Spyware / Malware / Virus Removal

slooooooowwww windows XP [Closed]

2 min read

Looking for the outcome? Ask AI

johnnybravo Topic Starter

Post #1October 2, 2015, 4:21 AM UTC

super slow win XP I retired this machine for newer hardware, but wouldnt mind getting this baby zipping along…

runs decently on safe mode, so i assume i have some stuff running in the background gumming things up…

any help is greatly appreciated

attached Avast log file

📎aswMBR.txt

Thanks!

JohnnyB

ken545

Post #2October 2, 2015, 3:34 PM UTC

What we can do on this forum is to run some programs to check for malware or a virus and if none is found then I can direct you to our windows forum for help with any windows related problems

Please download Farbar Recovery Scan Tool and save it to your DESKTOP

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

A simple way to check your system: Start –> Computer (right click) –> Properties

[external image: FRST_zps5d956a1a.jpg]

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

Please make sure All Users is checked

Just keep the defaults as in the picture checkmarked

Press Scan button.

It will produce a log called FRST.txt in the same directory the tool is run from.

Please copy and paste log back here.

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

johnnybravo

Post #3October 4, 2015, 12:41 AM UTC

thanks for taking an interest Ken,

always paranoid about the virus/trojan/monsters under my bed :-) comfortable working with this stuff, but would prefer an experts guidance - I grew up in the ancient days of TTL logic and Mag-core memory - would not be surprised if this thing is just bloated up with unneeded software and startup files, some of that stuff doesnt seem to want to remove…. UGH!!

all help is appreciated!

below are the .txt files you requested.

Thanks Again!

Johnny B

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-10-2015

Ran by [removed] (administrator) on PC112451638532 (03-10-2015 17:16:51)

Running from C:\Documents and Settings\[removed]\My Documents\DOWNLOADS

[removed]

Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) Language: English (United States)

Internet Explorer Version 6 (Default browser: FF)

Boot Mode: Safe Mode (with Networking)

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [866584 2006-11-03] (Microsoft Corporation)

HKLM\…\Run: [hpWirelessAssistant] => C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [794624 2005-04-11] (Hewlett-Packard Company)

HKLM\…\Run: [ccApp] => C:\Program Files\Common Files\Symantec Shared\ccApp.exe [48752 2005-04-08] (Symantec Corporation)

HKLM\…\Run: [BluetoothAuthenticationAgent] => rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

HKLM\…\Run: [AGRSMMSG] => C:\WINDOWS\AGRSMMSG.exe [88363 2004-08-24] (Agere Systems)

HKLM\…\Run: [HotSync] => C:\Program Files\palmOne\Hotsync.exe [471040 2004-06-09] (PalmSource, Inc)

HKLM\…\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-01-11] (Adobe Systems Incorporated)

HKLM\…\Run: [basicsmssmenu] => C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe [169328 2007-10-09] (Maxtor Corporation)

HKLM\…\Run: [AVG_UI] => C:\Program Files\AVG\Av\avgui.exe [3804072 2015-09-12] (AVG Technologies CZ, s.r.o.)

HKLM\…\Run: [AvgUi] => C:\Program Files\AVG\Framework\Common\avguix.exe [1125800 2015-09-10] (AVG Technologies CZ, s.r.o.)

HKLM\…\Run: [UserFaultCheck] => %systemroot%\system32\dumprep 0 -u

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxsrvc.dll [2004-12-13] (Intel Corporation)

Winlogon\Notify\NavLogon: C:\WINDOWS\system32\NavLogon.dll [2005-04-17] (Symantec Corporation)

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-13] (Microsoft Corporation)

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: E - E:\LaunchU3.exe -a

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: {0d69b8de-55fe-11da-9969-00904bf64e20} - rundll32.exe url.dll,FileProtocolHandler LapNetWizard.exe

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: {666af201-04bf-11dd-9b46-00904bf64e20} - E:\LapNetWizard.exe

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: {aa304543-1670-11db-9a03-00904bf64e20} - rundll32.exe url.dll,FileProtocolHandler LapNetWizard.exe

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: {bb6485d0-4561-11dc-9adf-95904f046d07} - E:\LapNetWizard.exe

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: {cd4ba99b-240d-11de-9b66-00904bf64e20} - E:\LaunchU3.exe -a

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: {df5748f8-3d39-11db-9a16-00904bf64e20} - rundll32.exe url.dll,FileProtocolHandler LapNetWizard.exe

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: {f3368d87-bf30-11da-99c4-00904bf64e20} - rundll32.exe url.dll,FileProtocolHandler LapNetWizard.exe

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\…\MountPoints2: {f3368d9f-bf30-11da-99c4-00904bf64e20} - rundll32.exe url.dll,FileProtocolHandler LapNetWizard.exe

HKU\S-1-5-18\…\Run: [DWQueuedReporting] => C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [39264 2007-03-22] (Microsoft Corporation)

ShellExecuteHooks: Microsoft AntiMalware ShellExecuteHook - {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll [83224 2006-11-03] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\WINDOWS\system32\AcSignIcon.dll [2006-03-05] (Autodesk)

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk [2007-11-12]

ShortcutTarget: HOTSYNCSHORTCUTNAME.lnk -> C:\Program Files\palmOne\Hotsync.exe (PalmSource, Inc)

Startup: C:\Documents and Settings\JOHN R\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk [2007-07-30]

ShortcutTarget: Microsoft Works Calendar Reminders.lnk -> C:\Program Files\MSWorks\Calendar\WKCALREM.EXE (Microsoft Corporation)

Startup: C:\Documents and Settings\JOHN R\Start Menu\Programs\Startup\palmOne Registration.lnk [2007-11-12]

ShortcutTarget: palmOne Registration.lnk -> C:\Program Files\palmOne\register.exe (palmOne/Leader Technologies)

BootExecute: autocheck autochk * C:\PROGRA~1\AVG\Av\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] [removed] [removed]

Tcpip\..\Interfaces\{EA70B343-E29B-42C4-AEDE-9A9B6ED409C7}: [DhcpNameServer] [removed] [removed]

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid;={SUB_CLSID}&pver;={SUB_PVER}&ar;=home

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=Q305&bd;=presario&pf;=laptop

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.google.com/mail/?shva=1

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

URLSearchHook: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)

URLSearchHook: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "" <======= ATTENTION

SearchScopes: HKLM -> DefaultScope value is missing

BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15] (Sun Microsystems, Inc.)

DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} hxxp://support.f-secure.com/ols/fscax.cab

DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} hxxp://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} hxxp://h20278.www2.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB

DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} hxxp://office.microsoft.com/officeupdate/content/opuc3.cab

DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} hxxp://www.nanoscan.com/as/v1/cabs/ascstubie.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125428060062

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145219489046

DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} hxxp://support.f-secure.com/ols/fscax.cab

DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} hxxp://www.crucial.com/controls/cpcScanner.cab

DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} hxxp://www.superadblocker.com/activex/sabspx.cab

DPF: {CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

FireFox:

========

FF ProfilePath: C:\Documents and Settings\JOHN R\Application Data\Mozilla\Firefox\Profiles\621t7m7n.default-1443376763433

FF Plugin: @macromedia.com/FlashPlayer9 -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll [2006-11-09] ()

FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)

FF Plugin: [removed]/YahooActiveXPluginBridge;version=1.0.0.1 -> C:\Program Files\Yahoo!\Common\npyaxmpb.dll [2006-11-03] (Yahoo! Inc.)

FF Plugin HKU\S-1-5-21-1594261026-4222727072-4100554716-1006: @macromedia.com/FlashPlayer9 -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll [2006-11-09] ()

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll [2006-12-12] (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2007-03-22] (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPSWF32.dll [2006-11-09] ()

FF Extension: Google Toolbar for Firefox - C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007-03-09]

FF HKLM\…\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-04-04]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AvgAMPS; C:\Program Files\AVG\Av\avgamps.exe [603120 2015-09-12] (AVG Technologies CZ, s.r.o.)

S2 AVGIDSAgent; C:\Program Files\AVG\Av\avgidsagent.exe [3793392 2015-09-12] (AVG Technologies CZ, s.r.o.)

S2 avgsvc; C:\Program Files\AVG\Framework\Common\avgsvcx.exe [858024 2015-09-10] (AVG Technologies CZ, s.r.o.)

S2 avgwd; C:\Program Files\AVG\Av\avgwdsvcx.exe [595832 2015-09-12] (AVG Technologies CZ, s.r.o.)

S2 Basics Service; C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe [124280 2007-10-09] (Seagate Technology LLC)

S2 Brother XP spl Service; C:\WINDOWS\system32\brsvc01a.exe [57344 2002-04-12] (brother Industries Ltd)

S2 btwdins; C:\Program Files\Bluetooth Software\bin\btwdins.exe [135168 2003-08-14] (WIDCOMM, Inc.) [File not signed]

S2 ccEvtMgr; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [185968 2005-04-08] (Symantec Corporation)

S3 ccPwdSvc; C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe [83568 2005-04-08] (Symantec Corporation)

S2 ccSetMgr; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [161392 2005-04-08] (Symantec Corporation)

S2 DefWatch; C:\Program Files\Symantec AntiVirus\DefWatch.exe [19648 2005-04-17] (Symantec Corporation)

S2 EPSONStatusAgent2; C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe [90112 2001-08-09] (SEIKO EPSON CORPORATION) [File not signed]

S3 hpqwmi; C:\Program Files\HPQ\SHARED\HPQWMI.exe [98304 2005-03-04] (Hewlett-Packard Development Company, L.P.) [File not signed]

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S3 iPodService; C:\Program Files\iPod\bin\iPodService.exe [327680 2004-10-13] (Apple Computer, Inc.) [File not signed]

S2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [38912 2005-02-22] () [File not signed]

S2 NA_Service; C:\WINDOWS\system32\NA_Service.exe [49152 2005-09-13] (Schneider Automation SAS) [File not signed]

S3 SavRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [124608 2005-04-17] (symantec)

S3 SNDSrvc; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [206552 2005-04-05] (Symantec Corporation)

S3 SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [992864 2005-03-30] (Symantec Corporation)

S3 Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [1706176 2005-04-17] (Symantec Corporation)

S2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [3509672 2015-09-15] (AVG Technologies CZ, s.r.o.)

