Can not access the control panel

Inactive-A
By michael j. odom
May 16, 2013
Topic Status:
Not open for further replies.
  1. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    Good.

    [​IMG] Create new restore point before proceeding with the next step....
    How to:
    - Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
    - Windows 7: http://www.howtogeek.com/howto/3195/create-a-system-restore-point-in-windows-7/
    - Vista: http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
    - XP: http://support.microsoft.com/kb/948247

    [​IMG] Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
  2. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    ComboFix 13-05-23.02 - Administrator 05/23/2013 17:17:14.1.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.278 [GMT -7:00]
    Running from: c:\documents and settings\Administrator\My Documents\Downloads\ComboFix.exe
    AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Administrator\Application Data\DefaultTab\DefaultTab
    c:\documents and settings\Administrator\Application Data\DefaultTab\DefaultTab\uninstalldt.exe
    c:\documents and settings\Administrator\Start Menu\Programs\Startup\BCU.exe
    c:\documents and settings\All Users\Start Menu\Programs\Startup\BCU.exe
    C:\drvrtmp
    c:\program files\DefaultTab
    c:\program files\DefaultTab\DefaultTab.crx
    c:\program files\DefaultTab\DefaultTabSearch.exe
    c:\program files\DefaultTab\uid
    c:\windows\system32\Cache
    c:\windows\system32\Cache\272512937d9e61a4.fb
    c:\windows\system32\Cache\287204568329e189.fb
    c:\windows\system32\Cache\28bc8f716fd76a47.fb
    c:\windows\system32\Cache\2c53092c95605355.fb
    c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
    c:\windows\system32\Cache\32c84fe32bb74d60.fb
    c:\windows\system32\Cache\3917078cb68ec657.fb
    c:\windows\system32\Cache\590ba23ce359fd0c.fb
    c:\windows\system32\Cache\610289e025a3ee9a.fb
    c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
    c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
    c:\windows\system32\Cache\6d03dad1035885d3.fb
    c:\windows\system32\Cache\a783c347d801ab5d.fb
    c:\windows\system32\Cache\a8556537add6dfc5.fb
    c:\windows\system32\Cache\ad10a52aff5e038d.fb
    c:\windows\system32\Cache\c1fa887b03019701.fb
    c:\windows\system32\Cache\c4d28dca2e7648be.fb
    c:\windows\system32\Cache\d201ef9910cd39de.fb
    c:\windows\system32\Cache\d2e94710a5708128.fb
    c:\windows\system32\Cache\d79b9dfe81484ec4.fb
    c:\windows\system32\Cache\f998975c9cc711ee.fb
    c:\windows\system32\SET64.tmp
    c:\windows\system32\SET68.tmp
    c:\windows\system32\SET69.tmp
    c:\windows\system32\SET70.tmp
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Legacy_DEFAULTTABSEARCH
    -------\Service_DefaultTabSearch
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-04-24 to 2013-05-24 )))))))))))))))))))))))))))))))
    .
    .
    2013-05-18 15:15 . 2013-05-18 15:1515616----a-w-c:\windows\system32\drivers\TrueSight.sys
    2013-05-17 21:07 . 2013-05-17 21:124167680----a-w-c:\program files\GUT4A.tmp
    2013-05-17 21:07 . 2013-05-17 21:12--------d-----w-c:\program files\GUM49.tmp
    2013-05-17 20:54 . 2013-05-09 08:5929816----a-w-c:\windows\system32\drivers\aswFsBlk.sys
    2013-05-17 20:54 . 2013-05-09 08:59368944----a-w-c:\windows\system32\drivers\aswSP.sys
    2013-05-17 20:54 . 2013-05-09 08:5956080----a-w-c:\windows\system32\drivers\aswTdi.sys
    2013-05-17 20:54 . 2013-05-09 08:5949760----a-w-c:\windows\system32\drivers\aswRdr.sys
    2013-05-17 20:54 . 2013-05-09 08:59765736----a-w-c:\windows\system32\drivers\aswSnx.sys
    2013-05-17 20:54 . 2013-05-09 08:59174664----a-w-c:\windows\system32\drivers\aswVmm.sys
    2013-05-17 20:54 . 2013-05-09 08:5949376----a-w-c:\windows\system32\drivers\aswRvrt.sys
    2013-05-17 20:54 . 2013-05-09 08:5966336----a-w-c:\windows\system32\drivers\aswMonFlt.sys
    2013-05-17 20:54 . 2013-05-09 08:58229648----a-w-c:\windows\system32\aswBoot.exe
    2013-05-17 20:52 . 2013-05-09 08:5841664----a-w-c:\windows\avastSS.scr
    2013-05-17 20:50 . 2013-05-17 20:50--------d-----w-c:\program files\AVAST Software
    2013-05-17 20:49 . 2013-05-17 20:50--------d-----w-c:\documents and settings\All Users\Application Data\AVAST Software
    2013-05-16 22:25 . 2013-05-16 22:25--------d-----w-c:\documents and settings\Administrator\Local Settings\Application Data\WinZip
    2013-05-16 22:23 . 2013-05-16 22:25--------d-----w-c:\documents and settings\All Users\Application Data\WinZip
    2013-05-16 22:22 . 2013-05-16 22:22--------d-----w-c:\documents and settings\Administrator\Local Settings\Application Data\AVG SafeGuard toolbar
    2013-05-16 22:22 . 2013-05-16 22:22--------d-----w-c:\documents and settings\All Users\Application Data\AVG SafeGuard toolbar
    2013-05-16 22:22 . 2013-05-16 22:22--------d-----w-c:\documents and settings\Administrator\Application Data\AVG SafeGuard toolbar
    2013-05-16 22:22 . 2013-05-16 22:2137664----a-w-c:\windows\system32\drivers\avgtpx86.sys
    2013-05-16 22:22 . 2013-05-16 22:22--------d-----w-c:\program files\AVG SafeGuard toolbar
    2013-05-16 21:15 . 2013-05-16 21:15--------d-----w-c:\documents and settings\Administrator\Application Data\Malwarebytes
    2013-05-16 21:14 . 2013-05-16 21:14--------d-----w-c:\documents and settings\All Users\Application Data\Malwarebytes
    2013-05-16 21:14 . 2013-04-04 21:5022856----a-w-c:\windows\system32\drivers\mbam.sys
    2013-05-16 21:14 . 2013-05-16 21:14--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2013-05-16 15:58 . 2013-05-16 15:58--------d-----w-c:\documents and settings\All Users\Application Data\Globalscape
    2013-05-16 15:58 . 2013-05-16 15:58--------d-----w-c:\documents and settings\Administrator\Local Settings\Application Data\Globalscape
    2013-05-16 15:57 . 2013-05-16 15:57--------d-----w-c:\documents and settings\Administrator\Application Data\Globalscape
    2013-05-16 15:56 . 2013-05-16 15:56--------d-----w-c:\program files\Globalscape
    2013-05-16 13:48 . 2013-05-16 13:4817613192----a-w-c:\windows\system32\FlashPlayerInstaller.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-05-21 20:00 . 2012-09-16 04:197304----a-w-c:\windows\TMP0001.TMP
    2013-05-16 13:48 . 2012-04-30 22:25692104-c--a-w-c:\windows\system32\FlashPlayerApp.exe
    2013-05-16 13:48 . 2011-12-04 03:2371048-c--a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
    2013-03-18 03:55 . 2013-03-18 03:5594112----a-w-c:\windows\system32\WindowsAccessBridge.dll
    2013-03-18 03:55 . 2013-03-18 03:56143872----a-w-c:\windows\system32\javacpl.cpl
    2013-03-18 03:55 . 2012-06-27 14:31861088----a-w-c:\windows\system32\npDeployJava1.dll
    2013-03-18 03:55 . 2012-06-27 14:31782240-c--a-w-c:\windows\system32\deployJava1.dll
    2013-03-11 20:33 . 2004-08-12 13:2733280----a-w-c:\windows\system32\rundll32.exe.lol
    2013-04-19 14:13 . 2013-04-19 14:12263064----a-w-c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2013-05-09 08:58121968----a-w-c:\program files\AVAST Software\Avast\ashShell.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32129272----a-w-c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32129272----a-w-c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32129272----a-w-c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2012-11-13 23:32129272----a-w-c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.17.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Spotify Web Helper"="c:\documents and settings\Administrator\Application Data\Spotify\Data\SpotifyWebHelper.exe" [2013-05-02 1105408]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "vProt"="c:\program files\AVG SafeGuard toolbar\vprot.exe" [2013-05-16 1226928]
    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
    .
    c:\documents and settings\Administrator\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\documents and settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe [2013-3-12 29106336]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2013-4-19 113664]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLinkedConnections"= 1 (0x1)
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Dropbox.lnk]
    path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Dropbox.lnk
    backup=c:\windows\pss\Dropbox.lnkStartup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2012-12-18 14:28946352----a-w-c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EXSHOW95.EXE]
    2001-09-07 23:1845056----a-w-c:\windows\system32\exshow95.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
    2005-09-20 17:3277824----a-w-c:\windows\system32\hkcmd.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
    2005-09-20 17:36114688----a-w-c:\windows\system32\igfxpers.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
    2005-09-20 17:3594208----a-w-c:\windows\system32\igfxtray.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]
    2002-03-14 23:4645056----a-w-c:\windows\system32\ico.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2011-10-24 22:28421888----a-w-c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
    2004-10-14 22:421404928----a-w-c:\program files\Analog Devices\Core\smax4pnp.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
    2013-05-02 21:081105408----a-w-c:\documents and settings\Administrator\Application Data\Spotify\Data\SpotifyWebHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2012-07-03 16:04252848----a-w-c:\program files\Common Files\Java\Java Update\jusched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xvid]
    2011-01-17 19:418192----a-w-c:\program files\Xvid\CheckUpdate.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Bonjour Service"=2 (0x2)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Torch\\Plugins\\Torrent\\TorchTorrent.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    .
    R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [5/17/2013 1:54 PM 49376]
    R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [5/17/2013 1:54 PM 174664]
    R0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\drivers\NBVol.sys [1/2/2012 10:08 AM 56496]
    R0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\drivers\NBVolUp.sys [1/2/2012 10:08 AM 12464]
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [5/17/2013 1:54 PM 765736]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5/17/2013 1:54 PM 368944]
    R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [5/16/2013 3:22 PM 37664]
    R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [1/9/2013 7:24 PM 242240]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/17/2013 1:54 PM 29816]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [5/17/2013 1:54 PM 66336]
    R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [5/16/2013 2:14 PM 418376]
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5/16/2013 2:14 PM 701512]
    R2 vToolbarUpdater15.2.0;vToolbarUpdater15.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe [5/16/2013 3:22 PM 1015984]
    R2 Yontoo Desktop Updater;Yontoo Desktop Updater;c:\program files\Yontoo\Y2Desktop.Updater.exe [4/15/2013 3:46 PM 23552]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5/16/2013 2:14 PM 22856]
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - BITS
    *NewlyCreated* - WS2IFSL
    *NewlyCreated* - WUAUSERV
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2013-05-17 20:561642448----a-w-c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2013-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 13:48]
    .
    2012-10-04 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 01:57]
    .
    2013-05-24 c:\windows\Tasks\avast! Emergency Update.job
    - c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-17 08:58]
    .
    2013-05-24 c:\windows\Tasks\GoforFilesUpdate.job
    - c:\program files\GoforFiles\GFFUpdater.exe [2013-04-13 22:46]
    .
    2013-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2013-05-17 20:55]
    .
    2013-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2013-05-17 20:55]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://search.babylon.com/?affID=111305&tt=120912_cpc_3712_8&babsrc=HP_ss&mntrId=1c4b856a000000000000001111cee809
    mStart Page = hxxp://start.funmoods.com/?f=1&a=iron2&chnl=iron2&cd=2XzuyEtN2Y1L1QzutDtDtCtCtCtC0C0E0EzztDzyzzyDyC0AtN0D0Tzu0CtByEyDtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1916545764
    uInternet Settings,ProxyOverride = *.local
    TCP: DhcpNameServer = 24.217.0.5 24.217.201.67 24.247.15.53
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\15.2.0\ViProtocol.dll
    FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2ls8wwb0.default\
    FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
    FF - prefs.js: browser.startup.homepage - hxxp://mysearch.avg.com/?cid={317F8199-0D3B-4481-8404-734F644A8F8E}&mid=9fb6e163c8b3448d9e18151bf31201f8-f3652a474480b4664b83f9f993bd9515e2efbbfb&lang=en&ds=hk018&pr=sa&d=2013-05-16 15:22&v=15.2.0.5&pid=safeguard&sg=1&sap=hp
    FF - ExtSQL: 2013-04-15 15:47; plugin@yontoo.com; c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2ls8wwb0.default\extensions\plugin@yontoo.com
    FF - ExtSQL: 2013-05-16 15:22; avg@toolbar; c:\documents and settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5
    FF - user.js: extentions.y2layers.installId - ff96c4de-bfce-4ceb-a7d8-b38ad70d226f
    FF - user.js: extentions.y2layers.defaultEnableAppsList - DropDownDeals,buzzdock,YontooNewOffers
    .
    - - - - ORPHANS REMOVED - - - -
    .
    BHO-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
    Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
    HKLM-Run-Aimersoft Helper Compact.exe - c:\program files\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe
    HKLM-Run-BrowserPlugInHelper - c:\program files\Aimersoft\Video Converter Ultimate\BrowserPlugInHelper.exe
    MSConfigStartUp-APSDaemon - c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
    MSConfigStartUp-DivXUpdate - c:\program files\DivX\DivX Update\DivXUpdate.exe
    MSConfigStartUp-Driver Whiz - c:\program files\Driver Whiz\Driver Whiz\DriverWhiz.exe
    MSConfigStartUp-DriverScanner - c:\program files\Uniblue\DriverScanner\launcher.exe
    MSConfigStartUp-HF_G_Jul - c:\program files\AVG Secure Search\HF_G_Jul.exe
    MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
    MSConfigStartUp-SpeedUpMyPC - c:\program files\Uniblue\SpeedUpMyPC\launcher.exe
    AddRemove-DefaultTab - c:\documents and settings\Administrator\Application Data\DefaultTab\DefaultTab\uninstalldt.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2013-05-23 17:36
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-2025429265-838170752-839522115-500\Software\DataMngr_Toolbar]
    @Denied: (2) (Administrator)
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(716)
    c:\windows\system32\sxs.dll
    .
    - - - - - - - > 'explorer.exe'(2584)
    c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.17.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\AVAST Software\Avast\AvastSvc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre7\bin\jqs.exe
    c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
    c:\documents and settings\Administrator\Application Data\Yontoo\YontooDesktop.exe
    c:\windows\SoftwareDistribution\Download\ebd2c51df7b0697dcbc09a2360b2c104\update\update.exe
    .
    **************************************************************************
    .
    Completion time: 2013-05-23 17:53:53 - machine was rebooted
    ComboFix-quarantined-files.txt 2013-05-24 00:53
    .
    Pre-Run: 3,387,228,160 bytes free
    Post-Run: 7,915,941,888 bytes free
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    .
    - - End Of File - - CF0DB97A2166A6FBB985FA3A3C792E45
  3. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    Looks good.

