Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 91982 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Spring Cleaning Before Win 7 Upgrade [Solved]


  • This topic is locked This topic is locked
15 replies to this topic

#1 denno

denno

    Silver Member

  • Authentic Member
  • PipPipPip
  • 351 posts
  • Interests:Raising Golden Retrievers; folk-rock and Irish music (what I do); reading; DIY; websites; writing

Posted 05 June 2014 - 10:32 AM

Hi there,

 

What it says.

 

Only real problems are slow loading times for internet and programs.  (Open Office and Thunderbird take a long time, especially).  And lots and lots of "A script on this page may be busy or... ,"

 

Surely exacerbated by my habit of leaving lots of browser windows open to read later.  And only have 2GB memory, which I suppose is paltry these days.

 

Thanks

 

 

 

 

OTL logfile created on: 6/5/2014 11:05:02 AM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Denno\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
1013.10 Mb Total Physical Memory | 440.91 Mb Available Physical Memory | 43.52% Memory free
2.38 Gb Paging File | 1.62 Gb Available in Paging File | 67.90% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 210.74 Gb Free Space | 70.70% Space Free | Partition Type: NTFS
Drive D: | 232.77 Gb Total Space | 199.42 Gb Free Space | 85.67% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SHERIFFJOHN | User Name: Denno | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Documents and Settings\Denno\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\Denno\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe (Foxit Corporation)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Denno\Local Settings\Apps\2.0\8HC0VQ42.WPJ\L95VWYDX.N7K\dell..tion_0f612f649c4a10af_0005.0004_3ddfe37344028d2c\DellSystemDetect.exe (Dell)
PRC - C:\Program Files\Fighters\SPAMfighter\sfus.exe (SPAMfighter ApS)
PRC - C:\Program Files\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS)
PRC - C:\Program Files\PDF24\pdf24.exe (Geek Software GmbH)
PRC - C:\Program Files\Fighters\FighterSuiteService.exe (SPAMfighter ApS)
PRC - C:\Program Files\IDrive\IDriveEBackground.exe (Pro-SoftNet Corp, U.S.A)
PRC - C:\Program Files\IDrive\IDriveE Service.exe (Pro Softnet Corporation)
PRC - C:\Program Files\Fighters\Tray\FightersTray.exe (SPAMfighter ApS)
PRC - C:\Program Files\IDrive\IDriveETray.exe (Pro Softnet Corp.)
PRC - C:\Program Files\IDrive\IDrivePlugin.exe ( )
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATI9HA.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
 
 
========== Modules (No Company Name) ==========
 
MOD - c:\Documents and Settings\Denno\Local Settings\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjuxmem.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Deployment\167a65f7be0a151b8d13b3ab3cff79f2\System.Deployment.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\2781e84862746a34f026d0ee179eed2b\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\243ff1822abc8282cb8fee37538170b4\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\850fa7110c7423c324762c1ad3130219\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\991c4e11f571a4074b9c4a5841222338\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\4c906eb82e6f56aea01b2a7291fab7ea\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\4e62d1d9b7dd2c2d14915abb73c22d50\mscorlib.ni.dll ()
MOD - C:\Documents and Settings\Denno\Application Data\Dropbox\bin\wxmsw28uh_vc.dll ()
MOD - C:\Documents and Settings\Denno\Application Data\Dropbox\bin\libcef.dll ()
MOD - C:\Program Files\Fighters\SPAMfighter\sfsg.dll ()
MOD - C:\Program Files\Fighters\SPAMfighter\sfse.dll ()
MOD - C:\Program Files\Microsoft Office\Office\MSO97.DLL ()
MOD - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
 
 
========== Services (SafeList) ==========
 
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (FoxitCloudUpdateService) -- C:\Program Files\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe (Foxit Corporation)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (SPAMfighter Update Service) -- C:\Program Files\Fighters\SPAMfighter\sfus.exe (SPAMfighter ApS)
SRV - (Suite Service) -- C:\Program Files\Fighters\FighterSuiteService.exe (SPAMfighter ApS)
SRV - (IDriveE Service) -- C:\Program Files\IDrive\IDriveE Service.exe (Pro Softnet Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (catchme) -- C:\DOCUME~1\Denno\LOCALS~1\Temp\catchme.sys File not found
DRV - (PfFilter) -- C:\Program Files\IObit\Password Folder\pffilter.sys (IObit Information Technology)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (OMCI) -- C:\WINDOWS\system32\drivers\omci.sys (Dell Computer Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20131118
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.5.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.5.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2013/08/14 23:09:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Denno\Application Data\Mozilla\Extensions
[2014/03/21 09:11:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Denno\Application Data\Mozilla\Firefox\Profiles\93ieznry.default-1385853555296\extensions
[2013/12/02 22:35:05 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\Denno\Application Data\Mozilla\Firefox\Profiles\93ieznry.default-1385853555296\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2014/05/09 20:37:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014/05/09 20:37:52 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
O1 HOSTS File: ([2013/09/28 06:55:36 | 000,000,822 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CommonToolkitTray] C:\Program Files\Fighters\Tray\FightersTray.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Program Files\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [sfagent] C:\Program Files\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS)
O4 - HKCU..\Run: [DellSystemDetect] C:\Documents and Settings\Denno\Start Menu\Programs\Dell\Dell System Detect.appref-ms ()
O4 - HKCU..\Run: [IDriveE Startup] C:\Program Files\IDrive\IDrvieEStartup.exe (Pro Softnet Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
O4 - Startup: C:\Documents and Settings\Denno\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Denno\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Documents and Settings\Denno\Start Menu\Programs\Startup\IDrive Tray.lnk = C:\Program Files\IDrive\IDriveEReg2ini.exe (Pro Softnet Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains:   ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: dell.com ([]* in Trusted sites)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1361254869718 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.22.32.8 64.22.32.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C210370-FF0F-404C-A510-43343D733ACB}: DhcpNameServer = 64.22.32.8 64.22.32.9
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Denno\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Denno\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/02/18 19:11:05 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/06/05 11:00:17 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Denno\Desktop\OTL.exe
[2014/06/04 23:36:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Foxit Reader
[2014/06/04 23:36:01 | 000,000,000 | ---D | C] -- C:\Program Files\FOXIT SOFTWARE
[2014/05/27 08:22:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Denno\Desktop\New Folder
[2014/05/09 20:37:11 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/02/23 23:15:23 | 001,562,624 | ---- | C] (Antanas Zdramys LY1DL) -- C:\Program Files\AZZ Cardfile.exe
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/06/05 11:00:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Denno\Desktop\OTL.exe
[2014/06/05 10:49:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/06/05 10:23:56 | 001,015,808 | -H-- | M] () -- C:\ffastun.ffo
[2014/06/05 10:23:56 | 000,004,994 | -H-- | M] () -- C:\ffastun.ffa
[2014/06/05 10:23:54 | 008,273,920 | -H-- | M] () -- C:\ffastun0.ffx
[2014/06/05 10:23:54 | 003,391,488 | -H-- | M] () -- C:\ffastun.ffl
[2014/06/04 23:36:17 | 000,001,811 | ---- | M] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2014/06/04 23:36:17 | 000,001,793 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Foxit Reader.lnk
[2014/06/04 21:42:24 | 000,000,222 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\mild chiles.url
[2014/06/04 08:31:09 | 000,000,254 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Beyonce.url
[2014/06/01 01:48:01 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2014/05/31 12:05:20 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2014/05/31 10:21:04 | 000,001,519 | ---- | M] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad.lnk
[2014/05/30 20:15:33 | 000,000,146 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\distractify.url
[2014/05/26 18:10:23 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Shortcut to frsb.lnk
[2014/05/26 18:08:29 | 000,000,759 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\ko.lnk
[2014/05/25 21:54:02 | 000,000,119 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Edible wild plants.url
[2014/05/25 21:46:52 | 000,000,131 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Clicker training.url
[2014/05/23 22:26:59 | 000,000,222 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Logon.job
[2014/05/23 22:26:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/05/19 22:19:18 | 000,000,141 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\crispy-fried-snapper.url
[2014/05/19 22:16:14 | 000,000,163 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\sichuan-crispy-fried-carp.url
[2014/05/19 21:59:18 | 000,001,024 | ---- | M] () -- C:\Documents and Settings\Denno\Start Menu\Programs\Startup\Dropbox.lnk
[2014/05/19 21:58:30 | 000,001,008 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Dropbox.lnk
[2014/05/18 22:57:47 | 000,000,114 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\acrostics.url
[2014/05/17 21:49:53 | 000,000,179 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\FB Invite How-2.url
[2014/05/14 08:42:09 | 005,273,025 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\How-to-Write-a-Song-Vol-1.zip
[2014/05/13 22:50:43 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2014/05/13 22:50:43 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2014/05/08 15:03:56 | 000,000,216 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
[2014/05/07 20:37:37 | 000,000,119 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\climatecentral.org.url
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/06/04 23:36:17 | 000,001,811 | ---- | C] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2014/06/04 23:36:17 | 000,001,793 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Foxit Reader.lnk
[2014/06/04 21:42:08 | 000,000,222 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\mild chiles.url
[2014/06/04 08:30:57 | 000,000,254 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Beyonce.url
[2014/05/31 10:21:04 | 000,001,519 | ---- | C] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad.lnk
[2014/05/30 20:14:46 | 000,000,146 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\distractify.url
[2014/05/26 18:10:23 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Shortcut to frsb.lnk
[2014/05/26 18:08:29 | 000,000,759 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\ko.lnk
[2014/05/25 21:53:53 | 000,000,119 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Edible wild plants.url
[2014/05/25 21:46:36 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Clicker training.url
[2014/05/19 22:19:00 | 000,000,141 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\crispy-fried-snapper.url
[2014/05/19 22:15:59 | 000,000,163 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\sichuan-crispy-fried-carp.url
[2014/05/19 21:59:18 | 000,001,024 | ---- | C] () -- C:\Documents and Settings\Denno\Start Menu\Programs\Startup\Dropbox.lnk
[2014/05/18 22:57:29 | 000,000,114 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\acrostics.url
[2014/05/17 21:49:35 | 000,000,179 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\FB Invite How-2.url
[2014/05/14 08:42:16 | 005,273,025 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\How-to-Write-a-Song-Vol-1.zip
[2014/05/07 20:37:19 | 000,000,119 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\climatecentral.org.url
[2014/04/02 00:14:40 | 000,026,032 | ---- | C] () -- C:\WINDOWS\System32\IDriveEXceedCryReg.exe
[2013/11/20 00:19:48 | 000,000,076 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\flfconfig.ini
[2013/11/03 23:15:14 | 000,116,944 | ---- | C] () -- C:\WINDOWS\Secure.dll
[2013/11/03 23:15:14 | 000,001,386 | -HS- | C] () -- C:\Documents and Settings\Denno\Application Data\systemFP.$dk
[2013/08/15 20:06:00 | 000,147,290 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1275210071-1177238915-839522115-1004-0.dat
[2013/08/15 20:05:56 | 000,147,290 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/07/27 06:15:17 | 000,000,060 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\WB.CFG
[2013/06/17 06:15:17 | 000,000,005 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\WBPU-TTL.DAT
[2013/04/12 04:53:09 | 000,008,074 | ---- | C] () -- C:\WINDOWS\extend.dat
[2013/04/12 04:50:39 | 000,000,022 | ---- | C] () -- C:\WINDOWS\exchng.ini
[2013/04/12 04:50:38 | 000,000,611 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2013/04/11 06:57:56 | 000,000,230 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2013/04/11 06:28:14 | 000,001,534 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ss.ini
[2013/04/01 21:47:16 | 000,001,450 | ---- | C] () -- C:\Documents and Settings\Denno\Local Settings\Application Data\recently-used.xbel
[2013/03/13 22:15:36 | 000,009,728 | ---- | C] () -- C:\Documents and Settings\Denno\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/03/12 20:38:41 | 000,000,056 | ---- | C] () -- C:\WINDOWS\azzCardfile Settings.ini
[2013/02/20 12:14:23 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2013/02/20 12:11:05 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4820.dll
[2013/02/20 01:51:29 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/02/19 12:58:29 | 000,055,808 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2013/02/19 02:41:56 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2013/02/18 19:13:24 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2013/02/18 19:09:31 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2013/02/18 13:36:57 | 000,004,346 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2013/02/18 13:36:18 | 000,137,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
 
