TechSpot

Av knocked out

By curleww
Sep 3, 2015
  1. Hi hopig some one can guide me to clean pc running on xp
    im using comodo av which has been blocked by malware have tried a reinstall and a download of avira but nothing will run
    on line eset scan found multiple issues and deleted them
    having to run in safe mode to access internet

    below is results of farbar scan


    Running from F:\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-329068152-1035525444-725345543-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator.5F5A4C13557347C
    ASPNET (S-1-5-21-329068152-1035525444-725345543-1004 - Limited - Enabled)
    Guest (S-1-5-21-329068152-1035525444-725345543-501 - Limited - Enabled)
    HelpAssistant (S-1-5-21-329068152-1035525444-725345543-1000 - Limited - Disabled)
    K (S-1-5-21-329068152-1035525444-725345543-1005 - Limited - Enabled) => %SystemDrive%\Documents and Settings\K
    m (S-1-5-21-329068152-1035525444-725345543-1003 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\m
    SUPPORT_388945a0 (S-1-5-21-329068152-1035525444-725345543-1002 - Limited - Disabled)
    UpdatusUser (S-1-5-21-329068152-1035525444-725345543-1007 - Limited - Enabled) => %SystemDrive%\Documents and Settings\UpdatusUser

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: ZoneAlarm Antivirus (Disabled - Out of date) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
    AV: Microsoft Security Essentials (Enabled - Up to date) {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    FW: ZoneAlarm Firewall (Disabled) {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.0.3.13070 - Adobe Systems Inc.)
    Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
    Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.08) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
    AliIM Plugins for Browser (HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\AliIM Plugins for Browser) (Version: 1.0 - Alibaba(China) Co., Ltd)
    ArcSoft PhotoStudio 5.5 (HKLM\...\{85309D89-7BE9-4094-BB17-24999C6118FC}) (Version: - ArcSoft)
    Atlantis (Version: 1.50 - Dell) Hidden
    Avira Launcher (HKLM\...\{315dd168-0794-4cf1-8355-f195cde642fc}) (Version: 1.1.45.11819 - Avira Operations GmbH & Co. KG)
    Avira Launcher (Version: 1.1.45.11819 - Avira Operations GmbH & Co. KG) Hidden
    Belarc Advisor 8.3 (HKLM\...\Belarc Advisor) (Version: 8.3.0.0 - Belarc Inc.)
    Belkin Desktop PCI Card Driver (HKLM\...\{50D47CE8-9C16-42D1-A8D8-B143B22E232A}) (Version: 1.12.0005 - Belkin)
    Belkin Setup and Router Monitor (HKLM\...\Belkin Setup and Router Monitor_is1) (Version: - )
    Belkin USB Print and Storage Center (HKLM\...\Belkin USB Print and Storage Center) (Version: 1.0.0 - Belkin International, Inc.)
    BlackBerry Desktop Software 7.1 (HKLM\...\BlackBerry_Desktop) (Version: 7.1.0.41 - Research In Motion Ltd.)
    BlackBerry Desktop Software 7.1 (Version: 7.1.0.41 - Research In Motion Ltd.) Hidden
    BlackBerry Device Software Updater (HKLM\...\{12BAA98C-F8DD-4BC9-BBE6-1C8463114197}) (Version: 6.0.1.37 - Research In Motion Ltd)
    Canon IJ Network Scan Utility (HKLM\...\Canon_IJ_Network_Scan_UTILITY) (Version: - )
    Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: - )
    Canon MP Navigator 3.0 (HKLM\...\MP Navigator 3.0) (Version: - )
    Canon MP600R (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600R) (Version: - )
    Canon MP600R User Registration (HKLM\...\Canon MP600R User Registration) (Version: - )
    Canon Utilities Easy-PhotoPrint (HKLM\...\Easy-PhotoPrint) (Version: - )
    CCleaner (HKLM\...\CCleaner) (Version: 3.23 - Piriform)
    CD-LabelPrint (HKLM\...\MediaNavigation.CDLabelPrint) (Version: - )
    Chromodo (HKLM\...\Chromodo) (Version: 44.5.7.268 - Comodo)
    Comodo Dragon (HKLM\...\Comodo Dragon) (Version: 43.3.3.185 - Comodo)
    COMODO Internet Security Premium (HKLM\...\{367D1EA4-24FD-402F-AFF0-08A678D2EE28}) (Version: 8.2.0.4674 - COMODO Security Solutions Inc.)
    Conexant SmartHSFi V92 56K Speakerphone PCI Modem (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2702) (Version: - )
    CPUID CPU-Z 1.62 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
    Creative MediaSource (HKLM\...\{56F3E1FF-54FE-4384-A153-6CCABA097814}) (Version: - )
    Dell Movie Studio Diagnostics (HKLM\...\InstallShield_{9ED6519B-324A-4C66-98EE-E3F54281BA78}) (Version: 1.50 - Dell)
    Dell ResourceCD (HKLM\...\{D78653C3-A8FF-415F-92E6-D774E634FF2D}) (Version: - )
    Digital Video Repair 2.2 (HKLM\...\Digital Video Repair) (Version: - )
    Dual Mode Digital Camera Z (HKLM\...\{3C516E56-0B4B-4BDE-88A2-035B4D170A26}) (Version: 2.1 - DSC)
     
  2. curleww

    curleww TS Rookie Topic Starter Posts: 37

    Easy-WebPrint (HKLM\...\Easy-WebPrint) (Version: - )
    FixCleaner (HKLM\...\{EFCCCA5E-6F4B-4B7B-903F-24D752DFDC64}) (Version: 2.0.4972 - Slimware Utilities, Inc.)
    Free File Opener v2011.7.0.1 (HKLM\...\Free File Opener_is1) (Version: 2011.7.0.1 - Free File Opener, LLC)
    Free Video to MP3 Converter version 5.0.30.1029 (HKLM\...\Free Video to MP3 Converter_is1) (Version: 5.0.30.1029 - DVDVideoSoft Ltd.)
    GeekBuddy (HKLM\...\{D4651C22-C4C5-4294-AD9C-91FF0F048CCC}) (Version: 4.1.31 - Comodo Security Solutions Inc)
    Google Chrome (HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)
    GoToMeeting 5.5.0.1133 (HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\GoToMeeting) (Version: 5.5.0.1133 - CitrixOnline)
    ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
    IMVU Avatar Chat Software (HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\IMVU Avatar chat client software BETA) (Version: - )
    InfraRecorder (HKLM\...\InfraRecorder) (Version: - Christian Kindahl)
    InstallIQ Updater (HKLM\...\{A9FE59F0-5BFA-4FDF-84C6-F45457715379}) (Version: 1.4.1.0 - W3i, LLC)
    Intel(R) Network Connections 16.8.46.0 (HKLM\...\{6438A99C-A37E-4758-A0AE-95F8A63AAFF5}) (Version: 16.8.46.0 - Intel)
    Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
    JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
    Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
    Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
    Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft ActiveSync (HKLM\...\{99052DB7-9592-4522-A558-5417BBAD48EE}) (Version: 4.5.5096.0 - Microsoft Corporation)
    Microsoft LifeCam (HKLM\...\{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}) (Version: 3.22.270.0 - Microsoft Corporation)
    Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
    Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)
    Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.6029.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
    Miro (HKLM\...\Miro) (Version: 6.0 - Participatory Culture Foundation)
    Mozilla Firefox 40.0.3 (x86 en-GB) (HKLM\...\Mozilla Firefox 40.0.3 (x86 en-GB)) (Version: 40.0.3 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
    MSN (HKLM\...\MSNINST) (Version: - )
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    MyDVD (HKLM\...\{5E835305-63BB-4E55-BBB7-EEBBE67774DB}) (Version: - )
    Nero - Burning Rom (HKLM\...\{A4D7B764-4140-11D4-88EB-0050DA3579C0}) (Version: 5.5.8.1 - ahead software gmbh)
    NVIDIA nView 136.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 136.53 - NVIDIA Corporation)
    NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
    Nvu 1.0PR (HKLM\...\Nvu_is1) (Version: 1.0PR - Linspire Inc.)
    PacketiX VPN Client (English) (HKLM\...\{F26E2781-2E22-4485-A33A-6F3E322A3F2D}) (Version: 2.20.5351 - SoftEther Corporation)
    PlayItAll media player 1.0.5 (HKLM\...\PlayItAll media player) (Version: 1.0.5 - PlayItAll)
    PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: - )
    RAR Password Recovery v1.1 RC16 (remove only) (HKLM\...\Intelore - RAR Password Recovery) (Version: - )
    Roxio VideoWave Movie Creator (HKLM\...\{BB46245B-CECA-406F-8790-3ABA0D01012F}) (Version: 1.6.676.0 - Roxio, Inc.)
    ScanSoft OmniPage SE 4.0 (HKLM\...\{C1E693A4-B1D5-4DCD-B68D-2087835B7184}) (Version: 15.00.0020 - Nuance Communications, Inc.)
    SecureClean4 (HKLM\...\{83b13a64-d98a-48a2-8cbc-ec0ec5433b18}) (Version: - )
    Security Task Manager 1.8d (HKLM\...\Security Task Manager) (Version: 1.8d - Neuber Software)
    Segoe UI (Version: 14.0.4327.805 - Microsoft Corp) Hidden
    Serif DrawPlus Starter Edition (HKLM\...\{33311EA4-0ECA-4E7F-83E5-8A92CD760152}) (Version: 2.0.2.010 - Serif (Europe) Ltd)
    Serif WebPlus 9.0 (HKLM\...\{4493E86C-1408-4AF6-8455-0744D25CD355}) (Version: 9.00 - Serif)
    Serviio (HKLM\...\Serviio) (Version: - )
    Skype™ 7.5 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
    SlimCleaner (HKLM\...\{6B8D6199-EE44-4FD7-813A-6D8C62C9B384}) (Version: 4.0.30878 - SlimWare Utilities, Inc.)
    SlimDrivers (HKLM\...\{A5457401-D56A-43F2-9524-78E54A7FC07A}) (Version: 2.2.32705 - SlimWare Utilities, Inc.)
    Snagit 10 (HKLM\...\{5BCC634A-58AD-42F9-B3C6-2EA52F81CF85}) (Version: 10.0.0 - TechSmith Corporation)
    Snagit 11 (HKLM\...\{7CA5C4DF-8327-4035-AE2B-CA76336A04FD}) (Version: 11.0.0 - TechSmith Corporation)
    SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.18.9570 - SoftEther VPN Project)
    Sonic Encoders (HKLM\...\{9941F0AA-B903-4AF4-A055-83A9815CC011}) (Version: 1.00 - Sonic Solutions)
    Sound Blaster Audigy 2 (HKLM\...\{E82BF103-904F-49C0-B77F-6EC110B71E87}) (Version: - )
    SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: - )
    Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
    Tweak UI (HKLM\...\Tweak UI 2.10) (Version: - )
    WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
    Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
    Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
    Windows Live OneCare safety scanner (HKLM\...\Windows Live OneCare safety scanner) (Version: - )
    Windows Live Sign-in Assistant (HKLM\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
    Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
    Windows Management Framework Core (HKLM\...\KB968930) (Version: - Microsoft Corporation)
    Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
    Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
    Windows Search 4.0 (HKLM\...\KB940157) (Version: 04.00.6001.503 - Microsoft Corporation)
    Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
    WinRAR 4.10 beta 5 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.10.5 - win.rar GmbH)
    XHeader (HKLM\...\XHeader) (Version: 1.215 - Intellimon)
    XSite Pro (HKLM\...\XSite Pro) (Version: 1.55 - Intellimon Ltd)
    XSitePro2 (HKLM\...\XSitePro2) (Version: 2.01 - Intellimon Ltd)
    Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
    Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )
    Yawcam 0.4.0 (HKLM\...\{8FE96B14-E1F9-47BF-8BA1-A81467CD259B}_is1) (Version: - )
    Your Uninstaller! 2010 (HKLM\...\YU2010_is1) (Version: 7.0 - URSoft, Inc.)
     
  3. curleww

    curleww TS Rookie Topic Starter Posts: 37

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{0BBFE402-CCA1-4f64-9322-13B66D841049}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{23102CBF-AC8D-4424-9364-A79738894850}\MSWord.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{0C1EB979-8EC7-46E8-8097-246957D6B94C}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{11CD84A3-A5E0-43CB-B3DF-92C623C0E0E0}\InprocServer32 -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{1434DD3D-0AF6-41E0-BB71-8C86010D9AF5}\localserver32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{25D005BF-FE63-4cce-AA25-CE952B1D9381}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{638B203F-8FB6-49ec-A139-AB8C530F0CAB}\MSPowerPoint.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{293600C7-E7B6-4f06-9329-D8522A33C7E8}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{B9E98D7E-F599-469d-95A7-0B6F86D082A0}\CamtasiaOutput.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{2A235D7E-0358-40E2-B51A-DE22F8F5C50D}\InprocServer32 -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{326787D9-37B9-47A6-B539-EE13E7B04B8B}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{47F64EC4-1AD6-4168-9D4C-00F3842F7CFB}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{4B66DD3F-2E6E-4F7C-B38C-E32608820825}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{53DBCD97-3FDF-4B60-975B-2596B57482EF}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\BBWebSLLauncher.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{54050FBB-F2AE-404b-8BFD-7EE3EC784A52}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{18AA4E21-D540-4a3a-9F9F-E6DE33D6F253}\MSExcel.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\Application\44.0.2403.157\delegate_execute.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.1\psuser.dll No Fil (the data entry has 1 more characters).
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{672CDBDB-0270-4EB9-83EC-216377522D21}\InprocServer32 -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{6B1948B3-9547-42F8-9B37-7AA9768134C4}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{23102CBF-AC8D-4424-9364-A79738894850}\MSWord.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{73D320C0-FACA-4553-9D5F-070F9E4DC5C8}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\psuser.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{82D1C283-A637-4A07-B1EC-8C7AE661EAF1}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{841BFDCA-6A9A-4EBC-BC7E-194AA5DCE428}\InprocServer32 -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files\Citrix\GoToMeeting\1133\G2MOutlookAddin.dll (Citrix Online, a division of Citrix Systems, Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{97090E2F-3062-4459-855B-014F0D3CDBB1}\InprocServer32 -> C:\Program Files\Windows Desktop Search\deskbar.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{AD046C04-9CC6-4424-A8E2-1F8BB9D0B29D}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManagerps.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{B9E98D7E-F599-469d-95A7-0B6F86D082A0}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{B9E98D7E-F599-469d-95A7-0B6F86D082A0}\CamtasiaOutput.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{BA3D0120-E617-4F66-ADCA-585CC2FB86DB}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\npGoogleUpdate3.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\npGoogleUpdate3.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{C8992C14-DF59-4518-808F-CCFBB5850282}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{D41C1E5B-0566-4BB1-BE72-1A5407349CA6}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\psuser.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{EB59852D-B38E-4A4C-94BA-6731836E5538}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{EE7F6B66-AC97-41CF-BD88-372DDB786DB6}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{F6CF0104-4F4A-4EBE-999D-A12D838E65B5}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgrPs.dll (Research In Motion Limited)

    ==================== Restore Points =========================

    Check "winmgmt" service or repair WMI.


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2004-08-10 12:00 - 2015-01-08 21:39 - 00450748 ___RC C:\WINDOWS\system32\Drivers\etc\hosts
    127.0.0.1 localhost
    127.0.0.2 licensing.intellimon.com mailserver.intellimon.com
    127.0.0.1 www.007guard.com
    127.0.0.1 007guard.com
    127.0.0.1 008i.com
    127.0.0.1 www.008k.com
    127.0.0.1 008k.com
    127.0.0.1 www.00hq.com
    127.0.0.1 00hq.com
    127.0.0.1 010402.com
    127.0.0.1 www.032439.com
    127.0.0.1 032439.com
    127.0.0.1 www.0scan.com
    127.0.0.1 0scan.com
    127.0.0.1 www.1000gratisproben.com
    127.0.0.1 1000gratisproben.com
    127.0.0.1 1001namen.com
    127.0.0.1 www.1001namen.com
    127.0.0.1 100888290cs.com
    127.0.0.1 www.100888290cs.com
    127.0.0.1 www.100sexlinks.com
    127.0.0.1 100sexlinks.com
    127.0.0.1 www.10sek.com
    127.0.0.1 10sek.com
    127.0.0.1 www.1-2005-search.com
    127.0.0.1 1-2005-search.com
    127.0.0.1 www.123fporn.info
    127.0.0.1 123fporn.info
    127.0.0.1 123haustiereundmehr.com

    There are 1000 more lines.


    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    Task: C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    Task: C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    Task: C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    Task: C:\WINDOWS\Tasks\FixCleaner Scan.job => C:\Program Files\FixCleaner\FixCleaner.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003Core.job => C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003UA.job => C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005Core.job => C:\Documents and Settings\K\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005UA.job => C:\Documents and Settings\K\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe
    Task: C:\WINDOWS\Tasks\PCSpeedClean_Popup.job => C:\Program Files\PC Speed Clean\Splash.exe
    Task: C:\WINDOWS\Tasks\SlimDrivers Scan.job => C:\Program Files\SlimDrivers\SlimDrivers.exe
    Task: C:\WINDOWS\Tasks\ZHVRBWWEU.job =>

    ==================== Loaded Modules (Whitelisted) ==============

    2011-10-20 13:35 - 2010-02-17 18:25 - 00152064 ____N () C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    2011-10-20 13:35 - 2010-02-09 15:55 - 00049152 ____N () C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    2004-08-10 12:00 - 2011-02-04 18:48 - 00291840 _____ () C:\WINDOWS\system32\sbe.dll
    2004-08-10 12:00 - 2013-01-02 07:49 - 01292288 _____ () C:\WINDOWS\system32\quartz.dll
    2004-08-10 12:00 - 2008-04-14 01:11 - 00059904 ____N () C:\WINDOWS\system32\devenum.dll
    2004-08-10 12:00 - 2008-04-14 01:11 - 00014336 ____N () C:\WINDOWS\system32\msdmo.dll
    2013-08-08 00:20 - 2013-08-08 00:20 - 00327680 ____C () C:\Program Files\Serviio\bin\ServiioService.exe
    2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
    2010-01-21 02:34 - 2010-01-21 02:34 - 08793952 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
    2010-10-08 23:05 - 2012-05-25 04:25 - 00921600 ____C () C:\Program Files\Yahoo!\Messenger\yui.dll
    2011-08-09 16:01 - 2012-05-25 04:25 - 00078336 ____C () C:\Program Files\Yahoo!\Messenger\pcre.dll
    2013-08-08 00:20 - 2013-08-08 00:20 - 00610304 ____C () C:\Program Files\Serviio\bin\ServiioConsole.exe

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4
    AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:1CE11B51
    AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:63238B95
    AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:B879A65B
    AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
    AlternateDataStreams: C:\Documents and Settings\m\Desktop\Intellimon.XSitePro.v2.117.3275.29192-DVT.rar:$CmdZnID

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CLPSLauncher => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

    ==================== EXE Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
    IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
    IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
    IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

    There are 7866 more restricted sites.

