Solved Website redirects and hidden files in folders

[Brockr11]

OTL logfile created on: 10/7/2012 12:46:38 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\brock\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.28 Gb Available Physical Memory | 64.25% Memory free
4.22 Gb Paging File | 3.37 Gb Available in Paging File | 79.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 291.81 Gb Total Space | 201.34 Gb Free Space | 69.00% Space Free | Partition Type: NTFS
Drive D: | 6.27 Gb Total Space | 0.88 Gb Free Space | 14.08% Space Free | Partition Type: NTFS

Computer Name: BROCK-PC | User Name: brock | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/07 00:45:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\brock\Desktop\OTL.exe
PRC - [2012/08/23 11:22:46 | 000,296,096 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\realplayer\Update\realsched.exe
PRC - [2010/02/18 16:40:26 | 002,012,912 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/01/15 11:26:18 | 004,874,240 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/10/18 20:10:42 | 000,479,232 | ---- | M] (Nikon Corporation) -- C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
PRC - [2007/01/29 18:11:36 | 000,537,520 | ---- | M] ( ) -- C:\Windows\System32\lxczcoms.exe
PRC - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2006/09/28 09:42:24 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe
PRC - [2006/09/03 14:32:28 | 000,208,896 | ---- | M] () -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe


========== Modules (No Company Name) ==========

MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/03/24 22:40:35 | 000,052,224 | ---- | M] () -- C:\Users\brock\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2007/09/20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll


========== Services (SafeList) ==========

SRV - [2012/08/29 17:39:59 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/01/29 18:11:36 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxczcoms.exe -- (lxcz_device)
SRV - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2006/09/11 20:02:44 | 000,544,256 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe -- (Remote UI Service)
SRV - [2006/09/11 20:01:04 | 000,167,936 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe -- (MCLServiceATL)
SRV - [2006/09/11 19:56:32 | 000,075,264 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\issm.exe -- (ISSM)
SRV - [2006/09/11 19:56:20 | 000,188,416 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\CCU\AlertService.exe -- (AlertService)
SRV - [2006/09/03 14:32:28 | 000,208,896 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe -- (DQLWinService)
SRV - [2006/09/01 03:47:56 | 000,026,624 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe -- (M1 Server)
SRV - [2006/05/10 13:13:52 | 000,029,696 | R--- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\tools\IntelDHSvcConf.exe -- (IntelDHSvcConf)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\wanatw4.sys -- (wanatw)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\brock\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/02/17 10:25:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/02/17 10:15:58 | 000,066,632 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 10:15:58 | 000,012,872 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Running] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2008/05/08 13:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/08 13:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
DRV - [2007/10/18 15:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2006/07/13 14:14:16 | 000,004,608 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys -- (TSHWMDTCP)
DRV - [2005/12/12 12:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
IE - HKLM\..\SearchScopes,DefaultScope = {734FCA9D-9357-4903-AF66-F73E9EBB20DC}
IE - HKLM\..\SearchScopes\{0DCFD6F3-ABBE-48E7-9E37-FD390CA57BC6}: "URL" = http://search.live.com/results.aspx...entrypoint={referrer:source?}&FORM=HVDUS7
IE - HKLM\..\SearchScopes\{734FCA9D-9357-4903-AF66-F73E9EBB20DC}: "URL" = http://search.aol.com/aolcom/search?query={searchTerms}&invocationType=msie70a
IE - HKLM\..\SearchScopes\{C16844E9-3E0E-48BD-9A9F-6D661940A067}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKLM\..\SearchScopes\{DE0CB003-48C8-4FA9-9E52-CF575AE057C0}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\..\SearchScopes,DefaultScope = {F24C5A77-CA73-4E1C-A30C-5BE5A5EFC3F8}
IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\..\SearchScopes\{0DCFD6F3-ABBE-48E7-9E37-FD390CA57BC6}: "URL" = http://search.live.com/results.aspx...entrypoint={referrer:source?}&FORM=HVDUS7
IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\..\SearchScopes\{C16844E9-3E0E-48BD-9A9F-6D661940A067}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\..\SearchScopes\{DE0CB003-48C8-4FA9-9E52-CF575AE057C0}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\..\SearchScopes\{F24C5A77-CA73-4E1C-A30C-5BE5A5EFC3F8}: "URL" = http://search.aol.com/aolcom/search?query={searchTerms}&invocationType=msie70a
IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files\TVUPlayer\npTVUAx.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\brock\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\brock\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/10/04 18:14:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/09/09 13:10:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/09/04 18:07:58 | 000,000,000 | ---D | M]