========== ZeroAccess Check ==========
 
[2013/02/19 12:51:12 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2012/12/27 06:24:19 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 06:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013/04/19 10:14:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\azzCardfile
[2013/06/16 00:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BSD
[2013/07/02 00:23:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2013/08/12 16:45:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Fighters
[2013/02/20 01:39:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HardwareHelper
[2013/11/21 01:37:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IObit
[2013/11/20 00:36:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2013/08/14 23:22:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\addpcs
[2014/06/02 21:53:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Audacity
[2013/04/19 10:14:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\azzCardfile
[2013/07/02 08:09:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\BitLord
[2013/04/27 23:19:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\CoreFTP
[2014/05/23 22:27:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Dropbox
[2014/02/22 10:44:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\DropboxMaster
[2013/02/20 01:46:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\ElevatedDiagnostics
[2013/04/12 18:06:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\EPSON
[2013/08/12 16:45:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Fighters
[2014/06/04 23:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Foxit Software
[2013/04/01 21:51:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\gtk-2.0
[2014/04/18 14:57:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\LiveKit
[2013/02/21 16:30:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\OpenOffice.org
[2013/07/02 00:28:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Python-Eggs
[2013/12/13 12:31:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Thunderbird
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %USERPROFILE%\..|smtmp;true;true;true /FP >
 
< %temp%\smtmp\*.* /s > >
 
< MD5 for: EXPLORER.EXE  >
[2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\erdnt\cache\explorer.exe
[2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
 
< MD5 for: EXPLORER.EXE.C1FECC5471F11AA2CD0A393551DF7.4AA2711F6FA0CFFF236EB33AE7318C3A.AAWQFF  >
[2011/09/24 20:43:57 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.c1fecc5471f11aa2cd0a393551df7.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
[2011/09/24 20:43:57 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.c1fecc5471f11aa2cd0a393551df7.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
[2011/09/24 20:43:57 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.c1fecc5471f11aa2cd0a393551df7.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
 
< MD5 for: EXPLORER.EXE.DF13972E38389FFB60A61E6FF32691.4AA2711F6FA0CFFF236EB33AE7318C3A.AAWQFF  >
[2011/09/24 20:43:58 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.df13972e38389ffb60a61e6ff32691.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
[2011/09/24 20:43:58 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.df13972e38389ffb60a61e6ff32691.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
[2011/09/24 20:43:58 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.df13972e38389ffb60a61e6ff32691.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
 
< MD5 for: EXPLORER.EXE-082F38A9.PF  >
[2013/11/21 09:59:34 | 000,017,608 | ---- | M] () MD5=3AC5ED2CD65690AEE5F55C844D98A844 -- C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf
 
< MD5 for: EXPLORER.SCF  >
[2003/07/16 16:28:12 | 000,000,080 | ---- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 -- C:\WINDOWS\explorer.scf
 
< MD5 for: IEXPLORE.BAT  >
[2013/04/21 03:58:12 | 000,029,803 | ---- | M] () MD5=E4B95882FB080670179EA3605395889B -- C:\JRT\iexplore.bat
 
< MD5 for: IEXPLORE.CHM  >
[2009/02/21 02:21:24 | 000,529,818 | ---- | M] () MD5=1435F4731719DF5F57D17DC38196245D -- C:\WINDOWS\Help\iexplore.chm
[2007/04/02 23:09:24 | 000,204,810 | ---- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE -- C:\WINDOWS\ie8\iexplore.chm
 
< MD5 for: IEXPLORE.EXE  >
[2008/04/14 06:42:24 | 000,093,184 | ---- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 -- C:\WINDOWS\ie8\iexplore.exe
[2008/04/14 06:42:24 | 000,093,184 | ---- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 -- C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2009/03/08 15:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 15:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\WINDOWS\erdnt\cache\iexplore.exe
[2009/03/08 15:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\WINDOWS\system32\dllcache\iexplore.exe
 
< MD5 for: IEXPLORE.EXE.MUI  >
[2009/03/08 15:21:44 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 -- C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 15:21:44 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 -- C:\Program Files\Internet Explorer\iexplore.exe.mui
 