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-329068152-1035525444-725345543-1003\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\m\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    HKU\S-1-5-21-329068152-1035525444-725345543-1007\Control Panel\Desktop\\Wallpaper -> (None)
    DNS Servers: 194.168.4.100 - 194.168.8.100
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\wlcsdk.exe] => Enabled:Windows Live Call
    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\msnmsgr.exe] => Enabled:Windows Live Messenger
    DomainProfile\AuthorizedApplications: [C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe] => :LocalSubNet:Enabled:Belkin Setup
    DomainProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\rapimgr.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    DomainProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\wcescomm.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    DomainProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\WCESMgr.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    StandardProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\wlcsdk.exe] => Enabled:Windows Live Call
    StandardProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\msnmsgr.exe] => Enabled:Windows Live Messenger
    StandardProfile\AuthorizedApplications: [C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe] => Enabled:Yahoo! Messenger
    StandardProfile\AuthorizedApplications: [C:\Program Files\Messenger\msmsgs.exe] => Enabled:Windows Messenger
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\dpvsetup.exe] => Enabled:Microsoft DirectPlay Voice Test
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\rundll32.exe] => Enabled:Run a DLL as an App
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office14\GROOVE.EXE] => Enabled:Microsoft SharePoint Workspace
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE] => Enabled:Microsoft OneNote
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE] => Enabled:Microsoft Office Outlook
    StandardProfile\AuthorizedApplications: [C:\Program Files\VideoLAN\VLC\vlc.exe] => Enabled:VLC media player
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\sessmgr.exe] => Disabled:mad:xpsp2res.dll,-22019
    StandardProfile\AuthorizedApplications: [E:\utorrent\uTorrent.exe] => Enabled:µTorrent
    StandardProfile\AuthorizedApplications: [C:\Program Files\Belkin\Belkin USB Print and Storage Center\Connect.exe] => Enabled:Belkin USB Print and Storage Center
    StandardProfile\AuthorizedApplications: [C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe] => :LocalSubNet:Enabled:Belkin Setup
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft LifeCam\LifeCam.exe] => Enabled:LifeCam.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft LifeCam\LifeEnC2.exe] => Enabled:LifeEnC2.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft LifeCam\LifeExp.exe] => Enabled:LifeExp.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft LifeCam\LifeTray.exe] => Enabled:LifeTray.exe
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\javaw.exe] => Enabled:Java(TM) Platform SE binary
    StandardProfile\AuthorizedApplications: [C:\Program Files\ooVoo\ooVoo.exe] => Enabled:eek:oVoo
    StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\Comodo\tvnserver.exe] => Enabled:TVN Server
    StandardProfile\AuthorizedApplications: [C:\Program Files\PacketiX VPN Client English\vpnclient.exe] => Enabled:packetiX VPN Client 2.0
    StandardProfile\AuthorizedApplications: [C:\Program Files\PacketiX VPN Client English\vpncmgr.exe] => Enabled:packetiX VPN Client Connection Manager 2.0
    StandardProfile\AuthorizedApplications: [C:\Program Files\PacketiX VPN Client English\vpncmd.exe] => Enabled:packetiX VPN Command-Line Admin Tool 2.0
    StandardProfile\AuthorizedApplications: [C:\Program Files\GigaTribe\gigatribe.exe] => Enabled:GigaTribe
    StandardProfile\AuthorizedApplications: [C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe] => Enabled:Daemonu.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe] => Enabled:BlackBerry Desktop Software
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\Temp\CMC_DRAGON\restart_helper.exe] => Enabled:restart_helper.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Serviio\bin\ServiioConsole.exe] => Enabled:Serviio
    StandardProfile\AuthorizedApplications: [C:\Program Files\Participatory Culture Foundation\Miro\Miro_Downloader.exe] => Enabled:Miro_Downloader
    StandardProfile\AuthorizedApplications: [C:\Program Files\SoftEther VPN Server\vpnsmgr.exe] => Enabled:SoftEther VPN Server Manager
    StandardProfile\AuthorizedApplications: [C:\Program Files\SoftEther VPN Server\vpnserver.exe] => Enabled:SoftEther VPN Server
    StandardProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\rapimgr.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    StandardProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\wcescomm.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    StandardProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\WCESMgr.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\mmc.exe] => Enabled:Microsoft Management Console
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Program Files\Skype\Phone\Skype.exe] => Enabled:Skype
    StandardProfile\AuthorizedApplications: [C:\Program Files\SoftEther VPN Client\vpncmgr.exe] => Enabled:SoftEther VPN Client Connection Manager
    StandardProfile\AuthorizedApplications: [C:\Program Files\SoftEther VPN Client\vpnclient.exe] => Enabled:SoftEther VPN Client
    StandardProfile\AuthorizedApplications: [C:\Program Files\SoftEther VPN Client\vpncmd.exe] => Enabled:SoftEther VPN Command-Line Admin Tool
    StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Program Files\Mozilla Firefox)
    DomainProfile\GloballyOpenPorts: [139:TCP] => Enabled:mad:xpsp2res.dll,-22004
    DomainProfile\GloballyOpenPorts: [445:TCP] => Enabled:mad:xpsp2res.dll,-22005
    DomainProfile\GloballyOpenPorts: [137:UDP] => Enabled:mad:xpsp2res.dll,-22001
    DomainProfile\GloballyOpenPorts: [138:UDP] => Enabled:mad:xpsp2res.dll,-22002
    DomainProfile\GloballyOpenPorts: [26675:TCP] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
    DomainProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    DomainProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22002
    StandardProfile\GloballyOpenPorts: [19540:UDP] => Enabled:SXUPTP
    StandardProfile\GloballyOpenPorts: [4481:TCP] => :LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
    StandardProfile\GloballyOpenPorts: [4481:UDP] => :LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery
    StandardProfile\GloballyOpenPorts: [443:UDP] => Disabled:eek:oVoo UDP port 443
    StandardProfile\GloballyOpenPorts: [37674:TCP] => Disabled:eek:oVoo TCP port 37674
    StandardProfile\GloballyOpenPorts: [37674:UDP] => Disabled:eek:oVoo UDP port 37674
    StandardProfile\GloballyOpenPorts: [37675:UDP] => Disabled:eek:oVoo UDP port 37675
    StandardProfile\GloballyOpenPorts: [5985:TCP] => Disabled:Windows Remote Management
    StandardProfile\GloballyOpenPorts: [80:TCP] => Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)
    StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    StandardProfile\GloballyOpenPorts: [26675:TCP] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    ==================== Faulty Device Manager Devices =============

    Could not list Devices. Check "winmgmt" service or repair WMI.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (09/01/2015 11:33:36 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (09/01/2015 12:28:51 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (08/30/2015 11:42:34 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (08/30/2015 12:12:57 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (08/29/2015 12:33:21 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (08/28/2015 12:38:38 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.2.5702, faulting module mozglue.dll, version 40.0.2.5702, fault address 0x0000e631.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (08/27/2015 08:42:13 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 39.0.3.5696, faulting module mozalloc.dll, version 39.0.3.5696, fault address 0x00001aa1.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (08/26/2015 05:58:24 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 39.0.3.5696, faulting module mozalloc.dll, version 39.0.3.5696, fault address 0x00001aa1.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (08/25/2015 10:08:33 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 39.0.3.5696, faulting module mozalloc.dll, version 39.0.3.5696, fault address 0x00001aa1.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (08/21/2015 11:35:00 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.


    System errors:
    =============
    Error: (09/03/2015 12:26:30 AM) (Source: W32Time) (EventID: 29) (User: )
    Description: The time provider NtpClient is configured to acquire time from one or more
    time sources, however none of the sources are currently accessible.
    No attempt to contact a source will be made for 120 minutes.
    NtpClient has no source of accurate time.

    Error: (09/03/2015 12:26:30 AM) (Source: W32Time) (EventID: 17) (User: )
    Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
    configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 120
    minutes.
    The error was: A socket operation was attempted to an unreachable host. (0x80072751)

    Error: (09/02/2015 11:26:28 PM) (Source: W32Time) (EventID: 29) (User: )
    Description: The time provider NtpClient is configured to acquire time from one or more
    time sources, however none of the sources are currently accessible.
    No attempt to contact a source will be made for 60 minutes.
    NtpClient has no source of accurate time.

    Error: (09/02/2015 11:26:28 PM) (Source: W32Time) (EventID: 17) (User: )
    Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
    configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 60
    minutes.
    The error was: A socket operation was attempted to an unreachable host. (0x80072751)

    Error: (09/02/2015 10:56:28 PM) (Source: W32Time) (EventID: 29) (User: )
    Description: The time provider NtpClient is configured to acquire time from one or more
    time sources, however none of the sources are currently accessible.
    No attempt to contact a source will be made for 30 minutes.
    NtpClient has no source of accurate time.

    Error: (09/02/2015 10:56:28 PM) (Source: W32Time) (EventID: 17) (User: )
    Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
    configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 30
    minutes.
    The error was: A socket operation was attempted to an unreachable host. (0x80072751)

    Error: (09/02/2015 10:43:10 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    CFRMD
    SASDIFSV
    SASKUTIL

    Error: (09/02/2015 10:43:10 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: Timeout (30000 milliseconds) waiting for the Avira Service Host service to connect.

    Error: (09/02/2015 10:43:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The PacketiX VPN Client service failed to start due to the following error:
    %%3

    Error: (09/02/2015 10:43:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The TrueVector Internet Monitor service failed to start due to the following error:
    %%2


    Microsoft Office:
    =========================
    Error: (09/01/2015 11:33:36 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (09/01/2015 12:28:51 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (08/30/2015 11:42:34 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (08/30/2015 12:12:57 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (08/29/2015 12:33:21 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (08/28/2015 12:38:38 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.2.5702mozglue.dll40.0.2.57020000e631

    Error: (08/27/2015 08:42:13 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe39.0.3.5696mozalloc.dll39.0.3.569600001aa1

    Error: (08/26/2015 05:58:24 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe39.0.3.5696mozalloc.dll39.0.3.569600001aa1

    Error: (08/25/2015 10:08:33 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe39.0.3.5696mozalloc.dll39.0.3.569600001aa1

    Error: (08/21/2015 11:35:00 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis operation returned because the timeout period expired.


    ==================== Memory info ===========================

    Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz
    Percentage of memory in use: 23%
    Total physical RAM: 3326.98 MB
    Available physical RAM: 2541.83 MB
    Total Virtual: 7259.51 MB
    Available Virtual: 6683.58 MB

    ==================== Drives ================================

    Drive c: (C 76gb) (Fixed) (Total:76.68 GB) (Free:10.07 GB) NTFS ==>[drive with boot components (Windows XP)]
    Drive e: (E 232 gb) (Fixed) (Total:232.82 GB) (Free:143.08 GB) NTFS
    Drive f: (F 750gb sata) (Fixed) (Total:698.64 GB) (Free:577.8 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows XP) (Size: 76.7 GB) (Disk ID: C9C9C9C9)
    Partition 1: (Active) - (Size=76.7 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (MBR Code: Windows XP) (Size: 232.8 GB) (Disk ID: C0B7C0B7)
    Partition 1: (Active) - (Size=232.8 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 2 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: 13B4A6DA)
    Partition 1: (Active) - (Size=698.6 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
  4. curleww

    curleww TS Rookie Topic Starter Posts: 37

    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:31-08-2015
    Ran by m (administrator) on 5F5A4C13557347C (03-09-2015 00:26:33)
    Running from F:\Downloads
    Loaded Profiles: m & UpdatusUser (Available Profiles: m & K & UpdatusUser & Administrator)
    Platform: Microsoft Windows XP Service Pack 3 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: FF)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Comodo Security Solutions Inc.) C:\Program Files\Common Files\Comodo\launcher_service.exe
    (Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
    () C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    () C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    (Comodo) C:\Program Files\Comodo\Chromodo\chromodo_updater.exe
    (Creative Technology Ltd) C:\WINDOWS\system32\CTSVCCDA.EXE
    (Oki Data Corporation) C:\WINDOWS\system32\spool\drivers\w32x86\3\OPHALDCS.EXE
    (Comodo) C:\Program Files\Comodo\Dragon\dragon_updater.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehrecvr.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehSched.exe
    (Intel Corporation) C:\WINDOWS\system32\IPROSetMonitor.exe
    (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
    (WhiteCanyon Inc.) C:\Program Files\WhiteCanyon\SecureClean 4\SCWatch4.exe
    () C:\Program Files\Serviio\bin\ServiioService.exe
    () C:\Program Files\Serviio\bin\ServiioService.exe
    (SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program Files\SoftEther VPN Client\vpnclient.exe
    (GlavSoft LLC.) C:\Program Files\Common Files\Comodo\tvnserver.exe
    (Microsoft Corporation) C:\WINDOWS\system32\MsPMSPSv.exe
    (Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\mcrdsvc.exe
    (Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe
    (Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
    (Creative Technology Ltd) C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    (Creative Technology Ltd) C:\WINDOWS\system32\CTHELPER.EXE
    (Microsoft Corporation) C:\WINDOWS\vVX3000.exe
    (GlavSoft LLC.) C:\Program Files\Common Files\Comodo\tvnserver.exe
    (SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program Files\SoftEther VPN Client\vpnclient.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
    (Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
    (Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
    (Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
    (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    (Microsoft Corporation) E:\PROGRA~1\MICROS~1\rapimgr.exe
    (Creative Technology Ltd) C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe
    (Yahoo! Inc.) C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe
    (SoftEther VPN Project at University of Tsukuba, Japan.) C:\Program Files\SoftEther VPN Client\vpncmgr.exe
    (Microsoft Corporation) E:\Program Files\Microsoft ActiveSync\wcescomm.exe
    (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe
    () C:\Program Files\Serviio\bin\ServiioConsole.exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [CTSysVol] => C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe [49152 2002-10-29] (Creative Technology Ltd)
    HKLM\...\Run: [AsioReg] => REGSVR32.EXE /S CTASIO.DLL
    HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
    HKLM\...\Run: [CTHelper] => C:\WINDOWS\system32\CTHELPER.EXE [28672 2003-02-20] (Creative Technology Ltd)
    HKLM\...\Run: [VX3000] => C:\WINDOWS\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
    HKLM\...\Run: [tvncontrol] => C:\Program Files\Common Files\Comodo\tvnserver.exe [828944 2012-01-27] (GlavSoft LLC.)
    HKLM\...\Run: [ScanSoft OmniPage SE 4.0-reminder] => C:\Program Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe [1410600 2006-09-26] (Nuance Communications, Inc.)
    HKLM\...\Run: [SoftEther VPN Client UI Helper] => C:\Program Files\SoftEther VPN Client\vpnclient.exe [3941096 2015-08-10] (SoftEther VPN Project at University of Tsukuba, Japan.)
    HKLM\...\Run: [NeroCheck] => C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
    HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
    HKLM\...\Run: [IJNetworkScanUtility] => C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [132704 2006-10-26] (CANON INC.)
    HKLM\...\Run: [ehTray] => C:\WINDOWS\ehome\ehtray.exe [64512 2005-08-05] (Microsoft Corporation)
    HKLM\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [335232 2015-04-18] (Oracle Corporation)
    HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1361088 2015-08-05] (COMODO)
    HKLM\...\Run: [Avira SystrayStartTrigger] => C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe [66936 2015-08-13] (Avira Operations GmbH & Co. KG)
    HKLM\...\Policies\Explorer: [NoControlPanel] 0
    HKLM\...\Policies\Explorer: [NoSharedDocuments] 0
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Run: [SpybotSD TeaTimer] => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Run: [Creative MediaSource Go] => C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe [126976 2002-11-25] (Creative Technology Ltd)
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Run: [Google Update] => C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [144200 2015-08-30] (Google Inc.)
    HKU\S-1-5-18\...\Run: [DWQueuedReporting] => C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [519584 2010-12-21] (Microsoft Corporation)
    HKU\S-1-5-18\...\RunOnce: [RunNarrator] => C:\WINDOWS\system32\Narrator.exe [53760 2008-04-14] (Microsoft Corporation)
    Lsa: [Notification Packages] :\WINDOWS\syste scecli
    ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
    Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SoftEther VPN Client Manager Startup.lnk [2014-03-22]
    ShortcutTarget: SoftEther VPN Client Manager Startup.lnk -> C:\Program Files\SoftEther VPN Client\vpncmgr.exe (SoftEther VPN Project at University of Tsukuba, Japan.)
    Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk [2014-03-09]
    ShortcutTarget: Windows Search.lnk -> C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
    Startup: C:\Documents and Settings\m\Start Menu\Programs\StartUp\Serviio.lnk [2015-07-29]
    ShortcutTarget: Serviio.lnk -> C:\Program Files\Serviio\bin\ServiioConsole.exe ()

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\..\Interfaces\{70C2F4ED-25C2-496E-B381-4222D511273F}: [DhcpNameServer] 10.211.254.254 8.8.8.8
    Tcpip\..\Interfaces\{BE8BAB0A-A427-4D7A-99F9-C5BA65B9CB7E}: [DhcpNameServer] 194.168.4.100 194.168.8.100

    Internet Explorer:
    ==================
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\Software\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://playitall.zugo.com/?cfg=2-130-0-2QNXH
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-gb/?ocid=iehp
    URLSearchHook: [S-1-5-21-329068152-1035525444-725345543-1007] ATTENTION => Default URLSearchHook is missing
    SearchScopes: HKU\.DEFAULT -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = hxxp://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-329068152-1035525444-725345543-1003 -> {38B937B1-8E9F-1D14-4BEF-6D295A099F9E} URL = hxxp://playitall.zugo.com/s/?q={searchTerms}&iesrc={referrer:source?}&cfg=2-130-0-2QNXH
    SearchScopes: HKU\S-1-5-21-329068152-1035525444-725345543-1003 -> {91D2D5A9-6A52-ECC0-4415-63DC5BBEA4C4} URL = hxxp://a2.wyzostart.com/s/?q={searchTerms}&iesrc={referrer:source?}&cfg=2-159-0-2ZzuJ
    BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files\TechSmith\Snagit 10\SnagitBHO.dll [2010-04-13] (TechSmith Corporation)
    BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
    BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
    BHO: EWPBrowseObject Class -> {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} -> C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-06-09] ()
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-18] (Oracle Corporation)
    BHO: No Name -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> No File
    BHO: No Name -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> No File
    BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-18] (Oracle Corporation)
    BHO: No Name -> {FB16E5C3-A9E2-47A2-8EFC-319E775E62CC} -> No File
    Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 10\SnagitIEAddin.dll [2010-04-13] (TechSmith Corporation)
    Toolbar: HKU\S-1-5-21-329068152-1035525444-725345543-1003 -> No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
    DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_60-windows-i586.cab
    DPF: {CAFEEFAC-0017-0000-0060-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_60-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_60-windows-i586.cab
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll [2012-11-08] (Belarc, Inc.)
    Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File
    Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File
    Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - No File