S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [13592 2006-11-03] (Microsoft Corporation)

S2 XipConnect; C:\XWAYDRV\XIPCONNECT.EXE [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S1 Avgdiskx; C:\WINDOWS\System32\DRIVERS\avgdiskx.sys [156080 2015-08-10] (AVG Technologies CZ, s.r.o.)

S1 AVGIDSDriverl; C:\WINDOWS\System32\DRIVERS\avgidsdriverlx.sys [240048 2015-08-28] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHX; C:\WINDOWS\System32\DRIVERS\avgidshx.sys [231344 2015-08-20] (AVG Technologies CZ, s.r.o.)

S1 AVGIDSShim; C:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [31664 2015-08-14] (AVG Technologies CZ, s.r.o.)

S1 Avgldx86; C:\WINDOWS\System32\DRIVERS\avgldx86.sys [232368 2015-08-10] (AVG Technologies CZ, s.r.o.)

S0 Avglogx; C:\WINDOWS\System32\DRIVERS\avglogx.sys [308656 2015-08-14] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx86; C:\WINDOWS\System32\DRIVERS\avgmfx86.sys [189872 2015-08-10] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx86; C:\WINDOWS\System32\DRIVERS\avgrkx86.sys [36784 2015-08-10] (AVG Technologies CZ, s.r.o.)

R1 Avgtdix; C:\WINDOWS\System32\DRIVERS\avgtdix.sys [231344 2015-08-28] (AVG Technologies CZ, s.r.o.)

R3 BCM43XX; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [371712 2005-03-10] (Broadcom Corporation)

S2 BCMNTIO; C:\Program Files\CheckIt\Diagnostics\BCMNTIO.SYS [3744 2004-03-05] () [File not signed]

S3 brfilt; C:\WINDOWS\System32\Drivers\Brfilt.sys [2944 2001-08-17] (Brother Industries Ltd.)

S3 BrScnUsb; C:\WINDOWS\System32\Drivers\BrScnUsb.sys [15263 2003-12-19] (Brother Industries Ltd.)

S3 BrUsbScn; C:\WINDOWS\System32\Drivers\BrUsbScn.sys [10368 2001-08-17] (Brother Industries Ltd.)

R0 BTKRNL; C:\WINDOWS\System32\drivers\btkrnl.sys [1257418 2003-08-14] (WIDCOMM, Inc.) [File not signed]

S2 BTSERIAL; C:\WINDOWS\system32\drivers\btserial.sys [22183 2003-08-14] () [File not signed]

S2 BTSLBCSP; C:\WINDOWS\system32\drivers\btslbcsp.sys [222876 2003-08-14] (WIDCOMM, Inc.) [File not signed]

S3 Duntlw; C:\WINDOWS\System32\Drivers\DuntlwNT.sys [53568 2006-02-24] (Schneider Automation) [File not signed]

S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [371248 2009-03-16] (Symantec Corporation)

S3 Eplpdx02; C:\WINDOWS\system32\Drivers\EPLPDX02.SYS [70084 2001-08-10] (MK Systems CO., LTD.) [File not signed]

S3 FTDIBUS; C:\WINDOWS\System32\drivers\ftdibus.sys [24369 2004-11-25] (FTDI Ltd.) [File not signed]

S3 FTSER2K; C:\WINDOWS\System32\drivers\ftser2k.sys [57820 2004-11-25] (FTDI Ltd.) [File not signed]

S3 giveio; C:\WINDOWS\system32\giveio.sys [5248 2006-03-27] () [File not signed]

S2 MAPMEM; C:\Program Files\CheckIt\Diagnostics\MAPMEM.SYS [3904 2004-03-05] () [File not signed]

S3 mf; C:\WINDOWS\System32\DRIVERS\mf.sys [63744 2008-04-13] (Microsoft Corporation)

S3 NAVENG; C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090405.003\NAVENG.SYS [89104 2009-03-16] (Symantec Corporation)

S3 NAVEX15; C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090405.003\NAVEX15.SYS [876144 2009-03-16] (Symantec Corporation)

R3 pfc; C:\WINDOWS\System32\drivers\pfc.sys [9856 2003-01-22] (Padus, Inc.) [File not signed]

R0 PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [20576 2005-01-26] (Sonic Solutions) [File not signed]

S3 Rasirda; C:\WINDOWS\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)

R3 RTL8023xp; C:\WINDOWS\System32\DRIVERS\Rtlnicxp.sys [69760 2004-06-28] (Realtek Semiconductor Corporation )

S1 SAVRT; C:\Program Files\Symantec AntiVirus\savrt.sys [324232 2005-02-04] (Symantec Corporation)

S1 SAVRTPEL; C:\Program Files\Symantec AntiVirus\Savrtpel.sys [53896 2005-02-04] (Symantec Corporation)

S3 senfilt; C:\WINDOWS\System32\drivers\senfilt.sys [381056 2004-04-26] (Sensaura)

S3 SMCIRDA; C:\WINDOWS\System32\DRIVERS\smcirda.sys [35913 2001-08-17] (SMC)

S3 SPBBCDrv; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [372832 2005-03-30] (Symantec Corporation)

S3 SymEvent; C:\Program Files\Symantec\SYMEVENT.SYS [123248 2006-01-31] (Symantec Corporation)

S3 SYMREDRV; C:\WINDOWS\system32\Drivers\SYMREDRV.SYS [17976 2005-04-05] (Symantec Corporation)

S1 SYMTDI; C:\WINDOWS\system32\Drivers\SYMTDI.SYS [267192 2005-04-05] (Symantec Corporation)

S3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [30632 2015-09-15] (TuneUp Software)

S3 USA19H; C:\WINDOWS\System32\DRIVERS\USA19H2k.sys [727908 2003-06-24] (Keyspan)

S3 USA19H2KP; C:\WINDOWS\System32\DRIVERS\USA19H2kp.SYS [44928 2003-06-24] (Keyspan)

S3 ApfiltrService; system32\DRIVERS\Apfiltr.sys [X]

S3 cglptnt; \??\C:\Documents and Settings\JOHN R\My Documents\0 Service Shared Files\totalcmd\cglptnt.sys [X]

S1 eabfiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys [X]

S3 FreshIO; \??\C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys [X]

S3 MidiSyn; system32\drivers\MidiSyn.sys [X]

U5 P3; C:\Windows\System32\Drivers\P3.sys [42752 2008-04-13] (Microsoft Corporation)

S3 PalmUSBD; system32\drivers\PalmUSBD.sys [X]

S2 pciinfo; \??\C:\DOCUME~1\JOHNRU~1\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys [X]

S3 SABProcEnum; \??\C:\Program Files\Internet Explorer\SABProcEnum.sys [X]

U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)

U3 Winsock - Google Desktop Search Backup Before First Install; no ImagePath

U3 Winsock - Google Desktop Search Backup Before Last Install; no ImagePath

U1 WS2IFSL; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-03 11:13 - 2015-10-03 11:16 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Mozilla

2015-10-03 11:13 - 2015-10-03 11:13 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla

2015-10-03 08:45 - 2015-10-03 17:17 - 00000000 ____D C:\FRST

2015-10-02 19:48 - 2015-10-02 19:48 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2015-10-02 08:23 - 2015-10-02 08:23 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$

2015-10-02 08:20 - 2015-10-02 08:24 - 00011580 _____ C:\WINDOWS\KB2862335.log

2015-10-02 08:17 - 2015-10-02 08:17 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB954155_WM9$

2015-10-02 08:16 - 2015-10-02 08:18 - 00009630 _____ C:\WINDOWS\KB954155.log

2015-10-02 07:52 - 2015-10-02 07:52 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$

2015-10-02 07:51 - 2015-10-02 07:53 - 00007539 _____ C:\WINDOWS\KB2834904-v2.log

2015-10-02 07:46 - 2015-10-02 07:46 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB972270$

2015-10-02 07:31 - 2015-10-02 07:32 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB956572$

2015-10-02 07:26 - 2015-10-02 07:37 - 00015341 _____ C:\WINDOWS\KB956572.log

2015-10-02 07:21 - 2015-10-02 07:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$

2015-10-02 07:17 - 2015-10-02 07:22 - 00008011 _____ C:\WINDOWS\KB2904266.log

2015-10-02 07:10 - 2015-10-02 07:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB956844$

2015-10-02 06:56 - 2015-10-02 07:13 - 00010096 _____ C:\WINDOWS\KB956844.log

2015-10-02 01:43 - 2013-07-02 19:12 - 00025088 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hidparse.sys

2015-10-02 01:43 - 2013-07-02 18:59 - 00014976 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbscan.sys

2015-10-02 01:40 - 2009-10-15 09:28 - 00119808 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\t2embed.dll

2015-10-02 01:40 - 2009-10-15 09:28 - 00081920 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\fontsub.dll

2015-10-02 01:32 - 2009-03-06 07:22 - 00284160 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\pdh.dll

2015-10-02 01:32 - 2009-02-09 05:10 - 00473600 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\fastprox.dll

2015-10-02 01:32 - 2009-02-09 05:10 - 00401408 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\rpcss.dll

2015-10-02 01:32 - 2009-02-06 04:11 - 00110592 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\services.exe

2015-10-02 01:32 - 2009-02-06 03:39 - 00035328 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\sc.exe

2015-10-02 01:32 - 2009-02-06 03:10 - 00227840 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wmiprvse.exe

2015-10-02 01:31 - 2009-02-09 05:10 - 00617472 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\advapi32.dll

2015-10-02 01:31 - 2009-02-09 05:10 - 00453120 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wmiprvsd.dll

2015-10-02 01:26 - 2009-06-21 14:44 - 00153088 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\triedit.dll