< MD5 for: IEXPLORE.HLP  >
[2003/07/16 16:30:14 | 000,180,335 | ---- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 -- C:\WINDOWS\Help\iexplore.hlp
 
< MD5 for: SERVICES  >
[2003/07/16 16:44:24 | 000,007,116 | ---- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A -- C:\WINDOWS\system32\drivers\etc\services
 
< MD5 for: SERVICES.CFG  >
[2014/05/08 09:48:48 | 000,560,495 | ---- | M] () MD5=12A7DDA9C7CA1AAA2C6F36BB1E24528B -- C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg
[2012/09/23 20:43:36 | 000,603,848 | R--- | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 -- C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\services.cfg
 
< MD5 for: SERVICES.CNF  >
[2004/02/15 13:30:24 | 000,000,002 | ---- | M] () MD5=A55822426A5330C04625A41D264C190B -- C:\Documents and Settings\Denno\My Documents\01 My Sites\lullabologist 2007\lullabologist.com\www\_vti_pvt\services.cnf
 
< MD5 for: SERVICES.DAT  >
[2013/04/21 23:04:55 | 000,001,720 | ---- | M] () MD5=43C1700D78D89F0B1F6FA88FD132BE1A -- C:\JRT\services.dat
 
< MD5 for: SERVICES.EXE  >
[2009/02/06 07:06:24 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\services.exe
[2008/04/14 06:42:36 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\ServicePackFiles\i386\services.exe
[2009/02/06 13:14:03 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE -- C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\services.exe
[2009/02/06 06:22:21 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD -- C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\services.exe
[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\erdnt\cache\services.exe
[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\services.exe
[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe
 
< MD5 for: SERVICES.HTML  >
[2006/06/04 03:58:20 | 000,010,485 | ---- | M] () MD5=0593516C8BE2A4A513FA239BA5525BBF -- C:\Documents and Settings\Denno\My Documents\01 My Sites\pabloX\Roots2\services.html
 
< MD5 for: SERVICES.LNK  >
[2013/02/18 19:11:05 | 000,001,602 | ---- | M] () MD5=08125797682F9567E12028EFA78AB5BF -- C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
[2013/02/18 19:11:05 | 000,001,602 | ---- | M] () MD5=08125797682F9567E12028EFA78AB5BF -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
[2011/06/09 13:55:27 | 000,001,602 | ---- | M] () MD5=60CB2E633CDAFBF3157893ECA8C22172 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
[2011/06/09 13:55:27 | 000,001,602 | ---- | M] () MD5=60CB2E633CDAFBF3157893ECA8C22172 -- C:\Documents and Settings\Denno\My Documents\My Documents\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
 
< MD5 for: SERVICES.MSC  >
[2003/07/16 16:44:24 | 000,033,464 | ---- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 -- C:\WINDOWS\system32\services.msc
 
< MD5 for: SERVICES.RDB  >
[2012/08/13 11:51:02 | 000,178,348 | ---- | M] () MD5=039C8CFBD74EE07F38CD9E4C7D95C5C6 -- C:\Program Files\OpenOffice.org 3\Basis\program\services.rdb
[2012/08/13 11:51:02 | 000,000,453 | ---- | M] () MD5=3D2ADA15FEF5B5FF468243161543D610 -- C:\Program Files\OpenOffice.org 3\program\services.rdb
[2012/08/10 16:12:16 | 000,008,060 | ---- | M] () MD5=7CA7D7150EC46321162F932ADCF5F35B -- C:\Program Files\OpenOffice.org 3\URE\misc\services.rdb
 
< MD5 for: WINLOGON.EXE  >
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\erdnt\cache\winlogon.exe
[2008/04/14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
 
< %SYSTEMDRIVE%\*.* >
[2013/02/18 19:11:05 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2013/04/12 11:45:51 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2013/05/26 17:22:06 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2013/08/07 09:11:23 | 000,012,004 | ---- | M] () -- C:\ComboFix.txt
[2013/02/18 19:11:05 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2013/05/12 00:05:14 | 000,157,360 | ---- | M] () -- C:\d278b98f.ttf
[2013/11/03 23:18:42 | 000,000,000 | ---- | M] () -- C:\END
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2014/06/05 10:23:56 | 000,004,994 | -H-- | M] () -- C:\ffastun.ffa
[2014/06/05 10:23:54 | 003,391,488 | -H-- | M] () -- C:\ffastun.ffl
[2014/06/05 10:23:56 | 001,015,808 | -H-- | M] () -- C:\ffastun.ffo
[2014/06/05 10:23:54 | 008,273,920 | -H-- | M] () -- C:\ffastun0.ffx
[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2013/02/18 19:11:05 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2013/02/18 19:11:05 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2013/02/19 00:19:39 | 000,022,729 | ---- | M] () -- C:\newfile.enc
[2013/02/19 00:19:39 | 000,022,729 | ---- | M] () -- C:\newkey
[2013/02/19 01:57:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2013/02/19 01:57:34 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2014/05/23 22:26:48 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI
 
< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2013/02/18 19:10:56 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\Fonts\*.exe >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.jpg >
 
< %systemroot%\*.png >
 
< %systemroot%\*.scr >
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
[2003/04/25 06:32:56 | 001,562,624 | ---- | M] (Antanas Zdramys LY1DL) -- C:\Program Files\AZZ Cardfile.exe
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< dir "%systemdrive%\*" /S /A:L /C >
 Volume in drive C has no label.
 Volume Serial Number is 6CF5-25D4
 Directory of C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices
02/12/2014  12:58 AM    <JUNCTION>     2.0.0.0__b03f5f7f11d50a3a
               0 File(s)              0 bytes
 Directory of C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote
02/12/2014  12:58 AM    <JUNCTION>     2.0.0.0__b03f5f7f11d50a3a
               0 File(s)              0 bytes
 Directory of C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices
02/12/2014  01:00 AM    <JUNCTION>     v4.0_4.0.0.0__b03f5f7f11d50a3a
               0 File(s)              0 bytes
     Total Files Listed:
               0 File(s)              0 bytes
               3 Dir(s)  226,249,797,632 bytes free
 
< %systemroot%\System32\config\*.sav >
[2013/02/18 13:35:14 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2013/02/18 13:35:14 | 000,602,112 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2013/02/18 13:35:14 | 000,421,888 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %PROGRAMFILES%\bak. /s >
 
< %systemroot%\system32\bak. /s >
 
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2013/02/19 01:59:36 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini
 
< %systemroot%\system32\config\systemprofile\*.dat /x >
 
< %systemroot%\*.config >
 
< %systemroot%\system32\*.db >
 
< %PROGRAMFILES%\Internet Explorer\*.dat >
 
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2013/02/19 02:02:38 | 000,000,177 | -HS- | M] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2013/02/20 01:43:01 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Show desktop.scf
 
< %USERPROFILE%\Desktop\*.exe >
[2014/03/05 21:50:45 | 000,404,048 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\DellSystemDetect.exe
[2014/06/05 11:00:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Denno\Desktop\OTL.exe
[2014/01/19 22:57:36 | 008,669,472 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Denno\Desktop\Windows7UpgradeAdvisorSetup.exe
 
< %PROGRAMFILES%\Common Files\*.* >
 
< %systemroot%\*.src >
 
< %systemroot%\install\*.* >
 
< %systemroot%\system32\DLL\*.* >
 
< %systemroot%\system32\HelpFiles\*.* >
 
< %systemroot%\system32\rundll\*.* >
 
< %systemroot%\winn32\*.* >
 
< %systemroot%\Java\*.* >
 
< %systemroot%\system32\test\*.* >
 
< %systemroot%\system32\Rundll32\*.* >
 
< %systemroot%\AppPatch\Custom\*.* >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2014-05-14 14:19:42
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:264A9BB7

< End of report >
 

 