    How is computer doing?

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Delete.
    • Confirm each time with Ok.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
  4. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    Sorry about that last message. I missed the Dont Pm Admins Rule.

    The computer isn't at its best. The system maybe a little cleaner, but, It's not entirely out of the Woods. The control panel is accessible. But I can not access "Add or Remove Programs" within the Control Panel. So. It's not entirely out of the Woods yet.
  5. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    Thanks. Go on...
  6. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    # AdwCleaner v2.301 - Logfile created 05/23/2013 at 20:31:33
    # Updated 16/05/2013 by Xplode
    # Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
    # User : Administrator - ODAM-A5614DA8DD
    # Boot Mode : Normal
    # Running from : C:\Documents and Settings\Administrator\My Documents\Downloads\adwcleaner.exe
    # Option [Delete]


    ***** [Services] *****

    Stopped & Deleted : Yontoo Desktop Updater

    ***** [Files / Folders] *****

    Deleted on reboot : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
    Deleted on reboot : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
    Deleted on reboot : C:\Program Files\Common Files\AVG Secure Search
    File Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\funmoods-speeddial.crx
    File Deleted : C:\END
    File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
    File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
    File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml
    File Deleted : C:\user.js
    Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Babylon
    Folder Deleted : C:\Documents and Settings\Administrator\Application Data\DefaultTab
    Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Funmoods
    Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2ls8wwb0.default\extensions\plugin@yontoo.com
    Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Yontoo
    Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\PackageAware
    Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\Wajam
    Folder Deleted : C:\Documents and Settings\Administrator\Start Menu\Programs\Browser Manager
    Folder Deleted : C:\Documents and Settings\Administrator\Start Menu\Programs\Wajam
    Folder Deleted : C:\Documents and Settings\All Users\Application Data\APN
    Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Secure Search
    Folder Deleted : C:\Documents and Settings\All Users\Application Data\Babylon
    Folder Deleted : C:\Documents and Settings\All Users\Application Data\Tarma Installer
    Folder Deleted : C:\Documents and Settings\All Users\Application Data\WeCareReminder
    Folder Deleted : C:\Program Files\Wajam
    Folder Deleted : C:\Program Files\Yontoo