2015-10-02 00:32 - 2015-10-02 19:50 - 00018037 _____ C:\WINDOWS\KB982132.log

2015-10-02 00:29 - 2015-10-02 19:50 - 00017951 _____ C:\WINDOWS\KB971657.log

2015-10-02 00:24 - 2015-10-02 19:50 - 00017912 _____ C:\WINDOWS\KB978338.log

2015-10-02 00:19 - 2015-10-02 19:51 - 00019067 _____ C:\WINDOWS\KB2909212.log

2015-10-02 00:16 - 2015-10-02 00:16 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB973869$

2015-10-02 00:14 - 2015-10-02 00:18 - 00009631 _____ C:\WINDOWS\KB973869.log

2015-10-02 00:13 - 2015-10-02 19:51 - 00017875 _____ C:\WINDOWS\KB2507938.log

2015-10-02 00:05 - 2015-10-02 19:52 - 00017905 _____ C:\WINDOWS\KB2780091.log

2015-10-02 00:03 - 2015-10-02 00:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2592799$

2015-10-01 23:45 - 2015-10-02 00:09 - 00010281 _____ C:\WINDOWS\KB2592799.log

2015-10-01 23:44 - 2015-10-02 19:49 - 00019628 _____ C:\WINDOWS\KB2510581.log

2015-10-01 23:38 - 2015-10-02 19:50 - 00017572 _____ C:\WINDOWS\KB974112.log

2015-10-01 23:26 - 2015-10-02 19:51 - 00017722 _____ C:\WINDOWS\KB2876217.log

2015-10-01 23:17 - 2015-10-02 19:49 - 00017751 _____ C:\WINDOWS\KB2483185.log

2015-10-01 22:43 - 2015-10-02 19:51 - 00018442 _____ C:\WINDOWS\KB2930275.log

2015-10-01 21:44 - 2015-10-01 21:44 - 00000804 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk

2015-09-30 21:31 - 2015-10-02 19:52 - 00025927 _____ C:\WINDOWS\KB2864063.log

2015-09-30 21:26 - 2009-07-27 15:27 - 00128512 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\dhtmled.ocx

2015-09-30 21:24 - 2015-09-30 21:26 - 00008147 _____ C:\WINDOWS\KB975025.log

2015-09-30 21:19 - 2015-09-30 21:21 - 00008023 _____ C:\WINDOWS\KB2719985.log

2015-09-30 21:15 - 2015-09-30 21:17 - 00007979 _____ C:\WINDOWS\KB952004.log

2015-09-30 21:09 - 2015-09-30 21:11 - 00007797 _____ C:\WINDOWS\KB974571.log

2015-09-30 20:57 - 2015-09-30 21:01 - 00007925 _____ C:\WINDOWS\KB2862152.log

2015-09-30 20:43 - 2015-09-30 20:45 - 00007835 _____ C:\WINDOWS\KB2850869.log

2015-09-30 20:34 - 2015-09-30 20:38 - 00007835 _____ C:\WINDOWS\KB2876331.log

2015-09-30 20:33 - 2015-09-30 20:33 - 00000573 _____ C:\Documents and Settings\JOHN R\Desktop\aswMBR.txt

2015-09-30 20:17 - 2015-09-30 20:18 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2535512$

2015-09-30 19:52 - 2015-09-30 20:27 - 00011566 _____ C:\WINDOWS\KB2535512.log

2015-09-29 18:01 - 2015-09-29 18:01 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Avg

2015-09-29 17:10 - 2015-09-29 17:10 - 00000000 ____D C:\Documents and Settings\Administrator\Desktop\Unused Desktop Shortcuts.{6357BCB6-B06E-11D6-82EF-00C04FA03755}

2015-09-29 17:10 - 2015-09-29 17:10 - 00000000 ____D C:\Documents and Settings\Administrator\Desktop\Unused Desktop Shortcuts

2015-09-29 16:36 - 2015-09-29 16:36 - 00000232 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job

2015-09-29 08:19 - 2011-04-21 06:37 - 00105472 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mup.sys

2015-09-29 07:22 - 2015-09-29 07:22 - 00016973 _____ C:\WINDOWS\KB2807986.log

2015-09-29 07:22 - 2015-09-29 07:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2807986$

2015-09-29 07:20 - 2015-09-29 07:20 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2570947$

2015-09-29 07:19 - 2015-09-29 07:21 - 00016464 _____ C:\WINDOWS\KB2570947.log

2015-09-29 06:54 - 2015-09-29 06:54 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868038$

2015-09-29 06:53 - 2015-09-29 06:54 - 00016117 _____ C:\WINDOWS\KB2868038.log

2015-09-29 06:51 - 2015-09-29 06:52 - 00014204 _____ C:\WINDOWS\KB978695.log

2015-09-29 06:51 - 2015-09-29 06:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB978695_WM9$

2015-09-29 06:43 - 2015-09-29 06:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2603381$

2015-09-29 06:41 - 2015-09-29 06:44 - 00016430 _____ C:\WINDOWS\KB2603381.log

2015-09-29 06:38 - 2015-09-29 06:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB973904$

2015-09-29 06:34 - 2015-09-29 06:39 - 00017470 _____ C:\WINDOWS\KB973904.log

2015-09-29 06:31 - 2015-09-29 06:31 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB973540_WM9$

2015-09-29 05:02 - 2015-09-29 05:56 - 00000000 ____D C:\WINDOWS\system32\MRT

2015-09-29 04:30 - 2015-09-29 04:30 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2698365$

2015-09-29 04:28 - 2015-09-29 04:31 - 00016916 _____ C:\WINDOWS\KB2698365.log

2015-09-29 04:15 - 2015-09-29 04:15 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB979309$

2015-09-29 03:10 - 2015-09-29 03:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB981997$

2015-09-29 03:06 - 2015-09-29 03:15 - 00015302 _____ C:\WINDOWS\KB981997.log

2015-09-29 02:42 - 2015-09-29 02:42 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2934207$

2015-09-29 02:35 - 2015-09-29 02:48 - 00013210 _____ C:\WINDOWS\KB2934207.log

2015-09-29 02:03 - 2015-09-29 02:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2723135-v2$

2015-09-29 01:48 - 2015-09-29 02:13 - 00015905 _____ C:\WINDOWS\KB2723135-v2.log

2015-09-29 00:29 - 2015-09-29 00:30 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$

2015-09-28 22:38 - 2015-09-28 22:39 - 00315032 _____ C:\WINDOWS\msxml4-KB973688-enu.LOG

2015-09-28 22:33 - 2015-09-28 22:33 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB982665$

2015-09-28 21:48 - 2015-09-28 21:48 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2478960$

2015-09-28 21:36 - 2015-09-28 21:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2393802$

2015-09-28 21:25 - 2015-09-28 21:42 - 00017318 _____ C:\WINDOWS\KB2393802.log

2015-09-28 21:14 - 2015-09-28 21:14 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB923561$

2015-09-28 21:12 - 2015-09-28 21:19 - 00015466 _____ C:\WINDOWS\KB923561.log

2015-09-28 21:07 - 2015-09-28 21:07 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2620712$

2015-09-28 20:56 - 2015-09-28 20:56 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2566454$

2015-09-28 20:54 - 2015-09-28 20:58 - 00013618 _____ C:\WINDOWS\KB2566454.log

2015-09-28 20:49 - 2015-09-28 20:49 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2661637$

2015-09-28 20:45 - 2015-09-28 20:51 - 00013406 _____ C:\WINDOWS\KB2661637.log

2015-09-28 20:39 - 2015-09-28 20:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

2015-09-28 20:36 - 2015-09-28 20:41 - 00011262 _____ C:\WINDOWS\KB2914368.log

2015-09-28 20:30 - 2015-09-28 20:30 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2584146$

2015-09-28 19:43 - 2015-09-28 19:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB975467$

2015-09-28 19:38 - 2015-09-28 19:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB968389$

2015-09-28 19:30 - 2015-09-28 19:30 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2423089$

2015-09-28 19:17 - 2015-09-28 19:32 - 00010684 _____ C:\WINDOWS\KB2423089.log

2015-09-28 09:46 - 2015-09-28 09:46 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\AVG

2015-09-28 09:45 - 2015-10-02 19:17 - 00065536 _____ C:\WINDOWS\system32\config\TuneUp.evt

2015-09-28 09:44 - 2015-09-15 13:52 - 00042920 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\TURegOpt.exe

2015-09-28 09:43 - 2015-09-28 09:43 - 00001795 _____ C:\Documents and Settings\All Users\Start Menu\Programs\AVG PC TuneUp.lnk

2015-09-28 09:43 - 2015-09-28 09:43 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\AVG PC TuneUp

2015-09-28 09:42 - 2013-07-16 17:58 - 00123008 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbvideo.sys

2015-09-28 09:42 - 2013-07-16 17:58 - 00060160 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbaudio.sys

2015-09-28 09:32 - 2015-09-30 19:58 - 00015395 _____ C:\WINDOWS\KB973507.log

2015-09-28 09:18 - 2015-09-30 20:07 - 00011014 _____ C:\WINDOWS\KB977816.log

2015-09-28 09:14 - 2010-06-18 06:36 - 03558912 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\moviemk.exe

2015-09-28 08:57 - 2015-09-28 09:12 - 00005762 _____ C:\WINDOWS\KB2859537.log

2015-09-28 08:54 - 2013-02-11 17:32 - 00012928 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usb8023x.sys

2015-09-28 08:54 - 2013-02-11 17:32 - 00012928 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usb8023.sys