OTL Extras logfile created on: 6/5/2014 11:05:02 AM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Denno\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
1013.10 Mb Total Physical Memory | 440.91 Mb Available Physical Memory | 43.52% Memory free
2.38 Gb Paging File | 1.62 Gb Available in Paging File | 67.90% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 210.74 Gb Free Space | 70.70% Space Free | Partition Type: NTFS
Drive D: | 232.77 Gb Total Space | 199.42 Gb Free Space | 85.67% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SHERIFFJOHN | User Name: Denno | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\WS_FTP Pro\ftp95pro.exe" = C:\Program Files\WS_FTP Pro\ftp95pro.exe:*:Enabled:WS_FTP 95 -- (Ipswitch, Inc. 81 Hartwell Ave. Lexington, MA)
"C:\Documents and Settings\Denno\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\Denno\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox -- (Dropbox, Inc.)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{111EE7DF-FC45-40C7-98A7-753AC46B12FB}" = QuickTime 7
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 55
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36A345C9-0691-45A1-AEEF-29ECEC8B5014}" = Microsoft Security Client
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1" = Foxit Cloud
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.12.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 5.5.1
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-0137-0409-0000-0000000FF1CE}" = Microsoft Works 6-9 Converter
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}" = OpenOffice.org 3.4.1
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.07)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5FFAC59-7519-4652-AD8C-FBFA97AEE1DA}" = DRIVERfighter
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4714DAA-07DF-4041-97AA-A65E9E918641}" = SPAMfighter
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 13 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 13 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Audacity_is1" = Audacity 2.0.3
"azzCardfile_is1" = azzCardfile 4.1
"CDex" = CDex extraction audio
"CoreFTP" = Core FTP LE
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"ESET Online Scanner" = ESET Online Scanner v3
"FFmpeg for Audacity_is1" = FFmpeg v0.6.2 for Audacity
"Foxit Reader_is1" = Foxit Reader
"HDMI" = Intel® Graphics Media Accelerator Driver
"IDrive_is1" = IDrive version 3.4.4 Dec 04, 2013
"ie8" = Windows Internet Explorer 8
"LAME_is1" = LAME v3.99.3 (for Windows)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials Prerelease
"Mozilla Firefox 29.0.1 (x86 en-US)" = Mozilla Firefox 29.0.1 (x86 en-US)
"Mozilla Thunderbird 24.5.0 (x86 en-US)" = Mozilla Thunderbird 24.5.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Office8.0" = Microsoft Office 97, Professional Edition
"Password Folder_is1" = Password Folder
"SPAMfighter" = SPAMfighter
"SysTools DBX Converter v3.2 DEMO Version_is1" = SysTools DBX Converter
"Temp File Cleaner" = Temp File Cleaner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"9204f5692a8faf3b" = Dell System Detect
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10/13/2013 10:11:58 PM | Computer Name = SHERIFFJOHN | Source = Application Hang | ID = 1002
Description = Hanging application audacity.exe, version 2.0.3.0, hang module hungapp,
 version 0.0.0.0, hang address 0x00000000.
 
Error - 10/13/2013 10:16:06 PM | Computer Name = SHERIFFJOHN | Source = Application Hang | ID = 1002
Description = Hanging application audacity.exe, version 2.0.3.0, hang module hungapp,
 version 0.0.0.0, hang address 0x00000000.
 
Error - 10/16/2013 2:58:01 AM | Computer Name = SHERIFFJOHN | Source = Application Error | ID = 1000
Description = Faulting application msimn.exe, version 6.0.2900.5512, faulting module
 livekit.dll, version 1.0.252.1, fault address 0x000260c6.
 
Error - 10/27/2013 4:59:09 AM | Computer Name = SHERIFFJOHN | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
 hungapp, version 0.0.0.0, hang address 0x00000000.
 
Error - 11/1/2013 9:10:59 AM | Computer Name = SHERIFFJOHN | Source = Application Hang | ID = 1002
Description = Hanging application mbam.exe, version 1.75.0.1, hang module hungapp,
 version 0.0.0.0, hang address 0x00000000.
 
Error - 11/2/2013 12:17:33 AM | Computer Name = SHERIFFJOHN | Source = Application Hang | ID = 1002
Description = Hanging application Folder Locker Free.exe, version 1.0.0.0, hang
module hungapp, version 0.0.0.0, hang address 0x00000000.
 
Error - 11/2/2013 12:17:33 AM | Computer Name = SHERIFFJOHN | Source = Application Hang | ID = 1002
Description = Hanging application Folder Locker Free.exe, version 1.0.0.0, hang
module hungapp, version 0.0.0.0, hang address 0x00000000.
 
Error - 11/2/2013 12:17:38 AM | Computer Name = SHERIFFJOHN | Source = Application Hang | ID = 1001
Description = Fault bucket -885509455.
 
Error - 11/2/2013 12:17:41 AM | Computer Name = SHERIFFJOHN | Source = Application Hang | ID = 1001
Description = Fault bucket -885509455.
 
Error - 11/2/2013 3:57:20 PM | Computer Name = SHERIFFJOHN | Source = Application Error | ID = 1000
Description = Faulting application msimn.exe, version 6.0.2900.5512, faulting module
 livekit.dll, version 1.0.252.1, fault address 0x000260c6.
 
[ System Events ]
Error - 6/2/2014 10:41:49 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/2/2014 10:41:49 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/3/2014 10:37:30 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/3/2014 10:37:40 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/3/2014 10:39:45 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/3/2014 10:39:45 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/4/2014 10:37:56 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/4/2014 10:38:05 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/4/2014 10:39:27 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
Error - 6/4/2014 10:39:27 PM | Computer Name = SHERIFFJOHN | Source = Microsoft Antimalware | ID = 2041
Description = The support for your operating system has expired. Running %%860 on
 an out of support operating system is not an adequate solution to protect against
 threats.  
 
 
< End of report >
 

 


    Advertisements

Register to Remove


#2 ken545

ken545

    Forum God

  • Classroom Teacher
  • 23,207 posts
  • Interests:Fighting Malware and cooking some great Italian and TexMex food
  • MVP

Posted 10 June 2014 - 12:43 PM

:welcome:

 

Sorry for the delay.

 

Before we do any cleaning just want to give you a heads up on Windows 7.  I see your running XP with just 2gbs of ram, this computer may not qualify for an upgrade, it may not have enough firing power so to speak, especially if your computer is pretty old 

 

You can check here, let me know what it advises you to do

http://www.microsoft...ails.aspx?id=20


Jeffce_zpsa19ee2e6.png

 

 

 

Want to help others, Join our Malware Removal Classroom  HERE

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.
donate.gif

 

Find us on Facebook
Please LIKE and SHARE

 

 

Just a reminder that threads will be closed if no reply in 3 days.


#3 denno

denno

    Silver Member

  • Authentic Member
  • PipPipPip
  • 351 posts
  • Interests:Raising Golden Retrievers; folk-rock and Irish music (what I do); reading; DIY; websites; writing

Posted 10 June 2014 - 03:02 PM

Hi Ken

I've saved the advisor's report, if you can open it.  Say's a custom install is needed, reload programs, couple programs need compatibility upgrades, and so forth.

I've been through this a few ways and I'm sure the computer will handle 7. Also going to put in the max for this computer, 4MB memory.

 

Thanks for the caution.

 

denno



#4 denno

denno

    Silver Member

  • Authentic Member
  • PipPipPip
  • 351 posts
  • Interests:Raising Golden Retrievers; folk-rock and Irish music (what I do); reading; DIY; websites; writing

Posted 10 June 2014 - 03:03 PM

Ahhh...heck, how do I append a file?



#5 ken545

ken545

    Forum God

  • Classroom Teacher
  • 23,207 posts
  • Interests:Fighting Malware and cooking some great Italian and TexMex food
  • MVP

Posted 10 June 2014 - 04:08 PM

Not sure what you mean by appending a file, what file

 

Adding memory to a computer is one of the best and cheapest upgrades you can do.

 

Give this a try, I have built maybe a dozen systems from the ground up and Crucial has always been the best memory that I could find, let it scan your system and it will give you some options

http://www.crucial.com/

 

In the meantime lets run some cleaners and see whats going on

 

-AdwCleaner-by Xplode
 
Click on this link to download : ADWCleaner
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
 
Do not click on any links in the top Advertisment.
 
 
  •  
  • Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
 

Jeffce_zpsa19ee2e6.png

 

 

 

Want to help others, Join our Malware Removal Classroom  HERE

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.
donate.gif

 

Find us on Facebook
Please LIKE and SHARE

 

 

Just a reminder that threads will be closed if no reply in 3 days.