    FireFox:
    ========
    FF ProfilePath: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-28] ()
    FF Plugin: @alibaba.com/nptrademanager;version=1.0 -> C:\DOCUME~1\m\LOCALS~1\Temp\..\application data\nptrademanager\nptrademanager.dll [2012-05-31] ( )
    FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-18] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-18] (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2010-06-01] (Yahoo! Inc.)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2012-12-13] ()
    FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-329068152-1035525444-725345543-1003: @citrixonline.com/appdetectorplugin -> C:\Documents and Settings\m\Local Settings\Application Data\Citrix\Plugins\94\npappdetector.dll [2013-02-21] (Citrix Online)
    FF Plugin HKU\S-1-5-21-329068152-1035525444-725345543-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-30] (Google Inc.)
    FF Plugin HKU\S-1-5-21-329068152-1035525444-725345543-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-30] (Google Inc.)
    FF Extension: PrivDog - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\Extensions\PrivDog@AdTrustMedia.com.xpi [2014-07-01]
    FF Extension: RAMBack - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\Extensions\ramback@pavlov.net.xpi [2014-07-19]
    FF Extension: eBay Sidebar for Firefox - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2014-06-27]
    FF Extension: NoScript - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-05-27]
    FF Extension: Adblock Plus - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-12-06]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-10-13]

    Chrome:
    =======
    CHR Profile: C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default
    CHR Extension: (Chrome Hotword Shared Module) - C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-29]
    CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-29]
    StartMenuInternet: Google Chrome - C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [569752 2010-07-28] (Affinegy, Inc.)
    S2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [228104 2015-08-13] (Avira Operations GmbH & Co. KG)
    R2 Belkin Local Backup Service; C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [152064 2010-02-17] () [File not signed]
    R2 Belkin Network USB Helper; C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [49152 2010-02-09] () [File not signed]
    R3 Blackberry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
    R2 ChromodoUpdater; C:\Program Files\Comodo\Chromodo\chromodo_updater.exe [1998520 2015-08-19] (Comodo)
    R2 CLPSLauncher; C:\Program Files\Common Files\Comodo\launcher_service.exe [70352 2012-08-23] (Comodo Security Solutions Inc.)
    S2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [4353840 2015-08-05] (COMODO)
    S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [1664704 2015-08-05] (COMODO)
    R2 Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [44032 1999-12-13] (Creative Technology Ltd) [File not signed]
    R2 DCSLoader; C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\OPHALDCS.EXE [24576 2004-03-02] (Oki Data Corporation)
    R2 DragonUpdater; C:\Program Files\Comodo\Dragon\dragon_updater.exe [1994936 2015-06-26] (Comodo)
    R2 Intel(R) PROSet Monitoring Service; C:\WINDOWS\system32\IProsetMonitor.exe [132768 2011-11-09] (Intel Corporation)
    R2 McrdSvc; C:\WINDOWS\ehome\mcrdsvc.exe [99328 2005-08-05] (Microsoft Corporation)
    S3 MHN; C:\WINDOWS\System32\mhn.dll [85504 2004-08-10] (Microsoft Corporation) [File not signed]
    S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)
    R2 SCWatch 4.0; C:\Program Files\WhiteCanyon\SecureClean 4\scwatch4.exe [364544 2007-05-17] (WhiteCanyon Inc.) [File not signed]
    R2 Serviio; C:\Program Files\Serviio\bin\ServiioService.exe [327680 2013-08-08] () [File not signed]
    R2 SEVPNCLIENT; C:\Program Files\SoftEther VPN Client\vpnclient.exe [3941096 2015-08-10] (SoftEther VPN Project at University of Tsukuba, Japan.)
    R2 tvnserver; C:\Program Files\Common Files\Comodo\tvnserver.exe [828944 2012-01-27] (GlavSoft LLC.)
    R2 WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [53520 2000-06-26] (Microsoft Corporation) [File not signed]
    S3 KOT; no ImagePath
    S2 vpnclient; no ImagePath
    S2 vsmon; C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe -service [X]

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [21035 2010-10-06] (Meetinghouse Data Communications) [File not signed]
    S3 AFGSp50; C:\WINDOWS\System32\Drivers\AFGSp50.sys [27072 2010-06-23] (Printing Communications Assoc., Inc. (PCAUSA))
    R3 AtlsAud; C:\WINDOWS\System32\drivers\AtlsAud.sys [21504 2002-12-03] (Dell Computer Corporation)
    R1 BANTExt; C:\WINDOWS\System32\Drivers\BANTExt.sys [3840 2011-06-03] () [File not signed]
    S3 Belkin700F; C:\WINDOWS\System32\DRIVERS\BLKWGDv7.sys [303616 2006-10-19] (Belkin Corporation. ) [File not signed]
    S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
    R1 Cdr4_xp; C:\WINDOWS\system32\Drivers\Cdr4_xp.sys [61424 2010-09-27] (Roxio) [File not signed]
    R1 Cdralw2k; C:\WINDOWS\system32\Drivers\Cdralw2k.sys [23420 2010-09-27] (Roxio) [File not signed]
    S0 cercsr6; C:\WINDOWS\system32\Drivers\cercsr6.sys [39904 2004-12-13] (Adaptec, Inc.) [File not signed]
    R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [15808 2015-08-05] (COMODO)
    R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [631872 2015-08-05] (COMODO)
    R1 cmdHlp; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [30144 2015-08-05] (COMODO)
    S3 ctdvda2k; C:\WINDOWS\System32\drivers\ctdvda2k.sys [287920 2003-03-27] (Creative Technology Ltd)
    R3 EMATCORE; C:\WINDOWS\System32\Drivers\AtlsVid.sys [134304 2002-12-04] (Dell Computer Corporation)
    R3 ha10kx2k; C:\WINDOWS\System32\drivers\ha10kx2k.sys [823616 2003-03-26] (Creative Technology Ltd)
    R3 hap16v2k; C:\WINDOWS\System32\drivers\hap16v2k.sys [141536 2003-03-26] (Creative Technology Ltd)
    S3 hitmanpro37; C:\WINDOWS\system32\drivers\hitmanpro37.sys [35992 2015-08-17] ()
    R0 Inspect; C:\WINDOWS\System32\DRIVERS\inspect.sys [105664 2015-08-05] (COMODO)
    R0 KL1; C:\WINDOWS\System32\DRIVERS\kl1.sys [133208 2012-01-09] (Kaspersky Lab ZAO)
    R1 kl2; C:\WINDOWS\System32\DRIVERS\kl2.sys [11352 2012-01-09] (Kaspersky Lab ZAO)
    R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [485808 2012-01-09] (Kaspersky Lab)
    S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [98520 2015-08-30] (Malwarebytes Corporation)
    S3 MHIKEY10; C:\WINDOWS\System32\Drivers\MHIKEY10.sys [51968 2011-02-10] (Generic USB smartcard reader)
    S3 MHNDRV; C:\WINDOWS\System32\DRIVERS\mhndrv.sys [11008 2004-08-10] (Microsoft Corporation) [File not signed]
    R0 MpFilter; C:\WINDOWS\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
    S3 NAL; C:\WINDOWS\system32\Drivers\iqvw32.sys [30368 2011-11-09] (Intel Corporation )
    S3 ndiscm; C:\WINDOWS\System32\DRIVERS\NetMotCM.sys [14336 2003-08-10] (Motorola Inc.)
    S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
    R3 Neo_vpn jp; C:\WINDOWS\System32\DRIVERS\Neo_0029.sys [22000 2012-08-07] (SoftEther Corporation)
    R1 OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [13632 2001-08-22] (Dell Computer Corporation) [File not signed]
    R3 pfc; C:\WINDOWS\System32\drivers\pfc.sys [9856 2002-11-11] (Padus, Inc.) [File not signed]
    R2 PfModNT; C:\WINDOWS\system32\drivers\PfModNT.sys [15840 2003-03-06] (Creative Technology Ltd.)
    R3 RTL8023xp; C:\WINDOWS\System32\DRIVERS\Rtnicxp.sys [118656 2009-02-25] (TRENDware International, Inc )
    S3 SEE; C:\WINDOWS\System32\drivers\see.sys [43104 2014-01-08] (SoftEther VPN Project at University of Tsukuba, Japan.)
    R3 sxuptp; C:\WINDOWS\System32\DRIVERS\sxuptp.sys [246936 2009-06-22] (silex technology, Inc.)
    S3 tap0901; C:\WINDOWS\System32\DRIVERS\tap0901.sys [35288 2013-08-22] (The OpenVPN Project)
    S3 taphss; C:\WINDOWS\System32\DRIVERS\taphss.sys [32768 2012-01-05] (AnchorFree Inc)
    S3 tapoas; C:\WINDOWS\System32\DRIVERS\tapoas.sys [26112 2011-08-19] (The OpenVPN Project) [File not signed]
    S3 USTORAGE; C:\WINDOWS\System32\DRIVERS\UStorage.sys [31104 2009-04-14] (USB Mass Storage.)
    R1 Vsdatant; C:\WINDOWS\System32\vsdatant.sys [526608 2012-05-03] (Check Point Software Technologies LTD)
    S3 AFGMp50; no ImagePath
    S1 CFRMD; no ImagePath
    S3 cpuz132; no ImagePath
    U2 Irmon; no ImagePath
    S1 SASDIFSV; no ImagePath
    S1 SASKUTIL; no ImagePath
    U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
    S3 SjyPkt; no ImagePath
    U5 Tcpip6; C:\Windows\System32\Drivers\Tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)
    S1 vcdrom; no ImagePath
    S3 ZTEusbmdm6k; no ImagePath
    S3 ZTEusbnmea; no ImagePath
    S3 ZTEusbser6k; no ImagePath

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    NETSVC: MHN -> C:\Windows\System32\mhn.dll (Microsoft Corporation)
    NETSVC: SSHNAS -> no filepath.

    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2099-11-13 20:58 - 2011-08-24 05:53 - 00000000 __SHD C:\WINDOWS\xxclone.arc
    2015-09-03 00:25 - 2015-09-03 00:26 - 00000000 ____D C:\FRST
    2015-09-01 23:34 - 2015-09-01 23:34 - 00380598 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-329068152-1035525444-725345543-1003-0.dat
    2015-08-30 22:13 - 2015-09-01 21:19 - 00000865 _____ C:\Documents and Settings\All Users\Desktop\Avira Launcher.lnk
    2015-08-30 22:12 - 2015-09-01 21:17 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Avira
    2015-08-30 22:11 - 2015-08-30 22:11 - 00000000 ____D C:\Program Files\Avira
    2015-08-30 22:11 - 2015-08-30 22:11 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Avira
    2015-08-30 21:34 - 2015-08-30 21:34 - 00001695 _____ C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
    2015-08-30 21:07 - 2015-08-30 21:07 - 00000702 _____ C:\WINDOWS\system32\{7995330B-E01F-4645-B702-53481E7CB778}.cmdfile
    2015-08-29 22:43 - 2015-08-29 22:43 - 00000781 _____ C:\Documents and Settings\All Users\Desktop\Internet (Chromodo).lnk
    2015-08-29 00:19 - 2015-09-01 23:56 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Package Cache
    2015-08-28 00:36 - 2015-08-28 21:54 - 00000000 ____D C:\Program Files\Mozilla Firefox
    2015-08-24 19:22 - 2015-08-24 19:22 - 00302760 _____ (Trend Micro Inc.) C:\WINDOWS\system32\Drivers\tmcomm.sys
    2015-08-21 22:51 - 2015-08-21 22:51 - 00000000 __SHD C:\WINDOWS\CSC
    2015-08-20 23:36 - 2015-08-20 23:36 - 00000015 _____ C:\Documents and Settings\m\all
    2015-08-17 23:36 - 2015-09-02 17:58 - 00030396 _____ C:\WINDOWS\setupapi.log
    2015-08-10 21:24 - 2015-09-02 23:33 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
    2015-08-10 14:45 - 2015-08-10 14:45 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\SoftEther VPN Client
    2015-08-10 01:31 - 2015-08-10 01:31 - 00487496 _____ C:\WINDOWS\system32\FNTCACHE.DAT
    2015-08-06 22:17 - 2015-08-07 21:03 - 00000000 ____D C:\Documents and Settings\m\Desktop\Lumia 2
    2015-08-06 22:05 - 2015-07-22 18:08 - 55791130 _____ C:\Documents and Settings\m\Desktop\MS-Office-2013-ISO-and-Activator(1).zip
    2015-08-05 01:30 - 2015-08-05 01:30 - 00631872 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmdGuard.sys
    2015-08-05 01:30 - 2015-08-05 01:30 - 00105664 _____ (COMODO) C:\WINDOWS\system32\Drivers\inspect.sys
    2015-08-05 01:30 - 2015-08-05 01:30 - 00030144 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmdhlp.sys
    2015-08-05 01:30 - 2015-08-05 01:30 - 00015808 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmderd.sys
    2015-08-05 01:29 - 2015-08-05 01:29 - 00445472 _____ (COMODO) C:\WINDOWS\system32\guard32.dll
    2015-08-05 01:29 - 2015-08-05 01:29 - 00033496 _____ (COMODO) C:\WINDOWS\system32\cmdcsr.dll
    2015-08-05 01:27 - 2015-08-05 01:27 - 00288448 _____ (COMODO) C:\WINDOWS\system32\cmdvrt32.dll
    2015-08-05 01:26 - 2015-08-05 01:26 - 00040640 _____ (COMODO) C:\WINDOWS\system32\cmdkbd32.dll

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-09-03 00:27 - 2010-09-09 18:20 - 00000000 ____D C:\Documents and Settings\m\Local Settings\Temp
    2015-09-03 00:22 - 2014-03-10 12:04 - 00000214 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
    2015-09-03 00:12 - 2010-11-02 00:16 - 00000962 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005UA.job
    2015-09-03 00:00 - 2014-04-11 13:16 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
    2015-09-02 23:39 - 2010-09-29 00:44 - 00000962 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003UA.job
    2015-09-02 22:43 - 2010-09-09 16:42 - 01127674 ____C C:\WINDOWS\WindowsUpdate.log
    2015-09-02 22:42 - 2013-12-17 22:40 - 00000000 ____D C:\Program Files\SoftEther VPN Client
    2015-09-02 22:42 - 2010-09-09 16:40 - 00000000 ____D C:\WINDOWS\Registration
    2015-09-02 22:41 - 2010-11-28 18:15 - 00000159 ____C C:\WINDOWS\wiadebug.log
    2015-09-02 22:40 - 2010-11-28 18:15 - 00000048 ____C C:\WINDOWS\wiaservc.log
    2015-09-02 22:39 - 2010-10-29 22:46 - 00000298 ___SH C:\WINDOWS\Tasks\ZHVRBWWEU.job
    2015-09-02 22:39 - 2010-09-09 18:18 - 00000006 ___HC C:\WINDOWS\Tasks\SA.DAT
    2015-09-02 15:30 - 2014-08-07 14:26 - 00000292 _____ C:\WINDOWS\Tasks\PCSpeedClean_Popup.job
    2015-09-02 15:03 - 2014-04-11 13:16 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
    2015-09-02 12:50 - 2014-02-25 05:26 - 00001324 _____ C:\WINDOWS\system32\d3d9caps.dat
    2015-09-02 12:12 - 2010-11-02 00:16 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005Core.job
    2015-09-02 06:12 - 2010-09-09 18:18 - 00032308 _____ C:\WINDOWS\SchedLgU.Txt
    2015-09-01 23:35 - 2012-05-17 20:49 - 01474832 _____ C:\WINDOWS\system32\Drivers\sfi.dat
    2015-09-01 23:35 - 2010-09-27 14:53 - 00001080 ____C C:\WINDOWS\system32\settingsbkup.sfm
    2015-09-01 23:35 - 2010-09-27 14:53 - 00001080 ____C C:\WINDOWS\system32\settings.sfm
    2015-09-01 23:35 - 2010-09-27 14:53 - 00000288 ____C C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-00000001-00001102-00000004-10031102}.dat
    2015-09-01 23:35 - 2010-09-27 14:53 - 00000288 ____C C:\WINDOWS\system32\DVCState-{00000002-00000000-00000001-00001102-00000004-10031102}.dat
    2015-09-01 23:34 - 2012-05-14 01:39 - 00380598 ____C C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    2015-09-01 23:34 - 2010-12-26 22:58 - 00131072 _____ C:\WINDOWS\system32\config\OAlerts.evt
    2015-09-01 23:34 - 2010-09-09 18:20 - 00000178 __SHC C:\Documents and Settings\m\ntuser.ini
    2015-09-01 23:34 - 2010-09-09 18:20 - 00000000 ____D C:\Documents and Settings\m
    2015-09-01 21:39 - 2010-09-29 00:44 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003Core.job
    2015-09-01 21:15 - 2010-09-09 16:42 - 00000000 ____D C:\WINDOWS\system32\Restore
    2015-09-01 21:03 - 2014-04-11 13:16 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
    2015-09-01 01:14 - 2011-10-22 16:29 - 00000000 ____D C:\Program Files\WinFF
    2015-09-01 01:12 - 2012-08-05 18:06 - 00000000 ____D C:\Documents and Settings\m\Desktop\ultra
    2015-09-01 00:51 - 2011-09-02 23:33 - 00000000 ____D C:\Documents and Settings\m\Desktop\barcode
    2015-09-01 00:51 - 2010-12-05 18:59 - 00000000 ____D C:\Documents and Settings\m\Desktop\New Folder (2)
    2015-09-01 00:50 - 2010-10-29 23:10 - 00000000 ____D C:\Documents and Settings\m\Desktop\8
    2015-08-31 00:03 - 2014-04-11 13:16 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
    2015-08-30 22:13 - 2014-06-25 03:26 - 00098520 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2015-08-30 21:54 - 2010-09-29 00:45 - 00002258 ____C C:\Documents and Settings\m\Desktop\Google Chrome.lnk
    2015-08-30 21:34 - 2012-05-17 20:37 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Comodo
    2015-08-30 21:34 - 2012-05-17 20:36 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Comodo
    2015-08-30 21:30 - 2012-05-17 20:36 - 00000000 ____D C:\Program Files\Comodo
    2015-08-30 21:25 - 2012-05-17 20:36 - 00000000 ____D C:\Documents and Settings\m\Local Settings\Application Data\Comodo
    2015-08-30 05:00 - 2013-02-06 19:49 - 00000430 ____C C:\WINDOWS\Tasks\FixCleaner Scan.job
    2015-08-30 03:00 - 2013-02-06 19:44 - 00000432 ____C C:\WINDOWS\Tasks\SlimDrivers Scan.job
    2015-08-30 02:21 - 2012-05-06 11:54 - 00000384 ___HC C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job
    2015-08-29 21:35 - 2012-09-16 19:39 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
    2015-08-28 21:53 - 2012-04-17 13:54 - 00778440 ____C (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
    2015-08-28 21:53 - 2011-05-20 01:22 - 00142536 ____C (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
    2015-08-28 21:51 - 2014-09-11 20:21 - 00000000 ____D C:\Documents and Settings\m\Local Settings\Application Data\Adobe
    2015-08-28 00:39 - 2011-08-18 23:36 - 00000000 ____D C:\Documents and Settings\m\Application Data\Skype
    2015-08-28 00:33 - 2014-11-07 13:51 - 00002265 _____ C:\Documents and Settings\All Users\Desktop\Skype.lnk
    2015-08-24 05:39 - 2012-06-04 00:10 - 00814149 ____C C:\Documents and Settings\m\Local Settings\Application Data\census.cache
    2015-08-24 05:39 - 2012-06-04 00:10 - 00259338 ____C C:\Documents and Settings\m\Local Settings\Application Data\ars.cache
    2015-08-20 23:45 - 2011-08-25 19:25 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2015-08-20 00:10 - 2004-08-10 12:00 - 00002206 ____C C:\WINDOWS\system32\wpa.dbl
    2015-08-19 01:09 - 2010-09-30 15:06 - 00000178 __SHC C:\Documents and Settings\K\ntuser.ini
    2015-08-19 01:08 - 2010-09-30 15:06 - 00000000 ____D C:\Documents and Settings\K\Local Settings\Temp
    2015-08-19 01:08 - 2010-09-30 15:06 - 00000000 ____D C:\Documents and Settings\K
    2015-08-17 00:00 - 2015-08-03 00:01 - 00035992 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys
    2015-08-11 00:48 - 2010-09-09 16:40 - 00000000 ____D C:\WINDOWS\Microsoft.NET
    2015-08-10 21:50 - 2013-08-11 12:13 - 00000000 ____D C:\WINDOWS\system32\MRT
    2015-08-10 21:46 - 2010-12-26 22:42 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2015-08-10 14:46 - 2012-08-06 22:32 - 00142056 ____C (SoftEther VPN Project at University of Tsukuba, Japan.) C:\WINDOWS\system32\vpncmd.exe
    2015-08-10 14:45 - 2014-03-22 11:57 - 00001779 _____ C:\Documents and Settings\All Users\Start Menu\SoftEther VPN Client Manager.lnk
    2015-08-10 14:45 - 2014-03-22 11:57 - 00001779 _____ C:\Documents and Settings\All Users\Desktop\SoftEther VPN Client Manager.lnk
    2015-08-10 01:09 - 2015-01-08 22:04 - 00021056 _____ C:\WINDOWS\system32\Drivers\fvstore.dat
    2015-08-10 00:17 - 2012-08-08 22:49 - 00000000 ____D C:\Documents and Settings\m\Application Data\vlc
    2015-08-08 15:00 - 2014-03-10 12:04 - 00000208 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
    2015-08-07 22:25 - 2011-01-09 20:33 - 00000000 ____D C:\Documents and Settings\m\Application Data\playitall
    2015-08-07 22:02 - 2010-10-07 00:21 - 00213504 ____C C:\Documents and Settings\m\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-08-07 21:04 - 2015-06-23 21:43 - 00000000 ____D C:\Documents and Settings\m\Desktop\Lumia
    2015-08-07 00:21 - 2012-10-11 23:45 - 00000000 ____D C:\Documents and Settings\m\Desktop\BBBB
    2015-08-07 00:21 - 2012-10-11 23:33 - 00000000 ____D C:\Documents and Settings\m\Desktop\BBB
    2015-08-07 00:21 - 2012-05-19 15:34 - 00000000 ____D C:\Documents and Settings\m\Desktop\becker
    2015-08-07 00:13 - 2011-03-06 14:06 - 00000000 ____D C:\Documents and Settings\m\Desktop\caravann photo
    2015-08-07 00:09 - 2013-10-16 16:36 - 00000000 ____D C:\Documents and Settings\m\Desktop\Caravan pics 2012
    2015-08-07 00:09 - 2013-02-01 18:11 - 00000000 ____D C:\Documents and Settings\m\Desktop\Family Tree
    2015-08-06 23:15 - 2012-04-16 17:24 - 00000000 ____D C:\Documents and Settings\m\Desktop\New Folder (5)
    2015-08-05 19:52 - 2014-11-19 21:38 - 00000000 ____D C:\Documents and Settings\m\Application Data\ImgBurn