2015-09-27 22:17 - 2015-09-27 22:17 - 00006544 _____ C:\WINDOWS\KB2820917.log

2015-09-27 22:17 - 2015-09-27 22:17 - 00006539 _____ C:\WINDOWS\KB2893294.log

2015-09-27 22:16 - 2015-09-27 22:16 - 00006471 _____ C:\WINDOWS\KB2757638.log

2015-09-27 22:15 - 2015-09-27 22:15 - 00006388 _____ C:\WINDOWS\KB2419632.log

2015-09-27 22:15 - 2015-09-27 22:15 - 00006298 _____ C:\WINDOWS\KB2508429.log

2015-09-27 22:14 - 2015-09-27 22:14 - 00006204 _____ C:\WINDOWS\KB2653956.log

2015-09-27 22:14 - 2015-09-27 22:14 - 00006120 _____ C:\WINDOWS\KB2749655.log

2015-09-27 22:14 - 2015-09-27 22:14 - 00006012 _____ C:\WINDOWS\KB974392.log

2015-09-27 22:13 - 2015-09-27 22:13 - 00006277 _____ C:\WINDOWS\KB2879017.log

2015-09-27 22:12 - 2015-09-27 22:13 - 00005981 _____ C:\WINDOWS\KB971029.log

2015-09-27 22:12 - 2015-09-27 22:12 - 00005876 _____ C:\WINDOWS\KB2506212.log

2015-09-27 22:10 - 2015-09-27 22:12 - 00006130 _____ C:\WINDOWS\KB977914.log

2015-09-27 22:10 - 2015-09-27 22:10 - 00005788 _____ C:\WINDOWS\KB2892075.log

2015-09-27 22:09 - 2015-09-27 22:09 - 00005701 _____ C:\WINDOWS\KB2619339.log

2015-09-27 22:09 - 2012-05-28 11:16 - 00536576 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\msado15.dll

2015-09-27 22:08 - 2015-09-27 22:08 - 00005683 _____ C:\WINDOWS\KB2705219-v2.log

2015-09-27 22:07 - 2015-09-27 22:08 - 00005532 _____ C:\WINDOWS\KB978542.log

2015-09-27 22:07 - 2015-09-27 22:07 - 00005448 _____ C:\WINDOWS\KB2727528.log

2015-09-27 22:06 - 2015-09-27 22:06 - 00005349 _____ C:\WINDOWS\KB979482.log

2015-09-27 22:06 - 2015-09-27 22:06 - 00005268 _____ C:\WINDOWS\KB978706.log

2015-09-27 22:06 - 2014-02-25 18:59 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\xp_eos.exe

2015-09-27 22:06 - 2014-02-25 18:59 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xp_eos.exe

2015-09-27 22:05 - 2012-07-04 07:05 - 00139784 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\rdpwd.sys

2015-09-27 22:04 - 2015-09-27 22:04 - 00005206 _____ C:\WINDOWS\KB960803.log

2015-09-27 21:53 - 2015-09-27 21:53 - 00005186 _____ C:\WINDOWS\KB973815.log

2015-09-27 21:51 - 2013-08-08 17:55 - 00144128 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbport.sys

2015-09-27 21:51 - 2013-08-08 17:55 - 00032384 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbccgp.sys

2015-09-27 21:51 - 2013-08-08 17:55 - 00005376 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbd.sys

2015-09-27 21:51 - 2009-03-18 04:02 - 00030336 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbehci.sys

2015-09-27 21:46 - 2015-09-27 21:46 - 00005465 _____ C:\WINDOWS\KB2813345.log

2015-09-27 21:45 - 2015-10-03 08:28 - 00006192 _____ C:\WINDOWS\KB2509553.log

2015-09-27 21:40 - 2015-09-28 22:36 - 00023093 _____ C:\WINDOWS\KB982665.log

2015-09-27 21:40 - 2015-09-27 21:42 - 00005809 _____ C:\WINDOWS\KB2676562.log

2015-09-27 21:39 - 2010-12-09 08:15 - 00718336 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntdll.dll

2015-09-27 21:39 - 2009-03-26 23:58 - 01203922 ____N C:\WINDOWS\system32\dllcache\sysmain.sdb

2015-09-27 21:39 - 2008-05-03 04:55 - 00002560 ____N (Microsoft Corporation) C:\WINDOWS\system32\xpsp4res.dll

2015-09-27 21:39 - 2008-04-21 05:08 - 00215552 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wordpad.exe

2015-09-27 21:38 - 2015-09-28 21:09 - 00021450 _____ C:\WINDOWS\KB2620712.log

2015-09-27 21:36 - 2015-09-29 04:17 - 00022797 _____ C:\WINDOWS\KB979309.log

2015-09-27 21:36 - 2011-07-08 07:02 - 00010496 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ndistapi.sys

2015-09-27 21:35 - 2015-09-28 20:32 - 00020885 _____ C:\WINDOWS\KB2584146.log

2015-09-27 21:35 - 2013-11-27 13:21 - 00040960 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ndproxy.sys

2015-09-27 21:35 - 2012-01-11 12:06 - 00003072 ____N C:\WINDOWS\system32\iacenc.dll

2015-09-27 21:35 - 2012-01-11 12:06 - 00003072 ____N C:\WINDOWS\system32\dllcache\iacenc.dll

2015-09-27 21:34 - 2015-09-28 19:45 - 00021591 _____ C:\WINDOWS\KB975467.log

2015-09-27 21:32 - 2015-09-28 19:40 - 00022309 _____ C:\WINDOWS\KB968389.log

2015-09-27 21:31 - 2010-10-11 07:59 - 00045568 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wab.exe

2015-09-27 16:36 - 2015-09-28 09:26 - 00000000 ___DC C:\Documents and Settings\JOHN R\Application Data\AVG

2015-09-27 16:20 - 2015-09-27 16:20 - 00000000 ___DC C:\Documents and Settings\JOHN R\Application Data\TuneUp Software

2015-09-27 16:20 - 2015-09-27 16:20 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\AVG

2015-09-27 16:08 - 2015-09-27 16:08 - 00000000 ___HD C:\$AVG

2015-09-27 12:16 - 2015-10-03 08:04 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData

2015-09-27 12:16 - 2015-09-27 12:16 - 00000000 ____D C:\Documents and Settings\JOHN R\Local Settings\Application Data\MFAData

2015-09-27 12:01 - 2015-09-28 09:14 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Avg

2015-09-27 11:58 - 2015-09-28 09:12 - 00000000 ____D C:\Program Files\AVG

2015-09-27 11:53 - 2015-10-01 21:49 - 00000000 ____D C:\Documents and Settings\JOHN R\Local Settings\Application Data\AvgSetupLog

2015-09-27 11:53 - 2015-09-28 09:27 - 00000000 ____D C:\Documents and Settings\JOHN R\Local Settings\Application Data\Avg

2015-09-27 11:00 - 2015-09-27 11:00 - 00000000 ____D C:\Documents and Settings\JOHN R\Desktop\Old Firefox Data

2015-09-27 07:19 - 2015-09-27 07:19 - 00000000 ____D C:\Temp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-03 17:18 - 2005-08-30 11:45 - 00000000 ____D C:\Documents and Settings\JOHN R\Local Settings\Temp

2015-10-03 17:11 - 2006-04-22 07:31 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini

2015-10-03 17:10 - 2006-04-22 07:31 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Temp

2015-10-03 11:19 - 2004-08-07 06:16 - 00001158 _____ C:\WINDOWS\system32\wpa.dbl

2015-10-03 11:00 - 2004-08-07 06:16 - 01759480 _____ C:\WINDOWS\WindowsUpdate.log

2015-10-03 10:59 - 2005-08-30 11:45 - 00000278 __SHC C:\Documents and Settings\JOHN R\ntuser.ini

2015-10-03 08:54 - 2005-08-30 12:06 - 00000000 ____D C:\Documents and Settings\JOHN R\Local Settings\Application Data\Adobe

2015-10-03 08:40 - 2004-08-07 06:16 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-10-03 05:24 - 2006-07-21 15:35 - 00000380 _____ C:\WINDOWS\Tasks\Symantec NetDetect.job

2015-10-02 19:41 - 2004-08-07 06:10 - 00526774 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-10-02 19:34 - 2007-08-16 19:11 - 00037617 _____ C:\WINDOWS\spupdsvc.log

2015-10-02 19:30 - 2004-08-06 22:51 - 00000157 _____ C:\WINDOWS\wiadebug.log

2015-10-02 19:30 - 2004-08-06 22:51 - 00000049 _____ C:\WINDOWS\wiaservc.log

2015-10-02 19:17 - 2004-08-07 06:16 - 00032544 _____ C:\WINDOWS\SchedLgU.Txt

2015-10-02 19:16 - 2007-07-31 21:57 - 00000012 _____ C:\WINDOWS\bthservsdp.dat

2015-10-02 19:16 - 2005-08-30 11:45 - 00000000 ___DC C:\Documents and Settings\JOHN R

2015-10-02 09:15 - 2005-05-22 23:48 - 00000000 ____D C:\WINDOWS\Microsoft.NET

2015-10-02 08:24 - 2007-08-16 18:08 - 00293169 _____ C:\WINDOWS\tsoc.log

2015-10-02 08:24 - 2007-08-16 18:08 - 00205831 _____ C:\WINDOWS\comsetup.log

2015-10-02 08:24 - 2007-08-16 18:08 - 00125746 _____ C:\WINDOWS\ntdtcsetup.log

2015-10-02 08:24 - 2007-08-16 18:08 - 00038370 _____ C:\WINDOWS\msgsocm.log

2015-10-02 08:24 - 2007-08-16 18:08 - 00034562 _____ C:\WINDOWS\ocmsn.log

2015-10-02 08:24 - 2007-08-16 18:08 - 00001374 _____ C:\WINDOWS\imsins.log

2015-10-02 08:24 - 2007-08-16 18:07 - 00765331 _____ C:\WINDOWS\FaxSetup.log

2015-10-02 08:24 - 2007-08-16 18:07 - 00372666 _____ C:\WINDOWS\ocgen.log

2015-10-02 08:24 - 2007-08-16 18:07 - 00119998 _____ C:\WINDOWS\iis6.log

2015-10-02 08:24 - 2007-07-31 21:42 - 00938094 _____ C:\WINDOWS\setupapi.log

2015-10-02 08:18 - 2007-08-16 18:08 - 00001374 _____ C:\WINDOWS\imsins.BAK

2015-10-02 07:43 - 2005-05-23 01:08 - 00000000 ___HD C:\WINDOWS\$hf_mig$

2015-10-02 07:33 - 2007-08-16 18:12 - 00149545 _____ C:\WINDOWS\updspapi.log

2015-10-02 07:22 - 2007-02-16 11:29 - 00620056 _____ C:\WINDOWS\system32\TZLog.log

2015-10-02 05:52 - 2005-05-23 01:11 - 00000000 ____D C:\Program Files\Microsoft Office