    ***** [Registry] *****

    Key Deleted : HKCU\Software\Conduit
    Key Deleted : HKCU\Software\DataMngr_Toolbar
    Key Deleted : HKCU\Software\Default Tab
    Key Deleted : HKCU\Software\IGearSettings
    Key Deleted : HKCU\Software\InstallCore
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416D-A838-AB665251703A}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Funmoods
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
    Key Deleted : HKCU\Software\pc optimizer pro
    Key Deleted : HKCU\Software\Softonic
    Key Deleted : HKCU\Software\Wajam
    Key Deleted : HKCU\Software\wecarereminder
    Key Deleted : HKLM\Software\AVG Security Toolbar
    Key Deleted : HKLM\Software\Babylon
    Key Deleted : HKLM\Software\BabylonToolbar
    Key Deleted : HKLM\Software\BrowserMngr
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\priam_bho.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
    Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
    Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
    Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO
    Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
    Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
    Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
    Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
    Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
    Key Deleted : HKLM\Software\Conduit
    Key Deleted : HKLM\Software\Default Tab
    Key Deleted : HKLM\Software\DefaultTab
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Playbryte
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wajam
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam
    Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
    Key Deleted : HKLM\Software\Wajam
    Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping [{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [BrowserMngr Start Page]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [BrowserMngrDefaultScope]
    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
    Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

    ***** [Internet Browsers] *****

    -\\ Internet Explorer v6.0.2900.5512

    Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?affID=111305&tt=120912_cpc_3712_8&babsrc=HP_ss&mntrId=1c4b856a000000000000001111cee809 --> hxxp://www.google.com
    Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=111305&tt=120912_cpc_3712_8&babsrc=NT_ss&mntrId=1c4b856a000000000000001111cee809 --> hxxp://www.google.com
    Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=iron2&chnl=iron2&cd=2XzuyEtN2Y1L1QzutDtDtCtCtCtC0C0E0EzztDzyzzyDyC0AtN0D0Tzu0CtByEyDtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1916545764 --> hxxp://www.google.com

    -\\ Mozilla Firefox v20.0.1 (en-US)

    File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2ls8wwb0.default\prefs.js

    C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2ls8wwb0.default\user.js ... Deleted !

    Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");
    Deleted : user_pref("browser.search.selectedEngine", "AVG Secure Search");
    Deleted : user_pref("extentions.y2layers.defaultEnableAppsList", "DropDownDeals,buzzdock,YontooNewOffers");
    Deleted : user_pref("extentions.y2layers.installId", "ff96c4de-bfce-4ceb-a7d8-b38ad70d226f");

    -\\ Google Chrome v26.0.1410.64

    File : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[S1].txt - [11912 octets] - [23/05/2013 20:31:33]

    ########## EOF - C:\AdwCleaner[S1].txt - [11973 octets] ##########
  7. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 4.9.4 (05.06.2013:1)
    OS: Microsoft Windows XP x86
    Ran by Administrator on Thu 05/23/2013 at 20:40:41.21
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\torch
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\torch



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] "C:\Documents and Settings\Administrator\Application Data\goforfiles"
    Failed to delete: [Folder] "C:\Documents and Settings\Administrator\Local Settings\Application Data\torch"
    Failed to delete: [Folder] "C:\Program Files\goforfiles"



    ~~~ FireFox

    Successfully deleted the following from C:\Documents and Settings\Administrator\Application Data\mozilla\firefox\profiles\2ls8wwb0.default\prefs.js

    user_pref("browser.startup.homepage", "hxxp://mysearch.avg.com/?cid={317F8199-0D3B-4481-8404-734F644A8F8E}&mid=9fb6e163c8b3448d9e18151bf31201f8-f3652a474480b4664b83f9f993bd951
    Emptied folder: C:\Documents and Settings\Administrator\Application Data\mozilla\firefox\profiles\2ls8wwb0.default\minidumps [2 files]



    ~~~ Chrome

    Successfully deleted: [Folder] C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\kiplfnciaokpcennlkldkdaeaaomamof





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Thu 05/23/2013 at 20:46:54.31
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  8. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    OTL logfile created on: 5/24/2013 7:48:47 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    509.98 Mb Total Physical Memory | 259.66 Mb Available Physical Memory | 50.91% Memory free
    1.21 Gb Paging File | 0.85 Gb Available in Paging File | 69.90% Paging File free
    Paging file location(s): C:\pagefile.sys 763 763 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 37.24 Gb Total Space | 7.36 Gb Free Space | 19.77% Space Free | Partition Type: NTFS

    Computer Name: ODAM-A5614DA8DD | User Name: Administrator | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2013/05/24 07:48:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe
    PRC - [2013/05/16 15:21:31 | 001,015,984 | ---- | M] (AVG Secure Search) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
    PRC - [2013/05/09 01:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
    PRC - [2013/05/09 01:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    PRC - [2013/05/02 14:08:25 | 001,105,408 | ---- | M] (Spotify Ltd) -- C:\Documents and Settings\Administrator\Application Data\Spotify\Data\SpotifyWebHelper.exe
    PRC - [2013/04/15 15:46:38 | 000,364,112 | ---- | M] (http://www.goforfiles.com/) -- C:\Program Files\GoforFiles\GFFUpdater.exe
    PRC - [2013/03/17 20:55:45 | 000,170,912 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
    PRC - [2013/03/12 00:05:50 | 029,106,336 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe
    PRC - [2013/02/03 13:49:15 | 001,349,472 | ---- | M] (Torch Media Inc.) -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\torch.exe
    PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


    ========== Modules (No Company Name) ==========

    MOD - [2013/05/23 09:03:41 | 002,085,888 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\13052301\algo.dll
    MOD - [2013/02/03 13:49:16 | 000,573,792 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\ppgooglenaclpluginchrome.dll
    MOD - [2013/02/03 13:49:15 | 004,008,040 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\pdf.dll
    MOD - [2013/02/03 13:49:15 | 001,403,760 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\avcodec-54.dll
    MOD - [2013/02/03 13:49:15 | 000,225,648 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\avformat-54.dll
    MOD - [2013/02/03 13:49:15 | 000,153,968 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\avutil-51.dll
    MOD - [2011/09/27 08:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    MOD - [2011/09/27 08:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll


    ========== Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- -- (NMSAccess)
    SRV - [2013/05/16 15:21:31 | 001,015,984 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
    SRV - [2013/05/16 06:48:32 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
    SRV - [2013/05/09 01:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2013/04/19 07:13:18 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
    SRV - [2013/04/18 18:38:04 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
    SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
    SRV - [2013/03/17 20:55:45 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
    DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
    DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
    DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
    DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - [2013/05/18 08:15:46 | 000,015,616 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\TrueSight.sys -- (TrueSight)
    DRV - [2013/05/16 15:21:31 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
    DRV - [2013/05/09 01:59:10 | 000,765,736 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
    DRV - [2013/05/09 01:59:10 | 000,368,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2013/05/09 01:59:10 | 000,174,664 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\aswVmm.sys -- (aswVmm)
    DRV - [2013/05/09 01:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2013/05/09 01:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\aswRvrt.sys -- (aswRvrt)
    DRV - [2013/05/09 01:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswMonFlt.sys -- (aswMonFlt)
    DRV - [2013/05/09 01:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
    DRV - [2013/05/09 01:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2013/01/09 19:33:27 | 000,279,712 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
    DRV - [2013/01/09 19:33:25 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
    DRV - [2013/01/09 19:24:43 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
    DRV - [2011/07/13 14:39:10 | 000,056,496 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\NBVol.sys -- (NBVol)
    DRV - [2011/07/13 14:39:10 | 000,012,464 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\NBVolUp.sys -- (NBVolUp)
    DRV - [2004/09/17 10:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
    DRV - [2002/07/16 16:07:00 | 000,008,704 | ---- | M] (Primax Electronics Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pelusblf.sys -- (pelusblf)
    DRV - [2002/06/28 18:21:40 | 000,017,251 | ---- | M] (Primax Electronics Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PELMOUSE.SYS -- (pelmouse)
    DRV - [2001/09/07 17:10:02 | 000,158,872 | ---- | M] (Kensington Technology Group) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KMW_SYS.sys -- (KMW_SYS)
    DRV - [2001/08/22 09:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (OMCI)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
    IE - HKLM\..\SearchScopes,DefaultScope =


    IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = about:blank
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\..\SearchScopes,Backup.Old.DefaultScope = {0D7562AE-8EF6-416d-A838-AB665251703A}
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - user.js - File not found

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013/02/28 07:42:18 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/17 13:52:49 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/19 07:13:25 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/04/19 07:12:30 | 000,000,000 | ---D | M]

    [2013/03/08 14:48:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
    [2013/05/23 20:31:57 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2ls8wwb0.default\extensions
    [2013/04/19 07:12:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2013/04/19 07:13:25 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2013/03/07 07:30:20 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
    [2013/05/16 15:22:42 | 000,003,725 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml
    [2013/03/07 07:30:20 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: ()
    CHR - default_search_provider: search_url =
    CHR - default_search_provider: suggest_url =
    CHR - homepage: http://www.google.com
    CHR - Extension: No name found = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.172_0\