    ==================== Files in the root of some directories =======

    2014-03-08 14:47 - 2014-03-08 14:47 - 0002528 ____C () C:\Documents and Settings\m\Application Data\$_hpcst$.hpc
    2011-01-26 21:49 - 2012-04-18 12:46 - 0000031 ____C () C:\Documents and Settings\m\Application Data\Days5.ini
    2013-05-26 00:21 - 2013-05-26 00:36 - 0000196 ____C () C:\Documents and Settings\m\Application Data\G-Force Prefs (WindowsMediaPlayer).txt
    2005-07-07 08:46 - 2005-07-07 08:46 - 0000015 ___HC () C:\Documents and Settings\m\Application Data\mlog.dat
    2014-08-02 22:49 - 2014-08-02 23:19 - 0000077 _____ () C:\Documents and Settings\m\Application Data\Rim.Desktop.Exception.log
    2014-08-02 22:50 - 2014-08-02 23:19 - 0000077 _____ () C:\Documents and Settings\m\Application Data\Rim.DesktopHelper.Exception.log
    2014-08-02 22:53 - 2014-08-02 23:19 - 0000077 _____ () C:\Documents and Settings\m\Application Data\Rim.Transcoder.Exception.log
    2012-06-11 22:35 - 2012-06-11 22:43 - 0214016 ____C () C:\Documents and Settings\m\Application Data\SharedSettings.ccs
    2012-06-04 00:10 - 2015-08-24 05:39 - 0259338 ____C () C:\Documents and Settings\m\Local Settings\Application Data\ars.cache
    2012-06-04 00:10 - 2015-08-24 05:39 - 0814149 ____C () C:\Documents and Settings\m\Local Settings\Application Data\census.cache
    2014-02-23 02:29 - 2014-03-01 01:40 - 0000664 _____ () C:\Documents and Settings\m\Local Settings\Application Data\d3d9caps.dat
    2010-10-07 00:21 - 2015-08-07 22:02 - 0213504 ____C () C:\Documents and Settings\m\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2010-09-09 18:24 - 2010-09-09 18:24 - 0000124 ____C () C:\Documents and Settings\m\Local Settings\Application Data\fusioncache.dat
    2012-06-03 23:53 - 2012-06-03 23:53 - 0000036 ____C () C:\Documents and Settings\m\Local Settings\Application Data\housecall.guid.cache
    2015-06-25 14:09 - 2015-06-25 14:09 - 0000218 _____ () C:\Documents and Settings\m\Local Settings\Application Data\recently-used.xbel
    2008-02-05 13:28 - 2008-02-05 13:28 - 0000051 _____ () C:\Documents and Settings\m\Local Settings\Application Data\setup.txt
    2011-08-29 02:25 - 2011-08-29 19:34 - 0002770 ____C () C:\Documents and Settings\m\Local Settings\Application Data\video.torrent

    Some files in TEMP:
    ====================
    C:\Documents and Settings\K\Local Settings\Temp\jre-6u31-windows-i586-iftw-rv.exe
    C:\Documents and Settings\K\Local Settings\Temp\mediaget_installer.exe
    C:\Documents and Settings\m\Local Settings\Temp\HitmanPro.exe
    C:\Documents and Settings\m\Local Settings\Temp\i4jd4391294368781684117.exe
    C:\Documents and Settings\m\Local Settings\Temp\jre-8u60-windows-au.exe
    C:\Documents and Settings\m\Local Settings\Temp\SkypeSetup.exe


    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

    ==================== End of FRST.txt ============================
     
  5. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===============================

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2
    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
    [​IMG] Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
    NOTE. If you already have MBAM 2.0 installed scroll down.
    • Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    If you already have MBAM 2.0 installed:
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    How to get logs:
    (Export log to save as txt)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
    • Click Ok
    • Attach that saved log to your next reply.
    (Copy to clipboard for pasting into forum replies or tickets)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Copy to Clipboard'
    • Paste the contents of the clipboard into your reply.
    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
  6. curleww

    curleww TS Rookie Topic Starter Posts: 37

    Not sure If some of these are keep items , now wait on your input
    f above is darker because it wont type and I had to copy paste it

    RogueKiller V10.10.4.0 [Sep 4 2015] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/software/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
    Started in : Safe mode with network support
    User : m [Administrator]
    Started from : F:\Downloads\RogueKiller.exe
    Mode : Scan -- Date : 09/05/2015 20:34:53

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 27 ¤¤¤
    [PUP] HKEY_LOCAL_MACHINE\RK_Software_ON_F_886D\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670} -> Found
    [PUP] HKEY_LOCAL_MACHINE\RK_Software_ON_F_886D\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593} -> Found
    [PUP] HKEY_LOCAL_MACHINE\RK_Software_ON_F_886D\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> Found
    [PUP] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670} -> Found
    [PUP] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC} -> Found
    [PUP] HKEY_LOCAL_MACHINE\RK_Software_ON_F_886D\Microsoft\Internet Explorer\Toolbar | {0974BA1E-64EC-11DE-B2A5-E43756D89593} : MediaBar -> Found
    [PUP] HKEY_LOCAL_MACHINE\RK_Software_ON_F_886D\Microsoft\Internet Explorer\Toolbar | {EF99BD32-C1FB-11D2-892F-0090271D4F88} : -> Found
    [PUP] HKEY_USERS\RK_K_ON_F_0BFA\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {EF99BD32-C1FB-11D2-892F-0090271D4F88} : -> Found
    [PUP] HKEY_USERS\RK_K_ON_F_0BFA\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {EF99BD32-C1FB-11D2-892F-0090271D4F88} : -> Found
    [PUP] HKEY_USERS\RK_m_ON_F_D0D0\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} : -> Found
    [Suspicious.Path] HKEY_USERS\RK_K_ON_F_0BFA\Software\Microsoft\Windows\CurrentVersion\Run | JP595IR86O : C:\DOCUME~1\K\LOCALS~1\Temp\Yjd.exe [x] -> Found
    [Suspicious.Path] HKEY_USERS\RK_K_ON_F_0BFA\Software\Microsoft\Windows\CurrentVersion\Run | B60JHDGR6V : C:\WINDOWS\Ykynia.exe [x] -> Found
    [Suspicious.Path] HKEY_LOCAL_MACHINE\RK_System_ON_F_2929\ControlSet001\Services\KOT (C:\DOCUME~1\m\LOCALS~1\Temp\KOT.exe) -> Found
    [PUP] HKEY_LOCAL_MACHINE\RK_System_ON_F_2929\ControlSet001\Services\YahooAUService ("C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe") -> Found
    [PUP] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Privacy Content Firewall ("C:\Program Files\AdTrustMedia\PrivDog\3.0.97.0\PrivDogService.exe") -> Found
    [PUM.Proxy] HKEY_USERS\RK_m_ON_F_D0D0\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
    [PUM.Proxy] HKEY_USERS\RK_K_ON_F_0BFA\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=;ftp=;https=; -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 194.168.4.100 194.168.8.100 ([-][X]) -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 194.168.4.100 194.168.8.100 ([-][X]) -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6526F4AF-2682-4DA1-A996-44C2CC3DA0B6} | DhcpNameServer : 194.168.4.100 194.168.8.100 ([-][X]) -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{70C2F4ED-25C2-496E-B381-4222D511273F} | DhcpNameServer : 10.211.254.254 8.8.8.8 ([X][-]) -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BE8BAB0A-A427-4D7A-99F9-C5BA65B9CB7E} | DhcpNameServer : 194.168.4.100 194.168.8.100 ([-][X]) -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{6526F4AF-2682-4DA1-A996-44C2CC3DA0B6} | DhcpNameServer : 194.168.4.100 194.168.8.100 ([-][X]) -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{BE8BAB0A-A427-4D7A-99F9-C5BA65B9CB7E} | DhcpNameServer : 194.168.4.100 194.168.8.100 ([-][X]) -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{70C2F4ED-25C2-496E-B381-4222D511273F} | DhcpNameServer : 10.211.254.254 8.8.8.8 ([X][-]) -> Found
    [PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{BE8BAB0A-A427-4D7A-99F9-C5BA65B9CB7E} | DhcpNameServer : 194.168.4.100 194.168.8.100 ([-][X]) -> Found
    [PUM.StartMenu] HKEY_USERS\S-1-5-21-329068152-1035525444-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Found

    ¤¤¤ Tasks : 1 ¤¤¤
    [Suspicious.Path] %WINDIR%\Tasks\Microsoft Antimalware Scheduled Scan.job -- C:\Program Files\Microsoft Security Client\MpCmdRun.exe (Scan -ScheduleJob -RestrictPrivileges) -> Found

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 [Too big!] ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0x2]) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: +++++
    --- User ---
    [MBR] d46d6c24cca3a4532cf172adc9316a98
    [BSP] 8cea78d13f2fe5d43bc9c69ae52cbc76 : Windows XP|VT.Unknown MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 78520 MB [Windows XP Bootstrap | Windows XP Bootloader]
    User = LL1 ... OK
    Error reading LL2 MBR! NOT VALID!

    +++++ PhysicalDrive1: +++++
    --- User ---
    [MBR] 22bd0667d6a512550b16546d3f320bd3
    [BSP] 5b42909a6365ad0299117b4dce297812 : Windows XP|VT.Unknown MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 238409 MB [Windows XP Bootstrap | Windows XP Bootloader]
    User = LL1 ... OK
    Error reading LL2 MBR! NOT VALID!

    +++++ PhysicalDrive2: +++++
    --- User ---
    [MBR] ae712d838f33e4ac8b1415573649d583
    [BSP] e6d9e6a3536eb7e98f2278b71870104f : Windows XP|VT.Unknown MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 715404 MB [Windows XP Bootstrap | Windows XP Bootloader]
    User = LL1 ... OK
    Error reading LL2 MBR! NOT VALID!
     
  7. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    Just go on...
     
  8. curleww

    curleww TS Rookie Topic Starter Posts: 37

    Not sure if that means to delete all rogue killer files or to go on to malware bytes ?
     
  9. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    In RK you only do what my instructions say:

    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.







     
  10. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    You don't go through tabs or do any other changes manually.
     
  11. curleww

    curleww TS Rookie Topic Starter Posts: 37

    Ok have run adw and jrt
    ater running adw computer wouldnt boot to safe mode ( blue stop screen ), eventually ater a few attempts and booting to last good config it then booted back in safe mode.

    same thing happened after 2nd run of adw
    I have run adw twice as I couldnt find the log file, I have included both logs


    # AdwCleaner v5.006 - Logfile created 07/09/2015 at 20:57:45
    # Updated 06/09/2015 by Xplode
    # Database : 2015-09-04.4 [Server]
    # Operating system : Microsoft Windows XP Service Pack 3 (x86)
    # Username : m - 5F5A4C13557347C
    # Running from : F:\Downloads\adwcleaner_5.006.exe
    # Option : Cleaning
    # Support : http://toolslib.net/forum

    ***** [ Services ] *****

    [-] Service Deleted : YahooAUService

    ***** [ Folders ] *****

    [-] Folder Deleted : C:\Documents and Settings\m\Local Settings\Application Data\slimware utilities inc

    ***** [ Files ] *****


    ***** [ Shortcuts ] *****


    ***** [ Scheduled tasks ] *****


    ***** [ Registry ] *****

    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC}
    [-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}
    [-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
    [-] Key Deleted : HKU\.DEFAULT\Software\ExpatShield
    [-] Key Deleted : HKCU\Software\SlimWare Utilities Inc
    [-] Key Deleted : HKLM\SOFTWARE\SlimWare Utilities Inc
    [-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}
    [!] Key Not Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}
    [!] Key Not Deleted : HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}

    ***** [ Web browsers ] *****

    [-] [C:\Documents and Settings\m\Application Data\mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._b7Members_.lastActivePing", "1439216747280");
    [-] [C:\Documents and Settings\m\Application Data\mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "mytransitguide@mindspark.com");
    [-] [C:\Documents and Settings\m\Application Data\mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\prefs.js] [Preference] Deleted : user_pref("extensions.trusted-ads.TrustAd", "{\"r\":[{\"t\":\"FQDN\",\"r\":\"trustedads.adtrustmedia.com\",\"c\":[{\"I\":\"1\",\"s\":[\"akimu.bigpoint.com\",\"cshoppingbox.partner.leguide.com\",\"eas.[...]
    [-] [C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : uk.ask.com
    [-] [C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : trovi.search
    [-] [C:\Documents and Settings\m\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Web Data] [Search Provider] Deleted : uk.ask.com
    [-] [C:\Documents and Settings\m\Local Settings\Application Data\Comodo\Chromodo\User Data\Default\Web Data] [Search Provider] Deleted : uk.ask.com

    *************************

    :: Winsock settings cleared

    ########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [3567 bytes] ##########

    -----------------------------------------------------------------------------------------xxxxxxxx--------------------------------

    # AdwCleaner v5.006 - Logfile created 08/09/2015 at 20:56:00
    # Updated 06/09/2015 by Xplode
    # Database : 2015-09-07.1 [Server]
    # Operating system : Microsoft Windows XP Service Pack 3 (x86)
    # Username : m - 5F5A4C13557347C
    # Running from : F:\Downloads\adwcleaner_5.006.exe
    # Option : Cleaning
    # Support : http://toolslib.net/forum

    ***** [ Services ] *****

    [-] Service Deleted : YahooAUService

    ***** [ Folders ] *****

    [-] Folder Deleted : C:\Documents and Settings\m\Application Data\Yahoo!\Companion
    [-] Folder Deleted : C:\Program Files\Yahoo!\Companion

    ***** [ Files ] *****


    ***** [ Shortcuts ] *****


    ***** [ Scheduled tasks ] *****


    ***** [ Registry ] *****

    [-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
    [-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC}
    [-] Key Deleted : HKU\.DEFAULT\Software\Yahoo\Companion
    [-] Key Deleted : HKCU\Software\Yahoo\Companion
    [-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar
    [-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion

    ***** [ Web browsers ] *****

    [-] [C:\Documents and Settings\m\Application Data\mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "mytransitguide@mindspark.com");
    [-] [C:\Documents and Settings\m\Application Data\mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\prefs.js] [Preference] Deleted : user_pref("extensions.trusted-ads.TrustAd", "{\"r\":[{\"t\":\"FQDN\",\"r\":\"trustedads.adtrustmedia.com\",\"c\":[{\"I\":\"1\",\"s\":[\"akimu.bigpoint.com\",\"cshoppingbox.partner.leguide.com\",\"eas.[...]

    *************************

    :: Winsock settings cleared

    ########## EOF - C:\AdwCleaner\AdwCleaner[C4].txt - [2351 bytes] ##########

    -------------------------------------------------------------------------------------xxxxxxx----------------------------------------------------



    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 7.6.0 (08.31.2015:1)
    OS: Microsoft Windows XP x86
    Ran by m on 08/09/2015 at 23:46:33.79
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services

    Successfully deleted: [Service] yahooauservice [Reboot required]



    ~~~ Tasks

    Successfully deleted: [Task] C:\WINDOWS\Tasks\PCSpeedClean_Popup.job
    Successfully deleted: [Task] C:\WINDOWS\Tasks\SlimDrivers Scan.job



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC}
    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{38B937B1-8E9F-1D14-4BEF-6D295A099F9E}
    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{91D2D5A9-6A52-ECC0-4415-63DC5BBEA4C4}
    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211181106}
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC}



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] C:\Documents and Settings\m\Application Data\fixcleaner
    Successfully deleted: [Folder] C:\Documents and Settings\m\Application Data\imvuclient
    Successfully deleted: [Folder] C:\Program Files\fixcleaner
    Successfully deleted: [Folder] C:\WINDOWS\System32\ai_recyclebin



    ~~~ FireFox

    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@alibaba.com/nptrademanager;version=1.0
    Emptied folder: C:\Documents and Settings\m\Application Data\mozilla\firefox\profiles\k9aa9uzg.default-1386241888593\minidumps [3 files]



    ~~~ Chrome


    [C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences] - default search provider reset

    [C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

    [C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

    [C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
    []





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on 08/09/2015 at 23:51:46.18
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  12. curleww

    curleww TS Rookie Topic Starter Posts: 37

    Malwarebytes returned nothing found
     
  13. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  14. curleww

    curleww TS Rookie Topic Starter Posts: 37

    combofix wants microsoft essentials to be disabled but I cant locate where its hiding, any ideas ,I will uninstall it when found (and after all is done here ) has its no longer supported
     
  15. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    Click on this link to see a list of programs that should be disabled
     
  16. curleww

    curleww TS Rookie Topic Starter Posts: 37

    I have no system tray or any trace of MSE but comboix still says to disable it.

