Spyware / Malware / Virus Removal

"Sponsorship" virus/longfintuna [Solved]

22 min read

Looking for the outcome? Ask AI

veramitude

Post #16September 21, 2013, 2:49 AM UTC

It won't let me download it now. It says I have "insufficient permissions"

veramitude

Post #17September 21, 2013, 3:12 PM UTC

i figured out how to restore adcleaner from avg, so i could run it again. Here is the report: # AdwCleaner v3.004 - Report created 21/09/2013 at 01:08:48 # Updated 15/09/2013 by Xplode # Operating System : Windows 7 Starter Service Pack 1 (32 bits) # Username : veramitude - VERAMITUDE-PC # Running from : C:\Users\veramitude\Downloads\AdwCleaner.exe # Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** File Found : C:\Users\veramitude\Desktop\Uninstall.exe File Found : C:\Windows\System32\Tasks\BrowserDefendert File Found : C:\Windows\System32\Tasks\DSite File Found : C:\Windows\System32\Tasks\EPUpdater Folder Found : C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Folder Found C:\Program Files\AVG Secure Search Folder Found C:\Program Files\Common Files\AVG Secure Search Folder Found C:\ProgramData\AVG Secure Search Folder Found C:\ProgramData\Babylon Folder Found C:\Users\veramitude\AppData\Local\AVG Secure Search Folder Found C:\Users\veramitude\AppData\LocalLow\AVG Secure Search Folder Found C:\Users\veramitude\AppData\Roaming\DSite ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKCU\Software\5e5788d9e23ce847 Key Found : HKCU\Software\AVG Secure Search Key Found : HKCU\Software\BabSolution Key Found : HKCU\Software\Delta Key Found : HKCU\Software\IGearSettings Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKLM\SOFTWARE\5e5788d9e23ce847 Key Found : HKLM\Software\AVG Secure Search Key Found : HKLM\Software\AVG Security Toolbar Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2} Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB} Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1 Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1 Key Found : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Found : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3} Key Found : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Key Found : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9} Key Found : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC} Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Found : HKLM\SOFTWARE\Classes\Prod.cap Key Found : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94} Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1 Key Found : HKLM\Software\DataMngr Key Found : HKLM\Software\Delta Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\BrowserDefendert Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\DSite Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\EPUpdater Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\BrowserDefendert Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\DSite Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\EPUpdater Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BrowserDefendert Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DSite Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EPUpdater Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin Key Found : HKLM\Software\Tarma Installer Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar] ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16686 -\\ Google Chrome v [ File : C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\preferences ] Found : homepage ************************* AdwCleaner[R0].txt - [7005 octets] - [19/09/2013 22:16:49] AdwCleaner[R1].txt - [7065 octets] - [20/09/2013 22:37:15] AdwCleaner[R2].txt - [6985 octets] - [21/09/2013 01:08:48] ########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [7045 octets] ##########

veramitude

Post #18September 21, 2013, 4:13 PM UTC

new otl report:

OTL logfile created on: 9/21/2013 11:17:55 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\veramitude\Downloads
Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16686)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1012.30 Mb Total Physical Memory | 282.06 Mb Available Physical Memory | 27.86% Memory free
2.08 Gb Paging File | 0.72 Gb Available in Paging File | 34.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 219.79 Gb Total Space | 182.52 Gb Free Space | 83.04% Space Free | Partition Type: NTFS

Computer Name: VERAMITUDE-PC | User Name: veramitude | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\veramitude\AppData\Local\Temp\CR_9B71B.tmp\setup.exe (Google Inc.)
PRC - C:\Users\veramitude\AppData\Local\Google\Update\Install\{608E8B82-B792-48FD-B748-5542E87030B6}\29.0.1547.76_29.0.1547.66_chrome_updater.exe ()
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Users\veramitude\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgfws.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgcfgex.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe (AVG Secure Search)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\loggingserver.exe ()
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe (Acer Incorporated)
PRC - C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Program Files\Gateway\Gateway Power Management\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Launch Manager\LMutilps32.exe (Dritek System Inc.)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files\Gateway\Registration\GREGsvc.exe (Acer Incorporated)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe (Acer Incorporated)
PRC - C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
PRC - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE ()

========== Modules (No Company Name) ==========

MOD - C:\Users\veramitude\AppData\Local\Google\Update\Install\{608E8B82-B792-48FD-B748-5542E87030B6}\29.0.1547.76_29.0.1547.66_chrome_updater.exe ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\log4cplusU.dll ()
MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\SiteSafety.dll ()
MOD - C:\Program Files\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE ()

========== Services (SafeList) ==========

SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgfws) – C:\Program Files\AVG\AVG2014\avgfws.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2014\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (vToolbarUpdater15.5.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe (AVG Secure Search)
SRV - (sftvsa) – C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (ePowerSvc) – C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe (Acer Incorporated)
SRV - (DsiWMIService) – C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (GREGService) – C:\Program Files\Gateway\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (Live Updater Service) – C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe (Acer Incorporated)
SRV - (IconMan_R) – C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
SRV - (IAStorDataMgrSvc) – C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (avgtp) – C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (SWDUMon) – C:\Windows\System32\drivers\SWDUMon.sys ()
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgdiskx) – C:\Windows\System32\drivers\avgdiskx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Sftvol) – C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation)
DRV - (Sftplay) – C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV - (Sftredir) – C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV - (Sftfs) – C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation)
DRV - (Avgfwfd) – C:\Windows\System32\drivers\avgfwd6x.sys (AVG Technologies CZ, s.r.o.)
DRV - (igddim32) – C:\Windows\System32\drivers\igddim32.sys (Intel Corporation)
DRV - (IntcDAud) – C:\Windows\System32\drivers\IntcDAud.sys (Intel® Corporation)
DRV - (RSPCIESTOR) – C:\Windows\System32\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (TsUsbGD) – C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com/?pc=MAGW
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={2430666…mp;d=2012-07-20 17:08:01&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\veramitude\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\veramitude\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\14.2.0.1 [2013/02/18 23:12:15 | 000,000,000 | —D | M]