2015-10-01 22:38 - 2007-07-31 21:43 - 00000809 _____ C:\WINDOWS\setupact.log

2015-09-29 17:05 - 2005-10-31 20:14 - 00000000 ____D C:\Program Files\Symantec AntiVirus

2015-09-29 16:56 - 2005-05-23 00:52 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Temp

2015-09-29 06:33 - 2007-08-16 18:08 - 00005038 _____ C:\WINDOWS\wmsetup.log

2015-09-29 06:19 - 2007-08-02 21:38 - 00000169 _____ C:\WINDOWS\win.ini

2015-09-29 03:11 - 2005-05-22 23:48 - 00000000 ____D C:\Program Files\Movie Maker

2015-09-29 00:10 - 2005-05-22 23:48 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2015-09-28 23:28 - 2009-04-04 20:30 - 00000000 ____D C:\WINDOWS\system32\XPSViewer

2015-09-28 19:31 - 2005-05-22 23:48 - 00000000 ____D C:\Program Files\Outlook Express

2015-09-28 09:11 - 2008-02-18 18:50 - 00000000 ____D C:\TITECH PERSIST BACKUPS

2015-09-28 08:48 - 2007-10-08 16:00 - 00000643 _____ C:\WINDOWS\WINCMD.INI

2015-09-28 08:27 - 2007-10-08 17:56 - 00001081 _____ C:\WINDOWS\wcx_ftp.ini

2015-09-27 20:31 - 2007-07-20 15:45 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Grisoft

2015-09-27 20:12 - 2005-05-23 00:52 - 00000000 __SHD C:\Documents and Settings\NetworkService

2015-09-27 20:11 - 2005-05-22 23:48 - 00000000 ____D C:\WINDOWS\system

2015-09-27 20:10 - 2007-10-25 18:31 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\AVG7

2015-09-27 10:13 - 2005-09-09 16:15 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\EPSON Printers

2015-09-27 10:12 - 2007-10-03 17:42 - 00000000 ____D C:\Program Files\Hijackthis

2015-09-27 10:00 - 2009-04-05 04:01 - 00001753 _____ C:\WINDOWS\Status.mif

2015-09-27 09:57 - 2005-09-21 05:02 - 00000000 ____D C:\Program Files\palmOne

2015-09-27 09:54 - 2006-08-23 15:20 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Google

2015-09-27 09:54 - 2005-08-30 11:45 - 00000000 ____D C:\Documents and Settings\JOHN R\Local Settings\Application Data\Google

2015-09-27 09:54 - 2005-05-23 01:21 - 00000000 ____D C:\Program Files\Google

2015-09-27 09:41 - 2005-05-23 00:52 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Temp

2015-09-27 07:14 - 2009-04-06 21:36 - 00000000 ___DC C:\Documents and Settings\JOHN R\Application Data\FreshDiagnose

==================== Files in the root of some directories =======

2005-09-08 20:27 - 2005-09-08 20:27 - 0000000 ____C () C:\Documents and Settings\JOHN R\Application Data\wklnhst.dat

2005-08-30 13:01 - 2007-12-20 23:42 - 0046080 ____C () C:\Documents and Settings\JOHN R\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Some files in TEMP:

====================

C:\Documents and Settings\JOHN R\Local Settings\Temp\avguirn_081985291108.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version:30-10-2015

Ran by [removed] (2015-10-03 17:19:14)

Running from C:\Documents and Settings\[removed]\My Documents\DOWNLOADS

Microsoft Windows XP Home Edition Service Pack 3 (X86) (2005-08-30 18:45:01)

Boot Mode: Safe Mode (with Networking)

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1594261026-4222727072-4100554716-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator

ASPNET (S-1-5-21-1594261026-4222727072-4100554716-1004 - Limited - Enabled)

Guest (S-1-5-21-1594261026-4222727072-4100554716-501 - Limited - Disabled)

HelpAssistant (S-1-5-21-1594261026-4222727072-4100554716-1005 - Limited - Disabled)

JOHN R (S-1-5-21-1594261026-4222727072-4100554716-1006 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\JOHN R

SUPPORT_388945a0 (S-1-5-21-1594261026-4222727072-4100554716-1002 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition (Enabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Symantec AntiVirus Corporate Edition (Disabled - Out of date) {FB06448E-52B8-493A-90F3-E43226D3305C}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Reader 8.1.2 (HKLM\…\{AC76BA86-7AD7-1033-7B44-A81200000003}) (Version: 8.1.2 - Adobe Systems Incorporated)

AS-i design (HKLM\…\{F61CE820-D776-11d5-9930-0060B08608E3}) (Version: - )

ASISWIN (HKLM\…\{7D902DC4-E25F-476D-B08C-C0415EE82FE3}) (Version: - )

AVG (HKLM\…\AvgZen) (Version: 1.11.1.17511 - AVG Technologies)

AVG (Version: 16.3.7134 - AVG Technologies) Hidden

AVG 2016 (Version: 16.0.4435 - AVG Technologies) Hidden

AVG PC TuneUp (HKLM\…\AVG PC TuneUp) (Version: 16.2.1.18873 - AVG Technologies)

AVG PC TuneUp (Version: 16.2.1 - AVG Technologies) Hidden

AVG Protection (HKLM\…\AVG) (Version: 2016.3.7134 - AVG Technologies)

AVG Zen (Version: 1.11.10 - AVG Technologies) Hidden

BIOS 2 (HKLM\…\BIOS 2) (Version: - )

Bluetooth Software (HKLM\…\{FE90E9E7-A158-4687-8853-DF677A939A61}) (Version: 1.4.2.12 - Bluetooth)

BRM_ART (HKLM\…\BRM_ART) (Version: - )

Brother MFL Pro Suite (HKLM\…\{0C3FCE48-6984-11D5-90F8-00E029591716}) (Version: - )

CheckIt Diagnostics (HKLM\…\CheckIt Diagnostics) (Version: 7.0 - Smith Micro Software, Inc.)

Compaq Presario v4000 User Guides (HKLM\…\Compaq Presario v4000 User Guides) (Version: 3.0.0.1 - Hewlett Packard)

Critical Update for Windows Media Player 11 (KB959772) (HKLM\…\KB959772_WM11) (Version: - Microsoft Corporation)

CutePDF Writer 2.6 (HKLM\…\CutePDF Writer Installation) (Version: - )

Drive Manager (HKLM\…\InstallShield_{48B0F38D-1913-44F3-99AA-D4C55A2B038E}) (Version: 1.00.0012 - Seagate Technology)

Drive Manager (Version: 1.00.0012 - Seagate Technology) Hidden

DWG TrueView 2007 (HKLM\…\{2CD6BBA0-17C8-4789-9B9B-B36F7E815F6A}) (Version: 17.0.54.170 - Autodesk)

EPSON Printer Software (HKLM\…\EPSON Printer and Utilities) (Version: - )

FMW 1 (Version: 1.11.3 - AVG Technologies) Hidden

gtkmm Runtime Environment 2.8 (HKLM\…\gtkmm) (Version: 2.8.4-2 - The gtkmm developers)

HijackThis 1.99.1 (HKLM\…\HijackThis) (Version: 1.99.1 - Soeperman Enterprises Ltd.)

Hijackthis 1.99.1 (HKLM\…\Hijackthis_is1) (Version: - Soeperman Enterprises Ltd)

HP Help and Support (HKLM\…\{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}) (Version: 4.4.0002 - HPQ)

HP Product Detection (HKLM\…\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}) (Version: 4.00.0004 - Hewlett-Packard Company)

HP Software Update (HKLM\…\{15EE79F4-4ED1-4267-9B0F-351009325D7D}) (Version: 3.0.5.001 - HEWLET~1|Hewlett-Packard)

HP Update (HKLM\…\{8C6027FD-53DC-446D-BB75-CACD7028A134}) (Version: 4.000.005.007 - Hewlett-Packard)

HP Wireless Assistant 1.01 A3 (HKLM\…\{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}) (Version: 1.01 A3 - Hewlett-Packard Company)

HpSdpAppCoreApp (Version: 3.00.0000 - Hewlett-Packard) Hidden

Intel(R) Graphics Media Accelerator Driver for Mobile (HKLM\…\{8A708DD8-A5E6-11D4-A706-000629E95E20}) (Version: - )

iTunes (HKLM\…\InstallShield_{BE20E2F5-1903-4AAE-B1AF-2046E586C925}) (Version: 4.7.0.42 - Apple Computer, Inc.)

iTunes (Version: 4.7.0.42 - Apple Computer, Inc.) Hidden

J2SE Runtime Environment 5.0 Update 10 (HKLM\…\{3248F0A8-6813-11D6-A77B-00B0D0150100}) (Version: 1.5.0.100 - Sun Microsystems, Inc.)

J2SE Runtime Environment 5.0 Update 11 (HKLM\…\{3248F0A8-6813-11D6-A77B-00B0D0150110}) (Version: 1.5.0.110 - Sun Microsystems, Inc.)

J2SE Runtime Environment 5.0 Update 2 (HKLM\…\{3248F0A8-6813-11D6-A77B-00B0D0150020}) (Version: 1.5.0.20 - Sun Microsystems, Inc.)

J2SE Runtime Environment 5.0 Update 5 (HKLM\…\{3248F0A8-6813-11D6-A77B-00B0D0150050}) (Version: 1.5.0.50 - Sun Microsystems, Inc.)

J2SE Runtime Environment 5.0 Update 6 (HKLM\…\{3248F0A8-6813-11D6-A77B-00B0D0150060}) (Version: 1.5.0.60 - Sun Microsystems, Inc.)

J2SE Runtime Environment 5.0 Update 9 (HKLM\…\{3248F0A8-6813-11D6-A77B-00B0D0150090}) (Version: 1.5.0.90 - Sun Microsystems, Inc.)

Java 2 Runtime Environment, SE v1.4.2_07 (HKLM\…\{7148F0A8-6813-11D6-A77B-00B0D0142070}) (Version: 1.4.2_07 - Sun Microsystems, Inc.)