#6 denno

denno

    Silver Member

  • Authentic Member
  • PipPipPip
  • 351 posts
  • Interests:Raising Golden Retrievers; folk-rock and Irish music (what I do); reading; DIY; websites; writing

Posted 11 June 2014 - 05:23 AM

Thanks for mem advice.

 

Here is logfile:

 

 

 

# AdwCleaner v3.212 - Report created 11/06/2014 at 00:44:36
# Updated 05/06/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Denno - SHERIFFJOHN
# Running from : C:\Documents and Settings\Denno\Desktop\adwcleaner_3.212.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\END
Folder Found : C:\Documents and Settings\Denno\Local Settings\Application Data\SearchProtect
Folder Found : C:\Program Files\SearchProtect
Folder Found : C:\Program Files\Uninstaller

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\dsiteproducts
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DSite
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\Somoto
Key Found : HKLM\Software\Driver-Soft
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{501451DE-5808-4599-B544-8BD0915B6B24}_is1

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v29.0.1 (en-US)

[ File : C:\Documents and Settings\Denno\Application Data\Mozilla\Firefox\Profiles\93ieznry.default-1385853555296\prefs.js ]


*************************

AdwCleaner[R0].txt - [1264 octets] - [11/06/2014 00:44:36]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1324 octets] ##########
 



#7 ken545

ken545

    Forum God

  • Classroom Teacher
  • 23,207 posts
  • Interests:Fighting Malware and cooking some great Italian and TexMex food
  • MVP

Posted 11 June 2014 - 06:19 AM

  •  
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
 
 
 
 
 
thisisujrt.gif Please download Junkware Removal Tool to your desktop.
  •  
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
 

Jeffce_zpsa19ee2e6.png

 

 

 

Want to help others, Join our Malware Removal Classroom  HERE

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.
donate.gif

 

Find us on Facebook
Please LIKE and SHARE

 

 

Just a reminder that threads will be closed if no reply in 3 days.


#8 denno

denno

    Silver Member

  • Authentic Member
  • PipPipPip
  • 351 posts
  • Interests:Raising Golden Retrievers; folk-rock and Irish music (what I do); reading; DIY; websites; writing

Posted 11 June 2014 - 06:46 AM

# AdwCleaner v3.212 - Report created 11/06/2014 at 08:44:33
# Updated 05/06/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Denno - SHERIFFJOHN
# Running from : C:\Documents and Settings\Denno\Desktop\adwcleaner_3.212.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v29.0.1 (en-US)

[ File : C:\Documents and Settings\Denno\Application Data\Mozilla\Firefox\Profiles\93ieznry.default-1385853555296\prefs.js ]


*************************

AdwCleaner[R0].txt - [1404 octets] - [11/06/2014 00:44:36]
AdwCleaner[R1].txt - [1464 octets] - [11/06/2014 08:24:56]
AdwCleaner[R2].txt - [810 octets] - [11/06/2014 08:44:33]
AdwCleaner[S0].txt - [1545 octets] - [11/06/2014 08:26:30]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [929 octets] ##########

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Microsoft Windows XP x86
Ran by Denno on Wed 06/11/2014 at  8:37:40.42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully stopped: [Service] spamfighter update service
Successfully deleted: [Service] spamfighter update service
Successfully stopped: [Service] suite service
Successfully deleted: [Service] suite service



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\commontoolkittray
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sfagent