    O1 HOSTS File: ([2013/05/23 17:34:58 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
    O4 - HKU\S-1-5-21-2025429265-838170752-839522115-500..\Run: [Spotify Web Helper] C:\Documents and Settings\Administrator\Application Data\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
    O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-2025429265-838170752-839522115-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2025429265-838170752-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-2025429265-838170752-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1342483168609 (WUWebControl Class)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.217.0.5 24.217.201.67 24.247.15.53
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E03B4504-FFF3-4F1A-B0E7-2736C2B36CDF}: DhcpNameServer = 24.217.0.5 24.217.201.67 24.247.15.53
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2011/12/03 16:02:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/05/23 20:40:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
    [2013/05/23 20:40:26 | 000,000,000 | ---D | C] -- C:\JRT
    [2013/05/23 17:01:58 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2013/05/23 16:58:10 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2013/05/23 16:58:10 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2013/05/23 16:58:10 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2013/05/23 16:58:10 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2013/05/23 16:56:44 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2013/05/23 16:55:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
    [2013/05/18 08:13:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\RK_Quarantine
    [2013/05/17 16:37:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
    [2013/05/17 13:58:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
    [2013/05/17 13:54:27 | 000,029,816 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2013/05/17 13:54:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
    [2013/05/17 13:54:26 | 000,368,944 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2013/05/17 13:54:24 | 000,056,080 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2013/05/17 13:54:24 | 000,049,760 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2013/05/17 13:54:21 | 000,765,736 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
    [2013/05/17 13:54:13 | 000,066,336 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys
    [2013/05/17 13:54:12 | 000,229,648 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2013/05/17 13:52:01 | 000,041,664 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2013/05/17 13:50:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
    [2013/05/17 13:49:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
    [2013/05/16 15:25:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\WinZip
    [2013/05/16 15:24:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinZip
    [2013/05/16 15:23:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip
    [2013/05/16 15:23:40 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip
    [2013/05/16 15:22:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:15 | 000,037,664 | ---- | C] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
    [2013/05/16 15:22:04 | 000,000,000 | ---D | C] -- C:\Program Files\AVG SafeGuard toolbar
    [2013/05/16 15:11:24 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
    [2013/05/16 15:11:24 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
    [2013/05/16 14:15:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
    [2013/05/16 14:14:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2013/05/16 14:14:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2013/05/16 14:14:32 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2013/05/16 14:14:31 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2013/05/16 09:09:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Adobe CS6
    [2013/05/16 08:58:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Globalscape
    [2013/05/16 08:58:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Globalscape
    [2013/05/16 08:57:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Globalscape
    [2013/05/16 08:57:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Globalscape
    [2013/05/16 08:56:56 | 000,000,000 | ---D | C] -- C:\Program Files\Globalscape
    [2013/05/14 13:29:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Chess Art Project
    [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2013/05/24 07:48:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
    [2013/05/24 07:05:00 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2013/05/24 01:54:00 | 000,000,378 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
    [2013/05/23 20:34:03 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2013/05/23 20:34:01 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\GoforFilesUpdate.job
    [2013/05/23 20:33:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2013/05/23 20:17:27 | 003,661,544 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2013/05/23 19:46:17 | 000,493,976 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2013/05/23 19:46:17 | 000,084,520 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2013/05/23 19:24:20 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2013/05/23 17:34:58 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2013/05/23 17:02:06 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2013/05/23 13:21:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2013/05/18 08:15:46 | 000,015,616 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
    [2013/05/18 07:52:05 | 000,001,831 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2013/05/17 13:58:03 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2013/05/17 13:54:28 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2013/05/17 13:54:13 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2013/05/16 15:26:37 | 000,003,838 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Attach.zip
    [2013/05/16 15:21:31 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
    [2013/05/16 14:14:37 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/05/09 19:44:57 | 000,102,912 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2013/05/09 14:51:18 | 000,060,665 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\6534_582701260029_6824834_n.jpg
    [2013/05/09 01:59:10 | 000,765,736 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
    [2013/05/09 01:59:10 | 000,368,944 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2013/05/09 01:59:10 | 000,174,664 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswVmm.sys
    [2013/05/09 01:59:10 | 000,056,080 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2013/05/09 01:59:10 | 000,049,376 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys
    [2013/05/09 01:59:09 | 000,066,336 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys
    [2013/05/09 01:59:09 | 000,049,760 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2013/05/09 01:59:08 | 000,029,816 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2013/05/09 01:58:37 | 000,041,664 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2013/05/09 01:58:28 | 000,229,648 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2013/04/29 07:24:33 | 000,001,914 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Spotify.lnk
    [2013/04/27 16:36:19 | 000,043,536 | -H-- | M] () -- C:\Documents and Settings\Administrator\Desktop\Plain-Black-Wallpaper.png
    [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2013/05/23 17:02:06 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2013/05/23 17:02:01 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2013/05/23 16:58:10 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2013/05/23 16:58:10 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2013/05/23 16:58:10 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2013/05/23 16:58:10 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2013/05/23 16:58:10 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2013/05/18 08:15:43 | 000,015,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
    [2013/05/17 13:58:03 | 000,001,831 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2013/05/17 13:58:03 | 000,001,813 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2013/05/17 13:55:20 | 000,000,900 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2013/05/17 13:55:19 | 000,000,896 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2013/05/17 13:54:28 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2013/05/17 13:54:19 | 000,174,664 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswVmm.sys
    [2013/05/17 13:54:17 | 000,049,376 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys
    [2013/05/17 13:54:17 | 000,000,378 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
    [2013/05/16 15:26:35 | 000,003,838 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Attach.zip
    [2013/05/16 14:14:37 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/05/09 14:51:12 | 000,060,665 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\6534_582701260029_6824834_n.jpg
    [2013/04/29 07:24:33 | 000,001,914 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Spotify.lnk
    [2013/04/27 16:36:15 | 000,043,536 | -H-- | C] () -- C:\Documents and Settings\Administrator\Desktop\Plain-Black-Wallpaper.png
    [2013/04/20 16:47:06 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
    [2013/04/13 08:07:36 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\AI_ContextMenu.dll
    [2013/04/13 07:45:25 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\AVERM.dll
    [2013/04/13 07:45:25 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\AVEQT.dll
    [2013/01/09 19:33:27 | 000,279,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
    [2013/01/09 19:33:25 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
    [2012/10/31 06:44:56 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\vusetup.dll
    [2012/09/15 21:12:38 | 000,004,553 | ---- | C] () -- C:\WINDOWS\System32\Setup2k.ini
    [2012/09/15 21:12:38 | 000,000,253 | ---- | C] () -- C:\WINDOWS\System32\presetup.ini
    [2012/09/15 20:22:04 | 000,000,037 | ---- | C] () -- C:\WINDOWS\marscam.ini
    [2012/07/16 16:55:33 | 000,105,472 | ---- | C] () -- C:\WINDOWS\System32\makeAVIS.exe
    [2012/07/16 16:55:33 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\FLT_ffdshow.dll
    [2012/07/16 16:55:32 | 000,268,800 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll
    [2012/07/16 16:55:32 | 000,049,664 | ---- | C] () -- C:\WINDOWS\System32\ffavisynth.dll
    [2012/07/16 16:55:31 | 001,183,481 | ---- | C] () -- C:\WINDOWS\System32\unins000.exe
    [2012/07/16 16:55:31 | 000,044,870 | ---- | C] () -- C:\WINDOWS\System32\unins000.dat
    [2012/06/06 21:55:33 | 000,723,230 | ---- | C] () -- C:\WINDOWS\unins000.exe
    [2012/06/06 21:55:33 | 000,105,652 | ---- | C] () -- C:\WINDOWS\unins000.dat
    [2012/02/15 10:23:12 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
    [2012/01/07 00:07:36 | 000,105,754 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2025429265-838170752-839522115-500-0.dat
    [2012/01/06 08:47:34 | 000,105,754 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    [2011/12/06 15:01:11 | 000,102,912 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2011/12/03 16:24:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
    [2011/12/03 16:05:12 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2011/12/03 15:58:59 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2011/12/03 07:53:59 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2011/12/03 07:50:48 | 003,661,544 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2011/09/22 10:08:56 | 003,978,240 | ---- | C] () -- C:\WINDOWS\System32\ffmpeg.dll
    [2011/08/22 12:07:48 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
    [2011/08/22 12:07:02 | 000,157,184 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll
    [2011/08/22 12:07:00 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
    [2011/08/22 12:06:30 | 001,525,760 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll
    [2011/08/22 12:06:30 | 000,211,968 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll
    [2011/08/22 12:06:30 | 000,099,840 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
    [2011/08/22 12:06:28 | 000,330,240 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll
    [2011/08/22 12:06:28 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll
    [2011/08/22 12:06:26 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll
    [2011/08/22 12:06:26 | 000,136,704 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
    [2011/05/30 06:42:50 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