Keyspan USB Serial Adapter (HKLM\…\{2E97DE76-851A-48AA-A0D6-665860FAD9CA}) (Version: - )

LiveUpdate 2.6 (Symantec Corporation) (HKLM\…\LiveUpdate) (Version: 2.6.18.0 - Symantec Corporation)

LS_HSI (Version: 1.0.21.1 - Integrator) Hidden

MATLAB Component Runtime 7.5 (HKLM\…\{c8f38ee3-4204-4fab-bbb7-0d37f47cc71e}) (Version: 7.5 - The MathWorks)

Microsoft .NET Framework 1.1 (HKLM\…\Microsoft .NET Framework 1.1 (1033)) (Version: - )

Microsoft .NET Framework 1.1 Hotfix (KB928366) (HKLM\…\M928366) (Version: - )

Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\…\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)

Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\…\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (HKLM\…\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)

Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\…\MSCompPackV1) (Version: 1 - Microsoft Corporation)

Microsoft Money 2005 (HKLM\…\Money2005b) (Version: 14 - Microsoft)

Microsoft Office File Validation Add-In (HKLM\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Standard Edition 2003 (HKLM\…\{91120409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\…\Wudf01000) (Version: - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Works (HKLM\…\{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}) (Version: 08.04.0623 - Microsoft Corporation)

Microsoft Works 4.5 (HKLM\…\Works) (Version: - )

Microsoft Works Calendar 1.0 (HKLM\…\Works Calendar) (Version: - )

Microsoft Works Setup Launcher (HKLM\…\Works99Setup) (Version: - )

Mozilla Firefox 38.0.5 (x86 en-US) (HKLM\…\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 38.0.5 - Mozilla)

MSN (HKLM\…\MSNINST) (Version: - )

MSXML 4.0 SP2 (KB925672) (HKLM\…\{A9CF9052-F4A0-475D-A00F-A8388C62DD63}) (Version: 4.20.9839.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB927978) (HKLM\…\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB936181) (HKLM\…\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 6 Service Pack 2 (KB954459) (HKLM\…\{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}) (Version: 6.20.1099.0 - Microsoft Corporation)

muvee autoProducer 4.0 - SE (HKLM\…\{534AA552-E1F1-4965-B2AA-FBDEB0730D60}) (Version: 4.00.050 - muvee Technologies)

Outlook Express Backup V6.5 (HKLM\…\Outlook Express Backup_is1) (Version: - Genie-Soft)

PL7 Pro V3.1 (HKLM\…\PL7 ProV31) (Version: - )

PL7 Pro V3.4 (HKLM\…\PL7 ProV34) (Version: - )

PowerSuite ATV31 (HKLM\…\{C6478A9C-2383-4BC9-BC61-4F19D317581D}) (Version: 2.0.0 - Schneider Electric)

PSSwinUS (HKLM\…\PSSwinUS) (Version: - )

SA Drivers Manager (HKLM\…\{10B15004-CD2A-49BD-ACB7-DFA124F39273}) (Version: 2.4 - )

SA UNITELWAY WDM Driver (HKLM\…\{BD0F102A-1F7C-46E4-9DF4-3D63E4774D5D}) (Version: 1.9 - )

SeaTools for Windows (HKLM\…\{98613C99-1399-416C-A07C-1EE1C585D872}) (Version: 1.1.1.0 - Seagate Technology)

Sonic Copy Module (HKLM\…\{B12665F4-4E93-4AB4-B7FC-37053B524629}) (Version: 2.0.0 - Sonic Solutions)

Sonic Data Module (HKLM\…\{075473F5-846A-448B-BCB3-104AA1760205}) (Version: 2.0.0 - Sonic Solutions)

Sonic MyDVD Plus (HKLM\…\{21657574-BD54-48A2-9450-EB03B2C7FC29}) (Version: 6.1.0 - Sonic Solutions)

Sonic Update Manager (HKLM\…\{30465B6C-B53F-49A1-9EBA-A3F187AD502E}) (Version: 3.0.0 - Sonic Solutions)

Symantec AntiVirus (HKLM\…\{5A633ED0-E5D7-4D65-AB8D-53ED43510284}) (Version: 10.0.359.0 - Symantec Corporation)

Texas Instruments PCIxx21/x515 drivers. (HKLM\…\InstallShield_{612DC38A-B36A-4699-88EB-12C7394DE2FC}) (Version: 1.09.0000 - Texas Instruments Inc.)

TightVNC 1.3.9 (HKLM\…\TightVNC_is1) (Version: 1.3.9 - TightVNC Group)

TIxx21 (Version: 1.09.0000 - Texas Instruments Inc.) Hidden

TwidoSoft (HKLM\…\{A7DB7470-C9DF-11D4-B49F-0006294FC964}) (Version: - )

UltimateDefrag V1 FREE Public Domain Version (HKLM\…\UltimateDefrag V1 FREE Public Domain Version) (Version: 1.72 - DiskTrix)

Universal Converter (HKLM\…\Universal Converter) (Version: 1.24.56.1 - Noël Danjou)

UserGuides (HKLM\…\{02E22217-0E96-4C3F-B831-83AA942B7715}) (Version: 1.00.6 - HPQ)

Visual Studio 2012 x86 Redistributables (HKLM\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden

Windows Defender (HKLM\…\{A06275F4-324B-4E85-95E6-87B2CD729401}) (Version: 1.1.1593.0 - Microsoft Corporation)

Windows Genuine Advantage Notifications (KB905474) (HKLM\…\WgaNotify) (Version: 1.5.0540.0 - Microsoft Corporation)

Windows Genuine Advantage Validation Tool (KB892130) (HKLM\…\KB892130) (Version: - Microsoft Corporation)

Windows Genuine Advantage Validation Tool (KB892130) (HKLM\…\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)

Windows Media Format 11 runtime (HKLM\…\Windows Media Format Runtime) (Version: - )

Windows Media Player 11 (HKLM\…\Windows Media Player) (Version: - )

Windows XP Service Pack 3 (HKLM\…\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{0DA49AC1-FBD9-4F26-89C4-42074DE9F500}\InprocServer32 -> no filepath

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{12630C47-7373-4463-8C38-EF1F45D08BB8}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{149EE4A0-EE69-11D2-AC32-006008E3F0A2}\InprocServer32 -> C:\Program Files\palmOne\ComConduit.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{149EE4A0-EE69-11D2-AC32-006008E3F0A2}\localserver32 -> C:\Program Files\palmOne\ComConduit.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{149EE4A1-EE69-11D2-AC32-006008E3F0A2}\InprocServer32 -> C:\Program Files\palmOne\ComConduit.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{149EE4A1-EE69-11D2-AC32-006008E3F0A2}\localserver32 -> C:\Program Files\palmOne\ComConduit.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{164A4365-064D-494D-92C8-9303A5080157}\InprocServer32 -> C:\Program Files\palmOne\SgCalendar.ocx (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{188047CE-0F0A-11D7-8331-00C04FA03755}\localserver32 -> C:\Program Files\palmOne\QuickInstall.exe (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{1C43DF3D-E1C6-473E-9627-D7638EF63690}\InprocServer32 -> C:\Program Files\palmOne\DmConduit.dll (PalmSource Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{1D67C047-F016-11D6-831E-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PictPreview.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{1E8640C7-545F-4E6A-83F4-D92706C99E00}\InprocServer32 -> no filepath

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{1FFD7892-06E4-4A0A-941E-BC966900C883}\InprocServer32 -> C:\Program Files\palmOne\PhotoDesktop\Media.ocx (palmOne, Inc. developed by ArcSoft, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{209DAEB8-0F02-11D7-8331-00C04FA03755}\localserver32 -> C:\Program Files\palmOne\QuickInstall.exe (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{28B8F788-271C-4618-9F55-4B1B40E6DF16}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{28DC33AE-D0A8-40A7-A9EA-5F6598207496}\InprocServer32 -> C:\Program Files\palmOne\ComDirect.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{2CE29E35-35AA-455F-894F-F70BE74DB639}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{2E0C66AC-5A87-4AFF-AC9F-93B33D43E4ED}\InprocServer32 -> C:\Program Files\palmOne\SgDateAlarm.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{3193996D-1AC8-11D4-80CC-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\AlarmSvr.dll (Palm, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{33AF5286-DC7B-40B3-AF6B-D5E15E9E72B7}\InprocServer32 -> C:\Program Files\palmOne\PhotoDesktop\MpegCodecFilter.ax (Arcsoft)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{33AF5287-DC7B-40B3-AF6B-D5E15E9E72B7}\InprocServer32 -> C:\Program Files\palmOne\PhotoDesktop\MpegCodecFilter.ax (Arcsoft)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{3597288E-FF31-49C2-A58A-EA88F3CEDD42}\InprocServer32 -> C:\Program Files\palmOne\SgCalendar.ocx (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{3B33746E-C60D-4213-9438-B36424338150}\InprocServer32 -> C:\Program Files\palmOne\ComDirect.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{3B52D512-935F-11D6-82D4-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PRouter.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{3CF39B9A-0CF8-4792-A918-67573260BDBE}\InprocServer32 -> C:\Program Files\palmOne\PhotoDesktop\Media.ocx (palmOne, Inc. developed by ArcSoft, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView\DWGVIEWRficn.dll (Autodesk, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{4054F903-7C40-43D0-8ACE-3F5D73A9890C}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{43F73EA1-92AE-11D6-82D3-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PRouter.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{496038FA-3891-4827-AFCD-A7B13B9FF75A}\InprocServer32 -> C:\Program Files\palmOne\PhotoDesktop\PhotosPlugIn.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{49EB4C90-AE3D-4846-A719-F775FFEE600A}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{57B98049-D96F-471B-942B-6B05CB2CFE0A}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{591E5416-DDC3-45E6-BE9D-C40D0B418F6E}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView\DWGVIEWR.exe (Autodesk, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{5AA15E20-EE68-11D2-AC32-006008E3F0A2}\InprocServer32 -> C:\Program Files\palmOne\ComConduit.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{61B7A221-D11F-4702-B5C0-79C492A726B9}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{6357BCA7-B06E-11D6-82EF-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\DefaultPlugin.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{6357BCB6-B06E-11D6-82EF-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PqiIcon.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{6357BCB9-B06E-11D6-82EF-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PqiIcon.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{6357BCBC-B06E-11D6-82EF-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PqiIcon.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{6357BCBE-B06E-11D6-82EF-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PqiIcon.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{6600B26A-CCCE-4EF9-870E-DAB97E489CDF}\InprocServer32 -> C:\Program Files\palmOne\SgDateAlarm.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{660AF3D0-0EC6-4285-8447-B286B724687B}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{75C8163F-59DF-4C9D-BC00-D0419B2CED5B}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{763F9014-A89C-11D6-82E7-00C04FA03755}\localserver32 -> C:\Program Files\palmOne\QuickInstall.exe (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{7686FC59-EA6F-11D5-823E-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\InstServ.dll (Palm, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{78547CB6-2D08-47F4-A1EB-AF576A33E433}\InprocServer32 -> C:\Program Files\palmOne\SgContacts.ocx (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{7AABBB95-79BE-4C0F-8024-EB6AF271231C}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView\DWGVIEWR.exe (Autodesk, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{7D11ED93-A77D-41FA-8EA5-5B39BC29E7F9}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{7DEBC7E0-FA1F-11D2-AC32-006008E3F0A2}\InprocServer32 -> C:\Program Files\palmOne\ComDirect.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{7DEBC7E4-FA1F-11D2-AC32-006008E3F0A2}\InprocServer32 -> C:\Program Files\palmOne\ComDirect.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{7DEBC7E6-FA1F-11D2-AC32-006008E3F0A2}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{7DEBC7E7-FA1F-11D2-AC32-006008E3F0A2}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{7DEBC7E9-FA1F-11D2-AC32-006008E3F0A2}\InprocServer32 -> C:\Program Files\palmOne\ComDirect.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{80C297AB-A0CB-4CE4-A5F1-36EB810BE047}\InprocServer32 -> C:\Program Files\palmOne\ComDirect.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{87001487-8B8A-4C40-BFEF-036F5BD5BAA3}\InprocServer32 -> C:\Program Files\palmOne\PhotoDesktop\PhotosPlugIn.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{887A7C26-B4AF-4F22-BE5E-20C00D340C74}\InprocServer32 -> no filepath