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\fighters"
Successfully deleted: [Folder] "C:\Documents and Settings\Denno\Application Data\fighters"
Successfully deleted: [Folder] "C:\Program Files\fighters"



~~~ FireFox

Emptied folder: C:\Documents and Settings\Denno\Application Data\mozilla\firefox\profiles\93ieznry.default-1385853555296\minidumps [1 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 06/11/2014 at  8:42:13.62
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

 



#9 ken545

ken545

    Forum God

  • Classroom Teacher
  • 23,207 posts
  • Interests:Fighting Malware and cooking some great Italian and TexMex food
  • MVP

Posted 11 June 2014 - 07:04 AM

Go ahead and run a new scan with OTL and post the New Log please, there wont be an extras log this time so dont go crazy looking for it


Jeffce_zpsa19ee2e6.png

 

 

 

Want to help others, Join our Malware Removal Classroom  HERE

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.
donate.gif

 

Find us on Facebook
Please LIKE and SHARE

 

 

Just a reminder that threads will be closed if no reply in 3 days.


#10 denno

denno

    Silver Member

  • Authentic Member
  • PipPipPip
  • 351 posts
  • Interests:Raising Golden Retrievers; folk-rock and Irish music (what I do); reading; DIY; websites; writing

Posted 11 June 2014 - 10:32 AM

Moving right along....

 

 

 

OTL logfile created on: 6/11/2014 12:07:41 PM - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Denno\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
1013.10 Mb Total Physical Memory | 23.64 Mb Available Physical Memory | 2.33% Memory free
2.38 Gb Paging File | 1.44 Gb Available in Paging File | 60.26% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 211.13 Gb Free Space | 70.83% Space Free | Partition Type: NTFS
Drive D: | 232.77 Gb Total Space | 199.42 Gb Free Space | 85.67% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SHERIFFJOHN | User Name: Denno | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Documents and Settings\Denno\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Denno\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe (Foxit Corporation)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Denno\Local Settings\Apps\2.0\8HC0VQ42.WPJ\L95VWYDX.N7K\dell..tion_0f612f649c4a10af_0005.0004_3ddfe37344028d2c\DellSystemDetect.exe (Dell)
PRC - C:\Program Files\PDF24\pdf24.exe (Geek Software GmbH)
PRC - C:\Program Files\IDrive\IDriveEBackground.exe (Pro-SoftNet Corp, U.S.A)
PRC - C:\Program Files\IDrive\IDriveE Service.exe (Pro Softnet Corporation)
PRC - C:\Program Files\azzCardfile\azzCardfile.exe (azzCardfile)
PRC - C:\Program Files\IDrive\IDriveETray.exe (Pro Softnet Corp.)
PRC - C:\Program Files\IDrive\IDrivePlugin.exe ( )
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATI9HA.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
 
 
========== Modules (No Company Name) ==========
 
MOD - c:\Documents and Settings\Denno\Local Settings\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0wfppc.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\mozjs.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldap32v60.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldappr32v60.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Deployment\167a65f7be0a151b8d13b3ab3cff79f2\System.Deployment.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\2781e84862746a34f026d0ee179eed2b\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\243ff1822abc8282cb8fee37538170b4\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\850fa7110c7423c324762c1ad3130219\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\991c4e11f571a4074b9c4a5841222338\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\4c906eb82e6f56aea01b2a7291fab7ea\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\4e62d1d9b7dd2c2d14915abb73c22d50\mscorlib.ni.dll ()
MOD - C:\Documents and Settings\Denno\Application Data\Dropbox\bin\wxmsw28uh_vc.dll ()
MOD - C:\Documents and Settings\Denno\Application Data\Dropbox\bin\libcef.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Program Files\azzCardfile\hunspelldll.dll ()
MOD - C:\Program Files\Microsoft Office\Office\MSO97.DLL ()
MOD - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
 
 
========== Services (SafeList) ==========
 
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (FoxitCloudUpdateService) -- C:\Program Files\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe (Foxit Corporation)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (IDriveE Service) -- C:\Program Files\IDrive\IDriveE Service.exe (Pro Softnet Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (catchme) -- C:\DOCUME~1\Denno\LOCALS~1\Temp\catchme.sys File not found
DRV - (PfFilter) -- C:\Program Files\IObit\Password Folder\pffilter.sys (IObit Information Technology)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (OMCI) -- C:\WINDOWS\system32\drivers\omci.sys (Dell Computer Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20131118
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.5.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.5.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2013/08/14 23:09:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Denno\Application Data\Mozilla\Extensions
[2014/03/21 09:11:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Denno\Application Data\Mozilla\Firefox\Profiles\93ieznry.default-1385853555296\extensions
[2013/12/02 22:35:05 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\Denno\Application Data\Mozilla\Firefox\Profiles\93ieznry.default-1385853555296\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2014/05/09 20:37:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014/05/09 20:37:52 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
O1 HOSTS File: ([2013/09/28 06:55:36 | 000,000,822 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Program Files\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKCU..\Run: [DellSystemDetect] C:\Documents and Settings\Denno\Start Menu\Programs\Dell\Dell System Detect.appref-ms ()
O4 - HKCU..\Run: [IDriveE Startup] C:\Program Files\IDrive\IDrvieEStartup.exe (Pro Softnet Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
O4 - Startup: C:\Documents and Settings\Denno\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Denno\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Documents and Settings\Denno\Start Menu\Programs\Startup\IDrive Tray.lnk = C:\Program Files\IDrive\IDriveEReg2ini.exe (Pro Softnet Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains:   ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: dell.com ([]* in Trusted sites)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1361254869718 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.22.32.8 64.22.32.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C210370-FF0F-404C-A510-43343D733ACB}: DhcpNameServer = 64.22.32.8 64.22.32.9
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Denno\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Denno\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/02/18 19:11:05 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/08/10 15:04:08 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/06/11 12:06:38 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Denno\Desktop\OTL.exe
[2014/06/11 08:33:22 | 001,016,261 | ---- | C] (Thisisu) -- C:\Documents and Settings\Denno\Desktop\JRT.exe
[2014/06/11 00:44:18 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/06/04 23:36:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Foxit Reader
[2014/06/04 23:36:01 | 000,000,000 | ---D | C] -- C:\Program Files\FOXIT SOFTWARE
[2013/02/23 23:15:23 | 001,562,624 | ---- | C] (Antanas Zdramys LY1DL) -- C:\Program Files\AZZ Cardfile.exe
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/06/11 12:06:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Denno\Desktop\OTL.exe
[2014/06/11 11:49:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/06/11 10:56:33 | 001,015,808 | -H-- | M] () -- C:\ffastun.ffo
[2014/06/11 10:56:33 | 000,004,994 | -H-- | M] () -- C:\ffastun.ffa
[2014/06/11 10:56:31 | 008,355,840 | -H-- | M] () -- C:\ffastun0.ffx
[2014/06/11 10:56:31 | 003,391,488 | -H-- | M] () -- C:\ffastun.ffl
[2014/06/11 08:39:35 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2014/06/11 08:33:30 | 001,016,261 | ---- | M] (Thisisu) -- C:\Documents and Settings\Denno\Desktop\JRT.exe
[2014/06/11 08:29:22 | 000,000,222 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Logon.job
[2014/06/11 08:29:13 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/06/11 00:36:18 | 001,333,465 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\adwcleaner_3.212.exe
[2014/06/08 20:48:11 | 000,001,024 | ---- | M] () -- C:\Documents and Settings\Denno\Start Menu\Programs\Startup\Dropbox.lnk
[2014/06/08 20:47:27 | 000,001,008 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Dropbox.lnk
[2014/06/08 15:29:55 | 000,000,216 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
[2014/06/07 21:39:04 | 000,000,135 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Smith.url
[2014/06/07 12:05:07 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2014/06/04 23:36:17 | 000,001,811 | ---- | M] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2014/06/04 23:36:17 | 000,001,793 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Foxit Reader.lnk
[2014/06/04 21:42:24 | 000,000,222 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\mild chiles.url
[2014/06/04 08:31:09 | 000,000,254 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Beyonce.url
[2014/05/31 10:21:04 | 000,001,519 | ---- | M] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad.lnk
[2014/05/30 20:15:33 | 000,000,146 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\distractify.url
[2014/05/26 18:10:23 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Shortcut to frsb.lnk
[2014/05/26 18:08:29 | 000,000,759 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\ko.lnk
[2014/05/25 21:54:02 | 000,000,119 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Edible wild plants.url
[2014/05/25 21:46:52 | 000,000,131 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\Clicker training.url
[2014/05/19 22:19:18 | 000,000,141 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\crispy-fried-snapper.url
[2014/05/19 22:16:14 | 000,000,163 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\sichuan-crispy-fried-carp.url
[2014/05/18 22:57:47 | 000,000,114 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\acrostics.url
[2014/05/17 21:49:53 | 000,000,179 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\FB Invite How-2.url
[2014/05/14 08:42:09 | 005,273,025 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\How-to-Write-a-Song-Vol-1.zip
[2014/05/13 22:50:43 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2014/05/13 22:50:43 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/06/11 00:36:17 | 001,333,465 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\adwcleaner_3.212.exe