    ========== ZeroAccess Check ==========

    [2012/09/15 20:04:55 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    "" = %SystemRoot%\system32\shdocvw.dll -- [2013/04/16 14:18:26 | 001,510,400 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
    "" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/13 17:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both

    ========== LOP Check ==========

    [2013/03/12 07:42:30 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Administrator\Application Data\4B856A
    [2012/08/30 06:48:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Acoustica
    [2013/04/13 07:58:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Aimersoft Video Converter Ultimate
    [2012/12/27 08:40:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\AimOne
    [2012/08/30 06:52:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Applied Acoustics Systems
    [2013/05/16 15:22:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar
    [2013/02/24 09:32:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\BitTorrent
    [2013/01/09 19:26:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Lite
    [2013/04/22 11:34:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\DDMSettings
    [2013/05/23 20:35:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Dropbox
    [2013/05/16 08:57:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Globalscape
    [2012/06/27 07:31:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Oracle
    [2013/02/25 09:38:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\player
    [2013/05/11 21:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Spotify
    [2012/12/02 15:22:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SumatraPDF
    [2012/08/30 06:49:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SynthMaker
    [2012/09/17 22:05:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Uniblue
    [2013/04/13 07:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\{950EB46C-6AC7-4ACC-AB36-9A6A77C08B6A}
    [2013/02/24 09:29:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
    [2012/09/12 16:46:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acoustica
    [2013/04/13 07:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Aimersoft Video Converter Ultimate
    [2013/05/17 13:50:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
    [2013/05/16 15:22:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
    [2013/01/09 19:26:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
    [2012/09/15 20:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
    [2013/05/16 08:58:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Globalscape
    [2012/11/11 16:30:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
    [2012/08/02 08:00:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Transparent
    [2013/05/16 15:25:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
    [2013/04/20 15:41:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\xml_param
    [2012/02/05 18:42:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

    ========== Purity Check ==========



    < End of report >
  9. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    [​IMG] Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Code:
    :OTL
    SRV - File not found [Auto | Stopped] -- -- (NMSAccess)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
    DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
    DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
    DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
    DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
    FF - user.js - File not found
    [2013/03/12 07:42:30 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Administrator\Application Data\4B856A
    PRC - [2013/05/16 15:21:31 | 001,015,984 | ---- | M] (AVG Secure Search) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
    SRV - [2013/05/16 15:21:31 | 001,015,984 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
    DRV - [2013/05/16 15:21:31 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
    [2013/05/16 15:22:42 | 000,003,725 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml
    [2013/05/16 15:22:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:15 | 000,037,664 | ---- | C] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
    [2013/05/16 15:22:04 | 000,000,000 | ---D | C] -- C:\Program Files\AVG SafeGuard toolbar
    [2013/05/16 15:22:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
    
    
    :Services
    
    :Reg
    
    :Files
    C:\Program Files\Common Files\AVG Secure Search
    
    :Commands
    [purity]
    [emptytemp]
    [emptyjava]
    [emptyflash]
    [Reboot]
    
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.
    Last scans....

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
  10. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    OTL logfile created on: 5/24/2013 7:48:47 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    509.98 Mb Total Physical Memory | 259.66 Mb Available Physical Memory | 50.91% Memory free
    1.21 Gb Paging File | 0.85 Gb Available in Paging File | 69.90% Paging File free
    Paging file location(s): C:\pagefile.sys 763 763 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 37.24 Gb Total Space | 7.36 Gb Free Space | 19.77% Space Free | Partition Type: NTFS

    Computer Name: ODAM-A5614DA8DD | User Name: Administrator | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2013/05/24 07:48:24 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe
    PRC - [2013/05/16 15:21:31 | 001,015,984 | ---- | M] (AVG Secure Search) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
    PRC - [2013/05/09 01:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
    PRC - [2013/05/09 01:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    PRC - [2013/05/02 14:08:25 | 001,105,408 | ---- | M] (Spotify Ltd) -- C:\Documents and Settings\Administrator\Application Data\Spotify\Data\SpotifyWebHelper.exe
    PRC - [2013/04/15 15:46:38 | 000,364,112 | ---- | M] (http://www.goforfiles.com/) -- C:\Program Files\GoforFiles\GFFUpdater.exe
    PRC - [2013/03/17 20:55:45 | 000,170,912 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
    PRC - [2013/03/12 00:05:50 | 029,106,336 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe
    PRC - [2013/02/03 13:49:15 | 001,349,472 | ---- | M] (Torch Media Inc.) -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\torch.exe
    PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


    ========== Modules (No Company Name) ==========

    MOD - [2013/05/23 09:03:41 | 002,085,888 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\13052301\algo.dll
    MOD - [2013/02/03 13:49:16 | 000,573,792 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\ppgooglenaclpluginchrome.dll
    MOD - [2013/02/03 13:49:15 | 004,008,040 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\pdf.dll
    MOD - [2013/02/03 13:49:15 | 001,403,760 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\avcodec-54.dll
    MOD - [2013/02/03 13:49:15 | 000,225,648 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\avformat-54.dll
    MOD - [2013/02/03 13:49:15 | 000,153,968 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Torch\Application\23.0.0.2295\avutil-51.dll
    MOD - [2011/09/27 08:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    MOD - [2011/09/27 08:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll


    ========== Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- -- (NMSAccess)
    SRV - [2013/05/16 15:21:31 | 001,015,984 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
    SRV - [2013/05/16 06:48:32 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
    SRV - [2013/05/09 01:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2013/04/19 07:13:18 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
    SRV - [2013/04/18 18:38:04 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
    SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
    SRV - [2013/03/17 20:55:45 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
    DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
    DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
    DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
    DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
    DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - [2013/05/18 08:15:46 | 000,015,616 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\TrueSight.sys -- (TrueSight)
    DRV - [2013/05/16 15:21:31 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
    DRV - [2013/05/09 01:59:10 | 000,765,736 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
    DRV - [2013/05/09 01:59:10 | 000,368,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2013/05/09 01:59:10 | 000,174,664 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\aswVmm.sys -- (aswVmm)
    DRV - [2013/05/09 01:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2013/05/09 01:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\aswRvrt.sys -- (aswRvrt)
    DRV - [2013/05/09 01:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswMonFlt.sys -- (aswMonFlt)
    DRV - [2013/05/09 01:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
    DRV - [2013/05/09 01:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2013/01/09 19:33:27 | 000,279,712 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
    DRV - [2013/01/09 19:33:25 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
    DRV - [2013/01/09 19:24:43 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
    DRV - [2011/07/13 14:39:10 | 000,056,496 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\NBVol.sys -- (NBVol)
    DRV - [2011/07/13 14:39:10 | 000,012,464 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\NBVolUp.sys -- (NBVolUp)
    DRV - [2004/09/17 10:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
    DRV - [2002/07/16 16:07:00 | 000,008,704 | ---- | M] (Primax Electronics Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pelusblf.sys -- (pelusblf)
    DRV - [2002/06/28 18:21:40 | 000,017,251 | ---- | M] (Primax Electronics Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PELMOUSE.SYS -- (pelmouse)
    DRV - [2001/09/07 17:10:02 | 000,158,872 | ---- | M] (Kensington Technology Group) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KMW_SYS.sys -- (KMW_SYS)
    DRV - [2001/08/22 09:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (OMCI)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
    IE - HKLM\..\SearchScopes,DefaultScope =


    IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = about:blank
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\..\SearchScopes,Backup.Old.DefaultScope = {0D7562AE-8EF6-416d-A838-AB665251703A}
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-2025429265-838170752-839522115-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - user.js - File not found

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013/02/28 07:42:18 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/05/17 13:52:49 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/19 07:13:25 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/04/19 07:12:30 | 000,000,000 | ---D | M]

    [2013/03/08 14:48:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
    [2013/05/23 20:31:57 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2ls8wwb0.default\extensions
    [2013/04/19 07:12:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2013/04/19 07:13:25 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
    [2013/03/07 07:30:20 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
    [2013/05/16 15:22:42 | 000,003,725 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml
    [2013/03/07 07:30:20 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

    ========== Chrome ==========

    CHR - default_search_provider: ()
    CHR - default_search_provider: search_url =
    CHR - default_search_provider: suggest_url =
    CHR - homepage: http://www.google.com
    CHR - Extension: No name found = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.172_0\

    O1 HOSTS File: ([2013/05/23 17:34:58 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
    O4 - HKU\S-1-5-21-2025429265-838170752-839522115-500..\Run: [Spotify Web Helper] C:\Documents and Settings\Administrator\Application Data\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
    O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Administrator\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-2025429265-838170752-839522115-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2025429265-838170752-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-2025429265-838170752-839522115-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1342483168609 (WUWebControl Class)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.217.0.5 24.217.201.67 24.247.15.53
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E03B4504-FFF3-4F1A-B0E7-2736C2B36CDF}: DhcpNameServer = 24.217.0.5 24.217.201.67 24.247.15.53
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2011/12/03 16:02:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/05/23 20:40:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
    [2013/05/23 20:40:26 | 000,000,000 | ---D | C] -- C:\JRT
    [2013/05/23 17:01:58 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2013/05/23 16:58:10 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2013/05/23 16:58:10 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2013/05/23 16:58:10 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2013/05/23 16:58:10 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2013/05/23 16:56:44 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2013/05/23 16:55:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
    [2013/05/18 08:13:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\RK_Quarantine
    [2013/05/17 16:37:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
    [2013/05/17 13:58:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
    [2013/05/17 13:54:27 | 000,029,816 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2013/05/17 13:54:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
    [2013/05/17 13:54:26 | 000,368,944 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2013/05/17 13:54:24 | 000,056,080 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2013/05/17 13:54:24 | 000,049,760 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2013/05/17 13:54:21 | 000,765,736 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
    [2013/05/17 13:54:13 | 000,066,336 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys
    [2013/05/17 13:54:12 | 000,229,648 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2013/05/17 13:52:01 | 000,041,664 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2013/05/17 13:50:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
    [2013/05/17 13:49:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
    [2013/05/16 15:25:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\WinZip
    [2013/05/16 15:24:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinZip
    [2013/05/16 15:23:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip
    [2013/05/16 15:23:40 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip
    [2013/05/16 15:22:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar
    [2013/05/16 15:22:15 | 000,037,664 | ---- | C] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
    [2013/05/16 15:22:04 | 000,000,000 | ---D | C] -- C:\Program Files\AVG SafeGuard toolbar
    [2013/05/16 15:11:24 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
    [2013/05/16 15:11:24 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
    [2013/05/16 14:15:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
    [2013/05/16 14:14:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2013/05/16 14:14:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2013/05/16 14:14:32 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2013/05/16 14:14:31 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2013/05/16 09:09:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Adobe CS6
    [2013/05/16 08:58:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Globalscape
    [2013/05/16 08:58:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Globalscape
    [2013/05/16 08:57:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Globalscape
    [2013/05/16 08:57:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Globalscape
    [2013/05/16 08:56:56 | 000,000,000 | ---D | C] -- C:\Program Files\Globalscape
    [2013/05/14 13:29:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Chess Art Project
    [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2013/05/24 07:48:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
    [2013/05/24 07:05:00 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2013/05/24 01:54:00 | 000,000,378 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
    [2013/05/23 20:34:03 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2013/05/23 20:34:01 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\GoforFilesUpdate.job
    [2013/05/23 20:33:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2013/05/23 20:17:27 | 003,661,544 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2013/05/23 19:46:17 | 000,493,976 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2013/05/23 19:46:17 | 000,084,520 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2013/05/23 19:24:20 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2013/05/23 17:34:58 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2013/05/23 17:02:06 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2013/05/23 13:21:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2013/05/18 08:15:46 | 000,015,616 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
    [2013/05/18 07:52:05 | 000,001,831 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2013/05/17 13:58:03 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2013/05/17 13:54:28 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2013/05/17 13:54:13 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2013/05/16 15:26:37 | 000,003,838 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Attach.zip
    [2013/05/16 15:21:31 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
    [2013/05/16 14:14:37 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/05/09 19:44:57 | 000,102,912 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2013/05/09 14:51:18 | 000,060,665 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\6534_582701260029_6824834_n.jpg
    [2013/05/09 01:59:10 | 000,765,736 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
    [2013/05/09 01:59:10 | 000,368,944 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2013/05/09 01:59:10 | 000,174,664 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswVmm.sys
    [2013/05/09 01:59:10 | 000,056,080 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2013/05/09 01:59:10 | 000,049,376 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys
    [2013/05/09 01:59:09 | 000,066,336 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys
    [2013/05/09 01:59:09 | 000,049,760 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2013/05/09 01:59:08 | 000,029,816 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2013/05/09 01:58:37 | 000,041,664 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2013/05/09 01:58:28 | 000,229,648 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2013/04/29 07:24:33 | 000,001,914 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Spotify.lnk
    [2013/04/27 16:36:19 | 000,043,536 | -H-- | M] () -- C:\Documents and Settings\Administrator\Desktop\Plain-Black-Wallpaper.png
    [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2013/05/23 17:02:06 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2013/05/23 17:02:01 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2013/05/23 16:58:10 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2013/05/23 16:58:10 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2013/05/23 16:58:10 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2013/05/23 16:58:10 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2013/05/23 16:58:10 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2013/05/18 08:15:43 | 000,015,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
    [2013/05/17 13:58:03 | 000,001,831 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2013/05/17 13:58:03 | 000,001,813 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2013/05/17 13:55:20 | 000,000,900 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2013/05/17 13:55:19 | 000,000,896 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2013/05/17 13:54:28 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2013/05/17 13:54:19 | 000,174,664 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswVmm.sys
    [2013/05/17 13:54:17 | 000,049,376 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys
    [2013/05/17 13:54:17 | 000,000,378 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
    [2013/05/16 15:26:35 | 000,003,838 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Attach.zip
    [2013/05/16 14:14:37 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/05/09 14:51:12 | 000,060,665 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\6534_582701260029_6824834_n.jpg
    [2013/04/29 07:24:33 | 000,001,914 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Spotify.lnk
    [2013/04/27 16:36:15 | 000,043,536 | -H-- | C] () -- C:\Documents and Settings\Administrator\Desktop\Plain-Black-Wallpaper.png
    [2013/04/20 16:47:06 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
    [2013/04/13 08:07:36 | 000,155,136 | ---- | C] () -- C:\WINDOWS\System32\AI_ContextMenu.dll
    [2013/04/13 07:45:25 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\AVERM.dll
    [2013/04/13 07:45:25 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\AVEQT.dll
    [2013/01/09 19:33:27 | 000,279,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
    [2013/01/09 19:33:25 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
    [2012/10/31 06:44:56 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\vusetup.dll
    [2012/09/15 21:12:38 | 000,004,553 | ---- | C] () -- C:\WINDOWS\System32\Setup2k.ini
    [2012/09/15 21:12:38 | 000,000,253 | ---- | C] () -- C:\WINDOWS\System32\presetup.ini
    [2012/09/15 20:22:04 | 000,000,037 | ---- | C] () -- C:\WINDOWS\marscam.ini
    [2012/07/16 16:55:33 | 000,105,472 | ---- | C] () -- C:\WINDOWS\System32\makeAVIS.exe
    [2012/07/16 16:55:33 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\FLT_ffdshow.dll
    [2012/07/16 16:55:32 | 000,268,800 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll
    [2012/07/16 16:55:32 | 000,049,664 | ---- | C] () -- C:\WINDOWS\System32\ffavisynth.dll
    [2012/07/16 16:55:31 | 001,183,481 | ---- | C] () -- C:\WINDOWS\System32\unins000.exe
    [2012/07/16 16:55:31 | 000,044,870 | ---- | C] () -- C:\WINDOWS\System32\unins000.dat
    [2012/06/06 21:55:33 | 000,723,230 | ---- | C] () -- C:\WINDOWS\unins000.exe
    [2012/06/06 21:55:33 | 000,105,652 | ---- | C] () -- C:\WINDOWS\unins000.dat
    [2012/02/15 10:23:12 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
    [2012/01/07 00:07:36 | 000,105,754 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2025429265-838170752-839522115-500-0.dat
    [2012/01/06 08:47:34 | 000,105,754 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    [2011/12/06 15:01:11 | 000,102,912 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2011/12/03 16:24:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
    [2011/12/03 16:05:12 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2011/12/03 15:58:59 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2011/12/03 07:53:59 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2011/12/03 07:50:48 | 003,661,544 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2011/09/22 10:08:56 | 003,978,240 | ---- | C] () -- C:\WINDOWS\System32\ffmpeg.dll
    [2011/08/22 12:07:48 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
    [2011/08/22 12:07:02 | 000,157,184 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll
    [2011/08/22 12:07:00 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
    [2011/08/22 12:06:30 | 001,525,760 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll
    [2011/08/22 12:06:30 | 000,211,968 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll
    [2011/08/22 12:06:30 | 000,099,840 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
    [2011/08/22 12:06:28 | 000,330,240 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll
    [2011/08/22 12:06:28 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll
    [2011/08/22 12:06:26 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll
    [2011/08/22 12:06:26 | 000,136,704 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
    [2011/05/30 06:42:50 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

    ========== ZeroAccess Check ==========

    [2012/09/15 20:04:55 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    "" = %SystemRoot%\system32\shdocvw.dll -- [2013/04/16 14:18:26 | 001,510,400 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
    "" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/13 17:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both

    ========== LOP Check ==========

    [2013/03/12 07:42:30 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Administrator\Application Data\4B856A
    [2012/08/30 06:48:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Acoustica
    [2013/04/13 07:58:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Aimersoft Video Converter Ultimate
    [2012/12/27 08:40:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\AimOne
    [2012/08/30 06:52:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Applied Acoustics Systems
    [2013/05/16 15:22:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar
    [2013/02/24 09:32:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\BitTorrent
    [2013/01/09 19:26:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Lite
    [2013/04/22 11:34:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\DDMSettings
    [2013/05/23 20:35:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Dropbox
    [2013/05/16 08:57:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Globalscape
    [2012/06/27 07:31:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Oracle
    [2013/02/25 09:38:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\player
    [2013/05/11 21:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Spotify
    [2012/12/02 15:22:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SumatraPDF
    [2012/08/30 06:49:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\SynthMaker
    [2012/09/17 22:05:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Uniblue
    [2013/04/13 07:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\{950EB46C-6AC7-4ACC-AB36-9A6A77C08B6A}
    [2013/02/24 09:29:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
    [2012/09/12 16:46:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acoustica
    [2013/04/13 07:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Aimersoft Video Converter Ultimate
    [2013/05/17 13:50:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
    [2013/05/16 15:22:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
    [2013/01/09 19:26:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
    [2012/09/15 20:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Whiz
    [2013/05/16 08:58:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Globalscape
    [2012/11/11 16:30:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
    [2012/08/02 08:00:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Transparent
    [2013/05/16 15:25:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
    [2013/04/20 15:41:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\xml_param
    [2012/02/05 18:42:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

    ========== Purity Check ==========



    < End of report >
  11. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    Results of screen317's Security Check version 0.99.64
    Windows XP Service Pack 3 x86
    Internet Explorer 6 Out of date!
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    Please wait while WMIC compiles updated MOF files.d
    I
    s
    p
    l
    a
    y
    N
    a
    m
    e
    ECHO is off.
    a
    v
    a
    s
    t
    !
    ECHO is off.
    A
    n
    t
    I
    v
    I
    r
    u
    s
    ECHO is off.
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    Malwarebytes Anti-Malware version 1.75.0.1300
    JavaFX 2.1.1
    Java 7 Update 17
    Java version out of Date!
    Adobe Flash Player 11.7.700.202
    Adobe Reader 10.1.6 Adobe Reader out of Date!
    Mozilla Firefox 20.0.1 Firefox out of Date!
    Google Chrome 26.0.1410.64
    Google Chrome 27.0.1453.94
    ````````Process Check: objlist.exe by Laurent````````
    Malwarebytes Anti-Malware mbamservice.exe
    Malwarebytes Anti-Malware mbamgui.exe
    Malwarebytes' Anti-Malware mbamscheduler.exe
    AVAST Software Avast AvastSvc.exe
    AVAST Software Avast avastUI.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C:: 23% Defragment your hard drive soon! (Do NOT defrag if SSD!)
    ````````````````````End of Log``````````````````````
     
  12. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    Farbar Service Scanner Version: 25-05-2013
    Ran by Administrator (administrator) on 25-05-2013 at 08:20:42
    Running from "C:\Documents and Settings\Administrator\My Documents\Downloads"
    Microsoft Windows XP Service Pack 3 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Attempt to access Yahoo IP returned error. Yahoo IP is offline
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Security Center:
    ============

    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    File Check:
    ========
    C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
    C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
    C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
    C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
    C:\WINDOWS\system32\netman.dll => MD5 is legit
    C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\WINDOWS\system32\srsvc.dll => MD5 is legit
    C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
    C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
    C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
    C:\WINDOWS\system32\qmgr.dll => MD5 is legit
    C:\WINDOWS\system32\es.dll => MD5 is legit
    C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
    C:\WINDOWS\system32\svchost.exe => MD5 is legit
    C:\WINDOWS\system32\rpcss.dll => MD5 is legit
    C:\WINDOWS\system32\services.exe => MD5 is legit

    Extra List:
    =======
    aswTdi(8) Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
    0x080000000500000001000000020000000300000004000000080000000600000007000000
    IpSec Tag value is correct.

    **** End of log ****
  13. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    C:\Documents and Settings\Administrator\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\54\3ebb08b6-12238dd9Java/Exploit.Agent.NBS trojancleaned by deleting - quarantined
    C:\System Volume Information\_restore{1F1E36AB-A67C-46BB-8508-BE655BB35447}\RP445\A0079798.dlla variant of Win32/Adware.Yontoo.B applicationcleaned by deleting - quarantined
    C:\System Volume Information\_restore{1F1E36AB-A67C-46BB-8508-BE655BB35447}\RP445\A0079802.dlla variant of Win32/Adware.Yontoo.B applicationcleaned by deleting - quarantined
    C:\System Volume Information\_restore{1F1E36AB-A67C-46BB-8508-BE655BB35447}\RP445\A0079806.dlla variant of Win32/Adware.Yontoo.B applicationcleaned by deleting - quarantined
    C:\System Volume Information\_restore{1F1E36AB-A67C-46BB-8508-BE655BB35447}\RP445\A0079810.dlla variant of Win32/Adware.Yontoo.B applicationcleaned by deleting - quarantined
    C:\System Volume Information\_restore{1F1E36AB-A67C-46BB-8508-BE655BB35447}\RP445\A0079817.dlla variant of Win32/Adware.Yontoo.A applicationcleaned by deleting - quarantined
  14. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    OTL log is incorrect.
    You clicked on "Scan" button instead of "Fix" button.
    Redo.
  15. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    All processes killed
    ========== OTL ==========
    Service NMSAccess stopped successfully!
    Service NMSAccess deleted successfully!
    Service WDICA stopped successfully!
    Service WDICA deleted successfully!
    Service PDRFRAME stopped successfully!
    Service PDRFRAME deleted successfully!
    Service PDRELI stopped successfully!
    Service PDRELI deleted successfully!
    Service PDFRAME stopped successfully!
    Service PDFRAME deleted successfully!
    Service PDCOMP stopped successfully!
    Service PDCOMP deleted successfully!
    Service PCIDump stopped successfully!
    Service PCIDump deleted successfully!
    Service lbrtfdc stopped successfully!
    Service lbrtfdc deleted successfully!
    Service i2omgmt stopped successfully!
    Service i2omgmt deleted successfully!
    Service Changer stopped successfully!
    Service Changer deleted successfully!
    Service catchme stopped successfully!
    Service catchme deleted successfully!
    File C:\ComboFix\catchme.sys not found.
    C:\Documents and Settings\Administrator\Application Data\4B856A folder moved successfully.
    No active process named ToolbarUpdater.exe was found!
    Service vToolbarUpdater15.2.0 stopped successfully!
    Service vToolbarUpdater15.2.0 deleted successfully!
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe moved successfully.
    Service avgtp stopped successfully!
    Service avgtp deleted successfully!
    C:\WINDOWS\system32\drivers\avgtpx86.sys moved successfully.
    C:\Program Files\Mozilla Firefox\searchplugins\safeguard-secure-search.xml moved successfully.
    C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG SafeGuard toolbar\SiteSafety folder moved successfully.
    C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG SafeGuard toolbar\DNT folder moved successfully.
    C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG SafeGuard toolbar folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\skin folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\zh-tw folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\zh-cn folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\tr folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\th folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\sv folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\sr folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\sk folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\ru folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\ro folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\pt-br folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\pt folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\pl folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\nl folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\nb folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\ms folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\ko folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\ja folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\it folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\id folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\hu folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\hi folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\fr folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\fi folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\es-es folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\es folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\en folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\el folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\de folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\da folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\cs folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale\af folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules\locale folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\modules folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\locale\en-US folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\locale folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\components folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5\chrome folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt\15.2.0.5 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\FireFoxExt folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar folder moved successfully.
    C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar\cache\tmp folder moved successfully.
    C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar\cache folder moved successfully.
    C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar folder moved successfully.
    File C:\WINDOWS\System32\drivers\avgtpx86.sys not found.
    Folder C:\Program Files\AVG SafeGuard toolbar\ not found.
    Folder C:\Documents and Settings\Administrator\Application Data\AVG SafeGuard toolbar\ not found.
    Folder C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar\ not found.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0 folder moved successfully.
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater folder moved successfully.
    C:\Program Files\Common Files\AVG Secure Search folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 102305606 bytes
    ->Temporary Internet Files folder emptied: 1081617 bytes
    ->FireFox cache emptied: 5279499 bytes
    ->Google Chrome cache emptied: 81873421 bytes
    ->Flash cache emptied: 8197977 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 49286 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 2189156 bytes
    %systemroot%\System32 .tmp files removed: 2577 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 42407360 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 232.00 mb


    [EMPTYJAVA]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService

    User: NetworkService

    Total Java Files Cleaned = 0.00 mb


    [EMPTYFLASH]

    User: Administrator
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: Default User

    User: LocalService

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.69.0 log created on 05252013_192409

    Files\Folders moved on Reboot...

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...
  16. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    [​IMG] Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions (if present).
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

    [​IMG] 1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it.
    • Run JavaRa.exe (Vista and 7 users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.
    • Do NOT post JavaRa log.

    ============================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [emptyjava]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure Windows Updates are current.

    4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Check if your browser plugins are up to date.
    Firefox - https://www.mozilla.org/en-US/plugincheck/
    other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

    6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    8. Run Temporary File Cleaner (TFC) weekly.

    9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    11. (Windows XP only) Run defrag at your convenience.

    12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    13. Read:
    How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
    Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

    14. Please, let me know, how your computer is doing.
  17. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    The system is running Faster.

    I think a lot of Space has been cleared up. So. That is a good Thing.

    As for the Initial Problem which was not being able to access the Control Panel,
    still remains a Problem. The error message informs me that "I don't have permission"

    Thank you for all your Help though. It was a good learning Process.

    Hopefully though, without completeing Reformating my system, there is a Solution

    to the Control Panel Problem. Again thanks for all your Help.
  18. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    When exactly does it happen?
    When you go Start>Control Panel or inside Control Panel?
     
  19. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    The Controls from Control Panel
  20. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    Download Windows Repair (All in One) from this site

    Install the program then run it.

    NOTE 1. In Windows Vista, 7 and 8 right click on the program, click "Run As Administrator".
    NOTE 2. Disable your antivirus program before running Windows Repair.


    Go to Step 2 and allow it to run CheckDisk by clicking on Do It button:

    [​IMG]



    Once that is done then go to Step 3 and allow it to run System File Check by clicking on Do It button:

    [​IMG]


    Go to Step 4 and under "System Restore" click on Create button:

    [​IMG]


    Go to Start Repairs tab and click Start button.

    Leave all checkmarks as they're.
    NOTE for Windows 8 users. Reset Registry Permissions is NOT checked by design.

    Click on Start button.

    [​IMG]

    Post Windows Repair log (_windows_repair_log.txt) which is located in the following folder:
    64-bit systems - C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Logs
    32-bit systems - C:\Program Files\Tweaking.com\Windows Repair (All in One)\Logs
  21. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    The Controls from Control Panel
  22. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    Go ahead with my previous reply.
  23. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    Running Repair Under System Account
    Starting Repairs...
    Start (5/27/2013 10:17:40 AM)

    Reset Registry Permissions 01/03
    HKEY_CURRENT_USER & Sub Keys
    Start (5/27/2013 10:17:41 AM)
    Running Repair Under Current User Account
    Done (5/27/2013 10:17:50 AM)

    Reset Registry Permissions 02/03
    HKEY_LOCAL_MACHINE & Sub Keys
    Start (5/27/2013 10:17:50 AM)
    Running Repair Under System Account
    Done (5/27/2013 10:20:32 AM)

    Reset Registry Permissions 03/03
    HKEY_CLASSES_ROOT & Sub Keys
    Start (5/27/2013 10:20:32 AM)
    Running Repair Under System Account
    Done (5/27/2013 10:22:41 AM)

    Register System Files
    Start (5/27/2013 10:22:41 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:30:10 AM)

    Repair WMI
    Start (5/27/2013 10:30:10 AM)
    Running Repair Under Current User Account
    The system cannot find the path specified.
    Access is denied.
    Invalid Global Switch.
    Running Repair Under System Account
    The system cannot find the path specified.
    Invalid Global Switch.
    Done (5/27/2013 10:34:25 AM)

    Repair Windows Firewall
    Start (5/27/2013 10:34:25 AM)
    Running Repair Under Current User Account
    System error 1060 has occurred.

    The specified service does not exist as an installed service.

    System error 1060 has occurred.

    The specified service does not exist as an installed service.

    The service name is invalid.

    More help is available by typing NET HELPMSG 2185.

    The service name is invalid.

    More help is available by typing NET HELPMSG 2185.

    Running Repair Under System Account
    System error 1060 has occurred.

    The specified service does not exist as an installed service.

    System error 1060 has occurred.

    The specified service does not exist as an installed service.

    The service name is invalid.

    More help is available by typing NET HELPMSG 2185.

    The service name is invalid.

    More help is available by typing NET HELPMSG 2185.

    Done (5/27/2013 10:35:10 AM)

    Repair Internet Explorer
    Start (5/27/2013 10:35:10 AM)
    Running Repair Under Current User Account
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    Running Repair Under System Account
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    Done (5/27/2013 10:41:33 AM)

    Repair MDAC/MS Jet
    Start (5/27/2013 10:41:33 AM)
    Running Repair Under Current User Account
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    Running Repair Under System Account
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    The system cannot find the path specified.
    Done (5/27/2013 10:42:44 AM)

    Repair Hosts File
    Start (5/27/2013 10:42:44 AM)
    Running Repair Under System Account
    Done (5/27/2013 10:42:51 AM)

    Remove Policies Set By Infections
    Start (5/27/2013 10:42:51 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:43:06 AM)

    Repair Icons
    Start (5/27/2013 10:43:06 AM)
    Running Repair Under System Account
    Could Not Find C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db.bak
    Could Not Find C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
    Done (5/27/2013 10:43:10 AM)

    Repair Winsock & DNS Cache
    Start (5/27/2013 10:43:10 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:43:50 AM)

    Repair Proxy Settings
    Start (5/27/2013 10:43:50 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:43:59 AM)

    Repair Windows Updates
    Start (5/27/2013 10:44:00 AM)
    Running Repair Under Current User Account
    The Automatic Updates service is not started.

    More help is available by typing NET HELPMSG 3521.

    The system cannot find the file specified.
    Running Repair Under System Account
    The BITS service is not started.

    More help is available by typing NET HELPMSG 3521.

    The Automatic Updates service is not started.

    More help is available by typing NET HELPMSG 3521.

    The system cannot find the file specified.
    Done (5/27/2013 10:47:24 AM)

    Repair CD/DVD Missing/Not Working
    Start (5/27/2013 10:47:24 AM)
    Done (5/27/2013 10:47:25 AM)

    Repair Volume Shadow Copy Service
    Start (5/27/2013 10:47:25 AM)
    Running Repair Under Current User Account
    The Volume Shadow Copy service is not started.

    More help is available by typing NET HELPMSG 3521.

    The MS Software Shadow Copy Provider service is not started.

    More help is available by typing NET HELPMSG 3521.

    Running Repair Under System Account
    The Volume Shadow Copy service is not started.

    More help is available by typing NET HELPMSG 3521.

    The MS Software Shadow Copy Provider service is not started.

    More help is available by typing NET HELPMSG 3521.

    Done (5/27/2013 10:48:24 AM)

    Repair MSI (Windows Installer)
    Start (5/27/2013 10:48:24 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:48:56 AM)

    Repair bat Association
    Start (5/27/2013 10:48:56 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:49:03 AM)

    Repair cmd Association
    Start (5/27/2013 10:49:03 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:49:10 AM)

    Repair com Association
    Start (5/27/2013 10:49:10 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:49:19 AM)

    Repair Directory Association
    Start (5/27/2013 10:49:19 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:49:26 AM)

    Repair Drive Association
    Start (5/27/2013 10:49:26 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:49:33 AM)

    Repair exe Association
    Start (5/27/2013 10:49:33 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:49:40 AM)

    Repair Folder Association
    Start (5/27/2013 10:49:40 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:49:47 AM)

    Repair inf Association
    Start (5/27/2013 10:49:47 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:49:54 AM)

    Repair lnk (Shortcuts) Association
    Start (5/27/2013 10:49:54 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:50:05 AM)

    Repair msc Association
    Start (5/27/2013 10:50:05 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:50:12 AM)

    Repair reg Association
    Start (5/27/2013 10:50:12 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:50:19 AM)

    Repair scr Association
    Start (5/27/2013 10:50:19 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:50:26 AM)

    Repair Windows Safe Mode
    Start (5/27/2013 10:50:26 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:50:33 AM)

    Repair Print Spooler
    Start (5/27/2013 10:50:33 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:50:53 AM)

    Restore Important Windows Services
    Start (5/27/2013 10:50:53 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:51:04 AM)

    Set Windows Services To Default Startup
    Start (5/27/2013 10:51:04 AM)
    Running Repair Under Current User Account
    Running Repair Under System Account
    Done (5/27/2013 10:53:38 AM)

    Cleaning up empty logs...

    All Selected Repairs Done.
    Done (5/27/2013 10:53:38 AM)
    Total Repair Time: 00:35:58


    ...YOU MUST RESTART YOUR SYSTEM...
    Running Repair Under System Account
  24. Broni

    Broni Malware Annihilator Posts: 46,127   +251

    How are things now?
  25. michael j. odom

    michael j. odom Newcomer, in training Topic Starter Posts: 35

    Well the System Runs but The Control Panel remains a Trespassing Zone. The Viruses or malware have Territorialized The Control Panel.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.