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{92DA540D-FCC0-442C-8F82-7F6C1DBD66C8}\InprocServer32 -> C:\Program Files\palmOne\SgMemos.ocx (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{A0C20550-9476-407C-BFB0-3C84C2639AE6}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{A13FAF1A-6069-40A4-AD5F-110EFA282490}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{A1EED615-F007-4D40-9C06-A3CCD3CB68E1}\InprocServer32 -> no filepath

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{A4C43001-108F-48E8-B2FF-F174977EDF03}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{A50DA40C-59F7-40A6-B2D1-748493584E9C}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{A545EB9B-B12D-4BA6-8110-1D61A3566A93}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{A61F01A5-CD25-4780-A3B9-041172CD6450}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{AB40E4E0-0F0C-11D7-8331-00C04FA03755}\localserver32 -> C:\Program Files\palmOne\QuickInstall.exe (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{AD74B184-E73A-4565-A38C-1329A29C7260}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{AF04C884-2C5F-430F-97ED-6E127F47046C}\InprocServer32 -> C:\Program Files\palmOne\DmConduit.dll (PalmSource Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{AF478991-F6B0-40E8-856B-E80BE0677AFC}\InprocServer32 -> C:\Program Files\palmOne\SgTasks.ocx (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{B2565128-0F22-11D7-8331-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PRouter.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{B2F7AF3C-0CA7-4EAE-BBBF-A748FBC500DD}\InprocServer32 -> C:\Program Files\palmOne\SgMemos.ocx (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{B416D295-53BA-4E16-8D54-B80281643A8A}\InprocServer32 -> C:\Program Files\palmOne\ComDirect.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{B53B7736-61FA-4EF3-8989-B83C80979D89}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{B9BF9DA9-1746-4C14-B53C-1826F81EAE0B}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{BD73860F-5142-44C9-B7C4-26CD2AB55477}\InprocServer32 -> C:\Program Files\palmOne\ComDirect.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{BE1B5231-A3E2-11D6-82E3-00C04FA03755}\localserver32 -> C:\Program Files\palmOne\QuickInstall.exe (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{BE1B5233-A3E2-11D6-82E3-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PRouter.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{BE1B5235-A3E2-11D6-82E3-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PRouter.dll (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{BE44897A-EB38-11D5-823F-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\RegServ.dll ()

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{C0010C26-F44B-4BE2-9D65-04D3934C5E46}\InprocServer32 -> C:\Program Files\palmOne\SgTasks.ocx (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{C11BCF07-4F91-4748-956E-2B4FFC9401C5}\InprocServer32 -> C:\Program Files\palmOne\SgContacts.ocx (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{C2775C61-2C1C-4D50-A5E6-4814620116CD}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{C3DB9DF7-64EC-46EC-86C4-27668ABA9777}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{D75FA101-6942-47DF-88DF-353F30D35682}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{D79AC66C-BDB2-4028-B79A-F1465F8FBB56}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{DCDA65F9-134B-4333-BCA0-809306CB2F55}\InprocServer32 -> C:\Program Files\palmOne\DmConduit.dll (PalmSource Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{DD7731C5-1E16-4087-A57F-FEDCFBD8EB2B}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{DEF0B543-775C-4963-A116-DF304EE2C4DA}\InprocServer32 -> C:\Program Files\palmOne\DmConduit.dll (PalmSource Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{DFD4C164-AE18-11D6-82EC-00C04FA03755}\localserver32 -> C:\Program Files\palmOne\QuickInstall.exe (palmOne, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{E5A0FEE6-087B-4E48-BE06-5E1A1EF5E116}\InprocServer32 -> C:\Program Files\palmOne\ComStandard.dll (PalmSource, Inc.)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{E851CFC8-5724-406D-9B36-11A44E72EA11}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{EE469827-4ED9-443B-9FB0-EFA81FEA6646}\InprocServer32 -> C:\Program Files\palmOne\Components\DelDups.dll ( palmOne, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{F0905939-16C0-4D2E-8F4F-73A4BEDEBE73}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{F1523FBD-0E09-4E8F-A952-B053B118FAAE}\InprocServer32 -> C:\Program Files\palmOne\PSDConduit.dll (PalmSource, Inc)

CustomCLSID: HKU\S-1-5-21-1594261026-4222727072-4100554716-1006_Classes\CLSID\{F21AC7C7-D6F5-11D6-8306-00C04FA03755}\InprocServer32 -> C:\Program Files\palmOne\PRouter.dll (palmOne, Inc.)

==================== Restore Points =========================

30-09-2015 19:46:39 Software Distribution Service 3.0

01-10-2015 22:56:55 Software Distribution Service 3.0

02-10-2015 05:51:05 Software Distribution Service 3.0

03-10-2015 06:34:53 System Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2004-08-04 01:00 - 2009-04-05 07:51 - 00305146 ____R C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

127.0.0.1 hityou.com

127.0.0.1 www.hityou.com

127.0.0.1 180searchassistant.com

127.0.0.1 www.180searchassistant.com

127.0.0.1 180solutions.com

127.0.0.1 www.180solutions.com

127.0.0.1 bis.180solutions.com

127.0.0.1 config.180solutions.com

127.0.0.1 cts.180solutions.com

127.0.0.1 downloads.180solutions.com

127.0.0.1 installs.180solutions.com

127.0.0.1 nowhere.180solutions.com

127.0.0.1 ping.180solutions.com

127.0.0.1 tv.180solutions.com

127.0.0.1 uploads.180solutions.com

127.0.0.1 public.zangocash.com

127.0.0.1 www.public.zangocash.com

127.0.0.1 static.zangocash.com

127.0.0.1 www.static.zangocash.com

127.0.0.1 www.zangocash.com

127.0.0.1 zangocash.com

127.0.0.1 007guard.com

127.0.0.1 www.007guard.com

127.0.0.1 2search.com

127.0.0.1 www.2search.com

127.0.0.1 2search.org

127.0.0.1 www.2search.org

127.0.0.1 bardownload.com

There are 1000 more lines.

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\iRadio task 1.job => C:\PROGRA~1\3aLab\iRadio\iRadio.exe

Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe

Task: C:\WINDOWS\Tasks\Symantec NetDetect.job => C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

==================== Loaded Modules (Whitelisted) ==============

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AVG Anti-Spyware Driver => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AVG Anti-Spyware Guard => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\…\007guard.com -> install.007guard.com

IE restricted site: HKU\.DEFAULT\…\008i.com -> 008i.com

IE restricted site: HKU\.DEFAULT\…\008k.com -> www.008k.com

IE restricted site: HKU\.DEFAULT\…\00hq.com -> www.00hq.com

IE restricted site: HKU\.DEFAULT\…\010402.com -> 010402.com

IE restricted site: HKU\.DEFAULT\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com

IE restricted site: HKU\.DEFAULT\…\0scan.com -> www.0scan.com

IE restricted site: HKU\.DEFAULT\…\1-2005-search.com -> www.1-2005-search.com

IE restricted site: HKU\.DEFAULT\…\1-domains-registrations.com -> www.1-domains-registrations.com

IE restricted site: HKU\.DEFAULT\…\1000gratisproben.com -> www.1000gratisproben.com

IE restricted site: HKU\.DEFAULT\…\1001namen.com -> www.1001namen.com

IE restricted site: HKU\.DEFAULT\…\100888290cs.com -> mir.100888290cs.com

IE restricted site: HKU\.DEFAULT\…\100sexlinks.com -> www.100sexlinks.com

IE restricted site: HKU\.DEFAULT\…\10sek.com -> www.10sek.com

IE restricted site: HKU\.DEFAULT\…\12-26.net -> user1.12-26.net

IE restricted site: HKU\.DEFAULT\…\12-27.net -> user1.12-27.net

IE restricted site: HKU\.DEFAULT\…\123haustiereundmehr.com -> www.123haustiereundmehr.com