[2014/06/08 20:48:11 | 000,001,024 | ---- | C] () -- C:\Documents and Settings\Denno\Start Menu\Programs\Startup\Dropbox.lnk
[2014/06/07 21:38:51 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Smith.url
[2014/06/04 23:36:17 | 000,001,811 | ---- | C] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2014/06/04 23:36:17 | 000,001,793 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Foxit Reader.lnk
[2014/06/04 21:42:08 | 000,000,222 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\mild chiles.url
[2014/06/04 08:30:57 | 000,000,254 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Beyonce.url
[2014/05/31 10:21:04 | 000,001,519 | ---- | C] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Notepad.lnk
[2014/05/30 20:14:46 | 000,000,146 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\distractify.url
[2014/05/26 18:10:23 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Shortcut to frsb.lnk
[2014/05/26 18:08:29 | 000,000,759 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\ko.lnk
[2014/05/25 21:53:53 | 000,000,119 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Edible wild plants.url
[2014/05/25 21:46:36 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\Clicker training.url
[2014/05/19 22:19:00 | 000,000,141 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\crispy-fried-snapper.url
[2014/05/19 22:15:59 | 000,000,163 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\sichuan-crispy-fried-carp.url
[2014/05/18 22:57:29 | 000,000,114 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\acrostics.url
[2014/05/17 21:49:35 | 000,000,179 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\FB Invite How-2.url
[2014/05/14 08:42:16 | 005,273,025 | ---- | C] () -- C:\Documents and Settings\Denno\Desktop\How-to-Write-a-Song-Vol-1.zip
[2014/04/02 00:14:40 | 000,026,032 | ---- | C] () -- C:\WINDOWS\System32\IDriveEXceedCryReg.exe
[2013/11/20 00:19:48 | 000,000,076 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\flfconfig.ini
[2013/11/03 23:15:14 | 000,116,944 | ---- | C] () -- C:\WINDOWS\Secure.dll
[2013/11/03 23:15:14 | 000,001,386 | -HS- | C] () -- C:\Documents and Settings\Denno\Application Data\systemFP.$dk
[2013/08/15 20:06:00 | 000,147,290 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1275210071-1177238915-839522115-1004-0.dat
[2013/08/15 20:05:56 | 000,147,290 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/07/27 06:15:17 | 000,000,060 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\WB.CFG
[2013/06/17 06:15:17 | 000,000,005 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\WBPU-TTL.DAT
[2013/04/12 04:53:09 | 000,008,074 | ---- | C] () -- C:\WINDOWS\extend.dat
[2013/04/12 04:50:39 | 000,000,022 | ---- | C] () -- C:\WINDOWS\exchng.ini
[2013/04/12 04:50:38 | 000,000,611 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2013/04/11 06:57:56 | 000,000,230 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2013/04/11 06:28:14 | 000,001,534 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ss.ini
[2013/04/01 21:47:16 | 000,001,450 | ---- | C] () -- C:\Documents and Settings\Denno\Local Settings\Application Data\recently-used.xbel
[2013/03/13 22:15:36 | 000,009,728 | ---- | C] () -- C:\Documents and Settings\Denno\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/03/12 20:38:41 | 000,000,056 | ---- | C] () -- C:\WINDOWS\azzCardfile Settings.ini
[2013/02/20 12:14:23 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2013/02/20 12:11:05 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4820.dll
[2013/02/20 01:51:29 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/02/19 12:58:29 | 000,055,808 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2013/02/19 02:41:56 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2013/02/18 19:13:24 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2013/02/18 19:09:31 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2013/02/18 13:36:57 | 000,004,346 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2013/02/18 13:36:18 | 000,137,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
 
========== ZeroAccess Check ==========
 
[2013/02/19 12:51:12 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2012/12/27 06:24:19 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 06:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013/04/19 10:14:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\azzCardfile
[2013/06/16 00:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BSD
[2013/07/02 00:23:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2013/02/20 01:39:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HardwareHelper
[2013/11/21 01:37:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IObit
[2013/11/20 00:36:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2013/08/14 23:22:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\addpcs
[2014/06/02 21:53:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Audacity
[2013/04/19 10:14:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\azzCardfile
[2013/07/02 08:09:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\BitLord
[2013/04/27 23:19:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\CoreFTP
[2014/06/11 08:30:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Dropbox
[2014/06/11 08:30:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\DropboxMaster
[2013/02/20 01:46:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\ElevatedDiagnostics
[2013/04/12 18:06:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\EPSON
[2014/06/04 23:35:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Foxit Software
[2013/04/01 21:51:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\gtk-2.0
[2014/04/18 14:57:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\LiveKit
[2013/02/21 16:30:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\OpenOffice.org
[2013/07/02 00:28:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Python-Eggs
[2013/12/13 12:31:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Denno\Application Data\Thunderbird
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %USERPROFILE%\..|smtmp;true;true;true /FP >
 
< %temp%\smtmp\*.* /s > >
 
< MD5 for: EXPLORER.EXE  >
[2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\erdnt\cache\explorer.exe
[2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
 
< MD5 for: EXPLORER.EXE.C1FECC5471F11AA2CD0A393551DF7.4AA2711F6FA0CFFF236EB33AE7318C3A.AAWQFF  >
[2011/09/24 20:43:57 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.c1fecc5471f11aa2cd0a393551df7.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
[2011/09/24 20:43:57 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.c1fecc5471f11aa2cd0a393551df7.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
[2011/09/24 20:43:57 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.c1fecc5471f11aa2cd0a393551df7.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
 
< MD5 for: EXPLORER.EXE.DF13972E38389FFB60A61E6FF32691.4AA2711F6FA0CFFF236EB33AE7318C3A.AAWQFF  >
[2011/09/24 20:43:58 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.df13972e38389ffb60a61e6ff32691.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
[2011/09/24 20:43:58 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.df13972e38389ffb60a61e6ff32691.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
[2011/09/24 20:43:58 | 001,032,196 | ---- | M] () MD5=7F7A5CE0E2DF951C9032DA0D74AB2806 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Quarantine\explorer.exe.df13972e38389ffb60a61e6ff32691.4aa2711f6fa0cfff236eb33ae7318c3a.aawqff
 
< MD5 for: EXPLORER.EXE-082F38A9.PF  >
[2013/11/21 09:59:34 | 000,017,608 | ---- | M] () MD5=3AC5ED2CD65690AEE5F55C844D98A844 -- C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf
 
< MD5 for: EXPLORER.SCF  >
[2003/07/16 16:28:12 | 000,000,080 | ---- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 -- C:\WINDOWS\explorer.scf
 
< MD5 for: IEXPLORE.BAT  >
[2014/04/06 01:13:18 | 000,031,401 | ---- | M] () MD5=335DFF8F23E5EC02B5426362F0F8509B -- C:\Documents and Settings\Denno\Local Settings\Temp\jrt\iexplore.bat
[2013/04/21 03:58:12 | 000,029,803 | ---- | M] () MD5=E4B95882FB080670179EA3605395889B -- C:\JRT\iexplore.bat
 
< MD5 for: IEXPLORE.CHM  >
[2009/02/21 02:21:24 | 000,529,818 | ---- | M] () MD5=1435F4731719DF5F57D17DC38196245D -- C:\WINDOWS\Help\iexplore.chm
[2007/04/02 23:09:24 | 000,204,810 | ---- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE -- C:\WINDOWS\ie8\iexplore.chm
 
< MD5 for: IEXPLORE.EXE  >
[2008/04/14 06:42:24 | 000,093,184 | ---- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 -- C:\WINDOWS\ie8\iexplore.exe
[2008/04/14 06:42:24 | 000,093,184 | ---- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 -- C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2009/03/08 15:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 15:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\WINDOWS\erdnt\cache\iexplore.exe
[2009/03/08 15:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E -- C:\WINDOWS\system32\dllcache\iexplore.exe
 
< MD5 for: IEXPLORE.EXE.MUI  >
[2009/03/08 15:21:44 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 -- C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 15:21:44 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 -- C:\Program Files\Internet Explorer\iexplore.exe.mui
 
< MD5 for: IEXPLORE.HLP  >
[2003/07/16 16:30:14 | 000,180,335 | ---- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 -- C:\WINDOWS\Help\iexplore.hlp
 
< MD5 for: SERVICES  >
[2003/07/16 16:44:24 | 000,007,116 | ---- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A -- C:\WINDOWS\system32\drivers\etc\services
 
< MD5 for: SERVICES.CFG  >
[2014/05/08 09:48:48 | 000,560,495 | ---- | M] () MD5=12A7DDA9C7CA1AAA2C6F36BB1E24528B -- C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg
[2012/09/23 20:43:36 | 000,603,848 | R--- | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 -- C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\services.cfg
 
< MD5 for: SERVICES.CNF  >
[2004/02/15 13:30:24 | 000,000,002 | ---- | M] () MD5=A55822426A5330C04625A41D264C190B -- C:\Documents and Settings\Denno\My Documents\01 My Sites\lullabologist 2007\lullabologist.com\www\_vti_pvt\services.cnf
 
< MD5 for: SERVICES.DAT  >
[2013/04/21 23:04:55 | 000,001,720 | ---- | M] () MD5=43C1700D78D89F0B1F6FA88FD132BE1A -- C:\JRT\services.dat
[2014/04/06 00:32:27 | 000,004,173 | ---- | M] () MD5=ED018DB6916ACAB46011A330B4B116AA -- C:\Documents and Settings\Denno\Local Settings\Temp\jrt\services.dat
 
< MD5 for: SERVICES.EXE  >
[2009/02/06 07:06:24 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\services.exe
[2008/04/14 06:42:36 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\ServicePackFiles\i386\services.exe
[2009/02/06 13:14:03 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE -- C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\services.exe
[2009/02/06 06:22:21 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD -- C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\services.exe
[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\erdnt\cache\services.exe