    I can only run with an internet connection in safe mode, the MS remove tool only works in normal mode
    but then combofix cant update or install the MS recovery console has I then have no internet connection

    hope im making sense here
     
  17. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    It looks like MSE is just some registry leftover so you can disregard Combofix warning regarding MSE.

    Why?
     
  18. curleww

    curleww TS Rookie Topic Starter Posts: 37

    ComboFix 15-09-07.01 - m 11/09/2015 23:02:10.2.1 - x86 NETWORK
    Running from: c:\documents and settings\m\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    AV: ZoneAlarm Antivirus *Disabled/Outdated* {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\All Users\Application Data\TEMP
    c:\documents and settings\m\Application Data\Windir
    c:\documents and settings\m\Local Settings\Application Data\assembly\tmp
    c:\documents and settings\m\WINDOWS
    C:\Microsoft
    c:\windows\tmp
    c:\windows\tmp\DEFAULT
    c:\windows\tmp\SAM
    c:\windows\tmp\SECURITY
    c:\windows\tmp\SOFTWARE
    c:\windows\tmp\SYSTEM
    .
    .
    ((((((((((((((((((((((((( Files Created from 2015-08-11 to 2015-09-11 )))))))))))))))))))))))))))))))
    .
    .
    2015-09-10 18:46 . 2015-09-10 18:46 16280 ----a-w- C:\FixitRegBackup.reg
    2015-09-04 22:43 . 2015-09-05 10:30 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2015-09-04 22:43 . 2015-09-05 10:30 -------- d-----w- c:\documents and settings\All Users\Application Data\RogueKiller
    2015-09-02 23:25 . 2015-09-02 23:31 -------- d-----w- C:\FRST
    2015-08-30 21:11 . 2015-08-30 21:11 -------- d-----w- c:\program files\Avira
    2015-08-30 21:11 . 2015-08-30 21:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
    2015-08-28 23:19 . 2015-09-01 22:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Package Cache
    2015-08-24 18:22 . 2015-08-24 18:22 302760 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    11747-11-13 19:58 . 2011-08-24 04:53 -------- d-sh--w- c:\windows\xxclone.arc
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2015-09-07 13:17 . 2014-06-25 02:26 98520 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2015-08-28 20:53 . 2012-04-17 12:54 778440 -c--a-w- c:\windows\system32\FlashPlayerApp.exe
    2015-08-28 20:53 . 2011-05-20 00:22 142536 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2015-08-16 23:00 . 2015-08-02 23:01 35992 ----a-w- c:\windows\system32\drivers\hitmanpro37.sys
    2015-08-10 13:46 . 2012-08-06 21:32 142056 -c--a-w- c:\windows\system32\vpncmd.exe
    2015-08-05 00:30 . 2015-08-05 00:30 105664 ----a-w- c:\windows\system32\drivers\inspect.sys
    2015-08-05 00:30 . 2015-08-05 00:30 30144 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
    2015-08-05 00:30 . 2015-08-05 00:30 631872 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
    2015-08-05 00:30 . 2015-08-05 00:30 15808 ----a-w- c:\windows\system32\drivers\cmderd.sys
    2015-08-05 00:29 . 2015-08-05 00:29 33496 ----a-w- c:\windows\system32\cmdcsr.dll
    2015-08-05 00:29 . 2015-08-05 00:29 445472 ----a-w- c:\windows\system32\guard32.dll
    2015-08-05 00:27 . 2015-08-05 00:27 288448 ----a-w- c:\windows\system32\cmdvrt32.dll
    2015-08-05 00:26 . 2015-08-05 00:26 40640 ----a-w- c:\windows\system32\cmdkbd32.dll
    2015-06-18 07:41 . 2014-06-25 01:37 121560 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2015-06-18 07:41 . 2013-05-27 21:23 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "Creative MediaSource Go"="c:\program files\Creative\MediaSource\Go\CTCMSGo.exe" [2002-11-25 126976]
    "Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2012-05-25 6595928]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTSysVol"="c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 49152]
    "AsioReg"="CTASIO.DLL" [2003-02-20 110592]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
    "CTHelper"="CTHELPER.EXE" [2003-02-20 28672]
    "VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736]
    "tvncontrol"="c:\program files\Common Files\Comodo\tvnserver.exe" [2012-01-27 828944]
    "ScanSoft OmniPage SE 4.0-reminder"="c:\program files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" [2006-09-26 1410600]
    "SoftEther VPN Client UI Helper"="c:\program files\SoftEther VPN Client\vpnclient.exe" [2015-08-10 3941096]
    "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
    "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2006-10-26 132704]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2013-01-17 267792]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2015-04-18 335232]
    "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2015-08-05 1361088]
    "Avira SystrayStartTrigger"="c:\program files\Avira\Launcher\Avira.SystrayStartTrigger.exe" [2015-08-13 66936]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-12-20 519584]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2008-04-14 53760]
    .
    c:\documents and settings\m\Start Menu\Programs\StartUp\
    Serviio.lnk - c:\program files\Serviio\bin\ServiioConsole.exe [2013-8-8 610304]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    SoftEther VPN Client Manager Startup.lnk - c:\program files\SoftEther VPN Client\vpncmgr.exe /startup [2014-3-22 4131560]
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoThumbnailCache"= 0 (0x0)
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "CGVPNCliService"=2 (0x2)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
    "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Belkin\\Belkin USB Print and Storage Center\\Connect.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
    "c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=
    "c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
    "c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=
    "c:\\Program Files\\Common Files\\Comodo\\tvnserver.exe"=
    "c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
    "c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
    "c:\\Program Files\\Serviio\\bin\\ServiioConsole.exe"=
    "c:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"=
    "e:\program files\Microsoft ActiveSync\rapimgr.exe"= e:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    "e:\program files\Microsoft ActiveSync\wcescomm.exe"= e:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "e:\program files\Microsoft ActiveSync\WCESMgr.exe"= e:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "c:\\WINDOWS\\system32\\mmc.exe"=
    "c:\\Documents and Settings\\m\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=
    "c:\\Documents and Settings\\K\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\SoftEther VPN Client\\vpncmgr.exe"=
    "c:\\Program Files\\SoftEther VPN Client\\vpnclient.exe"=
    "c:\\Program Files\\SoftEther VPN Client\\vpncmd.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "19540:UDP"= 19540:UDP:SXUPTP
    "443:UDP"= 443:UDP:*:Disabled:eek:oVoo UDP port 443
    "37674:TCP"= 37674:TCP:*:Disabled:eek:oVoo TCP port 37674
    "37674:UDP"= 37674:UDP:*:Disabled:eek:oVoo UDP port 37674
    "37675:UDP"= 37675:UDP:*:Disabled:eek:oVoo UDP port 37675
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 0 (0x0)
    .
    R1 CFRMD;CFRMD; [x]
    R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2015-08-05 631872]
    R1 SASDIFSV;SASDIFSV; [x]
    R1 SASKUTIL;SASKUTIL; [x]
    R1 vcdrom;Virtual CD-ROM Device Driver; [x]
    R2 Avira.ServiceHost;Avira Service Host;c:\program files\Avira\Launcher\Avira.ServiceHost.exe [2015-08-13 228104]
    R2 Belkin Local Backup Service;Belkin Local Backup Service;c:\program files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [2010-02-17 152064]
    R2 Belkin Network USB Helper;Belkin Network USB Helper;c:\program files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [2010-02-09 49152]
    R2 ChromodoUpdater;COMODO Chromodo Update Service;c:\program files\Comodo\Chromodo\chromodo_updater.exe [2015-08-19 1998520]
    R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-07-09 20328]
    R2 DragonUpdater;COMODO Dragon Update Service;c:\program files\Comodo\Dragon\dragon_updater.exe [2015-06-26 1994936]
    R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [2011-11-09 132768]
    R2 Serviio;Serviio;c:\program files\Serviio\bin\ServiioService.exe [2013-08-07 327680]
    R2 SEVPNCLIENT;SoftEther VPN Client;c:\program files\SoftEther VPN Client\vpnclient.exe [2015-08-10 3941096]
    R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-02-18 315488]
    R2 vpnclient;PacketiX VPN Client; [x]
    R3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\DRIVERS\BLKWGDv7.sys [2006-10-19 303616]
    R3 Blackberry Device Manager;Blackberry Device Manager;c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2013-01-18 577536]
    R3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [2015-08-05 1664704]
    R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys [2015-08-16 35992]
    R3 KOT;KOT; [x]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-09-07 98520]
    R3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10.sys [2011-02-10 51968]
    R3 SEE;SoftEther Ethernet Layer Driver;c:\windows\system32\drivers\see.sys [2014-01-08 43104]
    R3 SjyPkt;SjyPkt; [x]
    R3 sxuptp;SXUPTP Driver;c:\windows\system32\DRIVERS\sxuptp.sys [2009-06-22 246936]
    R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [2011-08-18 26112]
    R3 USTORAGE;UMass Storage Device;c:\windows\system32\DRIVERS\UStorage.sys [2009-04-14 31104]
    S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [2015-08-05 15808]
    S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2015-08-05 30144]
    S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2012-01-09 11352]
    S2 CLPSLauncher;COMODO LPS Launcher;c:\program files\Common Files\Comodo\launcher_service.exe [2012-08-23 70352]
    S2 tvnserver;TightVNC Server;c:\program files\Common Files\Comodo\tvnserver.exe [2012-01-27 828944]
    S3 Neo_vpn jp;VPN Client Device Driver - vpn jp;c:\windows\system32\DRIVERS\Neo_0029.sys [2012-08-07 22000]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2015-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 20:53]
    .
    2015-09-10 c:\windows\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
    - c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05 00:24]
    .
    2015-08-30 c:\windows\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
    - c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05 00:24]
    .
    2015-09-03 c:\windows\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
    - c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05 00:24]
    .
    2015-09-03 c:\windows\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
    - c:\program files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-05 00:24]
    .
    2015-09-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003Core.job
    - c:\documents and settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-09-28 20:33]
    .
    2015-09-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003UA.job
    - c:\documents and settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-09-28 20:33]
    .
    2015-09-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005Core.job
    - c:\documents and settings\K\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-01 10:59]
    .
    2015-09-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005UA.job
    - c:\documents and settings\K\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-01 10:59]
    .
    2015-09-10 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Logon.job
    - c:\windows\system32\xp_eos.exe [2014-03-09 01:59]
    .
    2015-08-08 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
    - c:\windows\system32\xp_eos.exe [2014-03-09 01:59]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Connection Wizard,ShellNext = hxxp://www.reimage.com/damage_caused_by_viruses.php
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
    IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
    IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\m\Start Menu\Programs\IMVU\Run IMVU.lnk
    TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
    FF - ProfilePath - c:\documents and settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2015-09-11 23:13
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-329068152-1035525444-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{2E8B329A-B67F-9B93-CE97-F9D9D740A288}*]
    "maobdknegdfgdccpjfckpdpcdj"=hex:6f,61,6e,68,67,62,6d,6a,69,64,66,67,6d,66,65,
    67,67,6c,70,63,6d,6a,61,6e,61,69,6d,67,69,66,00,6d
    "abnbalpcdlfchpjbiaockdephgnfkepmki"=hex:70,61,64,63,67,6a,6f,63,61,62,69,6f,
    64,70,66,70,6e,62,6f,6d,6e,62,6e,64,68,70,6e,65,6b,68,68,6d,00,40
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_232_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\COMODO\CIS\Data]
    "PaarEvent"=dword:00000001
    "LatestInstallation"=hex(b):95,59,b5,4f,00,00,00,00
    "Timestamp.{1861B42B-B05F-47B8-8566-BEE85A4D4FDC}"=hex(b):09,e0,c7,55,00,00,00,
    00
    "Timestamp.{B7F04E87-441A-4F26-BE21-C4339F539F87}"=hex(b):ad,bb,c7,55,00,00,00,
    00
    "CFPFSM"=dword:00000001
    "Timestamp.{B4865C2A-9D0E-423B-8DA7-087F623C4B4F}"=hex(b):ba,68,e3,55,00,00,00,
    00
    "Timestamp.{0D85521A-A20D-44D9-8380-EFB7C9BE423B}"=hex(b):ba,68,e3,55,00,00,00,
    00
    "Timestamp.{40210ABD-EB84-4326-AEF8-709448FA2BAE}"=hex(b):51,be,18,54,00,00,00,
    00
    "Timestamp.{77261D84-1F4B-4BCD-9CCC-AEAEE39596D7}"=hex(b):46,f0,ae,52,00,00,00,
    00
    "Timestamp.{84BA2452-41F4-470F-87E7-D5FA10F8956A}"=hex(b):49,be,18,54,00,00,00,
    00
    "Timestamp.{67CE8C55-02C1-4517-99F0-282BE2734181}"=hex(b):ba,68,e3,55,00,00,00,
    00
    "LastAvDetection"=hex(b):f0,e9,2e,53,00,00,00,00
    "RealTimeLastShowGeekBuddyOffer"=hex(b):04,ea,2e,53,00,00,00,00
    "Timestamp.{ABB45338-2428-46D5-BCA1-F907810012C7}"=hex(b):ba,68,e3,55,00,00,00,
    00
    "Timestamp.{BEBAFD97-F7E0-43C2-A7DF-0D1B5EE26620}"=hex(b):09,e0,c7,55,00,00,00,
    00
    "Timestamp.{DF77CAAC-D06C-4649-96B0-A6733E364723}"=hex(b):ba,68,e3,55,00,00,00,
    00
    "Timestamp.{9963D9E4-67D9-45DC-BC94-05BE99174D35}"=hex(b):5a,62,e3,55,00,00,00,
    00
    "Timestamp.{6AA9E24E-269F-4675-AE6A-67DF4BEE0E9E}"=hex(b):69,2c,38,52,00,00,00,
    00
    "CreateSymlinks"=dword:00000000
    "Timestamp.{AF858DA4-6F8E-4298-84E2-AB5DBB7741DB}"=hex(b):ba,68,e3,55,00,00,00,
    00
    "AvDbVersion"=dword:0000598b
    "AvDbUpdateDate"=hex(b):32,d9,bf,55,00,00,00,00
    "Bin update offered pdbsm"=dword:00000001
    "DisableCopyDefRecognizer"=dword:00000001
    "AvDbSigcount"=dword:02867c42
    "AvDbVersionTrustPurge"=dword:0000598b
    "AvDbVersionBoostPurge"=dword:0000598b
    "AgentStartTime.{42B27E2F-AAF4-443C-894C-0F079863C909}"=hex(b):d6,9c,b6,55,00,
    00,00,00
    "AvDbCheckDate"=hex(b):32,d9,bf,55,00,00,00,00
    "UrlDbVersion"=dword:000000b7
    "UpdateCondition.{54523EA7-7A82-43D5-A3E6-075A8A3926BE}"=dword:00000001
    "UpdateCondition.{36C87763-EED6-4E36-B2F5-FAD61CBDA924}"=dword:00000001
    "UpdateBin.{A6D52E4F-569B-4756-B3D8-DF217313DA85}"=hex(b):5f,aa,b6,55,00,00,00,
    00
    "Scan.{DBB22600-F6F5-41E4-866D-B11CBC208853}"=hex(b):ff,eb,4b,53,00,00,00,00
    "UpdateBin.{0E9B65E7-29F3-4520-A8EC-2DDEF68A1170}"=hex(b):15,d8,d3,54,00,00,00,
    00
    "UpdateBin.{04B31D06-88FC-45A8-81FC-0CE6E5E95960}"=hex(b):f6,d8,d3,54,00,00,00,
    00
    "Scan.{F140D794-60B6-4F00-9235-D6457AA25B22}"=hex(b):43,39,b7,55,00,00,00,00
    "FullScan.{F140D794-60B6-4F00-9235-D6457AA25B22}"=hex(b):43,39,b7,55,00,00,00,
    00
    "PreviousAvMode"=dword:00000003
    "SwitchOn.{E739B5BC-AD9F-4758-9567-A21B396737F1}"=hex(b):00,00,00,00,00,00,00,
    00
    "PreviousDfMode"=dword:00010000
    "SwitchOn.{8F5CCB37-64DD-423E-AEE4-3E7B3D162E32}"=hex(b):00,00,00,00,00,00,00,
    00
    "PreviousFwMode"=dword:00000008
    "SwitchOn.{F4C59B28-6A03-4BED-9E60-4BCFBD037303}"=hex(b):00,00,00,00,00,00,00,
    00
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
    "UpdateCondition.{904AF1EE-D41F-4ADF-90EA-15285FF2CAE9}"=dword:00000001
    "Bin update offered pdbm"=dword:00000001
    "Rcg.{E7EFFE86-07B1-4148-AE27-C8CF133A36C1}"=hex(b):00,00,00,00,00,00,00,00
    "Scan.{21E3884B-3682-4581-9128-EA1225FA023D}"=hex(b):b1,0d,bc,55,00,00,00,00
    "AllowedDowngrade"=dword:00000001
    "OS driver inspect"=dword:00000001
    "OS driver cmderd"=dword:00000001
    "PaarEventIS"=dword:00000001
    "PaarEventIE"=dword:00000001
    "OS driver cmdhlp"=dword:00000001
    "OS driver cmdguard"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\COMODO\CIS\Installer\Sym_Cam\CIS]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
    .
    [HKEY_LOCAL_MACHINE\software\COMODO\CIS\Options]
    "Partner"="Comodo"
    "InstallerName"="cispremiuminstallerx86"
    "LanguageName"="English (United States)"
    "UpdateURL"="http://download.comodo.com/"
    "LanguageID"=dword:00000409
    "UserEmail"=""
    "Activation Servers state"=dword:00000013
    "UpdateURLS"=multi:"http://download.comodo.com/\00\00"
    "CmcHost"="cmc.comodo.com"
    "UsageStatHost"="cmc.comodo.com"
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
    "ThemeName"="modern.set"
    "UrlsUpdateHost"="download.comodo.com"
    .
    [HKEY_LOCAL_MACHINE\System\ControlSet006\Services\CmdAgent\Mode\Configurations]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
    .
    [HKEY_LOCAL_MACHINE\System\ControlSet006\Services\CmdAgent\Mode\Data]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
    .
    [HKEY_LOCAL_MACHINE\System\ControlSet006\Services\CmdAgent\Mode\Options]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
    .
    [HKEY_LOCAL_MACHINE\System\Software\COMODO\Cam]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
    .
    [HKEY_LOCAL_MACHINE\System\Software\COMODO\Firewall Pro]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
    .
    Completion time: 2015-09-11 23:17:24
    ComboFix-quarantined-files.txt 2015-09-11 22:17
    ComboFix2.txt 2015-09-10 20:13
    .
    Pre-Run: 9,787,445,248 bytes free
    Post-Run: 9,743,458,304 bytes free
    .
    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /bootlog
    multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="XXCLONE: (Target Volume) [d:1,p:1] \WINDOWS" /fastdetect /NoExecute=OptIn
    .
    - - End Of File - - A154DC876B50EF55B640A101E3AD43CB
    8F558EB6672622401DA993E1E865C861
     
  19. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    You didn't answer my question.
    What's wrong with normal mode?