[2013/08/10 00:23:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncodin
g}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter},
CHR - homepage: http://www1.delta-search.com/?babsrc=HP_ss…c1&tsp=4970
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\Application\29.0.1547.66\gcswf32.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1901_0\plugins/avgnpss.dll
CHR - plugin: Norton Confidential (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.3.7_0\npcoplgn.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Best Buy pc app Detector (Enabled) = C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll
CHR - plugin: Google Update (Enabled) = C:\Users\veramitude\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: AVG Secure Search = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.5.0.2_0\
CHR - Extension: Chrome In-App Payments service = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\
CHR - Extension: Gmail = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/09/19 21:49:21 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2014\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Power Management] C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5422BDDB-2A4B-4D0D-B43E-7833771D1F38}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner - No CLSID value found
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll (AVG Secure Search)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{e9213060-0477-11e3-9806-047d7b23985b}\Shell - "" = AutoRun
O33 - MountPoints2\{e9213060-0477-11e3-9806-047d7b23985b}\Shell\AutoRun\command - "" = D:\TL_Bootstrap.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/09/19 22:16:11 | 000,000,000 | —D | C] – C:\AdwCleaner
[2013/09/19 21:48:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/09/19 21:16:32 | 000,000,000 | —D | C] – C:\RegBackup
[2013/09/19 21:15:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
[2013/09/19 21:15:06 | 000,000,000 | —D | C] – C:\Users\veramitude\Desktop\files
[2013/09/19 21:15:03 | 001,346,048 | —- | C] (Indigo Rose Corporation) – C:\Users\veramitude\Desktop\uninstall.exe
[2013/09/19 21:15:03 | 000,000,000 | —D | C] – C:\Users\veramitude\Desktop\Uninstall
[2013/09/17 02:58:41 | 000,000,000 | —D | C] – C:\Users\veramitude\AppData\Roaming\AVG2014
[2013/09/17 02:54:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2013/09/17 02:54:18 | 000,000,000 | —D | C] – C:\Program Files\AVG Secure Search
[2013/09/17 02:46:01 | 000,000,000 | —D | C] – C:\ProgramData\AVG2014
[2013/09/17 02:37:38 | 000,000,000 | —D | C] – C:\Users\veramitude\AppData\Local\Avg2014
[2013/09/12 21:33:58 | 002,706,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2013/09/12 21:33:55 | 002,876,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2013/09/12 21:33:54 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2013/09/12 21:33:53 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2013/09/12 21:33:52 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2013/09/12 21:33:50 | 000,493,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2013/09/12 21:33:50 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2013/09/12 21:33:50 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2013/09/12 21:33:50 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2013/09/12 21:33:50 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2013/09/11 23:31:49 | 000,133,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ataport.sys
[2013/09/11 23:31:46 | 002,348,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2013/09/11 23:31:43 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
[2013/09/11 23:31:43 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2013/09/11 23:31:42 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/09/11 23:31:41 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/09/11 23:31:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/09/11 23:31:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/09/11 23:31:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/08/24 03:00:36 | 000,000,000 | —D | C] – C:\Users\veramitude\AppData\Roaming\AVG
[2013/08/24 02:33:45 | 000,000,000 | —D | C] – C:\ProgramData\AVG
[2013/08/24 02:33:29 | 000,000,000 | -HSD | C] – C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/08/22 23:37:18 | 000,176,952 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2013/08/22 22:56:56 | 000,209,208 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgidsdriverx.sys
[2013/08/22 22:56:16 | 000,223,032 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avglogx.sys
[2013/08/22 22:56:16 | 000,146,232 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgidshx.sys

========== Files - Modified Within 30 Days ==========

[2013/09/21 11:30:12 | 000,002,362 | —- | M] () – C:\Users\veramitude\Desktop\Google Chrome.lnk
[2013/09/21 11:19:19 | 000,000,928 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1642401797-1464783693-1534332608-1000UA.job
[2013/09/21 11:03:01 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/09/21 11:02:59 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/09/21 11:02:10 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/09/21 01:13:48 | 000,000,114 | —- | M] () – C:\Users\veramitude\AppData\Roaming\WB.CFG
[2013/09/21 01:13:48 | 000,000,005 | —- | M] () – C:\Users\veramitude\AppData\Roaming\WBPU-TTL.DAT
[2013/09/20 22:29:51 | 000,016,160 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/09/20 22:29:51 | 000,016,160 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/09/20 22:22:10 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/20 22:21:55 | 796,102,656 | -HS- | M] () – C:\hiberfil.sys
[2013/09/20 01:03:58 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2013/09/20 01:03:58 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/09/19 21:49:21 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2013/09/19 21:19:55 | 000,000,301 | —- | M] () – C:\Users\veramitude\Desktop\Settings.ini
[2013/09/19 21:19:55 | 000,000,207 | —- | M] () – C:\Windows\tweaking.com-regbackup-VERAMITUDE-PC-Microsoft-Windows-7-Starter-(32-bit).dat
[2013/09/19 21:15:11 | 000,001,512 | —- | M] () – C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
[2013/09/19 21:15:03 | 001,346,048 | —- | M] (Indigo Rose Corporation) – C:\Users\veramitude\Desktop\uninstall.exe
[2013/09/19 21:15:03 | 000,325,960 | —- | M] () – C:\Users\veramitude\Desktop\lua5.1.dll
[2013/09/19 20:44:06 | 000,000,876 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1642401797-1464783693-1534332608-1000Core.job
[2013/09/17 22:51:01 | 000,000,565 | —- | M] () – C:\Users\veramitude\Desktop\MBR.zip
[2013/09/17 22:49:29 | 000,000,512 | —- | M] () – C:\Users\veramitude\Desktop\MBR.dat
[2013/09/17 02:54:54 | 000,000,942 | —- | M] () – C:\Users\Public\Desktop\AVG 2014.lnk
[2013/09/12 21:59:55 | 000,259,112 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2013/09/12 21:37:54 | 000,624,622 | —- | M] () – C:\Windows\System32\perfh009.dat
[2013/09/12 21:37:54 | 000,106,708 | —- | M] () – C:\Windows\System32\perfc009.dat
[2013/09/07 00:46:23 | 000,171,533 | —- | M] () – C:\Users\veramitude\Desktop\galembo_pg-pinkblue_lg.jpg
[2013/08/30 22:15:38 | 000,892,928 | —- | M] (Tweaking.com) – C:\Users\veramitude\Desktop\TweakingRegistryBackup.exe
[2013/08/22 23:37:18 | 000,176,952 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2013/08/22 22:56:56 | 000,209,208 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgidsdriverx.sys
[2013/08/22 22:56:16 | 000,223,032 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avglogx.sys
[2013/08/22 22:56:16 | 000,146,232 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgidshx.sys

========== Files Created - No Company Name ==========

[2013/09/19 21:19:55 | 000,000,207 | —- | C] () – C:\Windows\tweaking.com-regbackup-VERAMITUDE-PC-Microsoft-Windows-7-Starter-(32-bit).dat
[2013/09/19 21:15:11 | 000,001,512 | —- | C] () – C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
[2013/09/19 21:15:03 | 000,325,960 | —- | C] () – C:\Users\veramitude\Desktop\lua5.1.dll
[2013/09/17 22:51:01 | 000,000,565 | —- | C] () – C:\Users\veramitude\Desktop\MBR.zip
[2013/09/17 22:49:29 | 000,000,512 | —- | C] () – C:\Users\veramitude\Desktop\MBR.dat
[2013/09/17 02:54:54 | 000,000,942 | —- | C] () – C:\Users\Public\Desktop\AVG 2014.lnk
[2013/09/07 00:46:04 | 000,171,533 | —- | C] () – C:\Users\veramitude\Desktop\galembo_pg-pinkblue_lg.jpg
[2013/08/13 02:22:04 | 000,000,017 | —- | C] () – C:\Windows\System32\shortcut_ex.dat
[2013/08/10 15:47:06 | 000,013,464 | —- | C] () – C:\Windows\System32\drivers\SWDUMon.sys
[2013/08/10 01:22:05 | 000,000,114 | —- | C] () – C:\Users\veramitude\AppData\Roaming\WB.CFG
[2013/08/10 01:22:05 | 000,000,005 | —- | C] () – C:\Users\veramitude\AppData\Roaming\WBPU-TTL.DAT
[2013/02/28 01:51:03 | 000,000,036 | —- | C] () – C:\Windows\avgui.INI
[2012/01/27 22:47:35 | 000,247,560 | —- | C] () – C:\Windows\System32\drivers\RTConvEQ.dat
[2012/01/27 22:47:35 | 000,039,672 | —- | C] () – C:\Windows\System32\drivers\RtPCEE3.DAT
[2012/01/27 22:47:35 | 000,033,076 | —- | C] () – C:\Windows\System32\drivers\RtPCEE4.DAT
[2012/01/27 22:47:35 | 000,001,448 | —- | C] () – C:\Windows\System32\drivers\RtHdatEx.dat
[2012/01/27 22:47:35 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX3.dat
[2012/01/27 22:47:35 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX2.dat
[2012/01/27 22:47:35 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX1.dat
[2012/01/27 22:47:35 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX0.dat
[2012/01/27 22:47:35 | 000,000,176 | —- | C] () – C:\Windows\System32\drivers\RTHDAEQ1.dat
[2012/01/27 22:47:35 | 000,000,032 | —- | C] () – C:\Windows\System32\drivers\rtkhdaud.dat
[2012/01/27 22:44:34 | 000,080,416 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2012/01/06 03:49:32 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2012/01/06 03:49:31 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config

========== ZeroAccess Check ==========

[2009/07/14 00:42:31 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/07/25 21:55:59 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 17:29:20 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 21:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

Jo*

Post #19September 22, 2013, 5:13 AM UTC

Hello veramitude,

Double click on AdwCleaner.exe to run the tool again.

Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
When the scan has finished, the actual line should say "Pending. Please uncheck elements you do not want to remove". *!!*
This time, click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.

*!!* Don't worry too much about AVG Secure Search, it can be reinstalled later.

Please download Junkware Removal Tool from HERE and save it to your desktop.

Shutdown your antivirus to avoid any potential conflicts.
Right-mouse click JRT.exe and select Run as Administrator.
JRTwill begin to backup your registry and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, the log JRT.txt is saved on your desktop and will automatically open.

Post the contents of JRT.txt into your next reply.

Run OTL again.

Double click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
don't check the boxes beside LOP Check and Purity Check this time.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window OTL.Txt.
Please copy (Edit->Select All, Edit->Copy) the content of the file and post it with your next reply.

veramitude

Post #20September 22, 2013, 6:29 AM UTC

ADW cleaned report: # AdwCleaner v3.004 - Report created 22/09/2013 at 02:24:49 # Updated 15/09/2013 by Xplode # Operating System : Windows 7 Starter Service Pack 1 (32 bits) # Username : veramitude - VERAMITUDE-PC # Running from : C:\Users\veramitude\Downloads\AdwCleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** [/!\] Not Deleted ( Junction ) : C:\ProgramData\AVG Secure Search ***** [ Shortcuts ] ***** ***** [ Registry ] ***** ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16686 -\\ Google Chrome v [ File : C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [7005 octets] - [19/09/2013 22:16:49] AdwCleaner[R1].txt - [7065 octets] - [20/09/2013 22:37:15] AdwCleaner[R2].txt - [7125 octets] - [21/09/2013 01:08:48] AdwCleaner[R3].txt - [7185 octets] - [22/09/2013 01:54:25] AdwCleaner[R4].txt - [1113 octets] - [22/09/2013 02:07:18] AdwCleaner[R5].txt - [1233 octets] - [22/09/2013 02:18:25] AdwCleaner[R6].txt - [1354 octets] - [22/09/2013 02:23:05] AdwCleaner[S0].txt - [7628 octets] - [22/09/2013 02:02:19] AdwCleaner[S1].txt - [1195 octets] - [22/09/2013 02:09:34] AdwCleaner[S2].txt - [1315 octets] - [22/09/2013 02:20:48] AdwCleaner[S3].txt - [1295 octets] - [22/09/2013 02:24:49] ########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1355 octets] ##########

veramitude

Post #21September 22, 2013, 6:41 AM UTC

JRT log: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.1 (09.15.2013:1) OS: Windows 7 Starter x86 Ran by [removed] on Sun 09/22/2013 at 2:31:49.30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1642401797-1464783693-1534332608-1000\Software\SweetIM ~~~ Files Successfully deleted: [File] "C:\users\default user\start menu\programs\startup\best buy pc app.lnk" ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\best buy pc app" Successfully deleted: [Folder] "C:\Users\veramitude\appdata\local\best buy pc app" Successfully deleted: [Folder] "C:\Program Files\coupons" Successfully deleted: [Empty Folder] C:\Users\veramitude\appdata\local\{06A9D0B5-2768-4167-89CB-BD48F3860811} Successfully deleted: [Empty Folder] C:\Users\veramitude\appdata\local\{22F1529D-6B15-476C-B440-C7433A1151B6} Successfully deleted: [Empty Folder] C:\Users\veramitude\appdata\local\{4C5FE5BF-28D0-4CEA-8D2E-97ADDAB8B6CB} Successfully deleted: [Empty Folder] C:\Users\veramitude\appdata\local\{7C4E8948-88F2-41DA-A272-7403A073BFBB} Successfully deleted: [Empty Folder] C:\Users\veramitude\appdata\local\{8C85C2EE-BA9F-4266-B1C7-A55A9C64890D} Successfully deleted: [Empty Folder] C:\Users\veramitude\appdata\local\{A280BAEB-A1F9-43E0-B194-4F1945FFA05A} Successfully deleted: [Empty Folder] C:\Users\veramitude\appdata\local\{A950CD87-3263-40FE-AC42-E145F6FC89C8} Successfully deleted: [Empty Folder] C:\Users\veramitude\appdata\local\{CF454188-3C0C-4B47-B3C9-42CA11B2E691} ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sun 09/22/2013 at 2:40:04.67 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

veramitude

Post #22September 22, 2013, 7:01 AM UTC

otl log:

OTL logfile created on: 9/22/2013 2:43:18 AM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\veramitude\Downloads
Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16686)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1012.30 Mb Total Physical Memory | 406.29 Mb Available Physical Memory | 40.14% Memory free
1.99 Gb Paging File | 1.08 Gb Available in Paging File | 54.50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 219.79 Gb Total Space | 187.25 Gb Free Space | 85.20% Space Free | Partition Type: NTFS

Computer Name: VERAMITUDE-PC | User Name: veramitude | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\veramitude\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgfws.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgcfgex.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2014\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe (Acer Incorporated)
PRC - C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Program Files\Gateway\Gateway Power Management\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Launch Manager\LMutilps32.exe (Dritek System Inc.)
PRC - C:\Program Files\Launch Manager\LMworker.exe (Dritek System Inc.)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files\Gateway\Registration\GREGsvc.exe (Acer Incorporated)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
PRC - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

========== Modules (No Company Name) ==========

========== Services (SafeList) ==========

SRV - (vToolbarUpdater15.5.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgfws) – C:\Program Files\AVG\AVG2014\avgfws.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2014\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (sftvsa) – C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (ePowerSvc) – C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe (Acer Incorporated)
SRV - (DsiWMIService) – C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (GREGService) – C:\Program Files\Gateway\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (Live Updater Service) – C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe (Acer Incorporated)
SRV - (IconMan_R) – C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
SRV - (IAStorDataMgrSvc) – C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (avgtp) – C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (SWDUMon) – C:\Windows\System32\drivers\SWDUMon.sys ()
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgdiskx) – C:\Windows\System32\drivers\avgdiskx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Sftvol) – C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation)
DRV - (Sftplay) – C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV - (Sftredir) – C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV - (Sftfs) – C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation)
DRV - (Avgfwfd) – C:\Windows\System32\drivers\avgfwd6x.sys (AVG Technologies CZ, s.r.o.)
DRV - (igddim32) – C:\Windows\System32\drivers\igddim32.sys (Intel Corporation)
DRV - (IntcDAud) – C:\Windows\System32\drivers\IntcDAud.sys (Intel® Corporation)
DRV - (RSPCIESTOR) – C:\Windows\System32\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (TsUsbGD) – C:\Windows\System32\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com/?pc=MAGW
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\veramitude\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\veramitude\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

[2013/08/10 00:23:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncodin
g}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter},
CHR - homepage: http://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\Application\29.0.1547.76\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\Application\29.0.1547.76\gcswf32.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1901_0\plugins/avgnpss.dll
CHR - plugin: Norton Confidential (Enabled) = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.3.7_0\npcoplgn.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Best Buy pc app Detector (Enabled) = C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll
CHR - plugin: Google Update (Enabled) = C:\Users\veramitude\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Chrome In-App Payments service = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\
CHR - Extension: Gmail = C:\Users\veramitude\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/09/19 21:49:21 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2014\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Power Management] C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe (Acer Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5422BDDB-2A4B-4D0D-B43E-7833771D1F38}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner - No CLSID value found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{e9213060-0477-11e3-9806-047d7b23985b}\Shell - "" = AutoRun
O33 - MountPoints2\{e9213060-0477-11e3-9806-047d7b23985b}\Shell\AutoRun\command - "" = D:\TL_Bootstrap.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/09/22 02:31:44 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/09/19 22:16:11 | 000,000,000 | —D | C] – C:\AdwCleaner
[2013/09/19 21:48:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/09/19 21:16:32 | 000,000,000 | —D | C] – C:\RegBackup
[2013/09/19 21:15:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
[2013/09/19 21:15:06 | 000,000,000 | —D | C] – C:\Users\veramitude\Desktop\files
[2013/09/19 21:15:03 | 000,000,000 | —D | C] – C:\Users\veramitude\Desktop\Uninstall
[2013/09/17 02:58:41 | 000,000,000 | —D | C] – C:\Users\veramitude\AppData\Roaming\AVG2014
[2013/09/17 02:54:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2013/09/17 02:46:01 | 000,000,000 | —D | C] – C:\ProgramData\AVG2014
[2013/09/17 02:37:38 | 000,000,000 | —D | C] – C:\Users\veramitude\AppData\Local\Avg2014
[2013/09/12 21:33:58 | 002,706,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2013/09/12 21:33:55 | 002,876,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2013/09/12 21:33:54 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2013/09/12 21:33:53 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2013/09/12 21:33:52 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2013/09/12 21:33:50 | 000,493,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2013/09/12 21:33:50 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2013/09/12 21:33:50 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2013/09/12 21:33:50 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2013/09/12 21:33:50 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2013/09/11 23:31:49 | 000,133,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ataport.sys
[2013/09/11 23:31:46 | 002,348,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2013/09/11 23:31:43 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
[2013/09/11 23:31:43 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2013/09/11 23:31:42 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/09/11 23:31:42 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/09/11 23:31:42 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/09/11 23:31:41 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/09/11 23:31:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/09/11 23:31:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/09/11 23:31:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/08/24 03:00:36 | 000,000,000 | —D | C] – C:\Users\veramitude\AppData\Roaming\AVG
[2013/08/24 02:33:45 | 000,000,000 | —D | C] – C:\ProgramData\AVG
[2013/08/24 02:33:29 | 000,000,000 | -HSD | C] – C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}

========== Files - Modified Within 30 Days ==========

[2013/09/22 02:45:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/09/22 02:44:01 | 000,000,928 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1642401797-1464783693-1534332608-1000UA.job
[2013/09/22 02:36:14 | 000,016,160 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/09/22 02:36:14 | 000,016,160 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/09/22 02:28:28 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/22 02:28:19 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/09/22 02:28:17 | 796,102,656 | -HS- | M] () – C:\hiberfil.sys
[2013/09/22 02:03:08 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/09/22 00:29:57 | 000,000,115 | —- | M] () – C:\Users\veramitude\AppData\Roaming\WB.CFG
[2013/09/22 00:29:57 | 000,000,005 | —- | M] () – C:\Users\veramitude\AppData\Roaming\WBPU-TTL.DAT
[2013/09/21 20:44:04 | 000,000,876 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1642401797-1464783693-1534332608-1000Core.job
[2013/09/21 11:30:12 | 000,002,362 | —- | M] () – C:\Users\veramitude\Desktop\Google Chrome.lnk
[2013/09/20 01:03:58 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2013/09/20 01:03:58 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/09/19 21:49:21 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2013/09/19 21:19:55 | 000,000,301 | —- | M] () – C:\Users\veramitude\Desktop\Settings.ini
[2013/09/19 21:19:55 | 000,000,207 | —- | M] () – C:\Windows\tweaking.com-regbackup-VERAMITUDE-PC-Microsoft-Windows-7-Starter-(32-bit).dat
[2013/09/19 21:15:11 | 000,001,512 | —- | M] () – C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
[2013/09/19 21:15:03 | 000,325,960 | —- | M] () – C:\Users\veramitude\Desktop\lua5.1.dll
[2013/09/17 22:51:01 | 000,000,565 | —- | M] () – C:\Users\veramitude\Desktop\MBR.zip
[2013/09/17 22:49:29 | 000,000,512 | —- | M] () – C:\Users\veramitude\Desktop\MBR.dat
[2013/09/17 02:54:54 | 000,000,942 | —- | M] () – C:\Users\Public\Desktop\AVG 2014.lnk
[2013/09/12 21:59:55 | 000,259,112 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2013/09/12 21:37:54 | 000,624,622 | —- | M] () – C:\Windows\System32\perfh009.dat
[2013/09/12 21:37:54 | 000,106,708 | —- | M] () – C:\Windows\System32\perfc009.dat
[2013/09/07 00:46:23 | 000,171,533 | —- | M] () – C:\Users\veramitude\Desktop\galembo_pg-pinkblue_lg.jpg
[2013/08/30 22:15:38 | 000,892,928 | —- | M] (Tweaking.com) – C:\Users\veramitude\Desktop\TweakingRegistryBackup.exe

========== Files Created - No Company Name ==========

[2013/09/19 21:19:55 | 000,000,207 | —- | C] () – C:\Windows\tweaking.com-regbackup-VERAMITUDE-PC-Microsoft-Windows-7-Starter-(32-bit).dat
[2013/09/19 21:15:11 | 000,001,512 | —- | C] () – C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
[2013/09/19 21:15:03 | 000,325,960 | —- | C] () – C:\Users\veramitude\Desktop\lua5.1.dll
[2013/09/17 22:51:01 | 000,000,565 | —- | C] () – C:\Users\veramitude\Desktop\MBR.zip
[2013/09/17 22:49:29 | 000,000,512 | —- | C] () – C:\Users\veramitude\Desktop\MBR.dat
[2013/09/17 02:54:54 | 000,000,942 | —- | C] () – C:\Users\Public\Desktop\AVG 2014.lnk
[2013/09/07 00:46:04 | 000,171,533 | —- | C] () – C:\Users\veramitude\Desktop\galembo_pg-pinkblue_lg.jpg
[2013/08/13 02:22:04 | 000,000,017 | —- | C] () – C:\Windows\System32\shortcut_ex.dat
[2013/08/10 15:47:06 | 000,013,464 | —- | C] () – C:\Windows\System32\drivers\SWDUMon.sys
[2013/08/10 01:22:05 | 000,000,115 | —- | C] () – C:\Users\veramitude\AppData\Roaming\WB.CFG
[2013/08/10 01:22:05 | 000,000,005 | —- | C] () – C:\Users\veramitude\AppData\Roaming\WBPU-TTL.DAT
[2013/02/28 01:51:03 | 000,000,036 | —- | C] () – C:\Windows\avgui.INI
[2012/01/27 22:47:35 | 000,247,560 | —- | C] () – C:\Windows\System32\drivers\RTConvEQ.dat
[2012/01/27 22:47:35 | 000,039,672 | —- | C] () – C:\Windows\System32\drivers\RtPCEE3.DAT
[2012/01/27 22:47:35 | 000,033,076 | —- | C] () – C:\Windows\System32\drivers\RtPCEE4.DAT
[2012/01/27 22:47:35 | 000,001,448 | —- | C] () – C:\Windows\System32\drivers\RtHdatEx.dat
[2012/01/27 22:47:35 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX3.dat
[2012/01/27 22:47:35 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX2.dat
[2012/01/27 22:47:35 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX1.dat
[2012/01/27 22:47:35 | 000,000,520 | —- | C] () – C:\Windows\System32\drivers\RTEQEX0.dat
[2012/01/27 22:47:35 | 000,000,176 | —- | C] () – C:\Windows\System32\drivers\RTHDAEQ1.dat
[2012/01/27 22:47:35 | 000,000,032 | —- | C] () – C:\Windows\System32\drivers\rtkhdaud.dat
[2012/01/27 22:44:34 | 000,080,416 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2012/01/06 03:49:32 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2012/01/06 03:49:31 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config

========== ZeroAccess Check ==========

[2009/07/14 00:42:31 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/07/25 21:55:59 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 17:29:20 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 21:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

Jo*

Post #23September 22, 2013, 7:03 PM UTC

Hello veramitude,

do you still have the

"Sponsorship" virus/longfintuna, new tab says things like 'extreme memory leak detected'

issue?

————————————

Please read through these instructions to familarize yourself with what to expect when this tool runs

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

————————————

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

————————————

Double click on combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

————————————

How the computer is running now?

veramitude

Post #24September 23, 2013, 3:05 AM UTC

i have not had any incidents with longfintuna tabs opening today, however it usually only happens once a day and after my computer goes to sleep if i leave it open. Should i wait until it happens again to download ComboFix? or do it now? i have not been given the option of where to save any of the instructed downloads (otl, adwcleaner, etc.), will it be a problem if i can not save combofix to my desktop, but let it save automatically to "Downloads" like the others?

Jo*

Post #25September 23, 2013, 8:39 AM UTC

Hello veramitude,

Should i wait until it happens again to download ComboFix? or do it now?

please do it now!

i have not been given the option of where to save any of the instructed downloads (otl, adwcleaner, etc.), will it be a problem if i can not save combofix to my desktop, but let it save automatically to "Downloads" like the others?