[2012/09/09 13:10:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\brock\AppData\Roaming\Mozilla\Extensions
[2012/09/09 14:16:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\brock\AppData\Roaming\Mozilla\Firefox\Profiles\etr2fqqs.default\extensions
[2012/09/09 13:10:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/09/05 21:27:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/08/23 11:22:55 | 000,129,176 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2007/04/16 13:07:12 | 000,180,293 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npViewpoint.dll
[2012/09/05 21:26:22 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/09/05 21:26:22 | 000,002,253 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\brock\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\brock\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\brock\AppData\Local\Google\Chrome\Application\22.0.1229.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\brock\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Acrobat 7.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
CHR - plugin: GameTap (Enabled) = C:\Program Files\GameTap\bin\Release\npgametaptool.dll
CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\Program Files\TVUPlayer\npTVUAx.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files\Veetle\Player\npvlc.dll
CHR - plugin: Veetle Broadcaster Plugin (Enabled) = C:\Program Files\Veetle\VLCBroadcast\npvbp.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files\Veetle\plugins\npVeetle.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\brock\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Angry Birds = C:\Users\brock\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\brock\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Reddit Enhancement Suite = C:\Users\brock\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb\3.4_0\

O1 HOSTS File: ([2012/10/05 02:23:53 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: AOL &Dictionary Search - C:\Program Files\Common Files\aol\AOLSearch [2007/09/18 18:48:44 | 000,000,000 | ---D | M]
O8 - Extra context menu item: AOL &Thesaurus Search - C:\Program Files\Common Files\aol\AOLSearch [2007/09/18 18:48:44 | 000,000,000 | ---D | M]
O8 - Extra context menu item: AOL &Video Search - C:\Program Files\Common Files\aol\AOLSearch [2007/09/18 18:48:44 | 000,000,000 | ---D | M]
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.7.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BC1206EB-AE85-4833-901F-16AFF14E1757}: DhcpNameServer = 75.75.75.75 75.75.76.76
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.dll) - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\brock\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\brock\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/04 15:16:02 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\...com [@ = ComFile] -- Reg Error: Key error. File not found
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/07 00:45:36 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\brock\Desktop\OTL.exe
[2012/10/06 01:06:37 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/10/06 01:06:37 | 000,000,000 | ---D | C] -- C:\Users\brock\AppData\Local\temp
[2012/10/06 01:06:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/10/06 00:54:08 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/10/05 01:08:45 | 000,000,000 | ---D | C] -- C:\Users\brock\AppData\Local\CrashDumps
[2012/10/05 00:42:36 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/10/05 00:42:36 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/10/05 00:42:36 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/10/05 00:39:53 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/10/05 00:39:12 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/10/05 00:30:20 | 004,762,471 | R--- | C] (Swearware) -- C:\Users\brock\Desktop\ComboFix.exe
[2012/10/04 22:47:04 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\brock\Desktop\aswMBR.exe
[2012/10/04 22:24:35 | 000,000,000 | ---D | C] -- C:\Users\brock\Desktop\RK_Quarantine
[2012/10/04 21:57:37 | 002,212,440 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\brock\Desktop\TDSSKiller.exe
[2012/10/04 20:29:23 | 000,399,264 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\brock\Desktop\unhide.exe
[2012/10/04 18:28:32 | 000,000,000 | ---D | C] -- C:\Users\brock\AppData\Roaming\Malwarebytes
[2012/10/04 18:27:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/10/04 18:27:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/10/04 18:27:27 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/10/04 18:27:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/10/04 12:23:23 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2012/10/04 12:23:23 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012/10/03 02:30:22 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/10/03 02:28:14 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012/09/30 12:27:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\N360_BACKUP
[2012/09/30 10:05:27 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2012/09/27 11:26:32 | 000,000,000 | ---D | C] -- C:\Users\brock\AppData\Local\Windows Live
[2012/09/27 11:26:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2012/09/19 18:29:09 | 000,000,000 | ---D | C] -- C:\Program Files\Jnes
[2012/09/19 18:05:17 | 000,000,000 | ---D | C] -- C:\Users\brock\Documents\screenshots
[2012/09/14 01:05:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/09/14 01:04:31 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/09/14 01:04:28 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012/09/14 01:04:28 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/09/09 13:10:16 | 000,000,000 | ---D | C] -- C:\Users\brock\AppData\Roaming\Mozilla
[2008/02/18 21:26:08 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\brock\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2012/10/07 00:46:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/07 00:45:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\brock\Desktop\OTL.exe
[2012/10/07 00:39:12 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{46C19C9A-26A1-435A-AF07-C0A755687A16}.job
[2012/10/07 00:18:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1083133115-3377555592-1284217255-1001UA.job
[2012/10/06 23:52:26 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/06 23:52:26 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/06 23:52:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/05 02:36:02 | 272,933,054 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/10/05 02:23:53 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/10/05 00:30:36 | 004,762,471 | R--- | M] (Swearware) -- C:\Users\brock\Desktop\ComboFix.exe
[2012/10/04 23:30:04 | 000,000,512 | ---- | M] () -- C:\Users\brock\Desktop\MBR.dat
[2012/10/04 22:47:10 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\brock\Desktop\aswMBR.exe
[2012/10/04 21:57:01 | 002,193,278 | ---- | M] () -- C:\Users\brock\Desktop\tdsskiller.zip
[2012/10/04 20:29:30 | 000,399,264 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\brock\Desktop\unhide.exe
[2012/10/04 19:07:52 | 000,302,592 | ---- | M] () -- C:\Users\brock\Desktop\s2j02fly.exe
[2012/10/04 18:27:41 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/04 15:18:00 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1083133115-3377555592-1284217255-1001Core.job
[2012/10/04 12:24:51 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012/10/01 00:44:10 | 000,279,264 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/09/30 15:19:20 | 000,002,006 | ---- | M] () -- C:\Users\brock\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/09/30 09:55:20 | 000,604,284 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/09/30 09:55:20 | 000,103,984 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/09/17 19:25:14 | 002,212,440 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\brock\Desktop\TDSSKiller.exe
[2012/09/12 18:58:56 | 000,000,127 | ---- | M] () -- C:\Windows\System32\MRT.INI
[2012/09/09 13:40:39 | 000,000,848 | ---- | M] () -- C:\Users\brock\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/09/07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2012/10/05 00:42:36 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/10/05 00:42:36 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/10/05 00:42:36 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/10/05 00:42:36 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/10/05 00:42:36 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/10/04 23:30:04 | 000,000,512 | ---- | C] () -- C:\Users\brock\Desktop\MBR.dat
[2012/10/04 21:56:41 | 002,193,278 | ---- | C] () -- C:\Users\brock\Desktop\tdsskiller.zip
[2012/10/04 19:07:45 | 000,302,592 | ---- | C] () -- C:\Users\brock\Desktop\s2j02fly.exe
[2012/10/04 18:27:41 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/25 03:18:55 | 000,262,160 | ---- | C] () -- C:\Users\brock\Documents\PUNCHOUT.NES
[2012/09/25 03:18:55 | 000,000,388 | ---- | C] () -- C:\Users\brock\Documents\readnow.htm
[2012/09/19 23:06:15 | 000,040,976 | ---- | C] () -- C:\Users\brock\Documents\Super Mario Bros. (JU) [!].nes
[2012/09/19 23:06:15 | 000,000,397 | ---- | C] () -- C:\Users\brock\Documents\freeroms.htm
[2012/09/19 18:32:41 | 000,065,680 | ---- | C] () -- C:\Users\brock\Documents\GRADIUS.NES
[2012/09/19 18:32:41 | 000,000,388 | ---- | C] () -- C:\Users\brock\Documents\readme.htm
[2012/09/12 18:58:56 | 000,000,127 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2012/09/09 13:40:39 | 000,000,848 | ---- | C] () -- C:\Users\brock\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/09/05 14:10:00 | 000,000,245 | ---- | C] () -- C:\Users\brock\AppData\Roaming\burnaware.ini
[2012/09/04 13:10:06 | 000,000,184 | ---- | C] () -- C:\ProgramData\-krDrsJZ4zQCuX2r
[2012/09/04 13:10:05 | 000,000,160 | ---- | C] () -- C:\ProgramData\-krDrsJZ4zQCuX2
[2012/09/04 13:10:00 | 000,000,368 | ---- | C] () -- C:\ProgramData\krDrsJZ4zQCuX2
[2011/12/14 20:48:32 | 000,000,044 | ---- | C] () -- C:\Users\brock\jagex_cl_runescape_LIVE.dat
[2011/12/14 20:48:32 | 000,000,024 | ---- | C] () -- C:\Users\brock\random.dat
[2010/11/22 05:38:41 | 000,002,037 | ---- | C] () -- C:\Users\brock\AppData\Roaming\uunFpDlDrdGE.exe
[2010/11/22 04:12:31 | 000,002,037 | ---- | C] () -- C:\Users\brock\AppData\Roaming\MMLJwtECLDev.exe
[2010/09/16 12:51:54 | 000,000,438 | ---- | C] () -- C:\Users\brock\AppData\Roaming\wklnhst.dat
[2008/08/18 22:00:06 | 000,000,268 | R--- | C] () -- C:\ProgramData\Galaxy Swirl
[2008/08/18 22:00:06 | 000,000,268 | R--- | C] () -- C:\Users\brock\AppData\Roaming\Frameworks
[2008/08/18 22:00:06 | 000,000,020 | ---- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2008/08/18 22:00:06 | 000,000,012 | R--- | C] () -- C:\ProgramData\Guides
[2008/02/18 21:26:08 | 000,007,887 | ---- | C] () -- C:\Users\brock\AppData\Roaming\pcouffin.cat
[2008/02/18 21:26:08 | 000,001,144 | ---- | C] () -- C:\Users\brock\AppData\Roaming\pcouffin.inf
[2008/01/28 05:14:51 | 000,014,746 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2007/02/06 01:36:18 | 000,014,336 | ---- | C] () -- C:\Users\brock\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2007/03/07 21:58:26 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\acccore
[2008/02/13 21:11:30 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\LimeWire
[2008/08/30 21:00:21 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\Nikon
[2010/09/24 13:42:28 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\Template
[2010/09/24 14:09:37 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\Thinstall
[2008/06/25 00:55:50 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\Vso
[2012/09/04 18:08:08 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\VTExtra
[2007/01/31 23:37:29 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\WildTangent
[2007/05/12 02:52:52 | 000,000,000 | ---D | M] -- C:\Users\brock\AppData\Roaming\WinBatch

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMPD160878

< End of report >

 

[Brockr11]

OTL Extras logfile created on: 10/7/2012 12:46:38 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\brock\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.28 Gb Available Physical Memory | 64.25% Memory free
4.22 Gb Paging File | 3.37 Gb Available in Paging File | 79.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 291.81 Gb Total Space | 201.34 Gb Free Space | 69.00% Space Free | Partition Type: NTFS
Drive D: | 6.27 Gb Total Space | 0.88 Gb Free Space | 14.08% Space Free | Partition Type: NTFS

Computer Name: BROCK-PC | User Name: brock | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1083133115-3377555592-1284217255-1001\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{053BC9E8-2623-4A86-92BA-510A40548BA6}" = lport=10244 | protocol=6 | dir=in | app=system |
"{19392176-2CAB-4843-A01B-3787E67E6A4E}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{1A70C607-0120-4CDA-920C-8502D43E9994}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1CCA4FAB-26C5-4042-A19A-DB905D1349E8}" = lport=3390 | protocol=6 | dir=in | app=system |
"{28E5668F-6FC1-40A9-B8A0-16472FC51F4E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2E46B674-2421-4A68-8084-6859231DEEC7}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2F27BAA9-AF97-47D8-9521-4CA009B506F7}" = rport=10244 | protocol=6 | dir=out | app=system |
"{3DAB233C-A609-44ED-B599-D0CE087827AC}" = lport=9442 | protocol=17 | dir=in | name=intel(r) viiv(tm) media server discovery |
"{574D4637-DD0D-487A-B842-473EEB4A1730}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5A4D385E-0232-42DD-94B9-0384DD553C64}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{5B753521-B11C-4C09-96E1-55F104EF4B36}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{6B490143-3853-4477-8DF8-E443A51E7844}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{6F10D1D1-BA71-4054-827F-2481AD5C0DDA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{742FC935-1175-4A60-8E04-38996ACBE4FC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7907328E-2235-4465-BDFE-BAF2946512FF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8E9B4F0D-1D72-4836-B7DD-F64A1D9AC4AC}" = lport=10244 | protocol=6 | dir=in | app=system |
"{98D4E0CD-D5DA-4116-9456-6D4B24DE76A0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9BE8896A-FDA7-48A3-8F75-86D5E6AABE86}" = lport=3390 | protocol=6 | dir=in | app=system |
"{A5EE5B15-DBBC-4F5D-A0AD-0B8AEC431E2B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D607751A-D316-4F71-A0A8-E068D05489A9}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E1FD6D10-8957-4C57-8FC1-3A0FEA2B7934}" = rport=10244 | protocol=6 | dir=out | app=system |
"{F26299F8-E1BE-4D55-A1E9-47BDFE1AF6AA}" = lport=1900 | protocol=17 | dir=in | name=intel(r) viiv(tm) media server upnp discovery |
"{F3BDC228-472E-4840-8FAE-C213201AFF9E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F809AC3E-EC01-4D15-8B7C-25CAFADF0F07}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00A21572-7988-4E21-BDA5-2E6AEB23D960}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{0A2DD7D1-7F2E-4558-8721-CD3A68F2E191}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{0EA22793-21A7-4252-8C01-C474E27D035C}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{15C1A4CB-689F-47F6-8F3C-F0520DC1C162}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{16E2D29B-CD0A-4BF5-946B-6C36BA3373CD}" = protocol=17 | dir=in | app=c:\program files\aol 9.1b\waol.exe |
"{21033E33-76C5-4AB7-AB45-A26FB8A5059C}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{22EB1DCA-C1D1-44BF-B378-1E3EF15C7CA9}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{233B736A-9562-4AD6-99FE-9CF9987D1C9C}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{252C0682-D34F-4AD5-BF7E-004F5A53728C}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{25C87B64-20D6-44A5-8FD6-012A071FC497}" = protocol=17 | dir=in | app=c:\program files\aol 9.0c\waol.exe |
"{2670E4E3-C308-4312-801C-1CF7BC30BEC7}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1171314502\ee\aolsoftware.exe |
"{26A42FAA-D74A-4268-9EEE-1115AC73E073}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{27D88955-C880-4593-9EFC-EE159079BF05}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{2983C702-11E2-433D-8B4D-D86D5DB3F375}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{2A551B21-5810-49DC-B305-527E41FF8CCC}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{2CE01691-B528-4AE6-A632-D0C72D66CCFF}" = protocol=6 | dir=in | app=c:\program files\aol 9.0b\waol.exe |
"{2DDA793E-579D-4656-BFE2-A2BC339814EC}" = protocol=6 | dir=in | app=c:\program files\aol 9.0d\waol.exe |
"{36D32E51-79A8-4EF6-9C76-34D26EE86AF9}" = protocol=17 | dir=in | app=c:\program files\aol 9.0b\waol.exe |
"{3C6D4F76-34DF-45E8-9A1A-5E719058E47C}" = protocol=6 | dir=in | app=c:\program files\aol 9.0\waol.exe |
"{3CE95D0B-16E0-4A2D-9C8C-A9E31AFF6B61}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{3F0651DF-F282-4BBC-A8D6-03DC7824CDFC}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{4379F230-89E6-4799-AFE4-87C18359038C}" = protocol=17 | dir=in | app=c:\program files\aol 9.1\waol.exe |
"{4EE26663-9A1A-452A-944B-9F7F6FCAFB14}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
"{558DCEC5-3605-49D2-AB62-B060BE2E9C84}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{582624A4-4027-4C92-B890-2DE05EDAC06A}" = protocol=17 | dir=in | app=c:\windows\system32\lxczcoms.exe |
"{5BA40C2C-BA57-4FE7-B217-DF5C7929A1BA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5CC7D832-9B2D-4DAC-9D00-51DFCEA798B5}" = dir=in | app=c:\program files\hp connections\6811507\program\hp connections |
"{6132EAE8-6E09-450A-A493-3854CC83501B}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{65CC0131-A29B-49E5-9E08-75CDA3D44F24}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |
"{68587E3E-CEDB-4EA5-BCDB-1EE726C636FC}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6F2D4D4D-8B9C-43E9-9BB5-D752A97BA54D}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{712A184B-0ADB-4840-A3AB-B101634C3EF1}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{75EF4A4F-F508-4458-8FDC-7FB1385078C4}" = protocol=6 | dir=in | app=c:\program files\aol 9.1\waol.exe |
"{798EA52C-FF05-45DD-9BFA-C24865684E94}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{7A781AF1-9B74-45A7-A71D-49EB56B42D55}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{7B00EE73-0420-4F95-8315-553279A26EA9}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{829195A1-B136-4CA8-B142-CD4550AA745B}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{82C0B533-94B8-46EF-ADCA-1592BAF10EDB}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{845F9685-ED16-4FEA-A877-4A7D8F8CEF81}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{88D37FC4-AE3D-48D7-ACE7-0AF8969597B0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{943253DF-41BA-4CA6-8CE6-60B287A68D88}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |
"{957D2644-4389-4A6E-B733-E04FA4E59C00}" = protocol=6 | dir=in | app=c:\program files\aol 9.1a\waol.exe |
"{9BB04F86-71EB-48DE-AFE4-44F7F1722F00}" = protocol=6 | dir=in | app=c:\program files\hp connections\6811507\program\hp connections.exe |
"{A0881BFC-1B71-4FDC-83A6-238201F45B0E}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |
"{A537D681-619D-4E15-BC61-DE640AB73D27}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{A5A51947-617D-41C9-AA45-3F2CD295BDE2}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{A814A7D1-C1D4-4117-A620-BBF342AC785F}" = protocol=17 | dir=in | app=c:\program files\aol 9.0d\waol.exe |
"{AA0B9994-E09B-4213-AA13-CFFCD9BB8200}" = protocol=17 | dir=in | app=c:\program files\aol 9.0\waol.exe |
"{ADC3280C-D636-49B9-AC06-3E6DD16A4723}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |
"{B0BD6C1E-59DB-4D9B-B2A1-449CF524656F}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{B468D836-5A76-4AA7-B8A7-E9AE30AD540C}" = protocol=17 | dir=in | app=c:\program files\aol 9.1a\waol.exe |