    Also...are you familiar with xxclone?
     
  20. curleww

    curleww TS Rookie Topic Starter Posts: 37

    Sorry I didnt see your question,
    since the outset I have been unable to get an internet connection in normal mode, thats one of the reasons I was suspecting malware, I get limited or no connection and nothing I have tried over several days as fixed it

    xclone on here is actually no longer active and has been that way for some time, guess I really should remove it
     
  21. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    I'm assuming ZoneAlarm is your antivirus and a firewall?

    If so....

    In your list of installed programs I can also see:

    Avira Launcher (2 instances)
    Comodo Internet Security


    You must uninstall those.

    Also, disable "word wrap" in Notepad because your logs are harder to read.
     
  22. curleww

    curleww TS Rookie Topic Starter Posts: 37

    I was using zone alarm ages ago has AV and firewall ,I changd to comodo for AV
    its comodo that has stopped working since this problem .

    I tried avira to see if it would work but that also will not run, hitman pro had also been having problems it would launch and terminate within a minute or so

    word wrap in notepad is already unticked !

    im still having issues getting the letter f to type and the letter v but v does sometimes work or may do after holding or pressing key a few times,its more an issue in upper case ,
    f im still copy and pasting it

    I dont think its a keyboard issue but I will again try the keyboard on another machine tomorrow
     
  23. Broni

    Broni Malware Annihilator Posts: 52,911   +344

    Does your Comodo include firewall as well?

    Uninstall two instances of Avira Launcher then.

    Next...

    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
  24. curleww

    curleww TS Rookie Topic Starter Posts: 37

    I believe comodo was running Av and firewall, I can find no trace in add/ remove programs of zonealarm ? not sure what security essentials is named under in add/ remove.

    avira only one instance of that was in add/remove and it proved diicult to remove eventually removed it with "your uninstaller"
    keyboard has typed here v V and f F but they are still temperamental

    Farbar and additions text below

    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:13-09-2015 02
    Ran by m (administrator) on 5F5A4C13557347C (13-09-2015 23:56:25)
    Running from F:\Downloads
    Loaded Profiles: m (Available Profiles: m & K & UpdatusUser & Administrator)
    Platform: Microsoft Windows XP Service Pack 3 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Comodo Security Solutions Inc.) C:\Program Files\Common Files\Comodo\launcher_service.exe
    (GlavSoft LLC.) C:\Program Files\Common Files\Comodo\tvnserver.exe
    (Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [CTSysVol] => C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe [49152 2002-10-29] (Creative Technology Ltd)
    HKLM\...\Run: [AsioReg] => REGSVR32.EXE /S CTASIO.DLL
    HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
    HKLM\...\Run: [CTHelper] => C:\WINDOWS\system32\CTHELPER.EXE [28672 2003-02-20] (Creative Technology Ltd)
    HKLM\...\Run: [VX3000] => C:\WINDOWS\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
    HKLM\...\Run: [tvncontrol] => C:\Program Files\Common Files\Comodo\tvnserver.exe [828944 2012-01-27] (GlavSoft LLC.)
    HKLM\...\Run: [ScanSoft OmniPage SE 4.0-reminder] => C:\Program Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe [1410600 2006-09-26] (Nuance Communications, Inc.)
    HKLM\...\Run: [SoftEther VPN Client UI Helper] => C:\Program Files\SoftEther VPN Client\vpnclient.exe [3941096 2015-08-10] (SoftEther VPN Project at University of Tsukuba, Japan.)
    HKLM\...\Run: [NeroCheck] => C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
    HKLM\...\Run: [LifeCam] => C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
    HKLM\...\Run: [IJNetworkScanUtility] => C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [132704 2006-10-26] (CANON INC.)
    HKLM\...\Run: [ehTray] => C:\WINDOWS\ehome\ehtray.exe [64512 2005-08-05] (Microsoft Corporation)
    HKLM\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [335232 2015-04-18] (Oracle Corporation)
    HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1361088 2015-08-05] (COMODO)
    HKLM\...\Run: [Avira SystrayStartTrigger] => C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe
    HKLM\...\Policies\Explorer: [NoSharedDocuments] 0
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Run: [SpybotSD TeaTimer] => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Run: [Creative MediaSource Go] => C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe [126976 2002-11-25] (Creative Technology Ltd)
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Run: [Messenger (Yahoo!)] => C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
    HKU\S-1-5-18\...\Run: [DWQueuedReporting] => C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [519584 2010-12-21] (Microsoft Corporation)
    HKU\S-1-5-18\...\RunOnce: [RunNarrator] => C:\WINDOWS\system32\Narrator.exe [53760 2008-04-14] (Microsoft Corporation)
    ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
    Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SoftEther VPN Client Manager Startup.lnk [2014-03-22]
    ShortcutTarget: SoftEther VPN Client Manager Startup.lnk -> C:\Program Files\SoftEther VPN Client\vpncmgr.exe (SoftEther VPN Project at University of Tsukuba, Japan.)
    Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk [2014-03-09]
    ShortcutTarget: Windows Search.lnk -> C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
    Startup: C:\Documents and Settings\m\Start Menu\Programs\StartUp\Serviio.lnk [2015-07-29]
    ShortcutTarget: Serviio.lnk -> C:\Program Files\Serviio\bin\ServiioConsole.exe ()

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 194.168.4.100 194.168.8.100
    Tcpip\..\Interfaces\{6526F4AF-2682-4DA1-A996-44C2CC3DA0B6}: [DhcpNameServer] 194.168.4.100 194.168.8.100
    Tcpip\..\Interfaces\{70C2F4ED-25C2-496E-B381-4222D511273F}: [DhcpNameServer] 10.211.254.254 8.8.8.8
    Tcpip\..\Interfaces\{BE8BAB0A-A427-4D7A-99F9-C5BA65B9CB7E}: [DhcpNameServer] 194.168.4.100 194.168.8.100

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-329068152-1035525444-725345543-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files\TechSmith\Snagit 10\SnagitBHO.dll [2010-04-13] (TechSmith Corporation)
    BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
    BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
    BHO: EWPBrowseObject Class -> {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} -> C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-06-09] ()
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-18] (Oracle Corporation)
    BHO: No Name -> {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} -> No File
    BHO: No Name -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> No File
    BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-18] (Oracle Corporation)
    Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 10\SnagitIEAddin.dll [2010-04-13] (TechSmith Corporation)
    Toolbar: HKU\S-1-5-21-329068152-1035525444-725345543-1003 -> No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
    DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_60-windows-i586.cab
    DPF: {CAFEEFAC-0017-0000-0060-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_60-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_60-windows-i586.cab
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll [2012-11-08] (Belarc, Inc.)
    Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File
    Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File
    Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - No File

    FireFox:
    ========
    FF ProfilePath: C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-28] ()
    FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-18] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-18] (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [2010-06-01] (Yahoo! Inc.)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2012-12-13] ()
    FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-329068152-1035525444-725345543-1003: @citrixonline.com/appdetectorplugin -> C:\Documents and Settings\m\Local Settings\Application Data\Citrix\Plugins\94\npappdetector.dll [2013-02-21] (Citrix Online)
    FF Plugin HKU\S-1-5-21-329068152-1035525444-725345543-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-30] (Google Inc.)
    FF Plugin HKU\S-1-5-21-329068152-1035525444-725345543-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-30] (Google Inc.)
    FF Extension: RAMBack - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\Extensions\ramback@pavlov.net.xpi [2014-07-19]
    FF Extension: NoScript - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-05-27]
    FF Extension: Adblock Plus - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\k9aa9uzg.default-1386241888593\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-12-06]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-10-13]

    Chrome:
    =======
    CHR Profile: C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default
    CHR Extension: (Chrome Hotword Shared Module) - C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-29]
    CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-29]
    StartMenuInternet: Google Chrome - C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S2 AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [569752 2010-07-28] (Affinegy, Inc.)
    S2 Belkin Local Backup Service; C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [152064 2010-02-17] () [File not signed]
    S2 Belkin Network USB Helper; C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [49152 2010-02-09] () [File not signed]
    S3 Blackberry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
    S2 ChromodoUpdater; C:\Program Files\Comodo\Chromodo\chromodo_updater.exe [1998520 2015-08-19] (Comodo)
    R2 CLPSLauncher; C:\Program Files\Common Files\Comodo\launcher_service.exe [70352 2012-08-23] (Comodo Security Solutions Inc.)
    S2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [4353840 2015-08-05] (COMODO)
    S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [1664704 2015-08-05] (COMODO)
    S2 Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [44032 1999-12-13] (Creative Technology Ltd) [File not signed]
    S2 DCSLoader; C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\OPHALDCS.EXE [24576 2004-03-02] (Oki Data Corporation)
    S2 DragonUpdater; C:\Program Files\Comodo\Dragon\dragon_updater.exe [1994936 2015-06-26] (Comodo)
    S2 Intel(R) PROSet Monitoring Service; C:\WINDOWS\system32\IProsetMonitor.exe [132768 2011-11-09] (Intel Corporation)
    S2 McrdSvc; C:\WINDOWS\ehome\mcrdsvc.exe [99328 2005-08-05] (Microsoft Corporation)
    S3 MHN; C:\WINDOWS\System32\mhn.dll [85504 2004-08-10] (Microsoft Corporation) [File not signed]
    S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)
    S2 SCWatch 4.0; C:\Program Files\WhiteCanyon\SecureClean 4\scwatch4.exe [364544 2007-05-17] (WhiteCanyon Inc.) [File not signed]
    S2 Serviio; C:\Program Files\Serviio\bin\ServiioService.exe [327680 2013-08-08] () [File not signed]
    S2 SEVPNCLIENT; C:\Program Files\SoftEther VPN Client\vpnclient.exe [3941096 2015-08-10] (SoftEther VPN Project at University of Tsukuba, Japan.)
    R2 tvnserver; C:\Program Files\Common Files\Comodo\tvnserver.exe [828944 2012-01-27] (GlavSoft LLC.)
    S2 WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [53520 2000-06-26] (Microsoft Corporation) [File not signed]
    S2 Avira.ServiceHost; "C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe" [X]
    S3 KOT; no ImagePath
    S2 vpnclient; no ImagePath
    S2 vsmon; C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe -service [X]

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [21035 2010-10-06] (Meetinghouse Data Communications) [File not signed]
    S3 AFGSp50; C:\WINDOWS\System32\Drivers\AFGSp50.sys [27072 2010-06-23] (Printing Communications Assoc., Inc. (PCAUSA))
    S3 AtlsAud; C:\WINDOWS\System32\drivers\AtlsAud.sys [21504 2002-12-03] (Dell Computer Corporation)
    S1 BANTExt; C:\WINDOWS\System32\Drivers\BANTExt.sys [3840 2011-06-03] () [File not signed]
    S3 Belkin700F; C:\WINDOWS\System32\DRIVERS\BLKWGDv7.sys [303616 2006-10-19] (Belkin Corporation. ) [File not signed]
    S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
    R1 Cdr4_xp; C:\WINDOWS\system32\Drivers\Cdr4_xp.sys [61424 2010-09-27] (Roxio) [File not signed]
    R1 Cdralw2k; C:\WINDOWS\system32\Drivers\Cdralw2k.sys [23420 2010-09-27] (Roxio) [File not signed]
    S0 cercsr6; C:\WINDOWS\system32\Drivers\cercsr6.sys [39904 2004-12-13] (Adaptec, Inc.) [File not signed]
    R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [15808 2015-08-05] (COMODO)
    S1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [631872 2015-08-05] (COMODO)
    R1 cmdHlp; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [30144 2015-08-05] (COMODO)
    S3 ctdvda2k; C:\WINDOWS\System32\drivers\ctdvda2k.sys [287920 2003-03-27] (Creative Technology Ltd)
    S3 EMATCORE; C:\WINDOWS\System32\Drivers\AtlsVid.sys [134304 2002-12-04] (Dell Computer Corporation)
    S3 ha10kx2k; C:\WINDOWS\System32\drivers\ha10kx2k.sys [823616 2003-03-26] (Creative Technology Ltd)
    S3 hap16v2k; C:\WINDOWS\System32\drivers\hap16v2k.sys [141536 2003-03-26] (Creative Technology Ltd)
    S3 hitmanpro37; C:\WINDOWS\system32\drivers\hitmanpro37.sys [35992 2015-08-17] ()
    R0 Inspect; C:\WINDOWS\System32\DRIVERS\inspect.sys [105664 2015-08-05] (COMODO)
    R0 KL1; C:\WINDOWS\System32\DRIVERS\kl1.sys [133208 2012-01-09] (Kaspersky Lab ZAO)
    R1 kl2; C:\WINDOWS\System32\DRIVERS\kl2.sys [11352 2012-01-09] (Kaspersky Lab ZAO)
    S1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [485808 2012-01-09] (Kaspersky Lab)
    S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [98520 2015-09-07] (Malwarebytes Corporation)
    S3 MHIKEY10; C:\WINDOWS\System32\Drivers\MHIKEY10.sys [51968 2011-02-10] (Generic USB smartcard reader)
    S3 MHNDRV; C:\WINDOWS\System32\DRIVERS\mhndrv.sys [11008 2004-08-10] (Microsoft Corporation) [File not signed]
    S0 MpFilter; C:\WINDOWS\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
    S3 NAL; C:\WINDOWS\system32\Drivers\iqvw32.sys [30368 2011-11-09] (Intel Corporation )
    S3 ndiscm; C:\WINDOWS\System32\DRIVERS\NetMotCM.sys [14336 2003-08-10] (Motorola Inc.)
    S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
    R3 Neo_vpn jp; C:\WINDOWS\System32\DRIVERS\Neo_0029.sys [22000 2012-08-07] (SoftEther Corporation)
    S1 OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [13632 2001-08-22] (Dell Computer Corporation) [File not signed]
    R3 pfc; C:\WINDOWS\System32\drivers\pfc.sys [9856 2002-11-11] (Padus, Inc.) [File not signed]
    S2 PfModNT; C:\WINDOWS\system32\drivers\PfModNT.sys [15840 2003-03-06] (Creative Technology Ltd.)
    R3 RTL8023xp; C:\WINDOWS\System32\DRIVERS\Rtnicxp.sys [118656 2009-02-25] (TRENDware International, Inc )
    S3 SEE; C:\WINDOWS\System32\drivers\see.sys [43104 2014-01-08] (SoftEther VPN Project at University of Tsukuba, Japan.)
    S3 sxuptp; C:\WINDOWS\System32\DRIVERS\sxuptp.sys [246936 2009-06-22] (silex technology, Inc.)
    S3 tap0901; C:\WINDOWS\System32\DRIVERS\tap0901.sys [35288 2013-08-22] (The OpenVPN Project)
    S3 taphss; C:\WINDOWS\System32\DRIVERS\taphss.sys [32768 2012-01-05] (AnchorFree Inc)
    S3 tapoas; C:\WINDOWS\System32\DRIVERS\tapoas.sys [26112 2011-08-19] (The OpenVPN Project) [File not signed]
    S3 USTORAGE; C:\WINDOWS\System32\DRIVERS\UStorage.sys [31104 2009-04-14] (USB Mass Storage.)
    R1 Vsdatant; C:\WINDOWS\System32\vsdatant.sys [526608 2012-05-03] (Check Point Software Technologies LTD)
    S3 AFGMp50; no ImagePath
    R3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S1 CFRMD; no ImagePath
    S3 cpuz132; no ImagePath
    U2 Irmon; no ImagePath
    S1 SASDIFSV; no ImagePath
    S1 SASKUTIL; no ImagePath
    U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
    S3 SjyPkt; no ImagePath
    U5 Tcpip6; C:\Windows\System32\Drivers\Tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)
    S1 vcdrom; no ImagePath
    S3 ZTEusbmdm6k; no ImagePath
    S3 ZTEusbnmea; no ImagePath
    S3 ZTEusbser6k; no ImagePath
    U3 mbr; \??\C:\ComboFix\mbr.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    NETSVC: MHN -> C:\Windows\System32\mhn.dll (Microsoft Corporation)

    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2099-11-13 20:58 - 2011-08-24 05:53 - 00000000 __SHD C:\WINDOWS\xxclone.arc
    2015-09-12 23:16 - 2015-09-12 23:16 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\TEMP
    2015-09-11 23:17 - 2015-09-13 23:57 - 00000000 ____D C:\Documents and Settings\m\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00024529 _____ C:\ComboFix.txt
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\UpdatusUser\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\M.5F5A4C13557347C\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\Default User\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\Administrator.5F5A4C13557347C\Local Settings\temp
    2015-09-11 23:17 - 2015-09-11 23:17 - 00000000 ____D C:\Documents and Settings\Administrator.5F5A4C13557347C.000\Local Settings\temp
    2015-09-11 22:57 - 2015-09-11 22:57 - 00000000 _RSHD C:\cmdcons
    2015-09-11 22:57 - 2015-07-29 21:02 - 00000338 _____ C:\Boot.bak
    2015-09-11 22:57 - 2004-08-03 23:00 - 00260272 __RSH C:\cmldr
    2015-09-10 20:18 - 2015-09-10 20:18 - 00000000 ____H C:\WINDOWS\system32\config\system.tmp.LOG
    2015-09-10 20:18 - 2015-09-10 20:18 - 00000000 ____H C:\WINDOWS\system32\config\software.tmp.LOG
    2015-09-10 20:18 - 2015-09-10 20:18 - 00000000 ____H C:\WINDOWS\system32\config\sam.tmp.LOG
    2015-09-10 20:18 - 2015-09-10 20:18 - 00000000 ____H C:\WINDOWS\system32\config\default.tmp.LOG
    2015-09-10 20:17 - 2015-09-10 20:17 - 00008192 ____H C:\WINDOWS\system32\config\security.tmp.LOG
    2015-09-10 19:47 - 2011-06-26 07:45 - 00256000 _____ C:\WINDOWS\PEV.exe
    2015-09-10 19:47 - 2010-11-07 18:20 - 00208896 _____ C:\WINDOWS\MBR.exe
    2015-09-10 19:47 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
    2015-09-10 19:47 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
    2015-09-10 19:47 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
    2015-09-10 19:47 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
    2015-09-10 19:47 - 2000-08-31 01:00 - 00098816 _____ C:\WINDOWS\sed.exe
    2015-09-10 19:47 - 2000-08-31 01:00 - 00080412 _____ C:\WINDOWS\grep.exe
    2015-09-10 19:47 - 2000-08-31 01:00 - 00068096 _____ C:\WINDOWS\zip.exe
    2015-09-10 19:46 - 2015-09-10 19:46 - 00016280 _____ C:\FixitRegBackup.reg
    2015-09-09 23:06 - 2015-09-09 23:11 - 05635119 ____R (Swearware) C:\Documents and Settings\m\Desktop\ComboFix.exe
    2015-09-08 23:51 - 2015-09-08 23:51 - 00002798 _____ C:\Documents and Settings\m\Desktop\JRT.txt
    2015-09-04 23:43 - 2015-09-05 11:30 - 00035064 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
    2015-09-04 23:43 - 2015-09-05 11:30 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\RogueKiller
    2015-09-03 00:25 - 2015-09-13 23:56 - 00000000 ____D C:\FRST
    2015-09-01 23:34 - 2015-09-01 23:34 - 00380598 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-329068152-1035525444-725345543-1003-0.dat
    2015-08-30 22:13 - 2015-09-01 21:19 - 00000865 _____ C:\Documents and Settings\All Users\Desktop\Avira Launcher.lnk
    2015-08-30 22:11 - 2015-08-30 22:11 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Avira
    2015-08-30 21:34 - 2015-08-30 21:34 - 00001695 _____ C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
    2015-08-30 21:07 - 2015-08-30 21:07 - 00000702 _____ C:\WINDOWS\system32\{7995330B-E01F-4645-B702-53481E7CB778}.cmdfile
    2015-08-29 22:43 - 2015-08-29 22:43 - 00000781 _____ C:\Documents and Settings\All Users\Desktop\Internet (Chromodo).lnk
    2015-08-29 00:19 - 2015-09-01 23:56 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Package Cache
    2015-08-28 00:36 - 2015-08-28 21:54 - 00000000 ____D C:\Program Files\Mozilla Firefox
    2015-08-24 19:22 - 2015-08-24 19:22 - 00302760 _____ (Trend Micro Inc.) C:\WINDOWS\system32\Drivers\tmcomm.sys
    2015-08-21 22:51 - 2015-09-06 20:53 - 00000000 __SHD C:\WINDOWS\CSC
    2015-08-20 23:36 - 2015-08-20 23:36 - 00000015 _____ C:\Documents and Settings\m\all
    2015-08-17 23:36 - 2015-09-06 21:01 - 00032264 _____ C:\WINDOWS\setupapi.log