Let it save automatically to "Downloads" and then try to copy ComboFix.exe to your Desktop.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

————————————

Double click on combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

————————————

How the computer is running now?

veramitude

Post #26September 23, 2013, 4:59 PM UTC

combo fix log: ComboFix 13-09-23.02 - veramitude 09/23/2013 12:04:44.1.4 - x86 Microsoft Windows 7 Starter 6.1.7601.1.1252.1.1033.18.1012.193 [GMT -4:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: AVG Internet Security 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} FW: AVG Internet Security 2014 *Enabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2} SP: AVG Internet Security 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-08-23 to 2013-09-23 ))))))))))))))))))))))))))))))) . . 2013-09-23 16:35 . 2013-09-23 16:35 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-09-22 06:31 . 2013-09-22 06:31 ——– d—–w- c:\windows\ERUNT 2013-09-20 02:16 . 2013-09-22 06:39 ——– d—–w- C:\AdwCleaner 2013-09-20 01:48 . 2013-09-20 01:48 ——– d—–w- C:\_OTL 2013-09-20 01:16 . 2013-09-20 01:16 ——– d—–w- C:\RegBackup 2013-09-17 06:58 . 2013-09-17 06:58 ——– d—–w- c:\users\veramitude\AppData\Roaming\AVG2014 2013-09-17 06:46 . 2013-09-21 02:41 ——– d—–w- c:\programdata\AVG2014 2013-09-17 06:37 . 2013-09-17 07:12 ——– d—–w- c:\users\veramitude\AppData\Local\Avg2014 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-09-20 05:03 . 2013-04-05 02:50 692616 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2013-09-20 05:03 . 2011-12-19 09:07 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-08-23 03:37 . 2013-08-23 03:37 176952 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2013-08-23 02:56 . 2013-08-23 02:56 209208 —-a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2013-08-23 02:56 . 2013-08-23 02:56 223032 —-a-w- c:\windows\system32\drivers\avglogx.sys 2013-08-23 02:56 . 2013-08-23 02:56 146232 —-a-w- c:\windows\system32\drivers\avgidshx.sys 2013-08-21 02:54 . 2013-08-21 02:54 102200 —-a-w- c:\windows\system32\drivers\avgmfx86.sys 2013-08-15 01:46 . 2012-07-20 21:07 37664 —-a-w- c:\windows\system32\drivers\avgtpx86.sys 2013-08-10 22:51 . 2013-08-10 19:47 13464 —-a-w- c:\windows\system32\drivers\SWDUMon.sys 2013-08-01 20:08 . 2013-08-01 20:08 193848 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2013-08-01 20:06 . 2013-08-01 20:06 22840 —-a-w- c:\windows\system32\drivers\avgidsshimx.sys 2013-08-01 20:06 . 2013-08-01 20:06 120120 —-a-w- c:\windows\system32\drivers\avgdiskx.sys 2013-08-01 20:05 . 2013-08-01 20:05 26936 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2013-07-25 08:57 . 2013-08-14 18:01 1620992 —-a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-20 06:51 . 2011-03-29 02:36 22240 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2013-07-19 04:17 . 2013-07-19 04:17 94632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-07-19 04:16 . 2013-07-19 04:19 789416 —-a-w- c:\windows\system32\deployJava1.dll 2013-07-19 04:16 . 2013-07-19 04:19 867240 —-a-w- c:\windows\system32\npDeployJava1.dll 2013-07-19 01:41 . 2013-08-14 18:01 2048 —-a-w- c:\windows\system32\tzres.dll 2013-07-09 05:03 . 2013-08-14 18:01 3913664 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-07-09 05:03 . 2013-08-14 18:01 3968960 —-a-w- c:\windows\system32\ntkrnlpa.exe 2013-07-09 04:53 . 2013-08-14 18:01 1289096 —-a-w- c:\windows\system32\ntdll.dll 2013-07-09 04:52 . 2013-08-14 18:02 175104 —-a-w- c:\windows\system32\wintrust.dll 2013-07-09 04:50 . 2013-08-14 18:02 652800 —-a-w- c:\windows\system32\rpcrt4.dll 2013-07-09 04:46 . 2013-08-14 18:02 1166848 —-a-w- c:\windows\system32\crypt32.dll 2013-07-09 04:46 . 2013-08-14 18:02 140288 —-a-w- c:\windows\system32\cryptsvc.dll 2013-07-09 04:46 . 2013-08-14 18:02 103936 —-a-w- c:\windows\system32\cryptnet.dll 2013-07-06 05:05 . 2013-08-14 18:01 1293760 —-a-w- c:\windows\system32\drivers\tcpip.sys 2013-06-26 23:23 . 2013-06-26 23:23 20136 —-a-w- c:\windows\system32\drivers\Sftvollh.sys 2013-06-26 23:23 . 2013-06-26 23:23 24232 —-a-w- c:\windows\system32\drivers\Sftredirlh.sys 2013-06-26 23:23 . 2013-06-26 23:23 197800 —-a-w- c:\windows\system32\drivers\Sftplaylh.sys 2013-06-26 23:23 . 2013-06-26 23:23 1084072 —-a-w- c:\windows\system32\sftldr.dll 2013-06-26 23:22 . 2013-06-26 23:22 583848 —-a-w- c:\windows\system32\drivers\Sftfslh.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2013-06-27 20:11 579024 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2013-06-27 20:11 579024 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2013-06-27 20:11 579024 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}] 2013-06-27 20:11 579024 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2013-06-27 20:11 579024 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2013-06-27 20:11 579024 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-12-30 135168] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-12-30 168960] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-12-30 161280] "LManager"="c:\program files\Launch Manager\LManager.exe" [2011-07-01 1103440] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-10-08 1934632] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-05-18 10082920] "Power Management"="c:\program files\Gateway\Gateway Power Management\ePowerTray.exe" [2011-08-02 715368] "AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2013-08-26 4851248] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Google Update"="c:\users\veramitude\AppData\Local\Google\Update\GoogleUpdate.exe" /c . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" . R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [2013-08-27 3534896] R2 vToolbarUpdater15.5.0;vToolbarUpdater15.5.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [x] R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-06-07 191752] R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys [2013-08-10 13464] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 51040] S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2013-08-23 146232] S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2013-08-23 223032] S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2013-08-01 26936] S1 Avgdiskx;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiskx.sys [2013-08-01 120120] S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2012-09-04 50296] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2013-08-23 209208] S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2013-08-01 22840] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2013-08-23 176952] S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2013-08-01 193848] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-08-15 37664] S2 avgfws;AVG Firewall;c:\program files\AVG\AVG2014\avgfws.exe [2013-08-26 1358432] S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [2013-08-21 300640] S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [2011-05-13 249648] S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2013-04-22 822504] S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2011-07-01 353360] S2 ePowerSvc;ePower Service;c:\program files\Gateway\Gateway Power Management\ePowerSvc.exe [2011-08-02 739944] S2 GREGService;GREGService;c:\program files\Gateway\Registration\GREGsvc.exe [2011-05-30 36456] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336] S2 IconMan_R;IconMan_R;c:\program files\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-03-07 1755136] S2 Live Updater Service;Live Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2011-04-22 244624] S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944] S3 igddim32;igddim32;c:\windows\system32\DRIVERS\igddim32.sys [2011-12-30 1338368] S3 igdkmd32;igdkmd32;c:\windows\system32\DRIVERS\igdkmd32.sys [2011-12-30 418816] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-06-09 278528] S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-05-30 254056] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-09-29 490088] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 583848] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 197800] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 24232] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 20136] S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc . Contents of the 'Scheduled Tasks' folder . 2013-09-23 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-05 05:04] . 2013-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-09-28 02:11] . 2013-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-09-28 02:11] . 2013-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1642401797-1464783693-1534332608-1000Core.job - c:\users\veramitude\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-17 21:21] . 2013-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1642401797-1464783693-1534332608-1000UA.job - c:\users\veramitude\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-17 21:21] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com TCP: DhcpNameServer = 192.168.1.1 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) AddRemove-Coupon Printer for Windows5.0.0.2 - c:\program files\Coupons\uninstall.exe AddRemove-Tweaking.com - Registry Backup - c:\users\veramitude\Desktop\uninstall.exe AddRemove-DSite - c:\users\veramitude\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe AddRemove-e55b814e55744b76 - c:\programdata\Best Buy pc app\ClickOnceUninstaller.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— . - - - - - - - > 'Explorer.exe'(4564) c:\users\VERAMI~1\AppData\Local\Temp\catchme.dll c:\program files\Gateway\Gateway Power Management\SysHook.dll . Completion time: 2013-09-23 12:47:46 ComboFix-quarantined-files.txt 2013-09-23 16:47 . Pre-Run: 200,128,335,872 bytes free Post-Run: 199,802,040,320 bytes free . - - End Of File - - 993B3FF84DCFE91A429E09EF7BC5ADFF A36C5E4F47E84449FF07ED3517B43A31

