Solved Laptop won't boot

[chrisb39]

OTL log, part 3

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKLM\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-7811FX
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}

IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..\SearchScopes,DefaultScope = {0633ee93-d776-472f-a0ff-e1416b8b2e3a}
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..\SearchScopes\{F511D57E-B493-4DDB-ACEC-584774E89855}: "URL" = http://www.google.com/search?q={sea...={outputEncoding}&sourceid=ie7&rlz=1I7GWYE_en
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: pricepeep@getpricepeep.com:2.1.355.0
FF - prefs.js..extensions.enabledAddons: wrc@avast.com:8.0.1482
FF - prefs.js..network.proxy.no_proxies_on: "*.local,192.168.*.*"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_39: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O1DPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Bob\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Bob\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/03/02 16:25:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/11/25 13:27:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/05/03 16:24:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bob\AppData\Roaming\Mozilla\Extensions
[2013/03/03 13:54:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\17ts3mnb.default\extensions
[2013/03/02 18:48:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/07/11 16:24:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2012/09/11 17:18:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/03/02 18:48:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
[2013/03/02 16:25:29 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
File not found (No name found) -- C:\USERS\BOB\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\17TS3MNB.DEFAULT\EXTENSIONS\PRICEPEEP@GETPRICEPEEP.COM.XPI
[2012/04/20 18:19:34 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/20 18:18:25 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/20 18:18:25 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Bob\AppData\Local\Google\Chrome\Application\25.0.1364.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Bob\AppData\Local\Google\Chrome\Application\25.0.1364.97\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Bob\AppData\Local\Google\Chrome\Application\25.0.1364.97\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.6 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\Bob\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: Oberon com adapter (Enabled) = C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - Extension: YouTube = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: avast! WebRep = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1482_0\
CHR - Extension: Gmail = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2013/03/02 22:09:05 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg64.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3:64bit: - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [NcpRsuGui] C:\Program Files (x86)\NCP\SecureClient\rwsrsu.exe ()
O4 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000..\Run: [gStart] C:\Program Files (x86)\Garmin\Training Center\gStart.exe (GARMIN Corp.)
O4 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000..\Run: [HP Officejet Pro 8600 (NET)] C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} http://archives.gametap.com/static/cab_headless/GameTapWebPlayer.cab (GameTap Player)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/4.0.4.0/GarminAxControl_32.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7BE2F466-7B19-4D62-8C1E-D0BEA57514E3}: DhcpNameServer = 192.168.6.1 64.134.255.2 64.134.255.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C9B6A1B4-5E29-4103-BB55-13C479A15456}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F0A54FA5-DC49-4CC3-B97A-97BCC839D415}: DhcpNameServer = 10.22.60.11 10.22.60.12
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Bob\Pictures\EstesPark.JPG
O24 - Desktop BackupWallPaper: C:\Users\Bob\Pictures\EstesPark.JPG
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

[chrisb39]

OTL log, part 4

========== Files/Folders - Created Within 30 Days ==========

[2013/03/03 14:00:43 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/03/03 14:00:38 | 000,000,000 | ---D | C] -- C:\JRT
[2013/03/03 13:50:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Bob\Desktop\OTL.exe
[2013/03/03 13:50:17 | 000,547,491 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Bob\Desktop\JRT.exe
[2013/03/02 22:15:16 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\temp
[2013/03/02 22:09:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/03/02 22:06:29 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/03/02 21:57:02 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/03/02 21:57:02 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/03/02 21:57:02 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/03/02 21:56:53 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/03/02 21:56:39 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013/03/02 21:46:51 | 005,036,301 | R--- | C] (Swearware) -- C:\Users\Bob\Desktop\ComboFix.exe
[2013/03/02 20:23:28 | 000,000,000 | ---D | C] -- C:\Users\Bob\Desktop\RK_Quarantine
[2013/03/02 19:09:33 | 000,000,000 | ---D | C] -- C:\FRST
[2013/03/02 18:51:37 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\Malwarebytes
[2013/03/02 18:51:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/03/02 18:51:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/03/02 18:51:20 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/03/02 18:51:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/02/09 15:35:41 | 000,377,992 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013/02/09 15:35:41 | 000,068,992 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013/02/09 15:35:41 | 000,033,472 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013/02/09 15:35:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013/02/09 15:35:17 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013/02/09 15:35:14 | 000,227,648 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2013/02/09 15:34:14 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013/02/03 15:06:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WildTangent Games
[2013/02/03 15:06:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WildTangent Games
[2013/02/03 15:06:33 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\WildTangent

========== Files - Modified Within 30 Days ==========

[2013/03/03 14:06:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/03/03 14:01:01 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1843488475-1253667702-3664568970-1000UA.job
[2013/03/03 13:59:28 | 000,160,716 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2013/03/03 13:59:28 | 000,160,716 | ---- | M] () -- C:\ProgramData\nvModes.001
[2013/03/03 13:56:51 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\LogConfigTemp.xml
[2013/03/03 13:56:46 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/03/03 13:56:35 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/03/03 13:56:34 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/03/03 13:56:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/03/03 13:50:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bob\Desktop\OTL.exe
[2013/03/03 13:50:30 | 000,547,491 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Bob\Desktop\JRT.exe
[2013/03/03 13:50:14 | 000,594,019 | ---- | M] () -- C:\Users\Bob\Desktop\adwcleaner.exe
[2013/03/02 22:09:05 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013/03/02 21:47:06 | 005,036,301 | R--- | M] (Swearware) -- C:\Users\Bob\Desktop\ComboFix.exe
[2013/03/02 20:17:23 | 000,816,640 | ---- | M] () -- C:\Users\Bob\Desktop\RogueKiller.exe
[2013/03/02 18:59:42 | 000,717,118 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/03/02 18:59:42 | 000,613,520 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/03/02 18:59:42 | 000,108,446 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/03/02 18:51:22 | 000,000,950 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/03/02 18:32:43 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2013/03/01 18:01:00 | 000,000,848 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1843488475-1253667702-3664568970-1000Core.job
[2013/02/28 01:36:34 | 000,177,672 | ---- | M] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013/02/28 01:36:34 | 000,068,992 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013/02/28 01:36:33 | 001,025,880 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2013/02/28 01:36:33 | 000,377,992 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013/02/28 01:36:33 | 000,065,408 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013/02/28 01:36:32 | 000,080,888 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2013/02/28 01:36:32 | 000,059,216 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr.sys
[2013/02/28 01:36:31 | 000,033,472 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013/02/28 01:36:07 | 000,041,664 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2013/02/28 01:35:43 | 000,287,840 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2013/02/25 18:04:46 | 000,002,036 | ---- | M] () -- C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/02/25 18:04:46 | 000,002,034 | ---- | M] () -- C:\Users\Bob\Desktop\Google Chrome.lnk
[2013/02/14 07:34:33 | 000,389,968 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/02/13 19:05:59 | 000,001,726 | -H-- | M] () -- C:\Users\Bob\Documents\Default.rdp
[2013/02/09 15:35:42 | 000,001,787 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/02/03 15:06:49 | 000,002,378 | ---- | M] () -- C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - wildgames.lnk
[2013/02/03 15:06:48 | 000,002,346 | ---- | M] () -- C:\Users\Public\Desktop\WildTangent Games App - wildgames.lnk

========== Files Created - No Company Name ==========

[2013/03/03 13:50:03 | 000,594,019 | ---- | C] () -- C:\Users\Bob\Desktop\adwcleaner.exe
[2013/03/02 21:57:02 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/03/02 21:57:02 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/03/02 21:57:02 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/03/02 21:57:02 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/03/02 21:57:02 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/03/02 20:17:15 | 000,816,640 | ---- | C] () -- C:\Users\Bob\Desktop\RogueKiller.exe
[2013/03/02 18:51:22 | 000,000,950 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/03/02 16:25:30 | 000,177,672 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013/03/02 16:25:30 | 000,065,408 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013/02/09 15:35:42 | 000,001,787 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/02/03 15:06:47 | 000,002,378 | ---- | C] () -- C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - wildgames.lnk
[2013/02/03 15:06:46 | 000,002,346 | ---- | C] () -- C:\Users\Public\Desktop\WildTangent Games App - wildgames.lnk
[2013/01/24 19:14:13 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2011/11/05 15:23:57 | 000,000,126 | ---- | C] () -- C:\Windows\QUICKEN.INI
[2010/11/30 17:54:07 | 033,865,678 | ---- | C] () -- C:\Program Files (x86)\data.dpk
[2010/02/06 22:46:30 | 000,000,680 | ---- | C] () -- C:\Users\Bob\AppData\Local\d3d9caps.dat
[2010/01/24 12:21:29 | 000,023,949 | ---- | C] () -- C:\Users\Bob\LastSettings.cs
[2009/11/21 21:01:30 | 000,024,010 | ---- | C] () -- C:\Users\Bob\Rollable.cs
[2009/10/10 00:39:51 | 000,000,091 | ---- | C] () -- C:\Users\Bob\AppData\Local\fusioncache.dat
[2009/09/09 10:39:16 | 000,007,680 | ---- | C] () -- C:\Users\Bob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/17 19:03:44 | 000,000,000 | ---- | C] () -- C:\Users\Bob\AppData\Local\rx_image.Cache
[2009/01/12 20:09:58 | 000,160,716 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/01/12 20:09:19 | 000,160,716 | ---- | C] () -- C:\ProgramData\nvModes.dat

========== ZeroAccess Check ==========

[2006/11/02 08:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/08 10:59:03 | 012,899,840 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 10:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/04/11 00:11:14 | 000,891,392 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\fastprox.dll -- [2009/04/10 23:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008/01/20 19:50:58 | 000,513,024 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\wbemess.dll

 

[chrisb39]

OTL log, part 5

========== LOP Check ==========

[2011/06/17 20:54:41 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\2monkeys
[2011/06/25 18:31:44 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Alawar
[2011/04/14 16:53:50 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Arkadium
[2011/03/11 21:41:33 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Artifex Mundi
[2011/04/23 18:32:53 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Artogon
[2011/12/25 17:14:44 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Awem
[2011/05/19 18:47:33 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Big Fish Games
[2011/03/15 20:05:03 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Boomzap
[2012/01/26 20:25:16 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\casualArts
[2011/10/10 18:04:57 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ChaYoWo Games
[2011/04/07 20:44:08 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Column of the Maya
[2011/01/07 18:56:00 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ElementalsTheMagicKey
[2011/06/19 16:10:27 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Endless Fluff Games
[2011/07/11 15:40:01 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Enlightenus2SE_BFG
[2011/09/21 18:35:53 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ERS Game Studios
[2011/02/13 08:49:21 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Flip Video
[2011/07/01 16:56:55 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Floodlight Games
[2011/06/16 18:06:28 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\FlyWheelGames
[2011/05/25 16:21:39 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Friday's games
[2011/04/06 18:38:31 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Frogwares
[2011/03/14 17:40:12 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GameInvest
[2011/05/19 16:22:30 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GameMill Entertainment
[2011/04/10 08:34:31 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GamesCafe
[2013/01/01 10:16:51 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Garmin
[2011/04/21 17:37:07 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Gogii
[2011/03/17 16:57:31 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GOL_byHasbro
[2011/06/18 13:42:32 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\GuardiansOfMagic
[2012/02/05 10:32:28 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\HdO Adventure
[2011/09/12 17:23:26 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Islands2
[2011/12/01 17:27:04 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\JaiboGames
[2011/04/15 19:27:32 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Jetdogs Studios
[2010/12/31 16:37:01 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Ladia Group
[2011/06/20 17:43:56 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Lazy Turtle Games
[2011/03/21 15:17:44 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\MA2
[2011/03/13 11:11:47 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\MAI
[2011/05/20 20:39:21 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Millennium_Saves
[2011/02/19 14:48:35 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Mystery of Mortlake Mansion
[2011/04/12 15:46:06 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Namco
[2011/07/24 19:45:29 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\NevoSoft
[2012/12/01 19:43:52 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Oberon All My Gods
[2011/02/18 17:24:12 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Oberon Media
[2010/07/10 20:07:09 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Oberonv1000
[2011/06/02 16:29:08 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Sahmon Games
[2011/05/24 20:00:06 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Silverback Productions
[2011/11/16 19:27:55 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\SpinTop Games
[2010/12/13 18:54:40 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ThreeDays2
[2011/04/09 13:58:06 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Top Evidence
[2009/10/10 00:39:54 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Turbine
[2012/02/15 18:53:20 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Vast Studios
[2011/03/12 18:58:33 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Virtual Prophecy
[2011/02/22 19:17:33 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Western Software Technologies
[2013/02/03 15:06:58 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\WildTangent

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:A53EDDED
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMPA3C6C07
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:793ABD2B
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP9F6664C
@Alternate Data Stream - 188 bytes -> C:\ProgramData\TEMP:322EAACD
@Alternate Data Stream - 187 bytes -> C:\ProgramData\TEMP:5D10517E
@Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:E0648389
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:B3C1080A
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:18BB305F
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMPCADFB80
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP7DEAA30
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP6C2C750
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:AE9DFC85
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:52FE3CCD
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:15FA1ECB
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7D6E8689
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7CC19A3B
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:EB3A09D6
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6CC1CB6D
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:65AAB2AD
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6093F383
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:BE02DA6F
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:9FF05345
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:30997E0F
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:94213A87
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:C83B0187
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:6A285F23
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:27219865
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:F1E4DACB
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMPAC07741
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:BAE8784F
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:41326804
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:3E7C402E
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:269822E7
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:3F22DA14
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:39CC5718
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:9C0F8F95
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1FDDA142
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1E86AA26
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMPEAC2707
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:06253D7D
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:029E021F
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMPE29D4A1
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:A8036ADB
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:E9D68B36
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:8AB86A68
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:EE88D186
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:A5808D58
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:8C443193
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:2A8CD561
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0E361B63
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:B8441B0C
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5B132D3E
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:12A3FA49
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:97F0A1F8
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:F6FE6031
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E8AB98F0
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP3A8AA31
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:B00FB034
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:2020565D
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:0A404476
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:69102296
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:14A7EC62
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:C10D19E3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:5D4F063C
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:55662D3E
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2C6A77F3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2B059D79
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2ADC9FB3
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:70F0A2F4
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:FFD9E05D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP6125FEA
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:3EA1C214
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMPD780579
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:64AEDD72
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5C5A503E
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:2F34C507
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:1AAEFD5D
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:107FBBD4
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E9039033
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E3EEF684
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:C085816B
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:8F4D7D6C
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:40B42CCC
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C8F88A8F
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E89EDC52
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:69DD03D4
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:A917668A
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:C4E0513E

< End of report >

 

[Broni]

The very top part is missing.

 

[chrisb39]

OTL log, top part

OTL logfile created on: 3/3/2013 2:15:16 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Bob\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19400)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.67 Gb Available Physical Memory | 66.81% Memory free
8.16 Gb Paging File | 6.76 Gb Available in Paging File | 82.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 88.29 Gb Total Space | 22.02 Gb Free Space | 24.94% Space Free | Partition Type: NTFS
Drive D: | 88.02 Gb Total Space | 87.55 Gb Free Space | 99.47% Space Free | Partition Type: NTFS

Computer Name: FXLAPTOP | User Name: Bob | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/03/03 13:50:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Bob\Desktop\OTL.exe

 

[Broni]

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*
  FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
  O4 - HKLM..\Run: [] File not found
  O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found
  O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html File not found
  O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe File not found
  O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
  O15 - HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
  O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/4.0.4.0/GarminAxControl_32.CAB (Reg Error: Key error.)
  O18:64bit: - Protocol\Handler\livecall - No CLSID value found
  O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
  O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
  O18:64bit: - Protocol\Handler\msnim - No CLSID value found
  @Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:A53EDDED
  @Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:DA3C6C07
  @Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:793ABD2B
  @Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:D9F6664C
  @Alternate Data Stream - 188 bytes -> C:\ProgramData\TEMP:322EAACD
  @Alternate Data Stream - 187 bytes -> C:\ProgramData\TEMP:5D10517E
  @Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:E0648389
  @Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:B3C1080A
  @Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:18BB305F
  @Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:DCADFB80
  @Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:D7DEAA30
  @Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:D6C2C750
  @Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:AE9DFC85
  @Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:52FE3CCD
  @Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:15FA1ECB
  @Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7D6E8689
  @Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7CC19A3B
  @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:EB3A09D6
  @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6CC1CB6D
  @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:65AAB2AD
  @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6093F383
  @Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:BE02DA6F
  @Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:9FF05345
  @Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:30997E0F
  @Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:94213A87
  @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:C83B0187
  @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:6A285F23
  @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:27219865
  @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:F1E4DACB
  @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:DAC07741
  @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:BAE8784F
  @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:41326804
  @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:3E7C402E
  @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:269822E7
  @Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:3F22DA14
  @Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:39CC5718
  @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:9C0F8F95
  @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1FDDA142
  @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:1E86AA26
  @Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:DEAC2707
  @Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:06253D7D
  @Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:029E021F
  @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:DE29D4A1
  @Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:A8036ADB
  @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:E9D68B36
  @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:8AB86A68
  @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:EE88D186
  @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:A5808D58
  @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:8C443193
  @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:2A8CD561
  @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0E361B63
  @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:B8441B0C
  @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5B132D3E
  @Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:12A3FA49
  @Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:97F0A1F8
  @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:F6FE6031
  @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E8AB98F0
  @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:D3A8AA31
  @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:B00FB034
  @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:2020565D
  @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:0A404476
  @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:69102296
  @Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:14A7EC62
  @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:C10D19E3
  @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:5D4F063C
  @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:55662D3E
  @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2C6A77F3
  @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2B059D79
  @Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:2ADC9FB3
  @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:70F0A2F4
  @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:FFD9E05D
  @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:D6125FEA
  @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:3EA1C214
  @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:DD780579
  @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:64AEDD72
  @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5C5A503E
  @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:2F34C507
  @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:1AAEFD5D
  @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:107FBBD4
  @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E9039033
  @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:E3EEF684
  @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:C085816B
  @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:8F4D7D6C
  @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:40B42CCC
  @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C8F88A8F
  @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E89EDC52
  @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:69DD03D4
  @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:A917668A
  @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:C4E0513E
  
  :Commands
  [purity]
  [emptytemp]
  [emptyjava]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.

NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

Last scans...

Download Security Check from here or here and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
• Tick the box next to YES, I accept the Terms of Use
• Click Start
• Accept any security warnings from your browser.
• Check Scan archives
• Click Start
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click on List of found threats
• Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• NOTE. If Eset won't find any threats, it won't produce any log.

 

[chrisb39]

ESET scan found no threats.

OTL fix log:

All processes killed
========== OTL ==========
HKU\S-1-5-21-1843488475-1253667702-3664568970-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D}\ not found.
Registry key HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clonewarsadventures.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\freerealms.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\soe.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1843488475-1253667702-3664568970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sony.com\ deleted successfully.
Starting removal of ActiveX control Garmin Communicator Plug-In
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Garmin Communicator Plug-In\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-itss\ deleted successfully.
File Protocol\Handler\ms-itss - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
ADS C:\ProgramData\TEMP:A53EDDED deleted successfully.
ADS C:\ProgramData\TEMPA3C6C07 deleted successfully.
ADS C:\ProgramData\TEMP:793ABD2B deleted successfully.
ADS C:\ProgramData\TEMP9F6664C deleted successfully.
ADS C:\ProgramData\TEMP:322EAACD deleted successfully.
ADS C:\ProgramData\TEMP:5D10517E deleted successfully.
ADS C:\ProgramData\TEMP:E0648389 deleted successfully.
ADS C:\ProgramData\TEMP:B3C1080A deleted successfully.
ADS C:\ProgramData\TEMP:18BB305F deleted successfully.
ADS C:\ProgramData\TEMPCADFB80 deleted successfully.
ADS C:\ProgramData\TEMP7DEAA30 deleted successfully.
ADS C:\ProgramData\TEMP6C2C750 deleted successfully.
ADS C:\ProgramData\TEMP:AE9DFC85 deleted successfully.
ADS C:\ProgramData\TEMP:52FE3CCD deleted successfully.
ADS C:\ProgramData\TEMP:15FA1ECB deleted successfully.
ADS C:\ProgramData\TEMP:7D6E8689 deleted successfully.
ADS C:\ProgramData\TEMP:7CC19A3B deleted successfully.
ADS C:\ProgramData\TEMP:EB3A09D6 deleted successfully.
ADS C:\ProgramData\TEMP:6CC1CB6D deleted successfully.
ADS C:\ProgramData\TEMP:65AAB2AD deleted successfully.
ADS C:\ProgramData\TEMP:6093F383 deleted successfully.
ADS C:\ProgramData\TEMP:BE02DA6F deleted successfully.
ADS C:\ProgramData\TEMP:9FF05345 deleted successfully.
ADS C:\ProgramData\TEMP:30997E0F deleted successfully.
ADS C:\ProgramData\TEMP:94213A87 deleted successfully.
ADS C:\ProgramData\TEMP:C83B0187 deleted successfully.
ADS C:\ProgramData\TEMP:6A285F23 deleted successfully.
ADS C:\ProgramData\TEMP:27219865 deleted successfully.
ADS C:\ProgramData\TEMP:F1E4DACB deleted successfully.
ADS C:\ProgramData\TEMPAC07741 deleted successfully.
ADS C:\ProgramData\TEMP:BAE8784F deleted successfully.
ADS C:\ProgramData\TEMP:41326804 deleted successfully.
ADS C:\ProgramData\TEMP:3E7C402E deleted successfully.
ADS C:\ProgramData\TEMP:269822E7 deleted successfully.
ADS C:\ProgramData\TEMP:3F22DA14 deleted successfully.
ADS C:\ProgramData\TEMP:39CC5718 deleted successfully.
ADS C:\ProgramData\TEMP:9C0F8F95 deleted successfully.
ADS C:\ProgramData\TEMP:1FDDA142 deleted successfully.
ADS C:\ProgramData\TEMP:1E86AA26 deleted successfully.
ADS C:\ProgramData\TEMPEAC2707 deleted successfully.
ADS C:\ProgramData\TEMP:06253D7D deleted successfully.
ADS C:\ProgramData\TEMP:029E021F deleted successfully.
ADS C:\ProgramData\TEMPE29D4A1 deleted successfully.
ADS C:\ProgramData\TEMP:A8036ADB deleted successfully.
ADS C:\ProgramData\TEMP:E9D68B36 deleted successfully.
ADS C:\ProgramData\TEMP:8AB86A68 deleted successfully.
ADS C:\ProgramData\TEMP:EE88D186 deleted successfully.
ADS C:\ProgramData\TEMP:A5808D58 deleted successfully.
ADS C:\ProgramData\TEMP:8C443193 deleted successfully.
ADS C:\ProgramData\TEMP:2A8CD561 deleted successfully.
ADS C:\ProgramData\TEMP:0E361B63 deleted successfully.
ADS C:\ProgramData\TEMP:B8441B0C deleted successfully.
ADS C:\ProgramData\TEMP:5B132D3E deleted successfully.
ADS C:\ProgramData\TEMP:12A3FA49 deleted successfully.
ADS C:\ProgramData\TEMP:97F0A1F8 deleted successfully.
ADS C:\ProgramData\TEMP:F6FE6031 deleted successfully.
ADS C:\ProgramData\TEMP:E8AB98F0 deleted successfully.
ADS C:\ProgramData\TEMP3A8AA31 deleted successfully.
ADS C:\ProgramData\TEMP:B00FB034 deleted successfully.
ADS C:\ProgramData\TEMP:2020565D deleted successfully.
ADS C:\ProgramData\TEMP:0A404476 deleted successfully.
ADS C:\ProgramData\TEMP:69102296 deleted successfully.
ADS C:\ProgramData\TEMP:14A7EC62 deleted successfully.
ADS C:\ProgramData\TEMP:C10D19E3 deleted successfully.
ADS C:\ProgramData\TEMP:5D4F063C deleted successfully.
ADS C:\ProgramData\TEMP:55662D3E deleted successfully.
ADS C:\ProgramData\TEMP:2C6A77F3 deleted successfully.
ADS C:\ProgramData\TEMP:2B059D79 deleted successfully.
ADS C:\ProgramData\TEMP:2ADC9FB3 deleted successfully.
ADS C:\ProgramData\TEMP:70F0A2F4 deleted successfully.
ADS C:\ProgramData\TEMP:FFD9E05D deleted successfully.
ADS C:\ProgramData\TEMP6125FEA deleted successfully.
ADS C:\ProgramData\TEMP:3EA1C214 deleted successfully.
ADS C:\ProgramData\TEMPD780579 deleted successfully.
ADS C:\ProgramData\TEMP:64AEDD72 deleted successfully.
ADS C:\ProgramData\TEMP:5C5A503E deleted successfully.
ADS C:\ProgramData\TEMP:2F34C507 deleted successfully.
ADS C:\ProgramData\TEMP:1AAEFD5D deleted successfully.
ADS C:\ProgramData\TEMP:107FBBD4 deleted successfully.
ADS C:\ProgramData\TEMP:E9039033 deleted successfully.
ADS C:\ProgramData\TEMP:E3EEF684 deleted successfully.
ADS C:\ProgramData\TEMP:C085816B deleted successfully.
ADS C:\ProgramData\TEMP:8F4D7D6C deleted successfully.
ADS C:\ProgramData\TEMP:40B42CCC deleted successfully.
ADS C:\ProgramData\TEMP:C8F88A8F deleted successfully.
ADS C:\ProgramData\TEMP:E89EDC52 deleted successfully.
ADS C:\ProgramData\TEMP:69DD03D4 deleted successfully.
ADS C:\ProgramData\TEMP:A917668A deleted successfully.
ADS C:\ProgramData\TEMP:C4E0513E deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Bob
->Temp folder emptied: 76514 bytes
->Temporary Internet Files folder emptied: 51049120 bytes
->Java cache emptied: 22490826 bytes
->FireFox cache emptied: 13502251 bytes
->Google Chrome cache emptied: 10234344 bytes
->Flash cache emptied: 113488 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25749296 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 598115 bytes

Total Files Cleaned = 118.00 mb


[EMPTYJAVA]

User: All Users

User: Bob
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: Bob
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 03032013_194136

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

[chrisb39]

Checkup.txt

Results of screen317's Security Check version 0.99.60
Windows Vista Service Pack 2 x64 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.70.0.1100
Java(TM) 6 Update 39
Java version out of Date!
Adobe Reader 10.1.6 Adobe Reader out of Date!
Mozilla Firefox 12.0 Firefox out of Date!
Google Chrome 24.0.1312.57
Google Chrome 25.0.1364.97
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 6 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````



FSS.txt

Farbar Service Scanner Version: 03-03-2013
Ran by Bob (administrator) on 03-03-2013 at 20:03:06
Running from "C:\Users\Bob\Desktop"
Windows Vista (TM) Home Premium Service Pack 2 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcsvc.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0268288 ____A (Microsoft Corporation) 3ED0321127CE70ACDAABBF77E157C2A7

C:\Windows\System32\drivers\afd.sys
[2012-02-14 17:20] - [2012-01-03 07:25] - 0404992 ____A (Microsoft Corporation) C4F6CE6087760AD70960C9EB130E7943

C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2013-02-13 07:22] - [2013-01-04 04:31] - 1423720 ____A (Microsoft Corporation) 0E970F59D7FBB838316176B19A2ADB82

C:\Windows\System32\dnsrslvr.dll
[2011-04-14 06:37] - [2011-03-02 09:12] - 0117760 ____A (Microsoft Corporation) 06230F1B721494A6DF8D47FD395BB1B0

C:\Windows\System32\mpssvc.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0603136 ____A (Microsoft Corporation) 897E3BAF68BA406A61682AE39C83900C

C:\Windows\System32\bfe.dll
[2009-09-18 16:57] - [2009-04-11 00:11] - 0458240 ____A (Microsoft Corporation) FFB96C2589FFA60473EAD78B39FBDE29

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe
[2009-09-18 16:58] - [2009-04-11 00:11] - 1433600 ____A (Microsoft Corporation) B75232DAD33BFD95BF6F0A3E6BFF51E1

C:\Windows\System32\wscsvc.dll
[2009-09-18 16:57] - [2009-04-11 00:11] - 0074752 ____A (Microsoft Corporation) 9EA3E6D0EF7A5C2B9181961052A4B01A

C:\Windows\System32\wbem\WMIsvc.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0221696 ____A (Microsoft Corporation) D2E7296ED1BD26D8DB2799770C077A02

C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 1081856 ____A (Microsoft Corporation) 6D316F4859634071CC25C4FD4589AD2C

C:\Windows\System32\es.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0361984 ____A (Microsoft Corporation) E12F22B73F153DECE721CD45EC05B4AF

C:\Windows\System32\cryptsvc.dll
[2012-10-12 05:04] - [2012-06-01 17:20] - 0174592 ____A (Microsoft Corporation) CA78B312C44E4D52E842C2C8BD48E452

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll
[2009-09-18 16:58] - [2009-04-11 00:11] - 0719872 ____A (Microsoft Corporation) CF8B9A3A5E7DC57724A89D0C3E8CF9EF



**** End of log ****

 

[Broni]

Update Adobe Reader

You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions (if present).
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

8. Run Temporary File Cleaner (TFC) weekly.

9. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

11. (Windows XP only) Run defrag at your convenience.

12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

14. Please, let me know, how your computer is doing.

 

[chrisb39]

The computer is booting up without any problems. The issues I noticed in the web browsers have also been corrected. It seems everything's working fine. Thanks for your help!

OTL fix log:

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Bob
->Temp folder emptied: 45730 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 7652861 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25761086 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 32.00 mb


[EMPTYFLASH]

User: All Users

User: Bob
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Bob
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 03032013_223604

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

[chrisb39]

I did just try to start Windows Defender and get an error "Application failed to initialize:0x800106ba. A problem caused this program's service to stop. To start the service, restart your computer or search Help and Support for how to start a service manually."

Do you recommend using Windows Defender? If so, any suggestions about what to do about this error?

Thanks.

 

[Broni]

Windows Defender is totally useless so you have nothing to worry about.

Way to go!!
Good luck and stay safe

 

[chrisb39]

Great - thanks for your help!

 

[Broni]

You're very welcome

 

[chrisb39]

In trying to get everything up to date, I've run into one more issue. I can't get Java updated. I tried the "normal" update process. It failed. Then I uninstalled the current Java version and tried to install the latest version. That failed also. The latest error I received is this:

"Error - Java Installer
Downloaded File
C:\Users\Bob\AppData\LocalLow\Sun\Java\jrel.7.0_17\java_sp.dll is corrupt."

Any suggestions?

Also, I forgot to ask this before. I don't see a way to uninstall Windows Defender. Do I need to uninstall it or should I just let it be?

Thanks.

Chris

 

[Broni]

WD is part of Windows so it can only be disabled not uninstalled.

As for Java....
Let's try to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it.

• Run JavaRa.exe (Vista and 7 users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Do NOT post JavaRa log.

Then go here: https://www.techspot.com/downloads/6463-java-se.html and download standalone installer.

 

[chrisb39]

That did it - thanks again!

 

[Broni]

Cool beans