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-09-12 23:25 - 2010-09-09 16:42 - 01156072 ____C C:\WINDOWS\WindowsUpdate.log
    2015-09-12 21:01 - 2010-09-09 18:18 - 00000000 ____D C:\Documents and Settings\NetworkService
    2015-09-11 23:17 - 2014-07-13 20:35 - 00000000 ____D C:\Qoobox
    2015-09-11 23:13 - 2004-08-10 12:00 - 00000285 _____ C:\WINDOWS\system.ini
    2015-09-11 23:12 - 2010-09-09 18:20 - 00000000 ____D C:\Documents and Settings\m
    2015-09-11 22:57 - 2010-09-09 16:33 - 00000454 __RSH C:\boot.ini
    2015-09-11 20:04 - 2014-02-25 05:26 - 00001324 _____ C:\WINDOWS\system32\d3d9caps.dat
    2015-09-10 21:13 - 2010-09-09 18:18 - 00000000 ____D C:\Documents and Settings\LocalService
    2015-09-10 21:09 - 2014-07-13 20:31 - 00000000 ____D C:\WINDOWS\erdnt
    2015-09-10 20:19 - 2014-06-19 23:43 - 56360960 _____ C:\WINDOWS\system32\config\software.bak
    2015-09-10 20:19 - 2014-06-19 23:43 - 31195136 _____ C:\WINDOWS\system32\config\system.bak
    2015-09-10 20:19 - 2014-06-19 23:43 - 00028672 _____ C:\WINDOWS\system32\config\sam.bak
    2015-09-10 20:19 - 2014-06-19 23:42 - 05369856 _____ C:\WINDOWS\system32\config\default.bak
    2015-09-10 20:19 - 2014-06-19 23:42 - 00065536 _____ C:\WINDOWS\system32\config\security.bak
    2015-09-10 20:19 - 2010-11-28 18:15 - 00000216 ____C C:\WINDOWS\wiadebug.log
    2015-09-10 20:19 - 2010-09-27 14:53 - 00001080 ____C C:\WINDOWS\system32\settingsbkup.sfm
    2015-09-10 20:19 - 2010-09-27 14:53 - 00001080 ____C C:\WINDOWS\system32\settings.sfm
    2015-09-10 20:19 - 2010-09-27 14:53 - 00000288 ____C C:\WINDOWS\system32\DVCStateBkp-{00000002-00000000-00000001-00001102-00000004-10031102}.dat
    2015-09-10 20:19 - 2010-09-27 14:53 - 00000288 ____C C:\WINDOWS\system32\DVCState-{00000002-00000000-00000001-00001102-00000004-10031102}.dat
    2015-09-10 20:19 - 2010-09-09 18:20 - 00000178 __SHC C:\Documents and Settings\m\ntuser.ini
    2015-09-10 19:48 - 2010-09-09 18:18 - 00032564 _____ C:\WINDOWS\SchedLgU.Txt
    2015-09-10 19:48 - 2010-09-09 18:18 - 00000006 ___HC C:\WINDOWS\Tasks\SA.DAT
    2015-09-10 19:39 - 2010-09-29 00:44 - 00000962 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003UA.job
    2015-09-10 19:34 - 2010-09-27 14:57 - 04481358 _____ C:\WINDOWS\{00000002-00000000-00000001-00001102-00000004-10031102}.CDF
    2015-09-10 19:33 - 2015-08-10 21:24 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
    2015-09-10 19:31 - 2012-08-08 22:49 - 00000000 ____D C:\Documents and Settings\m\Application Data\vlc
    2015-09-10 19:31 - 2011-01-09 20:33 - 00000000 ____D C:\Documents and Settings\m\Application Data\playitall
    2015-09-10 19:28 - 2014-04-11 13:16 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
    2015-09-10 19:21 - 2013-12-17 22:40 - 00000000 ____D C:\Program Files\SoftEther VPN Client
    2015-09-10 19:21 - 2010-09-09 16:40 - 00000000 ____D C:\WINDOWS\Registration
    2015-09-10 19:19 - 2010-11-28 18:15 - 00000049 ____C C:\WINDOWS\wiaservc.log
    2015-09-10 19:17 - 2014-03-10 12:04 - 00000214 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
    2015-09-08 20:56 - 2014-07-13 20:36 - 00000000 ____D C:\AdwCleaner
    2015-09-07 14:17 - 2014-06-25 03:26 - 00098520 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2015-09-03 22:12 - 2010-11-02 00:16 - 00000962 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005UA.job
    2015-09-03 21:39 - 2010-09-29 00:44 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003Core.job
    2015-09-03 21:03 - 2014-04-11 13:16 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
    2015-09-03 21:03 - 2014-04-11 13:16 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
    2015-09-03 12:12 - 2010-11-02 00:16 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005Core.job
    2015-09-01 23:35 - 2012-05-17 20:49 - 01474832 _____ C:\WINDOWS\system32\Drivers\sfi.dat
    2015-09-01 23:34 - 2012-05-14 01:39 - 00380598 ____C C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    2015-09-01 23:34 - 2010-12-26 22:58 - 00131072 _____ C:\WINDOWS\system32\config\OAlerts.evt
    2015-09-01 21:15 - 2010-09-09 16:42 - 00000000 ____D C:\WINDOWS\system32\Restore
    2015-09-01 01:14 - 2011-10-22 16:29 - 00000000 ____D C:\Program Files\WinFF
    2015-09-01 01:12 - 2012-08-05 18:06 - 00000000 ____D C:\Documents and Settings\m\Desktop\ultra
    2015-09-01 00:51 - 2011-09-02 23:33 - 00000000 ____D C:\Documents and Settings\m\Desktop\barcode
    2015-09-01 00:51 - 2010-12-05 18:59 - 00000000 ____D C:\Documents and Settings\m\Desktop\New Folder (2)
    2015-09-01 00:50 - 2010-10-29 23:10 - 00000000 ____D C:\Documents and Settings\m\Desktop\8
    2015-08-31 00:03 - 2014-04-11 13:16 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
    2015-08-30 21:54 - 2010-09-29 00:45 - 00002258 ____C C:\Documents and Settings\m\Desktop\Google Chrome.lnk
    2015-08-30 21:34 - 2012-05-17 20:37 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Comodo
    2015-08-30 21:34 - 2012-05-17 20:36 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Comodo
    2015-08-30 21:30 - 2012-05-17 20:36 - 00000000 ____D C:\Program Files\Comodo
    2015-08-30 21:25 - 2012-05-17 20:36 - 00000000 ____D C:\Documents and Settings\m\Local Settings\Application Data\Comodo
    2015-08-29 21:35 - 2012-09-16 19:39 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
    2015-08-28 21:53 - 2012-04-17 13:54 - 00778440 ____C (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
    2015-08-28 21:53 - 2011-05-20 01:22 - 00142536 ____C (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
    2015-08-28 21:51 - 2014-09-11 20:21 - 00000000 ____D C:\Documents and Settings\m\Local Settings\Application Data\Adobe
    2015-08-28 00:39 - 2011-08-18 23:36 - 00000000 ____D C:\Documents and Settings\m\Application Data\Skype
    2015-08-28 00:33 - 2014-11-07 13:51 - 00002265 _____ C:\Documents and Settings\All Users\Desktop\Skype.lnk
    2015-08-24 05:39 - 2012-06-04 00:10 - 00814149 ____C C:\Documents and Settings\m\Local Settings\Application Data\census.cache
    2015-08-24 05:39 - 2012-06-04 00:10 - 00259338 ____C C:\Documents and Settings\m\Local Settings\Application Data\ars.cache
    2015-08-20 23:45 - 2011-08-25 19:25 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2015-08-20 00:10 - 2004-08-10 12:00 - 00002206 ____C C:\WINDOWS\system32\wpa.dbl
    2015-08-19 01:09 - 2010-09-30 15:06 - 00000178 __SHC C:\Documents and Settings\K\ntuser.ini
    2015-08-19 01:08 - 2010-09-30 15:06 - 00000000 ____D C:\Documents and Settings\K\Local Settings\Temp
    2015-08-19 01:08 - 2010-09-30 15:06 - 00000000 ____D C:\Documents and Settings\K
    2015-08-17 00:00 - 2015-08-03 00:01 - 00035992 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys

    ==================== Files in the root of some directories =======

    2014-03-08 14:47 - 2014-03-08 14:47 - 0002528 ____C () C:\Documents and Settings\m\Application Data\$_hpcst$.hpc
    2011-01-26 21:49 - 2012-04-18 12:46 - 0000031 ____C () C:\Documents and Settings\m\Application Data\Days5.ini
    2013-05-26 00:21 - 2013-05-26 00:36 - 0000196 ____C () C:\Documents and Settings\m\Application Data\G-Force Prefs (WindowsMediaPlayer).txt
    2014-08-02 22:49 - 2014-08-02 23:19 - 0000077 _____ () C:\Documents and Settings\m\Application Data\Rim.Desktop.Exception.log
    2014-08-02 22:50 - 2014-08-02 23:19 - 0000077 _____ () C:\Documents and Settings\m\Application Data\Rim.DesktopHelper.Exception.log
    2014-08-02 22:53 - 2014-08-02 23:19 - 0000077 _____ () C:\Documents and Settings\m\Application Data\Rim.Transcoder.Exception.log
    2012-06-11 22:35 - 2012-06-11 22:43 - 0214016 ____C () C:\Documents and Settings\m\Application Data\SharedSettings.ccs
    2012-06-04 00:10 - 2015-08-24 05:39 - 0259338 ____C () C:\Documents and Settings\m\Local Settings\Application Data\ars.cache
    2012-06-04 00:10 - 2015-08-24 05:39 - 0814149 ____C () C:\Documents and Settings\m\Local Settings\Application Data\census.cache
    2014-02-23 02:29 - 2014-03-01 01:40 - 0000664 _____ () C:\Documents and Settings\m\Local Settings\Application Data\d3d9caps.dat
    2010-10-07 00:21 - 2015-08-07 22:02 - 0213504 ____C () C:\Documents and Settings\m\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2010-09-09 18:24 - 2010-09-09 18:24 - 0000124 ____C () C:\Documents and Settings\m\Local Settings\Application Data\fusioncache.dat
    2012-06-03 23:53 - 2012-06-03 23:53 - 0000036 ____C () C:\Documents and Settings\m\Local Settings\Application Data\housecall.guid.cache
    2015-06-25 14:09 - 2015-06-25 14:09 - 0000218 _____ () C:\Documents and Settings\m\Local Settings\Application Data\recently-used.xbel
    2008-02-05 13:28 - 2008-02-05 13:28 - 0000051 _____ () C:\Documents and Settings\m\Local Settings\Application Data\setup.txt
    2011-08-29 02:25 - 2011-08-29 19:34 - 0002770 ____C () C:\Documents and Settings\m\Local Settings\Application Data\video.torrent

    Some files in TEMP:
    ====================
    C:\Documents and Settings\K\Local Settings\temp\jre-6u31-windows-i586-iftw-rv.exe
    C:\Documents and Settings\K\Local Settings\temp\mediaget_installer.exe


    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

    ==================== End of FRST.txt ============================
     
  25. curleww

    curleww TS Rookie Topic Starter Posts: 37

    Additional scan result of Farbar Recovery Scan Tool (x86) Version:13-09-2015 02
    Ran by m (2015-09-13 23:58:56)
    Running from F:\Downloads
    Microsoft Windows XP Service Pack 3 (X86) (2010-09-09 15:47:40)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-329068152-1035525444-725345543-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator.5F5A4C13557347C
    ASPNET (S-1-5-21-329068152-1035525444-725345543-1004 - Limited - Enabled)
    Guest (S-1-5-21-329068152-1035525444-725345543-501 - Limited - Enabled)
    HelpAssistant (S-1-5-21-329068152-1035525444-725345543-1000 - Limited - Disabled)
    K (S-1-5-21-329068152-1035525444-725345543-1005 - Limited - Enabled) => %SystemDrive%\Documents and Settings\K
    m (S-1-5-21-329068152-1035525444-725345543-1003 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\m
    SUPPORT_388945a0 (S-1-5-21-329068152-1035525444-725345543-1002 - Limited - Disabled)
    UpdatusUser (S-1-5-21-329068152-1035525444-725345543-1007 - Limited - Enabled) => %SystemDrive%\Documents and Settings\UpdatusUser

