22 22:12:04 | 000,046,464 | —- | C] () – C:\WINDOWS\System32\dllcache\atibt829.sys
[2013/08/22 00:23:03 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk
[2013/08/22 00:23:01 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk
[2013/07/17 17:27:21 | 000,014,776 | —- | C] () – C:\WINDOWS\System32\drivers\SmartDefragDriver.sys
[2013/06/03 21:19:56 | 000,002,023 | —- | C] () – C:\Documents and Settings\Owner\.recently-used.xbel
[2012/07/04 20:47:14 | 000,007,596 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/02/16 21:03:00 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/28 23:07:56 | 000,047,896 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/05/03 12:25:38 | 000,000,036 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache
[2011/03/09 23:37:03 | 010,977,280 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sandra.mda
[2010/03/09 11:00:14 | 000,000,586 | —- | C] () – C:\Documents and Settings\Owner\Shortcut to My Documents.lnk
[2009/02/13 23:52:19 | 000,007,528 | —- | C] () – C:\Program Files\dirMap-le
[2009/02/13 18:59:03 | 000,001,861 | —- | C] () – C:\Program Files\RFPOrderingInfo.html
[2009/01/13 17:49:05 | 001,189,712 | —- | C] () – C:\Program Files\data2.cab
[2009/01/13 17:49:05 | 000,470,174 | —- | C] () – C:\Program Files\engine32.cab
[2009/01/13 17:49:05 | 000,464,834 | —- | C] () – C:\Program Files\setup.ibt
[2009/01/13 17:49:05 | 000,027,414 | —- | C] () – C:\Program Files\data1.hdr
[2009/01/13 17:49:05 | 000,000,729 | —- | C] () – C:\Program Files\setup.ini
[2009/01/13 17:49:05 | 000,000,455 | —- | C] () – C:\Program Files\layout.bin
[2009/01/13 17:49:04 | 002,059,521 | —- | C] () – C:\Program Files\data1.cab
[2009/01/13 17:49:04 | 000,222,562 | —- | C] () – C:\Program Files\setup.inx
[2008/12/08 23:06:38 | 013,107,200 | —- | C] () – C:\Documents and Settings\Owner\ntuser.bak
[2008/04/18 22:44:02 | 000,000,032 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2007/01/02 22:30:43 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2006/08/13 20:40:26 | 019,871,883 | —- | C] () – C:\Documents and Settings\Owner\WorkDay1.gif
[2006/08/13 20:37:32 | 019,871,883 | —- | C] () – C:\Documents and Settings\Owner\workday1
[2006/06/29 23:30:48 | 005,913,195 | —- | C] () – C:\Program Files\dia-0.92.2-1-setup.exe
[2006/06/18 12:20:16 | 000,000,575 | —- | C] () – C:\Documents and Settings\Owner\log.pxt
[2006/05/07 14:19:57 | 000,001,751 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/02 19:25:34 | 004,678,103 | —- | C] () – C:\Documents and Settings\Owner\forex systems research company - forex trading with candlest.pdf
[2005/10/03 14:26:51 | 035,646,644 | —- | C] () – C:\Program Files\nisas05eng_in.exe
[2005/07/12 23:09:58 | 000,013,650 | —- | C] () – C:\Program Files\mailpv.chm
[2005/03/02 15:35:10 | 000,115,992 | —- | C] () – C:\Documents and Settings\Owner\KRC HijackThis Analyzer.zip
[2005/02/25 23:40:55 | 000,049,559 | —- | C] () – C:\Documents and Settings\Owner\winpatrollog.html
[2005/02/24 00:17:44 | 000,205,674 | —- | C] () – C:\Program Files\CWShredder.zip
[2005/02/18 13:31:38 | 000,000,137 | —- | C] () – C:\Documents and Settings\NetworkService\Local Settings\Application Data\fusioncache.dat
[2004/07/27 15:06:05 | 000,000,014 | —- | C] () – C:\Documents and Settings\Owner\usb
[2004/05/15 13:54:22 | 000,203,264 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/05/14 05:12:15 | 000,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2003/01/19 17:10:16 | 000,000,194 | —- | C] () – C:\Program Files\EraserSetup.asc
[2003/01/19 17:09:42 | 002,745,808 | —- | C] () – C:\Program Files\erasersetup.exe
========== ZeroAccess Check ==========
[2004/05/14 04:57:24 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2006/09/23 13:12:50 | 001,497,088 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\System32\wbem\fastprox.dll – [2006/11/24 03:46:23 | 000,472,064 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2006/11/24 03:46:22 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both
< End of report >
I did as instructed in your last post, by downloading tweaking.com Registry Backup. Tried running the program twice and pressed the Backup button whilst on the Backup Registry Tab, but nothing happened, just that the program frooze up on me. Could not exit the window or end the process, so had to resort to a hard reboot on both ocassions. Because I was unable to backup the registry I did not run OTL.exe with your additional code 