veramitude

Post #27September 23, 2013, 5:01 PM UTC

i have noticed it running faster already. it used to take a long long time to get into and manage my emails. not today! thanks! I feel like perhaps this is all resolved!! haven't yet seen any longfintuna tabs open either. I will leave my computer open and let it go to sleep to test it today, and report back the results. Thank you for all of your help!!

Jo*

Post #28September 23, 2013, 10:57 PM UTC

Hello veramitude,

1. Install latest Java:

Install latest Java 7 update: JAVA Click this link and click on the Free JAVA Download.

2. Malwarebytes' Anti-Malware
Download the free version of Malwarebytes' Anti-Malware and save it to your desktop.

Double-click mbam-setup****.exe and follow the prompts to install the program.
Note to Vista / 7 users, please right-click and select Run as Administrator.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware.
Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please copy and paste the log back into your next reply.

Note 1: The log can also be found via the Logs tab when Malwarebytes' Anti-Malware is started.
Note 2: If you receive a notice that some of the items couldn't be removed and they have been added to the delete on reboot list, please reboot.

3. ESET Online Scanner

Connect any existing external hard drives and / or other removable media.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
- Click the [external image: Posted Image] button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as MyEsetScan. Alternatively, look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt. Include the contents of this report in your next reply.
Push the Back button.
Select Uninstall application on close check box and push [external image: Posted Image]

veramitude

Post #29September 24, 2013, 4:33 AM UTC

I am happy to say i have not seen a longfishtuna tab open all day. Not since before i ran the adware cleaner last night! i already had malware, so i didn't need to install it. I did run the quick scan: Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.09.24.01 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16686 veramitude :: VERAMITUDE-PC [administrator] 9/23/2013 10:16:19 PM mbam-log-2013-09-23 (22-16-19).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 193718 Time elapsed: 38 minute(s), 16 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

veramitude

Post #30September 24, 2013, 6:45 AM UTC

eset online scanner found no threats

thank you!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

"Sponsorship" virus/longfintuna [Solved]

✨ Ask AI

Ask AI