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: ZoneAlarm Antivirus (Disabled - Out of date) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
    AV: Microsoft Security Essentials (Enabled - Up to date) {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    FW: ZoneAlarm Firewall (Disabled) {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.0.3.13070 - Adobe Systems Inc.)
    Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
    Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.08) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
    AliIM Plugins for Browser (HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\AliIM Plugins for Browser) (Version: 1.0 - Alibaba(China) Co., Ltd)
    ArcSoft PhotoStudio 5.5 (HKLM\...\{85309D89-7BE9-4094-BB17-24999C6118FC}) (Version: - ArcSoft)
    Atlantis (Version: 1.50 - Dell) Hidden
    Belarc Advisor 8.3 (HKLM\...\Belarc Advisor) (Version: 8.3.0.0 - Belarc Inc.)
    Belkin Desktop PCI Card Driver (HKLM\...\{50D47CE8-9C16-42D1-A8D8-B143B22E232A}) (Version: 1.12.0005 - Belkin)
    Belkin Setup and Router Monitor (HKLM\...\Belkin Setup and Router Monitor_is1) (Version: - )
    Belkin USB Print and Storage Center (HKLM\...\Belkin USB Print and Storage Center) (Version: 1.0.0 - Belkin International, Inc.)
    BlackBerry Desktop Software 7.1 (HKLM\...\BlackBerry_Desktop) (Version: 7.1.0.41 - Research In Motion Ltd.)
    BlackBerry Desktop Software 7.1 (Version: 7.1.0.41 - Research In Motion Ltd.) Hidden
    BlackBerry Device Software Updater (HKLM\...\{12BAA98C-F8DD-4BC9-BBE6-1C8463114197}) (Version: 6.0.1.37 - Research In Motion Ltd)
    Canon IJ Network Scan Utility (HKLM\...\Canon_IJ_Network_Scan_UTILITY) (Version: - )
    Canon IJ Network Tool (HKLM\...\Canon_IJ_Network_UTILITY) (Version: - )
    Canon MP Navigator 3.0 (HKLM\...\MP Navigator 3.0) (Version: - )
    Canon MP600R (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600R) (Version: - )
    Canon MP600R User Registration (HKLM\...\Canon MP600R User Registration) (Version: - )
    Canon Utilities Easy-PhotoPrint (HKLM\...\Easy-PhotoPrint) (Version: - )
    CCleaner (HKLM\...\CCleaner) (Version: 3.23 - Piriform)
    CD-LabelPrint (HKLM\...\MediaNavigation.CDLabelPrint) (Version: - )
    Chromodo (HKLM\...\Chromodo) (Version: 44.5.7.268 - Comodo)
    Comodo Dragon (HKLM\...\Comodo Dragon) (Version: 43.3.3.185 - Comodo)
    COMODO Internet Security Premium (HKLM\...\{367D1EA4-24FD-402F-AFF0-08A678D2EE28}) (Version: 8.2.0.4674 - COMODO Security Solutions Inc.)
    Conexant SmartHSFi V92 56K Speakerphone PCI Modem (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2702) (Version: - )
    CPUID CPU-Z 1.62 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
    Creative MediaSource (HKLM\...\{56F3E1FF-54FE-4384-A153-6CCABA097814}) (Version: - )
    Dell Movie Studio Diagnostics (HKLM\...\InstallShield_{9ED6519B-324A-4C66-98EE-E3F54281BA78}) (Version: 1.50 - Dell)
    Dell ResourceCD (HKLM\...\{D78653C3-A8FF-415F-92E6-D774E634FF2D}) (Version: - )
    Digital Video Repair 2.2 (HKLM\...\Digital Video Repair) (Version: - )
    Dual Mode Digital Camera Z (HKLM\...\{3C516E56-0B4B-4BDE-88A2-035B4D170A26}) (Version: 2.1 - DSC)
    Easy-WebPrint (HKLM\...\Easy-WebPrint) (Version: - )
    FixCleaner (HKLM\...\{EFCCCA5E-6F4B-4B7B-903F-24D752DFDC64}) (Version: 2.0.4972 - Slimware Utilities, Inc.)
    Free File Opener v2011.7.0.1 (HKLM\...\Free File Opener_is1) (Version: 2011.7.0.1 - Free File Opener, LLC)
    Free Video to MP3 Converter version 5.0.30.1029 (HKLM\...\Free Video to MP3 Converter_is1) (Version: 5.0.30.1029 - DVDVideoSoft Ltd.)
    GeekBuddy (HKLM\...\{D4651C22-C4C5-4294-AD9C-91FF0F048CCC}) (Version: 4.1.31 - Comodo Security Solutions Inc)
    Google Chrome (HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)
    GoToMeeting 5.5.0.1133 (HKU\S-1-5-21-329068152-1035525444-725345543-1003\...\GoToMeeting) (Version: 5.5.0.1133 - CitrixOnline)
    ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
    InfraRecorder (HKLM\...\InfraRecorder) (Version: - Christian Kindahl)
    InstallIQ Updater (HKLM\...\{A9FE59F0-5BFA-4FDF-84C6-F45457715379}) (Version: 1.4.1.0 - W3i, LLC)
    Intel(R) Network Connections 16.8.46.0 (HKLM\...\{6438A99C-A37E-4758-A0AE-95F8A63AAFF5}) (Version: 16.8.46.0 - Intel)
    Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
    JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
    Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
    Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
    Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft ActiveSync (HKLM\...\{99052DB7-9592-4522-A558-5417BBAD48EE}) (Version: 4.5.5096.0 - Microsoft Corporation)
    Microsoft LifeCam (HKLM\...\{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}) (Version: 3.22.270.0 - Microsoft Corporation)
    Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
    Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)
    Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.6029.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
    Miro (HKLM\...\Miro) (Version: 6.0 - Participatory Culture Foundation)
    Mozilla Firefox 40.0.3 (x86 en-GB) (HKLM\...\Mozilla Firefox 40.0.3 (x86 en-GB)) (Version: 40.0.3 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
    MSN (HKLM\...\MSNINST) (Version: - )
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    MyDVD (HKLM\...\{5E835305-63BB-4E55-BBB7-EEBBE67774DB}) (Version: - )
    Nero - Burning Rom (HKLM\...\{A4D7B764-4140-11D4-88EB-0050DA3579C0}) (Version: 5.5.8.1 - ahead software gmbh)
    NVIDIA nView 136.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 136.53 - NVIDIA Corporation)
    NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
    Nvu 1.0PR (HKLM\...\Nvu_is1) (Version: 1.0PR - Linspire Inc.)
    PacketiX VPN Client (English) (HKLM\...\{F26E2781-2E22-4485-A33A-6F3E322A3F2D}) (Version: 2.20.5351 - SoftEther Corporation)
    PlayItAll media player 1.0.5 (HKLM\...\PlayItAll media player) (Version: 1.0.5 - PlayItAll)
    PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: - )
    RAR Password Recovery v1.1 RC16 (remove only) (HKLM\...\Intelore - RAR Password Recovery) (Version: - )
    Roxio VideoWave Movie Creator (HKLM\...\{BB46245B-CECA-406F-8790-3ABA0D01012F}) (Version: 1.6.676.0 - Roxio, Inc.)
    ScanSoft OmniPage SE 4.0 (HKLM\...\{C1E693A4-B1D5-4DCD-B68D-2087835B7184}) (Version: 15.00.0020 - Nuance Communications, Inc.)
    SecureClean4 (HKLM\...\{83b13a64-d98a-48a2-8cbc-ec0ec5433b18}) (Version: - )
    Security Task Manager 1.8d (HKLM\...\Security Task Manager) (Version: 1.8d - Neuber Software)
    Segoe UI (Version: 14.0.4327.805 - Microsoft Corp) Hidden
    Serif DrawPlus Starter Edition (HKLM\...\{33311EA4-0ECA-4E7F-83E5-8A92CD760152}) (Version: 2.0.2.010 - Serif (Europe) Ltd)
    Serif WebPlus 9.0 (HKLM\...\{4493E86C-1408-4AF6-8455-0744D25CD355}) (Version: 9.00 - Serif)
    Serviio (HKLM\...\Serviio) (Version: - )
    Skype™ 7.5 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
    SlimCleaner (HKLM\...\{6B8D6199-EE44-4FD7-813A-6D8C62C9B384}) (Version: 4.0.30878 - SlimWare Utilities, Inc.)
    SlimDrivers (HKLM\...\{A5457401-D56A-43F2-9524-78E54A7FC07A}) (Version: 2.2.32705 - SlimWare Utilities, Inc.)
    Snagit 10 (HKLM\...\{5BCC634A-58AD-42F9-B3C6-2EA52F81CF85}) (Version: 10.0.0 - TechSmith Corporation)
    Snagit 11 (HKLM\...\{7CA5C4DF-8327-4035-AE2B-CA76336A04FD}) (Version: 11.0.0 - TechSmith Corporation)
    SoftEther VPN Client (HKLM\...\softether_sevpnclient) (Version: 4.18.9570 - SoftEther VPN Project)
    Sonic Encoders (HKLM\...\{9941F0AA-B903-4AF4-A055-83A9815CC011}) (Version: 1.00 - Sonic Solutions)
    Sound Blaster Audigy 2 (HKLM\...\{E82BF103-904F-49C0-B77F-6EC110B71E87}) (Version: - )
    SoundMAX (HKLM\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: - )
    Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
    Tweak UI (HKLM\...\Tweak UI 2.10) (Version: - )
    WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
    Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
    Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
    Windows Live OneCare safety scanner (HKLM\...\Windows Live OneCare safety scanner) (Version: - )
    Windows Live Sign-in Assistant (HKLM\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
    Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
    Windows Management Framework Core (HKLM\...\KB968930) (Version: - Microsoft Corporation)
    Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
    Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
    Windows Search 4.0 (HKLM\...\KB940157) (Version: 04.00.6001.503 - Microsoft Corporation)
    Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
    WinRAR 4.10 beta 5 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.10.5 - win.rar GmbH)
    XHeader (HKLM\...\XHeader) (Version: 1.215 - Intellimon)
    XSite Pro (HKLM\...\XSite Pro) (Version: 1.55 - Intellimon Ltd)
    XSitePro2 (HKLM\...\XSitePro2) (Version: 2.01 - Intellimon Ltd)
    Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
    Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )
    Yawcam 0.4.0 (HKLM\...\{8FE96B14-E1F9-47BF-8BA1-A81467CD259B}_is1) (Version: - )
    Your Uninstaller! 2010 (HKLM\...\YU2010_is1) (Version: 7.0 - URSoft, Inc.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{0BBFE402-CCA1-4f64-9322-13B66D841049}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{23102CBF-AC8D-4424-9364-A79738894850}\MSWord.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{0C1EB979-8EC7-46E8-8097-246957D6B94C}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{11CD84A3-A5E0-43CB-B3DF-92C623C0E0E0}\InprocServer32 -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{1434DD3D-0AF6-41E0-BB71-8C86010D9AF5}\localserver32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{25D005BF-FE63-4cce-AA25-CE952B1D9381}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{638B203F-8FB6-49ec-A139-AB8C530F0CAB}\MSPowerPoint.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{293600C7-E7B6-4f06-9329-D8522A33C7E8}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{B9E98D7E-F599-469d-95A7-0B6F86D082A0}\CamtasiaOutput.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{2A235D7E-0358-40E2-B51A-DE22F8F5C50D}\InprocServer32 -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{326787D9-37B9-47A6-B539-EE13E7B04B8B}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{47F64EC4-1AD6-4168-9D4C-00F3842F7CFB}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{4B66DD3F-2E6E-4F7C-B38C-E32608820825}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{53DBCD97-3FDF-4B60-975B-2596B57482EF}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\BBWebSLLauncher.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{54050FBB-F2AE-404b-8BFD-7EE3EC784A52}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{18AA4E21-D540-4a3a-9F9F-E6DE33D6F253}\MSExcel.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\Application\44.0.2403.157\delegate_execute.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.1\psuser.dll No Fil (the data entry has 1 more characters).
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{672CDBDB-0270-4EB9-83EC-216377522D21}\InprocServer32 -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{6B1948B3-9547-42F8-9B37-7AA9768134C4}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{23102CBF-AC8D-4424-9364-A79738894850}\MSWord.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{73D320C0-FACA-4553-9D5F-070F9E4DC5C8}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\psuser.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{82D1C283-A637-4A07-B1EC-8C7AE661EAF1}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{841BFDCA-6A9A-4EBC-BC7E-194AA5DCE428}\InprocServer32 -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files\Citrix\GoToMeeting\1133\G2MOutlookAddin.dll (Citrix Online, a division of Citrix Systems, Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> no filepath
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{97090E2F-3062-4459-855B-014F0D3CDBB1}\InprocServer32 -> C:\Program Files\Windows Desktop Search\deskbar.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{AD046C04-9CC6-4424-A8E2-1F8BB9D0B29D}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManagerps.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{B9E98D7E-F599-469d-95A7-0B6F86D082A0}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\TechSmith\SnagIt\Accessories\{B9E98D7E-F599-469d-95A7-0B6F86D082A0}\CamtasiaOutput.dll (TechSmith Corporation)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{BA3D0120-E617-4F66-ADCA-585CC2FB86DB}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\npGoogleUpdate3.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\npGoogleUpdate3.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{C8992C14-DF59-4518-808F-CCFBB5850282}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\devicemanagerproperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{D41C1E5B-0566-4BB1-BE72-1A5407349CA6}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\GoogleUpdateOnDemand.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\1.3.28.13\psuser.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{EB59852D-B38E-4A4C-94BA-6731836E5538}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\DeviceManagerProperties.dll (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{EE7F6B66-AC97-41CF-BD88-372DDB786DB6}\localserver32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
    CustomCLSID: HKU\S-1-5-21-329068152-1035525444-725345543-1003_Classes\CLSID\{F6CF0104-4F4A-4EBE-999D-A12D838E65B5}\InprocServer32 -> C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgrPs.dll (Research In Motion Limited)

    ==================== Restore Points =========================

    Check "winmgmt" service or repair WMI.


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2004-08-10 12:00 - 2015-09-11 23:13 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
    127.0.0.1 localhost

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    Task: C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    Task: C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    Task: C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003Core.job => C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1003UA.job => C:\Documents and Settings\m\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005Core.job => C:\Documents and Settings\K\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-1035525444-725345543-1005UA.job => C:\Documents and Settings\K\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe

    ==================== Loaded Modules (Whitelisted) ==============

    2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
    2010-01-21 02:34 - 2010-01-21 02:34 - 08793952 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
    2012-05-26 21:48 - 2011-12-15 12:38 - 00166912 _____ () C:\Program Files\WinRAR\rarext.dll
    2011-10-20 13:35 - 2010-02-17 18:25 - 00132096 ____N () C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkLocalBackup.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:1CE11B51
    AlternateDataStreams: C:\Documents and Settings\m\Desktop\Intellimon.XSitePro.v2.117.3275.29192-DVT.rar:$CmdZnID

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CLPSLauncher => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

    ==================== EXE Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
    IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
    IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
    IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

    There are 7866 more restricted sites.

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-329068152-1035525444-725345543-1003\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\m\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    DNS Servers: 194.168.4.100 - 194.168.8.100
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)


    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\wlcsdk.exe] => Enabled:Windows Live Call
    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\msnmsgr.exe] => Enabled:Windows Live Messenger
    DomainProfile\AuthorizedApplications: [C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe] => :LocalSubNet:Enabled:Belkin Setup
    DomainProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\rapimgr.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    DomainProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\wcescomm.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    DomainProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\WCESMgr.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    StandardProfile\AuthorizedApplications: [C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe] => Enabled:Yahoo! Messenger
    StandardProfile\AuthorizedApplications: [C:\Program Files\Messenger\msmsgs.exe] => Enabled:Windows Messenger
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\dpvsetup.exe] => Enabled:Microsoft DirectPlay Voice Test
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office14\GROOVE.EXE] => Enabled:Microsoft SharePoint Workspace
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE] => Enabled:Microsoft OneNote
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE] => Enabled:Microsoft Office Outlook
    StandardProfile\AuthorizedApplications: [C:\Program Files\VideoLAN\VLC\vlc.exe] => Enabled:VLC media player
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\sessmgr.exe] => Disabled:mad:xpsp2res.dll,-22019
    StandardProfile\AuthorizedApplications: [C:\Program Files\Belkin\Belkin USB Print and Storage Center\Connect.exe] => Enabled:Belkin USB Print and Storage Center
    StandardProfile\AuthorizedApplications: [C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe] => :LocalSubNet:Enabled:Belkin Setup
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft LifeCam\LifeCam.exe] => Enabled:LifeCam.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft LifeCam\LifeEnC2.exe] => Enabled:LifeEnC2.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft LifeCam\LifeExp.exe] => Enabled:LifeExp.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft LifeCam\LifeTray.exe] => Enabled:LifeTray.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\Comodo\tvnserver.exe] => Enabled:TVN Server
    StandardProfile\AuthorizedApplications: [C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe] => Enabled:Daemonu.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe] => Enabled:BlackBerry Desktop Software
    StandardProfile\AuthorizedApplications: [C:\Program Files\Serviio\bin\ServiioConsole.exe] => Enabled:Serviio
    StandardProfile\AuthorizedApplications: [C:\Program Files\Participatory Culture Foundation\Miro\Miro_Downloader.exe] => Enabled:Miro_Downloader
    StandardProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\rapimgr.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    StandardProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\wcescomm.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    StandardProfile\AuthorizedApplications: [E:\Program Files\Microsoft ActiveSync\WCESMgr.exe] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\mmc.exe] => Enabled:Microsoft Management Console
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\m\Local Settings\Application Data\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\K\Local Settings\Application Data\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Program Files\Skype\Phone\Skype.exe] => Enabled:Skype
    StandardProfile\AuthorizedApplications: [C:\Program Files\SoftEther VPN Client\vpncmgr.exe] => Enabled:SoftEther VPN Client Connection Manager
    StandardProfile\AuthorizedApplications: [C:\Program Files\SoftEther VPN Client\vpnclient.exe] => Enabled:SoftEther VPN Client
    StandardProfile\AuthorizedApplications: [C:\Program Files\SoftEther VPN Client\vpncmd.exe] => Enabled:SoftEther VPN Command-Line Admin Tool
    StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:Firefox (C:\Program Files\Mozilla Firefox)
    DomainProfile\GloballyOpenPorts: [139:TCP] => Enabled:mad:xpsp2res.dll,-22004
    DomainProfile\GloballyOpenPorts: [445:TCP] => Enabled:mad:xpsp2res.dll,-22005
    DomainProfile\GloballyOpenPorts: [137:UDP] => Enabled:mad:xpsp2res.dll,-22001
    DomainProfile\GloballyOpenPorts: [138:UDP] => Enabled:mad:xpsp2res.dll,-22002
    DomainProfile\GloballyOpenPorts: [26675:TCP] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
    DomainProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    DomainProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22002
    StandardProfile\GloballyOpenPorts: [19540:UDP] => Enabled:SXUPTP
    StandardProfile\GloballyOpenPorts: [4481:TCP] => :LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
    StandardProfile\GloballyOpenPorts: [4481:UDP] => :LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery
    StandardProfile\GloballyOpenPorts: [443:UDP] => Disabled:eek:oVoo UDP port 443
    StandardProfile\GloballyOpenPorts: [37674:TCP] => Disabled:eek:oVoo TCP port 37674
    StandardProfile\GloballyOpenPorts: [37674:UDP] => Disabled:eek:oVoo UDP port 37674
    StandardProfile\GloballyOpenPorts: [37675:UDP] => Disabled:eek:oVoo UDP port 37675
    StandardProfile\GloballyOpenPorts: [5985:TCP] => Disabled:Windows Remote Management
    StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    StandardProfile\GloballyOpenPorts: [26675:TCP] => :169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    ==================== Faulty Device Manager Devices =============

    Could not list Devices. Check "winmgmt" service or repair WMI.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (09/13/2015 11:56:53 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

    Error: (09/13/2015 11:53:30 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (09/12/2015 11:50:58 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (09/12/2015 11:20:35 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

    Error: (09/12/2015 11:13:19 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

    Error: (09/12/2015 11:10:55 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

    Error: (09/12/2015 11:09:39 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

    Error: (09/11/2015 11:48:14 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (09/11/2015 10:54:55 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]

    Error: (09/10/2015 11:45:59 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application plugin-container.exe, version 40.0.3.5716, faulting module mozglue.dll, version 40.0.3.5716, fault address 0x0000e250.
    Processing media-specific event for [plugin-container.exe!ws!]


    System errors:
    =============
    Error: (09/13/2015 09:08:46 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
    in order to run the server:
    {A1F4E726-8CF1-11D1-BF92-0060081ED811}

    Error: (09/12/2015 11:51:42 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
    in order to run the server:
    {A1F4E726-8CF1-11D1-BF92-0060081ED811}

    Error: (09/12/2015 11:37:00 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
    in order to run the server:
    {A1F4E726-8CF1-11D1-BF92-0060081ED811}

    Error: (09/12/2015 11:36:44 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
    in order to run the server:
    {A1F4E726-8CF1-11D1-BF92-0060081ED811}

    Error: (09/12/2015 11:34:29 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
    in order to run the server:
    {A1F4E726-8CF1-11D1-BF92-0060081ED811}

    Error: (09/12/2015 11:25:10 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service wuauserv with arguments ""
    in order to run the server:
    {E60687F7-01A1-40AA-86AC-DB1CBF673334}

    Error: (09/12/2015 11:20:45 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service MSIServer with arguments ""
    in order to run the server:
    {000C101C-0000-0000-C000-000000000046}

    Error: (09/12/2015 11:20:41 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service MSIServer with arguments ""
    in order to run the server:
    {000C101C-0000-0000-C000-000000000046}

    Error: (09/12/2015 11:20:38 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service MSIServer with arguments ""
    in order to run the server:
    {000C101C-0000-0000-C000-000000000046}

    Error: (09/12/2015 11:20:35 PM) (Source: DCOM) (EventID: 10005) (User: 5F5A4C13557347C)
    Description: DCOM got error "%%1084" attempting to start the service MSIServer with arguments ""
    in order to run the server:
    {000C101C-0000-0000-C000-000000000046}


    Microsoft Office:
    =========================
    Error: (09/13/2015 11:56:53 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis operation returned because the timeout period expired.

    Error: (09/13/2015 11:53:30 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (09/12/2015 11:50:58 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (09/12/2015 11:20:35 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis operation returned because the timeout period expired.

    Error: (09/12/2015 11:13:19 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis operation returned because the timeout period expired.

    Error: (09/12/2015 11:10:55 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis operation returned because the timeout period expired.

    Error: (09/12/2015 11:09:39 PM) (Source: crypt32) (EventID: 8) (User: )
    Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis operation returned because the timeout period expired.

    Error: (09/11/2015 11:48:14 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (09/11/2015 10:54:55 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250

    Error: (09/10/2015 11:45:59 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: plugin-container.exe40.0.3.5716mozglue.dll40.0.3.57160000e250


    ==================== Memory info ===========================

    Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz
    Percentage of memory in use: 14%
    Total physical RAM: 3326.98 MB
    Available physical RAM: 2855.8 MB
    Total Virtual: 7259.42 MB
    Available Virtual: 7067.38 MB

    ==================== Drives ================================

    Drive c: (C 76gb) (Fixed) (Total:76.68 GB) (Free:9.13 GB) NTFS ==>[drive with boot components (Windows XP)]
    Drive e: (E 232 gb) (Fixed) (Total:232.82 GB) (Free:143.08 GB) NTFS
    Drive f: (F 750gb sata) (Fixed) (Total:698.64 GB) (Free:577.92 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows XP) (Size: 76.7 GB) (Disk ID: C9C9C9C9)
    Partition 1: (Active) - (Size=76.7 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (MBR Code: Windows XP) (Size: 232.8 GB) (Disk ID: C0B7C0B7)
    Partition 1: (Active) - (Size=232.8 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 2 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: 13B4A6DA)
    Partition 1: (Active) - (Size=698.6 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...