[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\services.exe
[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe
 
< MD5 for: SERVICES.HTML  >
[2006/06/04 03:58:20 | 000,010,485 | ---- | M] () MD5=0593516C8BE2A4A513FA239BA5525BBF -- C:\Documents and Settings\Denno\My Documents\01 My Sites\pabloX\Roots2\services.html
 
< MD5 for: SERVICES.LNK  >
[2013/02/18 19:11:05 | 000,001,602 | ---- | M] () MD5=08125797682F9567E12028EFA78AB5BF -- C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
[2013/02/18 19:11:05 | 000,001,602 | ---- | M] () MD5=08125797682F9567E12028EFA78AB5BF -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
[2011/06/09 13:55:27 | 000,001,602 | ---- | M] () MD5=60CB2E633CDAFBF3157893ECA8C22172 -- C:\Documents and Settings\Denno\My Documents\Documents and Settings\Denno\My Documents\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
[2011/06/09 13:55:27 | 000,001,602 | ---- | M] () MD5=60CB2E633CDAFBF3157893ECA8C22172 -- C:\Documents and Settings\Denno\My Documents\My Documents\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
 
< MD5 for: SERVICES.MSC  >
[2003/07/16 16:44:24 | 000,033,464 | ---- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 -- C:\WINDOWS\system32\services.msc
 
< MD5 for: SERVICES.RDB  >
[2012/08/13 11:51:02 | 000,178,348 | ---- | M] () MD5=039C8CFBD74EE07F38CD9E4C7D95C5C6 -- C:\Program Files\OpenOffice.org 3\Basis\program\services.rdb
[2012/08/13 11:51:02 | 000,000,453 | ---- | M] () MD5=3D2ADA15FEF5B5FF468243161543D610 -- C:\Program Files\OpenOffice.org 3\program\services.rdb
[2012/08/10 16:12:16 | 000,008,060 | ---- | M] () MD5=7CA7D7150EC46321162F932ADCF5F35B -- C:\Program Files\OpenOffice.org 3\URE\misc\services.rdb
 
< MD5 for: WINLOGON.EXE  >
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\erdnt\cache\winlogon.exe
[2008/04/14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/14 06:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
 
< %SYSTEMDRIVE%\*.* >
[2013/02/18 19:11:05 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2013/04/12 11:45:51 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2013/05/26 17:22:06 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2013/08/07 09:11:23 | 000,012,004 | ---- | M] () -- C:\ComboFix.txt
[2013/02/18 19:11:05 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2013/05/12 00:05:14 | 000,157,360 | ---- | M] () -- C:\d278b98f.ttf
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2014/06/11 10:56:33 | 000,004,994 | -H-- | M] () -- C:\ffastun.ffa
[2014/06/11 10:56:31 | 003,391,488 | -H-- | M] () -- C:\ffastun.ffl
[2014/06/11 10:56:33 | 001,015,808 | -H-- | M] () -- C:\ffastun.ffo
[2014/06/11 10:56:31 | 008,355,840 | -H-- | M] () -- C:\ffastun0.ffx
[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2013/02/18 19:11:05 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2013/02/18 19:11:05 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2013/02/19 00:19:39 | 000,022,729 | ---- | M] () -- C:\newfile.enc
[2013/02/19 00:19:39 | 000,022,729 | ---- | M] () -- C:\newkey
[2013/02/19 01:57:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2013/02/19 01:57:34 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2014/06/11 08:29:09 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI
 
< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2013/02/18 19:10:56 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\Fonts\*.exe >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.jpg >
 
< %systemroot%\*.png >
 
< %systemroot%\*.scr >
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
[2003/04/25 06:32:56 | 001,562,624 | ---- | M] (Antanas Zdramys LY1DL) -- C:\Program Files\AZZ Cardfile.exe
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< dir "%systemdrive%\*" /S /A:L /C >
 Volume in drive C has no label.
 Volume Serial Number is 6CF5-25D4
 Directory of C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices
02/12/2014  12:58 AM    <JUNCTION>     2.0.0.0__b03f5f7f11d50a3a
               0 File(s)              0 bytes
 Directory of C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote
02/12/2014  12:58 AM    <JUNCTION>     2.0.0.0__b03f5f7f11d50a3a
               0 File(s)              0 bytes
 Directory of C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices
02/12/2014  01:00 AM    <JUNCTION>     v4.0_4.0.0.0__b03f5f7f11d50a3a
               0 File(s)              0 bytes
     Total Files Listed:
               0 File(s)              0 bytes
               3 Dir(s)  226,681,229,312 bytes free
 
< %systemroot%\System32\config\*.sav >
[2013/02/18 13:35:14 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2013/02/18 13:35:14 | 000,602,112 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2013/02/18 13:35:14 | 000,421,888 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %PROGRAMFILES%\bak. /s >
 
< %systemroot%\system32\bak. /s >
 
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2013/02/19 01:59:36 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini
 
< %systemroot%\system32\config\systemprofile\*.dat /x >
 
< %systemroot%\*.config >
 
< %systemroot%\system32\*.db >
 
< %PROGRAMFILES%\Internet Explorer\*.dat >
 
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2013/02/19 02:02:38 | 000,000,177 | -HS- | M] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2013/02/20 01:43:01 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Denno\Application Data\Microsoft\Internet Explorer\Quick Launch\Show desktop.scf
 
< %USERPROFILE%\Desktop\*.exe >
[2014/06/11 00:36:18 | 001,333,465 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\adwcleaner_3.212.exe
[2014/03/05 21:50:45 | 000,404,048 | ---- | M] () -- C:\Documents and Settings\Denno\Desktop\DellSystemDetect.exe
[2014/06/11 08:33:30 | 001,016,261 | ---- | M] (Thisisu) -- C:\Documents and Settings\Denno\Desktop\JRT.exe
[2014/06/11 12:06:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Denno\Desktop\OTL.exe
 
< %PROGRAMFILES%\Common Files\*.* >
 
< %systemroot%\*.src >
 
< %systemroot%\install\*.* >
 
< %systemroot%\system32\DLL\*.* >
 
< %systemroot%\system32\HelpFiles\*.* >
 
< %systemroot%\system32\rundll\*.* >
 
< %systemroot%\winn32\*.* >
 
< %systemroot%\Java\*.* >
 
< %systemroot%\system32\test\*.* >
 
< %systemroot%\system32\Rundll32\*.* >
 
< %systemroot%\AppPatch\Custom\*.* >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2014-05-14 14:19:42
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:264A9BB7

< End of report >
 


    Advertisements

Register to Remove


#11 ken545

ken545

    Forum God

  • Classroom Teacher
  • 23,207 posts
  • Interests:Fighting Malware and cooking some great Italian and TexMex food
  • MVP

Posted 11 June 2014 - 11:01 AM

No malware that I can see, lets clean out your temp files and other not needed garbage

 

Open OTL.exe
  •  
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
 
 
:OTL
 
 
:Services
 
:Reg
 
:Files
ipconfig /flushdns /c
 
 
:Commands
[purity]
[resethosts]
[EMPTYJAVA] 
[emptytemp]
[start explorer]
[Reboot]
 
  • Then click the Run Fix button at the top. <--Not run Scan
  • Let the program run unhindered, reboot when it is done
  • Then post the results of the log it produces

Jeffce_zpsa19ee2e6.png

 

 

 

Want to help others, Join our Malware Removal Classroom  HERE

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.
donate.gif

 

Find us on Facebook
Please LIKE and SHARE

 

 

Just a reminder that threads will be closed if no reply in 3 days.


#12 denno

denno

    Silver Member

  • Authentic Member
  • PipPipPip
  • 351 posts
  • Interests:Raising Golden Retrievers; folk-rock and Irish music (what I do); reading; DIY; websites; writing

Posted 11 June 2014 - 12:42 PM

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Denno\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Denno\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYJAVA]
 
User: All Users
 
User: Default User
 
User: Denno
 
User: LocalService
 
User: NetworkService
 
Total Java Files Cleaned = 0.00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Denno
->Temp folder emptied: 664387 bytes
->Temporary Internet Files folder emptied: 33177 bytes
->FireFox cache emptied: 2367127 bytes
->Flash cache emptied: 492 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 1766 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1646 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 3.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 06112014_143632

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
 



#13 ken545

ken545

    Forum God

  • Classroom Teacher
  • 23,207 posts
  • Interests:Fighting Malware and cooking some great Italian and TexMex food
  • MVP

Posted 11 June 2014 - 12:59 PM

:thumbup:

 

How is your system behaving now ???


Jeffce_zpsa19ee2e6.png

 

 

 

Want to help others, Join our Malware Removal Classroom  HERE

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.
donate.gif

 

Find us on Facebook
Please LIKE and SHARE

 

 

Just a reminder that threads will be closed if no reply in 3 days.


#14 denno

denno

    Silver Member

  • Authentic Member
  • PipPipPip
  • 351 posts
  • Interests:Raising Golden Retrievers; folk-rock and Irish music (what I do); reading; DIY; websites; writing

Posted 11 June 2014 - 02:10 PM

Actually very well.  Have only had one hang up.  This is where I'm, say, saving something and I get a dialog box that becomes non-responsive.  But, you know, if the junk is outa the system and I'm going to be going to a new operating system, that's probably okay.  Will also have the increased memory which should speed things up and, I hope, prevent hang ups.  Had just one of those "a script on this page....." problems.....probably still before we had done much here.

 

Ken, I want to do the same thing with my wife's nearly-identical computer.  Should I start a separate thread?

 

Thanks



#15 ken545

ken545

    Forum God

  • Classroom Teacher
  • 23,207 posts
  • Interests:Fighting Malware and cooking some great Italian and TexMex food
  • MVP

Posted 11 June 2014 - 02:28 PM

Glad things are working out for you.  Working more than one computer per thread can be really exhausting and very confusing , so yes go ahead and start a new topic for your wife.  Post back here and give me a heads up when you post and a link to the topic

 

 

Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups, any programs that where not removed you can just drag to the trash.
 
 
Malwarebytes is the free version and yours to keep and will not be removed
 
 
  •  
How did I get infected in the first place ?    
Read these links and find out how to prevent getting infected again.
 
 
 
Safe Surfn
Ken

Jeffce_zpsa19ee2e6.png

 

 

 

Want to help others, Join our Malware Removal Classroom  HERE

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.
donate.gif

 

Find us on Facebook
Please LIKE and SHARE

 

 

Just a reminder that threads will be closed if no reply in 3 days.

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users