IE restricted site: HKU\.DEFAULT\…\123moviedownload.com -> www.123moviedownload.com

IE restricted site: HKU\.DEFAULT\…\123simsen.com -> www.123simsen.com

IE restricted site: HKU\.DEFAULT\…\123topsearch.com -> www.123topsearch.com

There are 7493 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\JOHN R\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

DNS Servers: [removed] - [removed]

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: HotKeysCmds => C:\WINDOWS\system32\hkcmd.exe

MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

MSCONFIG\startupreg: IgfxTray => C:\WINDOWS\system32\igfxtray.exe

MSCONFIG\startupreg: ISUSPM Startup => "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

MSCONFIG\startupreg: ISUSScheduler => "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

MSCONFIG\startupreg: LSBWatcher => c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\qttask.exe" -atboottime

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Program Files\Mozilla Firefox)

StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgnsx.exe] => Enabled:Online Shield

StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgdiagex.exe] => Enabled:AVG Diagnostics

StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgmfapx.exe] => Enabled:AVG Installer

StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgemcx.exe] => Enabled:Personal Email Scanner

DomainProfile\GloballyOpenPorts: [139:TCP] => Enabled:@xpsp2res.dll,-22004

DomainProfile\GloballyOpenPorts: [445:TCP] => Enabled:@xpsp2res.dll,-22005

DomainProfile\GloballyOpenPorts: [137:UDP] => Enabled:@xpsp2res.dll,-22001

DomainProfile\GloballyOpenPorts: [138:UDP] => Enabled:@xpsp2res.dll,-22002

StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22004

StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22005

StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22001

StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22002

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (10/03/2015 08:56:44 AM) (Source: crypt32) (EventID: 11) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (10/03/2015 08:56:44 AM) (Source: crypt32) (EventID: 11) (User: )

Error: (10/02/2015 01:33:42 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application cidaemon.exe, version 5.1.2600.0, faulting module unknown, version 0.0.0.0, fault address 0x1000b9c0.

Processing media-specific event for [cidaemon.exe!ws!]

Error: (10/01/2015 09:54:31 PM) (Source: EventSystem) (EventID: 4609) (User: )

Description: The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043C from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

Error: (10/01/2015 09:54:31 PM) (Source: EventSystem) (EventID: 4609) (User: )

Error: (10/01/2015 09:50:52 PM) (Source: MsiInstaller) (EventID: 1008) (User: PC112451638532)

Description: The installation of C:\WINDOWS\Installer\48dad2f0.msi is not permitted due to an error in software restriction policy processing. The object cannot be trusted.

Error: (10/01/2015 09:39:04 PM) (Source: EventSystem) (EventID: 4609) (User: )

Error: (09/30/2015 09:50:33 PM) (Source: EventSystem) (EventID: 4614) (User: )

Description: The COM+ Event System detected an inconsistency in its internal state. The assertion "GetLastError() == 122L" failed at line 162 of d:\comxp_sp3\com\com1x\src\events\shared\sectools.cpp. Please contact Microsoft Product Support Services to report this error.

Error: (09/30/2015 08:23:49 PM) (Source: MsiInstaller) (EventID: 11311) (User: NT AUTHORITY)

Description: SA_Error1709: StandardAction(0xC00706AD): Product: FMW 1 – Error 1311. SA_Error1311: StandardAction(0xC007051F): Source file not found(cabinet): C:\WINDOWS\TEMP\AvgSetup_2cd25579-8334-42dd-901a-6c98f5133bca\install\fmw\fbdllx.cab. Verify that the file exists and that you can access it.

System errors:

=============

Error: (10/03/2015 05:15:01 PM) (Source: DCOM) (EventID: 10005) (User: PC112451638532)

Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""

in order to run the server:

{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (10/03/2015 05:11:18 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""

in order to run the server:

{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (10/03/2015 11:19:32 AM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""

in order to run the server:

{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (10/03/2015 11:10:52 AM) (Source: DCOM) (EventID: 10005) (User: PC112451638532)

Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""

in order to run the server:

{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (10/03/2015 11:02:54 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

Avgdiskx

AVGIDSDriverl

AVGIDSShim

Avgldx86

Avglogx

eabfiltr

eeCtrl

Fips

intelppm

SAVRT

SAVRTPEL

SYMTDI

Error: (10/03/2015 11:02:49 AM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""

in order to run the server:

{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (10/03/2015 11:00:05 AM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""

in order to run the server:

{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (10/03/2015 10:59:43 AM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""

in order to run the server:

{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (10/03/2015 08:47:01 AM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""

in order to run the server:

{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (10/03/2015 08:44:31 AM) (Source: DCOM) (EventID: 10005) (User: PC112451638532)

Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""

in order to run the server:

{A1F4E726-8CF1-11D1-BF92-0060081ED811}

==================== Memory info ===========================

Processor: Intel(R) Celeron(R) M processor 1.40GHz

Percentage of memory in use: 77%

Total physical RAM: 502.42 MB

Available physical RAM: 111.11 MB

Total Virtual: 1224.54 MB

Available Virtual: 896.6 MB

==================== Drives ================================

Drive c: (JOHN LAPTOP C DRIVE) (Fixed) (Total:74.53 GB) (Free:35.41 GB) NTFS ==>[drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 74.5 GB) (Disk ID: 94E494E4)

Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

ken545

Post #4October 4, 2015, 2:59 AM UTC

Looks like you have AVG and Symantec Anti Virus running, Microsoft recommends just One AV, keep it updated and run regular scans, more than one is overkill and will severely hamper system performance, your call but you need to go to Add Remove Programs in the Control Panel and uninstall one

Running from C:\Documents and Settings\[removed]\My Documents\DOWNLOADS <– The directions stated to download FRST to your desktop, all our tools and scanners run better from the desktop rather than being buried in some folder, so go to your Downloads folder and look for FRST, right click on it and select CUT, then come back to your desktop and right click on a blank space and select PASTE

Why did you run FRST in Safemode, are you not able to boot up normally ??

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner TO YOUR DESKTOP

Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers

Do not click on any links in the top Advertisment.

[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click on Scan.

After the scan is complete click on "Clean"

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the content of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

===============================================================================

[external image: thisisujrt.gif] Please download Junkware Removal Tool TO YOUR DESKTOP

Download the one from Bleeping Computer

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

===============================================================================

Download Malwarebytes' Anti-Malware TO YOUR DESKTOP

Windows XP : Double click on the icon to run it.

Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

[external image: 0841859c-1a35-4dbd-b41a-e720629e3e22_zps]

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Treat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished on the bottom right click on SAVE RESULTS then select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

johnnybravo

Post #5October 4, 2015, 7:16 PM UTC

Thanks Ken,

running in safe mode, otherwise it would take another week to get to this point!!

i tried to uninstall AGV this morning, but ran out of patience…

I installed and ran spybot (free) yesterday, it seemed to help a little, but still super slow when not running in safemode.

i seem to remember the old spybot gummed me up back in '08, but cannot remember.

thanks for advice re:download, force of habit to dump them in that "download" folder..

below: txt files as requested

Adware cleaner:

# AdwCleaner v5.010 - Logfile created 04/10/2015 at 08:38:28
# Updated 04/10/2015 by Xplode
# Database : 2015-10-04.3 [Server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : JOHN RUECKERT - PC112451638532
# Running from : C:\Documents and Settings\JOHN RUECKERT\Desktop\AdwCleaner.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\Documents and Settings\All Users\Application Data\Viewpoint
[-] Folder Deleted : C:\Documents and Settings\JOHN RUECKERT\Application Data\Viewpoint
[-] Folder Deleted : C:\Program Files\Yahoo!\Companion

***** [ Files ] *****

[-] File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\yahoo.xml

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9DBB28C1-1925-11D3-A498-00104B6EB52E}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{03F998B2-0E00-11D3-A498-00104B6EB52E}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
[-] Key Deleted : HKCU\Software\Yahoo\Companion
[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar
[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion

***** [ Web browsers ] *****

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2107 bytes] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Microsoft Windows XP x86
Ran by [removed] on Sun 10/04/2015 at 9:51:39.29
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant

~~~ Registry Keys

~~~ Files

~~~ Informational

C:\WINDOWS\system32\tasklist.exe doesn't exist [Process check skipped . Windows XP Home Edition?]

~~~ Folders

~~~ FireFox

Emptied folder: C:\Documents and Settings\JOHN RUECKERT\Application Data\mozilla\firefox\profiles\621t7m7n.default-1443376763433\minidumps [2 files]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 10/04/2015 at 10:11:48.73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/4/2015
Scan Time: 10:24:02 AM
Logfile: malware results.txt
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.10.04.03
Rootkit Database: v2015.10.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: JOHN RUECKERT

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 386739
Time Elapsed: 1 hr, 18 min, 46 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 2
PUM.Hijack.StartMenu, HKU\S-1-5-21-1594261026-4222727072-4100554716-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|StartMenuLogoff, 1, Good: (0), Bad: (1),,[9a59f35f95f64cead107c0c158adf709]
PUM.Hijack.StartMenu, HKU\S-1-5-21-1594261026-4222727072-4100554716-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|StartMenuLogoff, 1, Good: (0), Bad: (1),,[767daca639520036f3e5621f788db749]

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

ken545

Post #6October 5, 2015, 12:44 AM UTC

Hello,

Did you have Malwarebytes Quarantine the entries it found, the log is not showing that, if not you will have to run it again

You can highlight one of the detections by left clicking on it.

Then, right click on the highlighted detection, and select 'Check All Items'.

Next, click 'Remove Selected'. That should remove them all

Then open FRST, be sure to checkmark Additions, run a new scan and post both the FRST and Additions logs please

johnnybravo

Post #7October 6, 2015, 4:13 AM UTC

Thanks again for the help ken!

as requested:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-10-2015

Ran by [removed] (administrator) on PC112451638532 (05-10-2015 21:03:23)

Running from C:\Documents and Settings\[removed]\Desktop

[removed]

Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) Language: English (United States)

Internet Explorer Version 8 (Default browser: FF)

Boot Mode: Safe Mode (with Networking)

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe