Laptop won't boot

chrisb39 · Mar 3, 2013

OTL.txt too large to copy and paste here.

chrisb39 · Mar 3, 2013

Extras.txt

OTL Extras logfile created on: 3/3/2013 2:15:16 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Bob\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19400)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.67 Gb Available Physical Memory | 66.81% Memory free
8.16 Gb Paging File | 6.76 Gb Available in Paging File | 82.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 88.29 Gb Total Space | 22.02 Gb Free Space | 24.94% Space Free | Partition Type: NTFS
Drive D: | 88.02 Gb Total Space | 87.55 Gb Free Space | 99.47% Space Free | Partition Type: NTFS

Computer Name: FXLAPTOP | User Name: Bob | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = B2 83 90 5F 51 3E CA 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0737D49F-07EF-458F-AB88-A89CCDBE7898}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{16A4A2BA-DAF5-4B25-BC62-18D62BCC390D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{185F6B1C-89A7-48CD-B325-CD1C1B9A073E}" = rport=138 | protocol=17 | dir=out | app=system |
"{2A56496F-FF98-43AB-880F-B319B9D3E917}" = lport=24727 | protocol=6 | dir=in | name=flipshareserver |
"{2A5B89F1-8A14-4E4D-A908-70A60B2891C1}" = lport=137 | protocol=17 | dir=in | app=system |
"{34E05718-A262-44C5-B6A0-3C6C64845078}" = lport=2869 | protocol=6 | dir=in | app=system |
"{49555F8C-D3FA-4BBB-A471-973DA57FFF92}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{548AF6D1-54C0-458C-8ED3-7AD699332079}" = lport=138 | protocol=17 | dir=in | app=system |
"{5CFC5B5D-8616-49F9-80EC-EF2160FF5E80}" = lport=445 | protocol=6 | dir=in | app=system |
"{5EB59D61-0DF4-40E3-98B1-482CFF643A4B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{704767B2-1682-4571-8BD9-86BAF73873E1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8C9A38E7-F2C6-4F4A-B08C-A3EFC37D332C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{937B569A-470F-47AD-A4BD-2CA1E1ABE60F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{96340FA8-B30D-4CDB-82DE-16635FD732D6}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A9592E16-08E0-4CBC-8806-F673BBD3CC20}" = rport=139 | protocol=6 | dir=out | app=system |
"{ABE536E1-7845-483E-BCF8-D83817F1D533}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C38F2A96-5C6A-49AF-9DF9-C1A5D7D7F468}" = rport=137 | protocol=17 | dir=out | app=system |
"{D430C77A-FB11-423A-98DE-8E5A7EF34DF0}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{D8B53AC5-608F-4129-AF76-421DEB365006}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{DA40D955-548D-4FC9-B8B1-205059F7EAA8}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DEB54241-5EE6-425A-BE4D-C73DE2506DCA}" = lport=24726 | protocol=6 | dir=in | name=flipshareserver |
"{EAB691CB-0D13-4EF2-878C-BF4AC67DD6FB}" = rport=445 | protocol=6 | dir=out | app=system |
"{F8D8BB93-52CA-4074-92C5-2C324D34F7BA}" = lport=139 | protocol=6 | dir=in | app=system |
"{FB63C8BF-0C07-49FE-BF39-DCBEFDDD0C45}" = lport=2869 | protocol=6 | dir=in | app=system |
"{FC5E5AB2-8F4D-4FCA-BA8B-E544B29D8878}" = lport=10243 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02F4F6D8-5B41-4FDD-A178-2C561F1C7C58}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{224DF280-FE57-41A3-B512-719320448E3D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{22AF4FE8-A315-47F4-8598-579A484CC9C9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{22E8B7F0-93A7-4C3A-B8C1-DBBE48CAD8C0}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{23941BEF-C161-4FCC-BA99-AB3B02714E11}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2B065AE7-5CE5-489D-AA12-1FB4D7CE8F0F}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{2B1426C2-98F2-4D14-87E7-84909B30769A}" = protocol=6 | dir=out | app=system |
"{331B5642-4FF9-47AF-AC98-B6B396354AF6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3630B414-A30B-451A-B350-53341A02B658}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{3B59FBD0-C4E2-4EFE-B00D-675CBDA7CCD9}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\devicesetup.exe |
"{3BF6DCEE-2EEF-486C-AC5A-A136C5B451BA}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{3F8CFD46-D2F3-4C38-A122-D04C62DBBA81}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{4043E03D-3036-40A1-9FA3-F3AD3ABEF46F}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-enus-downloader.exe |
"{4414AFEB-83FC-43D9-AB6F-930BC82A12FE}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{462793E4-4506-4BBE-8B7B-06F19BE31462}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{513C25EF-A339-4C2B-9BAC-E2E278AA5EE6}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-enus-downloader.exe |
"{58A2BA2C-66C5-4DE3-94A0-22166EA1F52D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{64AA37D5-51AA-4C20-AC44-39C0AE7D9E05}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-enus-downloader.exe |
"{78D60862-1927-451F-B409-D0305BBC144A}" = dir=in | app=c:\program files (x86)\msn messenger\msnmsgr.exe |
"{8E97AA8F-875C-4A15-A0EC-B8F2D3529E1D}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-enus-downloader.exe |
"{906C3554-E1FE-469A-A94F-BFD2CB917544}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-enus-downloader.exe |
"{94D5296B-A367-4204-843E-5AF6A77C99F9}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9A0F7BF9-978E-48DA-B6F3-A0388B6584B1}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9CB3C05D-43C7-4721-BA1D-66A63A8269C3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A57337B8-21B8-4ED0-B930-A54DDBA4B4D8}" = dir=in | app=c:\program files (x86)\msn messenger\livecall.exe |
"{A5BC9F63-0BC5-41B3-84B3-ADAC824CE529}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{B0EE68E9-6008-490B-890D-A2D74E8DC9E7}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BA4236BD-72D5-4976-AF3F-8314E0AB7F1A}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{BF7ABF77-E5D6-4E77-862D-E9E119E8FA1E}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{C369DB48-5DE2-453A-84EC-781618E78C6F}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"{C7060552-9CC5-4B54-9845-72FA43ACD370}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{C7185F13-9E59-42B7-988D-BE1EF6F2FE90}" = dir=in | app=c:\program files\hp\hp officejet pro 8600\bin\hpnetworkcommunicator.exe |
"{CA797DE4-C665-4F9A-AFC6-67F15AA0A5AF}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-enus-downloader.exe |
"{CA8D6ABB-6C85-41A3-BC73-59D80E7402FF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CA99A65E-BF38-456B-96CE-C965FE6587C0}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{CAB7ACC5-4DE4-455F-AF49-8B0EB2B7094D}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{CEACD922-AAA2-4B19-A6CD-C9515EE52B49}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-enus-downloader.exe |
"{CF74ACA2-98B6-4FA7-BF45-9E2231685103}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"{D0BCF2ED-D4B4-46DC-92CD-ED46050D79D0}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{E417F28A-F3EE-4CC6-B0E1-71E13681504A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E4B27F62-2F1C-4B90-B914-836911AF5AE8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E8EF0B28-BF0E-41C1-8F0D-C1B5EC0780FB}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-enus-downloader.exe |
"{EE1D740B-371D-40ED-89EE-090BBC7CC039}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F143BD21-7CA0-41A6-88DF-C545684126AE}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-enus-downloader.exe |
"{F28CEE4C-A3B8-4A3B-959E-518DE72BB1B0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F92D4EFE-9A89-48E0-9548-232378949941}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FA639ADF-A001-474B-8960-677C78634585}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-enus-downloader.exe |
"TCP Query User{0732C7DF-0B33-431D-B942-F5FE8D3D22F1}C:\users\public\sony online entertainment\installed games\everquest ii extended\eq2voiceservice.exe" = protocol=6 | dir=in | app=c:\users\public\sony online entertainment\installed games\everquest ii extended\eq2voiceservice.exe |
"TCP Query User{0A0471CE-AD73-4043-BD2E-52E431EB07DF}C:\program files (x86)\turbine\ddo unlimited\dndclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\turbine\ddo unlimited\dndclient.exe |
"TCP Query User{14866A67-8FA5-48BD-AAE3-8E0016B22A49}C:\program files (x86)\ncp\secureclient\ncpmon.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ncp\secureclient\ncpmon.exe |
"TCP Query User{4AA35BEB-6765-4207-A374-885C265E0203}C:\program files (x86)\microsoft games\age of empires ii\empires2.icd" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\age of empires ii\empires2.icd |
"TCP Query User{577C0B24-8F2A-4249-9581-6E6C819880B7}C:\program files (x86)\ncp\secureclient\ncpmon.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ncp\secureclient\ncpmon.exe |
"TCP Query User{890FCF8E-64F7-46EB-96A2-41CED476813C}C:\program files (x86)\yahoo! games\rock and roll jeopardy!\rock & roll jeopardy!.exe" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo! games\rock and roll jeopardy!\rock & roll jeopardy!.exe |
"TCP Query User{C09F8E77-45A8-4B72-8DD2-8DC60BC563B2}C:\users\bob\appdata\local\microsoft\windows\temporary internet files\content.ie5\vmepg41j\anarchyonline_18.0.4-large[1].exe" = protocol=6 | dir=in | app=c:\users\bob\appdata\local\microsoft\windows\temporary internet files\content.ie5\vmepg41j\anarchyonline_18.0.4-large[1].exe |
"TCP Query User{D2AC6507-4D01-4DEA-BA71-D8A2FC7A0B72}C:\program files (x86)\gametap web player\bin\release\gametapplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\gametap web player\bin\release\gametapplayer.exe |
"TCP Query User{FE7F4A23-0A18-4172-8873-78ADBD2C749B}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{1CB3AEC2-D153-47F4-8F33-4CBD65A3D997}C:\users\bob\appdata\local\microsoft\windows\temporary internet files\content.ie5\vmepg41j\anarchyonline_18.0.4-large[1].exe" = protocol=17 | dir=in | app=c:\users\bob\appdata\local\microsoft\windows\temporary internet files\content.ie5\vmepg41j\anarchyonline_18.0.4-large[1].exe |
"UDP Query User{2603C9F2-3B51-4017-A870-FC2C208F59C1}C:\program files (x86)\turbine\ddo unlimited\dndclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\turbine\ddo unlimited\dndclient.exe |
"UDP Query User{503CAD49-D275-4144-85B5-BD71CC33D07C}C:\program files (x86)\ncp\secureclient\ncpmon.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ncp\secureclient\ncpmon.exe |
"UDP Query User{8508A937-257B-4D31-96ED-181D591DFA1E}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{96A25C9F-4E8C-45B3-833A-19B268CE123D}C:\program files (x86)\ncp\secureclient\ncpmon.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ncp\secureclient\ncpmon.exe |
"UDP Query User{A1A37A32-88C7-456F-B73D-16036A484796}C:\program files (x86)\yahoo! games\rock and roll jeopardy!\rock & roll jeopardy!.exe" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo! games\rock and roll jeopardy!\rock & roll jeopardy!.exe |
"UDP Query User{DC126AB0-BBEB-4C9A-AEF7-8B42F57C618C}C:\program files (x86)\microsoft games\age of empires ii\empires2.icd" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\age of empires ii\empires2.icd |
"UDP Query User{E8AB155D-10DA-4376-809F-1A804F64E8EE}C:\program files (x86)\gametap web player\bin\release\gametapplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\gametap web player\bin\release\gametapplayer.exe |
"UDP Query User{F6BFE118-3205-4AA0-A086-1580E8A18A3C}C:\users\public\sony online entertainment\installed games\everquest ii extended\eq2voiceservice.exe" = protocol=17 | dir=in | app=c:\users\public\sony online entertainment\installed games\everquest ii extended\eq2voiceservice.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{237D687E-9E50-4A30-B810-262764CC491B}" = Garmin Communicator Plugin x64
"{2D5E3D2B-919F-407C-8757-E64827518BB6}" = HP Officejet Pro 8600 Basic Device Software
"{82B3C254-537C-4C6D-9C79-7671A011536A}" = O2Micro Flash Memory Card Reader Driver (x64)
"{877924AA-E044-4266-B37D-E974CD799934}" = Bonjour
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"98157A226B40B173301B0F53C8E98C47805D5152" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0)
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A1E0BDA-5E8F-436d-8BE5-7E97C5CB899D}" = Quicken 2012
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}" = iSEEK AnswerWorks English Runtime
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216039FF}" = Java(TM) 6 Update 39
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{34FF0741-EC67-4C05-AC2A-6D257123DF2E}" = BigFix
"{39098402-3F7A-4257-A4AE-FC1181D1B40B}" = Camera Assistant Software for Gateway
"{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}" = Garmin USB Drivers
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{571700F0-DB9D-4B3A-B03D-35A14BB5939F}" = Windows Live Messenger
"{5BEBD7F0-5544-3B4C-8D15-7154AA35BEA2}" = Google Talk Plugin
"{647BB978-2876-487B-9B0E-FDB73F0EA4A2}" = Garmin Communicator Plugin
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-gateway" = WildTangent Games App
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-wildgames" = WildTangent Games App
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7D542452-84EB-47C0-97BA-735C523AB555}" = Garmin Training Center
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Gateway Recovery Management
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110246513}" = Catan - The Computer Game
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}" = HP Update
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{97C658D2-61FB-027F-0D76-E9CDC84AFEC7}" = FlipShare
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.6)
"{AE1EC58E-B2AC-4959-A4C2-C38202A25239}" = Garmin WebUpdater
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B6F5C6D8-C443-4B55-932F-AE11B5743FC4}" = HP Officejet Pro 8600 Help
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Age of Empires 2.0" = Microsoft Age of Empires II
"avast" = avast! Free Antivirus
"ESET Online Scanner" = ESET Online Scanner v3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 12.0 (x86 en-US)" = Mozilla Firefox 12.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NCP RWS/GA" = NCP Secure Entry Client
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Star Sword_is1" = Star Sword
"WildTangent gateway Master Uninstall" = Gateway Games

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"SOE-EverQuest II" = EverQuest II
"SOE-EverQuest II Extended" = EverQuest II

< End of report >

Broni · Mar 3, 2013

All logs have to be pasted.

If some log exceeds 50,000 characters post limit, split it into a couple of replies.

chrisb39 · Mar 3, 2013

OTL log, part 1

PRC - [2013/02/28 01:36:01 | 000,045,248 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/12/18 07:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/05/06 12:07:18 | 000,460,144 | ---- | M] () -- C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe
PRC - [2011/05/06 11:58:52 | 001,085,440 | ---- | M] () -- C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe
PRC - [2008/12/16 13:43:10 | 001,078,792 | ---- | M] (NCP Engineering GmbH) -- C:\Program Files (x86)\NCP\SecureClient\NCPRWSNT.EXE
PRC - [2008/12/02 07:33:54 | 000,850,432 | ---- | M] () -- C:\Program Files (x86)\NCP\SecureClient\rwsrsu.exe
PRC - [2008/10/06 09:58:18 | 000,032,768 | ---- | M] () -- C:\Program Files (x86)\NCP\SecureClient\NCPSEC.EXE
PRC - [2008/08/13 14:34:08 | 001,891,416 | ---- | M] (GARMIN Corp.) -- C:\Program Files (x86)\Garmin\Training Center\gStart.exe
PRC - [2008/06/30 11:22:40 | 000,086,016 | ---- | M] (NCP engineering GmbH) -- C:\Program Files (x86)\NCP\SecureClient\ncpclcfg.exe
PRC - [2008/04/15 17:54:42 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2008/04/15 17:54:40 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/02/12 01:43:44 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe

========== Modules (No Company Name) ==========

MOD - [2008/12/02 07:33:54 | 000,850,432 | ---- | M] () -- C:\Program Files (x86)\NCP\SecureClient\rwsrsu.exe
MOD - [2008/12/02 07:33:16 | 000,978,944 | ---- | M] () -- C:\Program Files (x86)\NCP\SecureClient\rsussl.dll

========== Services (SafeList) ==========

SRV:64bit: - [2013/02/28 01:36:01 | 000,045,248 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2008/06/11 12:18:30 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe -- (ETService)
SRV:64bit: - [2008/01/20 19:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2007/10/18 15:37:22 | 000,412,672 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysNative\DRIVERS\xaudio64.exe -- (XAudioService)
SRV - [2012/12/18 07:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/04/20 18:19:00 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011/05/06 12:07:18 | 000,460,144 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2011/05/06 11:58:52 | 001,085,440 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe -- (FlipShareServer)
SRV - [2010/10/12 10:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/03/29 21:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/12/16 13:43:10 | 001,078,792 | ---- | M] (NCP Engineering GmbH) [Auto | Running] -- C:\Program Files (x86)\NCP\SecureClient\NCPRWSNT.EXE -- (ncprwsnt)
SRV - [2008/12/02 07:33:54 | 000,850,432 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\NCP\SecureClient\rwsrsu.exe -- (rwsrsu)
SRV - [2008/10/06 09:58:18 | 000,032,768 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\NCP\SecureClient\NCPSEC.EXE -- (NcpSec)
SRV - [2008/06/30 11:22:40 | 000,086,016 | ---- | M] (NCP engineering GmbH) [Auto | Running] -- C:\Program Files (x86)\NCP\SecureClient\ncpclcfg.exe -- (ncpclcfg)
SRV - [2008/04/15 17:54:42 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2008/01/29 10:09:58 | 000,165,416 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2007/02/12 01:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe -- (o2flash)

chrisb39 · Mar 3, 2013

OTL log, part 2

========== Driver Services (SafeList) ==========

DRV:64bit: - [2013/02/28 01:36:34 | 000,068,992 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2013/02/28 01:36:33 | 001,025,880 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2013/02/28 01:36:33 | 000,377,992 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2013/02/28 01:36:32 | 000,080,888 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2013/02/28 01:36:32 | 000,059,216 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr.sys -- (aswRdr)
DRV:64bit: - [2013/02/28 01:36:31 | 000,033,472 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012/04/18 10:05:16 | 000,019,304 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2012/02/29 06:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2010/07/12 11:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/09/30 17:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009/01/09 14:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2008/11/17 14:50:30 | 004,751,360 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETw5v64.sys -- (NETw5v64)
DRV:64bit: - [2008/11/10 14:43:52 | 000,143,496 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ncplelhp.sys -- (ncplelhp)
DRV:64bit: - [2008/11/10 14:43:52 | 000,143,496 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ncplelhp.sys -- (ncpfilt)
DRV:64bit: - [2008/06/10 20:13:00 | 000,264,192 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2008/05/13 18:43:00 | 000,055,328 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2008/04/28 19:00:00 | 000,392,192 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64)
DRV:64bit: - [2008/04/15 17:54:16 | 000,388,120 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor)
DRV:64bit: - [2008/04/14 19:14:40 | 000,062,040 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\o2mdx64.sys -- (O2MDRDR)
DRV:64bit: - [2008/04/07 19:46:44 | 000,051,928 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\o2sdx64.sys -- (O2SDRDR)
DRV:64bit: - [2008/03/25 16:51:16 | 001,487,872 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2008/03/25 16:47:06 | 000,294,400 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2008/03/25 16:45:44 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2008/01/30 03:46:24 | 000,062,480 | ---- | M] (UPEK Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\tcusb.sys -- (TcUsb)
DRV:64bit: - [2008/01/20 19:49:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\RootMdm.sys -- (ROOTMODEM)
DRV:64bit: - [2008/01/20 19:47:25 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\serscan.sys -- (StillCam)
DRV:64bit: - [2008/01/20 19:46:57 | 000,286,720 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\VSTAZL6.SYS -- (HSFHWAZL)
DRV:64bit: - [2008/01/20 19:46:57 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2008/01/20 19:46:55 | 000,111,104 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus)
DRV:64bit: - [2008/01/17 20:31:30 | 000,320,560 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:64bit: - [2007/10/18 15:37:10 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\xaudio64.sys -- (XAudio)
DRV:64bit: - [2007/05/23 17:47:28 | 000,020,784 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV:64bit: - [2006/06/18 22:27:24 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\mdmxsdk.sys -- (mdmxsdk)
DRV - [2008/06/11 12:13:24 | 000,017,952 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\int15_64.sys -- (int15)

========== Standard Registry (SafeList) ==========

chrisb39 · Mar 3, 2013

OTL log, part 3

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKLM\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}

IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..\SearchScopes\{F511D57E-B493-4DDB-ACEC-584774E89855}: "URL" = http://www.google.com/search?q={sea...={outputEncoding}&sourceid=ie7&rlz=1I7GWYE_en
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: pricepeep@getpricepeep.com:2.1.355.0
FF - prefs.js..extensions.enabledAddons: wrc@avast.com:8.0.1482
FF - prefs.js..network.proxy.no_proxies_on: "*.local,192.168.*.*"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_39: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O1DPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Bob\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Bob\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/03/02 16:25:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/11/25 13:27:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/05/03 16:24:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bob\AppData\Roaming\Mozilla\Extensions
[2013/03/03 13:54:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\17ts3mnb.default\extensions
[2013/03/02 18:48:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/07/11 16:24:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/09/11 17:18:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/03/02 18:48:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
[2013/03/02 16:25:29 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
File not found (No name found) -- C:\USERS\BOB\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\17TS3MNB.DEFAULT\EXTENSIONS\PRICEPEEP@GETPRICEPEEP.COM.XPI
[2012/04/20 18:19:34 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/20 18:18:25 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/20 18:18:25 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Bob\AppData\Local\Google\Chrome\Application\25.0.1364.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Bob\AppData\Local\Google\Chrome\Application\25.0.1364.97\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Bob\AppData\Local\Google\Chrome\Application\25.0.1364.97\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: Oberon com adapter (Enabled) = C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - Extension: YouTube = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: avast! WebRep = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1482_0\
CHR - Extension: Gmail = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2013/03/02 22:09:05 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg64.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3:64bit: - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [NcpRsuGui] C:\Program Files (x86)\NCP\SecureClient\rwsrsu.exe ()
O4 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000..\Run: [gStart] C:\Program Files (x86)\Garmin\Training Center\gStart.exe (GARMIN Corp.)
O4 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000..\Run: [HP Officejet Pro 8600 (NET)] C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} http://archives.gametap.com/static/cab_headless/GameTapWebPlayer.cab (GameTap Player)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/4.0.4.0/GarminAxControl_32.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7BE2F466-7B19-4D62-8C1E-D0BEA57514E3}: DhcpNameServer = 192.168.6.1 64.134.255.2 64.134.255.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C9B6A1B4-5E29-4103-BB55-13C479A15456}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F0A54FA5-DC49-4CC3-B97A-97BCC839D415}: DhcpNameServer = 10.22.60.11 10.22.60.12
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Bob\Pictures\EstesPark.JPG
O24 - Desktop BackupWallPaper: C:\Users\Bob\Pictures\EstesPark.JPG
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

chrisb39 · Mar 3, 2013

OTL log, part 4

========== Files/Folders - Created Within 30 Days ==========

[2013/03/03 14:00:43 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/03/03 14:00:38 | 000,000,000 | ---D | C] -- C:\JRT
[2013/03/03 13:50:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Bob\Desktop\OTL.exe
[2013/03/03 13:50:17 | 000,547,491 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Bob\Desktop\JRT.exe
[2013/03/02 22:15:16 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\temp
[2013/03/02 22:09:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/03/02 22:06:29 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/03/02 21:57:02 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/03/02 21:57:02 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/03/02 21:57:02 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/03/02 21:56:53 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/03/02 21:56:39 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013/03/02 21:46:51 | 005,036,301 | R--- | C] (Swearware) -- C:\Users\Bob\Desktop\ComboFix.exe
[2013/03/02 20:23:28 | 000,000,000 | ---D | C] -- C:\Users\Bob\Desktop\RK_Quarantine
[2013/03/02 19:09:33 | 000,000,000 | ---D | C] -- C:\FRST
[2013/03/02 18:51:37 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\Malwarebytes
[2013/03/02 18:51:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/03/02 18:51:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/03/02 18:51:20 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/03/02 18:51:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/02/09 15:35:41 | 000,377,992 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013/02/09 15:35:41 | 000,068,992 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013/02/09 15:35:41 | 000,033,472 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013/02/09 15:35:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013/02/09 15:35:17 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013/02/09 15:35:14 | 000,227,648 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2013/02/09 15:34:14 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013/02/03 15:06:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WildTangent Games
[2013/02/03 15:06:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WildTangent Games
[2013/02/03 15:06:33 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\WildTangent

========== Files - Modified Within 30 Days ==========

[2013/03/03 14:06:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/03/03 14:01:01 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1843488475-1253667702-3664568970-1000UA.job
[2013/03/03 13:59:28 | 000,160,716 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2013/03/03 13:59:28 | 000,160,716 | ---- | M] () -- C:\ProgramData\nvModes.001
[2013/03/03 13:56:51 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\LogConfigTemp.xml
[2013/03/03 13:56:46 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/03/03 13:56:35 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/03/03 13:56:34 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/03/03 13:56:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/03/03 13:50:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bob\Desktop\OTL.exe
[2013/03/03 13:50:30 | 000,547,491 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Bob\Desktop\JRT.exe
[2013/03/03 13:50:14 | 000,594,019 | ---- | M] () -- C:\Users\Bob\Desktop\adwcleaner.exe
[2013/03/02 22:09:05 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013/03/02 21:47:06 | 005,036,301 | R--- | M] (Swearware) -- C:\Users\Bob\Desktop\ComboFix.exe
[2013/03/02 20:17:23 | 000,816,640 | ---- | M] () -- C:\Users\Bob\Desktop\RogueKiller.exe
[2013/03/02 18:59:42 | 000,717,118 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/03/02 18:59:42 | 000,613,520 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/03/02 18:59:42 | 000,108,446 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/03/02 18:51:22 | 000,000,950 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/03/02 18:32:43 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2013/03/01 18:01:00 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1843488475-1253667702-3664568970-1000Core.job
[2013/02/28 01:36:34 | 000,177,672 | ---- | M] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013/02/28 01:36:34 | 000,068,992 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013/02/28 01:36:33 | 001,025,880 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2013/02/28 01:36:33 | 000,377,992 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013/02/28 01:36:33 | 000,065,408 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013/02/28 01:36:32 | 000,080,888 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2013/02/28 01:36:32 | 000,059,216 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr.sys
[2013/02/28 01:36:31 | 000,033,472 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013/02/28 01:36:07 | 000,041,664 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2013/02/28 01:35:43 | 000,287,840 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2013/02/25 18:04:46 | 000,002,036 | ---- | M] () -- C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/02/25 18:04:46 | 000,002,034 | ---- | M] () -- C:\Users\Bob\Desktop\Google Chrome.lnk
[2013/02/14 07:34:33 | 000,389,968 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/02/13 19:05:59 | 000,001,726 | -H-- | M] () -- C:\Users\Bob\Documents\Default.rdp
[2013/02/09 15:35:42 | 000,001,787 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/02/03 15:06:49 | 000,002,378 | ---- | M] () -- C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - wildgames.lnk
[2013/02/03 15:06:48 | 000,002,346 | ---- | M] () -- C:\Users\Public\Desktop\WildTangent Games App - wildgames.lnk

========== Files Created - No Company Name ==========

[2013/03/03 13:50:03 | 000,594,019 | ---- | C] () -- C:\Users\Bob\Desktop\adwcleaner.exe
[2013/03/02 21:57:02 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/03/02 21:57:02 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/03/02 21:57:02 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/03/02 21:57:02 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/03/02 21:57:02 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/03/02 20:17:15 | 000,816,640 | ---- | C] () -- C:\Users\Bob\Desktop\RogueKiller.exe
[2013/03/02 18:51:22 | 000,000,950 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/03/02 16:25:30 | 000,177,672 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013/03/02 16:25:30 | 000,065,408 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013/02/09 15:35:42 | 000,001,787 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/02/03 15:06:47 | 000,002,378 | ---- | C] () -- C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - wildgames.lnk
[2013/02/03 15:06:46 | 000,002,346 | ---- | C] () -- C:\Users\Public\Desktop\WildTangent Games App - wildgames.lnk
[2013/01/24 19:14:13 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2011/11/05 15:23:57 | 000,000,126 | ---- | C] () -- C:\Windows\QUICKEN.INI
[2010/11/30 17:54:07 | 033,865,678 | ---- | C] () -- C:\Program Files (x86)\data.dpk
[2010/02/06 22:46:30 | 000,000,680 | ---- | C] () -- C:\Users\Bob\AppData\Local\d3d9caps.dat
[2010/01/24 12:21:29 | 000,023,949 | ---- | C] () -- C:\Users\Bob\LastSettings.cs
[2009/11/21 21:01:30 | 000,024,010 | ---- | C] () -- C:\Users\Bob\Rollable.cs
[2009/10/10 00:39:51 | 000,000,091 | ---- | C] () -- C:\Users\Bob\AppData\Local\fusioncache.dat
[2009/09/09 10:39:16 | 000,007,680 | ---- | C] () -- C:\Users\Bob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/17 19:03:44 | 000,000,000 | ---- | C] () -- C:\Users\Bob\AppData\Local\rx_image.Cache
[2009/01/12 20:09:58 | 000,160,716 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/01/12 20:09:19 | 000,160,716 | ---- | C] () -- C:\ProgramData\nvModes.dat

========== ZeroAccess Check ==========

[2006/11/02 08:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/08 10:59:03 | 012,899,840 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 10:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/04/11 00:11:14 | 000,891,392 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\fastprox.dll -- [2009/04/10 23:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008/01/20 19:50:58 | 000,513,024 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\wbemess.dll

chrisb39 · Mar 3, 2013

OTL log, part 5

========== LOP Check ==========

[2011/06/17 20:54:41 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\2monkeys
[2011/06/25 18:31:44 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Alawar
[2011/04/14 16:53:50 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Arkadium
[2011/03/11 21:41:33 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Artifex Mundi
[2011/04/23 18:32:53 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Artogon
[2011/12/25 17:14:44 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Awem
[2011/05/19 18:47:33 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Big Fish Games
[2011/03/15 20:05:03 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Boomzap
[2012/01/26 20:25:16 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\casualArts
[2011/10/10 18:04:57 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ChaYoWo Games
[2011/04/07 20:44:08 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Column of the Maya
[2011/01/07 18:56:00 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ElementalsTheMagicKey
[2011/06/19 16:10:27 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Endless Fluff Games
[2011/07/11 15:40:01 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Enlightenus2SE_BFG
[2011/09/21 18:35:53 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ERS Game Studios
[2011/02/13 08:49:21 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Flip Video
[2011/07/01 16:56:55 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Floodlight Games
[2011/06/16 18:06:28 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\FlyWheelGames
[2011/05/25 16:21:39 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Friday's games
[2011/04/06 18:38:31 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Frogwares
[2011/03/14 17:40:12 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GameInvest
[2011/05/19 16:22:30 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GameMill Entertainment
[2011/04/10 08:34:31 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GamesCafe
[2013/01/01 10:16:51 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Garmin
[2011/04/21 17:37:07 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Gogii
[2011/03/17 16:57:31 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GOL_byHasbro
[2011/06/18 13:42:32 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GuardiansOfMagic
[2012/02/05 10:32:28 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\HdO Adventure
[2011/09/12 17:23:26 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Islands2
[2011/12/01 17:27:04 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\JaiboGames
[2011/04/15 19:27:32 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Jetdogs Studios
[2010/12/31 16:37:01 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Ladia Group
[2011/06/20 17:43:56 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Lazy Turtle Games
[2011/03/21 15:17:44 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\MA2
[2011/03/13 11:11:47 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\MAI
[2011/05/20 20:39:21 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Millennium_Saves
[2011/02/19 14:48:35 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Mystery of Mortlake Mansion
[2011/04/12 15:46:06 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Namco
[2011/07/24 19:45:29 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\NevoSoft
[2012/12/01 19:43:52 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Oberon All My Gods
[2011/02/18 17:24:12 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Oberon Media
[2010/07/10 20:07:09 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Oberonv1000
[2011/06/02 16:29:08 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Sahmon Games
[2011/05/24 20:00:06 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Silverback Productions
[2011/11/16 19:27:55 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\SpinTop Games
[2010/12/13 18:54:40 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ThreeDays2
[2011/04/09 13:58:06 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Top Evidence
[2009/10/10 00:39:54 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Turbine
[2012/02/15 18:53:20 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Vast Studios
[2011/03/12 18:58:33 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Virtual Prophecy
[2011/02/22 19:17:33 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Western Software Technologies
[2013/02/03 15:06:58 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\WildTangent

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:A53EDDED
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMPA3C6C07
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:793ABD2B
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP9F6664C
@Alternate Data Stream - 188 bytes -> C:\ProgramData\TEMP:322EAACD
@Alternate Data Stream - 187 bytes -> C:\ProgramData\TEMP:5D10517E
@Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:E0648389
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:B3C1080A
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:18BB305F
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMPCADFB80
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP7DEAA30
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP6C2C750
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:AE9DFC85
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:52FE3CCD
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:15FA1ECB
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7D6E8689
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7CC19A3B
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:EB3A09D6
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6CC1CB6D
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:65AAB2AD
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6093F383
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:BE02DA6F
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:9FF05345
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:30997E0F
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:94213A87
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:C83B0187
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:6A285F23
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:27219865
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:F1E4DACB
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMPAC07741
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:BAE8784F
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:41326804
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:3E7C402E
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:269822E7
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:3F22DA14
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:39CC5718
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:9C0F8F95
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1FDDA142
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1E86AA26
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMPEAC2707
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:06253D7D
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:029E021F
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMPE29D4A1
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:A8036ADB
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:E9D68B36
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:8AB86A68
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:EE88D186
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:A5808D58
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:8C443193
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:2A8CD561
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0E361B63
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:B8441B0C
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5B132D3E
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:12A3FA49
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:97F0A1F8
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:F6FE6031
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E8AB98F0
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP3A8AA31
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:B00FB034
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:2020565D
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:0A404476
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:69102296
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:14A7EC62
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:C10D19E3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:5D4F063C
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:55662D3E
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2C6A77F3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2B059D79
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2ADC9FB3
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:70F0A2F4
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:FFD9E05D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP6125FEA
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:3EA1C214
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMPD780579
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:64AEDD72
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5C5A503E
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:2F34C507
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:1AAEFD5D
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:107FBBD4
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E9039033
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E3EEF684
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:C085816B
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:8F4D7D6C
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:40B42CCC
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C8F88A8F
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E89EDC52
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:69DD03D4
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:A917668A
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:C4E0513E

< End of report >

Broni · Mar 3, 2013

The very top part is missing.

chrisb39 · Mar 3, 2013

OTL log, top part

OTL logfile created on: 3/3/2013 2:15:16 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Bob\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19400)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.67 Gb Available Physical Memory | 66.81% Memory free
8.16 Gb Paging File | 6.76 Gb Available in Paging File | 82.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 88.29 Gb Total Space | 22.02 Gb Free Space | 24.94% Space Free | Partition Type: NTFS
Drive D: | 88.02 Gb Total Space | 87.55 Gb Free Space | 99.47% Space Free | Partition Type: NTFS

Computer Name: FXLAPTOP | User Name: Bob | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/03/03 13:50:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bob\Desktop\OTL.exe

Broni · Mar 3, 2013

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe File not found
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/4.0.4.0/GarminAxControl_32.CAB (Reg Error: Key error.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:A53EDDED
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:DA3C6C07
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:793ABD2B
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:D9F6664C
@Alternate Data Stream - 188 bytes -> C:\ProgramData\TEMP:322EAACD
@Alternate Data Stream - 187 bytes -> C:\ProgramData\TEMP:5D10517E
@Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:E0648389
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:B3C1080A
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:18BB305F
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:DCADFB80
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:D7DEAA30
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:D6C2C750
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:AE9DFC85
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:52FE3CCD
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:15FA1ECB
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7D6E8689
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7CC19A3B
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:EB3A09D6
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6CC1CB6D
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:65AAB2AD
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6093F383
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:BE02DA6F
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:9FF05345
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:30997E0F
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:94213A87
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:C83B0187
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:6A285F23
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:27219865
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:F1E4DACB
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:DAC07741
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:BAE8784F
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:41326804
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:3E7C402E
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:269822E7
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:3F22DA14
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:39CC5718
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:9C0F8F95
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1FDDA142
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1E86AA26
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:DEAC2707
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:06253D7D
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:029E021F
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:DE29D4A1
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:A8036ADB
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:E9D68B36
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:8AB86A68
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:EE88D186
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:A5808D58
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:8C443193
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:2A8CD561
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0E361B63
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:B8441B0C
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5B132D3E
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:12A3FA49
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:97F0A1F8
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:F6FE6031
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E8AB98F0
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:D3A8AA31
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:B00FB034
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:2020565D
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:0A404476
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:69102296
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:14A7EC62
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:C10D19E3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:5D4F063C
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:55662D3E
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2C6A77F3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2B059D79
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2ADC9FB3
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:70F0A2F4
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:FFD9E05D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:D6125FEA
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:3EA1C214
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:DD780579
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:64AEDD72
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5C5A503E
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:2F34C507
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:1AAEFD5D
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:107FBBD4
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E9039033
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E3EEF684
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:C085816B
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:8F4D7D6C
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:40B42CCC
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C8F88A8F
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E89EDC52
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:69DD03D4
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:A917668A
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:C4E0513E

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

Last scans...

[IMG]

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

[IMG]

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click on List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

chrisb39 · Mar 4, 2013

ESET scan found no threats.

OTL fix log:

All processes killed
========== OTL ==========
HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D}\ not found.
Registry key HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clonewarsadventures.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\freerealms.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\soe.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sony.com\ deleted successfully.
Starting removal of ActiveX control Garmin Communicator Plug-In
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Garmin Communicator Plug-In\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-itss\ deleted successfully.
File Protocol\Handler\ms-itss - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
ADS C:\ProgramData\TEMP:A53EDDED deleted successfully.
ADS C:\ProgramData\TEMPA3C6C07 deleted successfully.
ADS C:\ProgramData\TEMP:793ABD2B deleted successfully.
ADS C:\ProgramData\TEMP9F6664C deleted successfully.
ADS C:\ProgramData\TEMP:322EAACD deleted successfully.
ADS C:\ProgramData\TEMP:5D10517E deleted successfully.
ADS C:\ProgramData\TEMP:E0648389 deleted successfully.
ADS C:\ProgramData\TEMP:B3C1080A deleted successfully.
ADS C:\ProgramData\TEMP:18BB305F deleted successfully.
ADS C:\ProgramData\TEMPCADFB80 deleted successfully.
ADS C:\ProgramData\TEMP7DEAA30 deleted successfully.
ADS C:\ProgramData\TEMP6C2C750 deleted successfully.
ADS C:\ProgramData\TEMP:AE9DFC85 deleted successfully.
ADS C:\ProgramData\TEMP:52FE3CCD deleted successfully.
ADS C:\ProgramData\TEMP:15FA1ECB deleted successfully.
ADS C:\ProgramData\TEMP:7D6E8689 deleted successfully.
ADS C:\ProgramData\TEMP:7CC19A3B deleted successfully.
ADS C:\ProgramData\TEMP:EB3A09D6 deleted successfully.
ADS C:\ProgramData\TEMP:6CC1CB6D deleted successfully.
ADS C:\ProgramData\TEMP:65AAB2AD deleted successfully.
ADS C:\ProgramData\TEMP:6093F383 deleted successfully.
ADS C:\ProgramData\TEMP:BE02DA6F deleted successfully.
ADS C:\ProgramData\TEMP:9FF05345 deleted successfully.
ADS C:\ProgramData\TEMP:30997E0F deleted successfully.
ADS C:\ProgramData\TEMP:94213A87 deleted successfully.
ADS C:\ProgramData\TEMP:C83B0187 deleted successfully.
ADS C:\ProgramData\TEMP:6A285F23 deleted successfully.
ADS C:\ProgramData\TEMP:27219865 deleted successfully.
ADS C:\ProgramData\TEMP:F1E4DACB deleted successfully.
ADS C:\ProgramData\TEMPAC07741 deleted successfully.
ADS C:\ProgramData\TEMP:BAE8784F deleted successfully.
ADS C:\ProgramData\TEMP:41326804 deleted successfully.
ADS C:\ProgramData\TEMP:3E7C402E deleted successfully.
ADS C:\ProgramData\TEMP:269822E7 deleted successfully.
ADS C:\ProgramData\TEMP:3F22DA14 deleted successfully.
ADS C:\ProgramData\TEMP:39CC5718 deleted successfully.
ADS C:\ProgramData\TEMP:9C0F8F95 deleted successfully.
ADS C:\ProgramData\TEMP:1FDDA142 deleted successfully.
ADS C:\ProgramData\TEMP:1E86AA26 deleted successfully.
ADS C:\ProgramData\TEMPEAC2707 deleted successfully.
ADS C:\ProgramData\TEMP:06253D7D deleted successfully.
ADS C:\ProgramData\TEMP:029E021F deleted successfully.
ADS C:\ProgramData\TEMPE29D4A1 deleted successfully.
ADS C:\ProgramData\TEMP:A8036ADB deleted successfully.
ADS C:\ProgramData\TEMP:E9D68B36 deleted successfully.
ADS C:\ProgramData\TEMP:8AB86A68 deleted successfully.
ADS C:\ProgramData\TEMP:EE88D186 deleted successfully.
ADS C:\ProgramData\TEMP:A5808D58 deleted successfully.
ADS C:\ProgramData\TEMP:8C443193 deleted successfully.
ADS C:\ProgramData\TEMP:2A8CD561 deleted successfully.
ADS C:\ProgramData\TEMP:0E361B63 deleted successfully.
ADS C:\ProgramData\TEMP:B8441B0C deleted successfully.
ADS C:\ProgramData\TEMP:5B132D3E deleted successfully.
ADS C:\ProgramData\TEMP:12A3FA49 deleted successfully.
ADS C:\ProgramData\TEMP:97F0A1F8 deleted successfully.
ADS C:\ProgramData\TEMP:F6FE6031 deleted successfully.
ADS C:\ProgramData\TEMP:E8AB98F0 deleted successfully.
ADS C:\ProgramData\TEMP3A8AA31 deleted successfully.
ADS C:\ProgramData\TEMP:B00FB034 deleted successfully.
ADS C:\ProgramData\TEMP:2020565D deleted successfully.
ADS C:\ProgramData\TEMP:0A404476 deleted successfully.
ADS C:\ProgramData\TEMP:69102296 deleted successfully.
ADS C:\ProgramData\TEMP:14A7EC62 deleted successfully.
ADS C:\ProgramData\TEMP:C10D19E3 deleted successfully.
ADS C:\ProgramData\TEMP:5D4F063C deleted successfully.
ADS C:\ProgramData\TEMP:55662D3E deleted successfully.
ADS C:\ProgramData\TEMP:2C6A77F3 deleted successfully.
ADS C:\ProgramData\TEMP:2B059D79 deleted successfully.
ADS C:\ProgramData\TEMP:2ADC9FB3 deleted successfully.
ADS C:\ProgramData\TEMP:70F0A2F4 deleted successfully.
ADS C:\ProgramData\TEMP:FFD9E05D deleted successfully.
ADS C:\ProgramData\TEMP6125FEA deleted successfully.
ADS C:\ProgramData\TEMP:3EA1C214 deleted successfully.
ADS C:\ProgramData\TEMPD780579 deleted successfully.
ADS C:\ProgramData\TEMP:64AEDD72 deleted successfully.
ADS C:\ProgramData\TEMP:5C5A503E deleted successfully.
ADS C:\ProgramData\TEMP:2F34C507 deleted successfully.
ADS C:\ProgramData\TEMP:1AAEFD5D deleted successfully.
ADS C:\ProgramData\TEMP:107FBBD4 deleted successfully.
ADS C:\ProgramData\TEMP:E9039033 deleted successfully.
ADS C:\ProgramData\TEMP:E3EEF684 deleted successfully.
ADS C:\ProgramData\TEMP:C085816B deleted successfully.
ADS C:\ProgramData\TEMP:8F4D7D6C deleted successfully.
ADS C:\ProgramData\TEMP:40B42CCC deleted successfully.
ADS C:\ProgramData\TEMP:C8F88A8F deleted successfully.
ADS C:\ProgramData\TEMP:E89EDC52 deleted successfully.
ADS C:\ProgramData\TEMP:69DD03D4 deleted successfully.
ADS C:\ProgramData\TEMP:A917668A deleted successfully.
ADS C:\ProgramData\TEMP:C4E0513E deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Bob
->Temp folder emptied: 76514 bytes
->Temporary Internet Files folder emptied: 51049120 bytes
->Java cache emptied: 22490826 bytes
->FireFox cache emptied: 13502251 bytes
->Google Chrome cache emptied: 10234344 bytes
->Flash cache emptied: 113488 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25749296 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 598115 bytes

Total Files Cleaned = 118.00 mb

[EMPTYJAVA]

User: All Users

User: Bob
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: All Users

User: Bob
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 03032013_194136

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

chrisb39 · Mar 4, 2013

Checkup.txt

Results of screen317's Security Check version 0.99.60
Windows Vista Service Pack 2 x64 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.70.0.1100
Java(TM) 6 Update 39
Java version out of Date!
Adobe Reader 10.1.6 Adobe Reader out of Date!
Mozilla Firefox 12.0 Firefox out of Date!
Google Chrome 24.0.1312.57
Google Chrome 25.0.1364.97
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 6 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

FSS.txt

Farbar Service Scanner Version: 03-03-2013
Ran by Bob (administrator) on 03-03-2013 at 20:03:06
Running from "C:\Users\Bob\Desktop"
Windows Vista (TM) Home Premium Service Pack 2 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcsvc.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0268288 ____A (Microsoft Corporation) 3ED0321127CE70ACDAABBF77E157C2A7

C:\Windows\System32\drivers\afd.sys
[2012-02-14 17:20] - [2012-01-03 07:25] - 0404992 ____A (Microsoft Corporation) C4F6CE6087760AD70960C9EB130E7943

C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2013-02-13 07:22] - [2013-01-04 04:31] - 1423720 ____A (Microsoft Corporation) 0E970F59D7FBB838316176B19A2ADB82

C:\Windows\System32\dnsrslvr.dll
[2011-04-14 06:37] - [2011-03-02 09:12] - 0117760 ____A (Microsoft Corporation) 06230F1B721494A6DF8D47FD395BB1B0

C:\Windows\System32\mpssvc.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0603136 ____A (Microsoft Corporation) 897E3BAF68BA406A61682AE39C83900C

C:\Windows\System32\bfe.dll
[2009-09-18 16:57] - [2009-04-11 00:11] - 0458240 ____A (Microsoft Corporation) FFB96C2589FFA60473EAD78B39FBDE29

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe
[2009-09-18 16:58] - [2009-04-11 00:11] - 1433600 ____A (Microsoft Corporation) B75232DAD33BFD95BF6F0A3E6BFF51E1

C:\Windows\System32\wscsvc.dll
[2009-09-18 16:57] - [2009-04-11 00:11] - 0074752 ____A (Microsoft Corporation) 9EA3E6D0EF7A5C2B9181961052A4B01A

C:\Windows\System32\wbem\WMIsvc.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0221696 ____A (Microsoft Corporation) D2E7296ED1BD26D8DB2799770C077A02

C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 1081856 ____A (Microsoft Corporation) 6D316F4859634071CC25C4FD4589AD2C

C:\Windows\System32\es.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0361984 ____A (Microsoft Corporation) E12F22B73F153DECE721CD45EC05B4AF

C:\Windows\System32\cryptsvc.dll
[2012-10-12 05:04] - [2012-06-01 17:20] - 0174592 ____A (Microsoft Corporation) CA78B312C44E4D52E842C2C8BD48E452

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0719872 ____A (Microsoft Corporation) CF8B9A3A5E7DC57724A89D0C3E8CF9EF

**** End of log ****

Broni · Mar 4, 2013

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions (if present).
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

8. Run Temporary File Cleaner (TFC) weekly.

9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

11. (Windows XP only) Run defrag at your convenience.

12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

14. Please, let me know, how your computer is doing.

chrisb39 · Mar 4, 2013

The computer is booting up without any problems. The issues I noticed in the web browsers have also been corrected. It seems everything's working fine. Thanks for your help!

OTL fix log:

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Bob
->Temp folder emptied: 45730 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 7652861 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25761086 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 32.00 mb

[EMPTYFLASH]

User: All Users

User: Bob
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: All Users

User: Bob
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 03032013_223604

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

chrisb39 · Mar 4, 2013

I did just try to start Windows Defender and get an error "Application failed to initialize:0x800106ba. A problem caused this program's service to stop. To start the service, restart your computer or search Help and Support for how to start a service manually."

Do you recommend using Windows Defender? If so, any suggestions about what to do about this error?

Thanks.

Broni · Mar 4, 2013

Windows Defender is totally useless so you have nothing to worry about.

Way to go!!
Good luck and stay safe

chrisb39 · Mar 4, 2013

Great - thanks for your help!

Broni · Mar 4, 2013

You're very welcome

chrisb39 · Mar 5, 2013

In trying to get everything up to date, I've run into one more issue. I can't get Java updated. I tried the "normal" update process. It failed. Then I uninstalled the current Java version and tried to install the latest version. That failed also. The latest error I received is this:

"Error - Java Installer
Downloaded File
C:\Users\Bob\AppData\LocalLow\Sun\Java\jrel.7.0_17\java_sp.dll is corrupt."

Any suggestions?

Also, I forgot to ask this before. I don't see a way to uninstall Windows Defender. Do I need to uninstall it or should I just let it be?

Thanks.

Chris

TechSpot

Welcome to TechSpot

Laptop won't boot

chrisb39 Newcomer, in training Posts: 38

Attached Files:

OTL.Txt

chrisb39 Newcomer, in training Posts: 38

Broni Malware Annihilator Posts: 40,051 +187

chrisb39 Newcomer, in training Posts: 38

chrisb39 Newcomer, in training Posts: 38

chrisb39 Newcomer, in training Posts: 38

chrisb39 Newcomer, in training Posts: 38

chrisb39 Newcomer, in training Posts: 38

Broni Malware Annihilator Posts: 40,051 +187

chrisb39 Newcomer, in training Posts: 38

Broni Malware Annihilator Posts: 40,051 +187

chrisb39 Newcomer, in training Posts: 38

chrisb39 Newcomer, in training Posts: 38

Broni Malware Annihilator Posts: 40,051 +187

chrisb39 Newcomer, in training Posts: 38

chrisb39 Newcomer, in training Posts: 38

Broni Malware Annihilator Posts: 40,051 +187

chrisb39 Newcomer, in training Posts: 38

Broni Malware Annihilator Posts: 40,051 +187

chrisb39 Newcomer, in training Posts: 38

Add New Comment

	TechSpot Members Login or sign up for free, it takes about 30 seconds.			You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.