"{BAFC60B8-CB2F-457A-9F60-AA8CD05231DF}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{C2A291FA-CEDF-43D5-96CE-19CF804FD8CF}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{C54956E1-4BBA-4BAB-BCCB-C2424B1B76A9}" = protocol=6 | dir=in | app=c:\program files\aol 9.0c\waol.exe |
"{C6A52CF1-2EFA-4216-A5BC-C54CDB5BC40A}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{C6C78D30-0C40-4C73-B359-1034F9B3BF96}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1171314502\ee\aolsoftware.exe |
"{C70BCBC0-B335-4FE8-8874-E5548234B668}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{CB07E062-143E-488C-AFFC-60CAC3CB572A}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
"{D0F3971C-B9EE-4995-AF06-E235CCE80631}" = protocol=6 | dir=in | app=c:\program files\aol 9.1b\waol.exe |
"{D7E00792-7BF8-4F42-BA6D-9F3341B74215}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{E33AF550-009A-4468-AB3F-C9C93F2685D0}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{E678C2BC-C355-480A-94E3-7A8107903B12}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{E6DBA212-54EB-4DBE-B360-5C514734CE0B}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{F2F41293-265E-4816-A7F0-54B205C24AD4}" = protocol=6 | dir=in | app=c:\windows\system32\lxczcoms.exe |
"{F521559B-65D0-44CD-BBFC-8442AF7F734B}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{FD9A6DA8-42FE-4A45-A0C3-B5D99CBE52C1}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"TCP Query User{2DCE9C3A-FD9E-4426-A374-453C91D1C854}C:\users\brock\appdata\local\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\brock\appdata\local\google\chrome\application\chrome.exe |
"TCP Query User{392988F5-7EDB-40C4-85EA-B10628F53AE9}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{3D211351-88B7-499D-9587-3F82500AC7FB}C:\program files\hp games\wheel of fortune\wheel of fortune.exe" = protocol=6 | dir=in | app=c:\program files\hp games\wheel of fortune\wheel of fortune.exe |
"TCP Query User{414CF060-0681-439A-9E9E-071A951895DF}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{701DF24D-E651-4DBD-9867-A6AB082ED70E}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{799A0468-5271-43D7-96C2-C30F3C1FF948}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{BB89D2E9-2473-4DC3-8A10-E2DE5B9749AA}C:\users\brock\appdata\roaming\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\users\brock\appdata\roaming\sopcast\adv\sopadver.exe |
"UDP Query User{329698D5-0C56-4B9A-96D7-B3CFFCAE5BA6}C:\program files\hp games\wheel of fortune\wheel of fortune.exe" = protocol=17 | dir=in | app=c:\program files\hp games\wheel of fortune\wheel of fortune.exe |
"UDP Query User{3E39BB72-98C1-4068-978B-1BAFC305254D}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{65131BDF-3D86-4C45-8A9D-2B7DD8443EF2}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{9C4CEA3B-F07C-45BF-9355-698ADB4C45DC}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{A30FA0D6-6853-48A7-A2A1-B02B8567467E}C:\users\brock\appdata\local\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\brock\appdata\local\google\chrome\application\chrome.exe |
"UDP Query User{ADB99AC9-4BB8-4B9B-B1FE-EDC5F0353332}C:\users\brock\appdata\roaming\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\users\brock\appdata\roaming\sopcast\adv\sopadver.exe |
"UDP Query User{D2E6ED6F-A283-4CF7-92CA-643D204B39D0}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6E7BF6EC-C3E7-43A7-8A03-0D204E3EC01B}" = Intel® Viiv™ Software
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90840409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Excel Viewer 2003
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B6829D65-F5C5-47F0-00BC-F5906EA94F4C}" = Tiger Woods PGA TOUR 07
"{B7B3E9B3-FB14-4927-894B-E9124509AF5A}" = Adobe Flash Player 10 ActiveX
"{B83A15A7-2BD5-4416-BC43-AF5F9A4B08A9}" = muvee autoProducer 5.0
"{C3DC29BC-A8CF-4578-9DFC-37F049C44771}" = OcxSetup
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{C8F7C1E5-0150-11D6-A96C-00D05908F85D}" = USB Driver
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F94234DB-FD06-42C3-B88D-6FC4DC9F988C}" = HP Easy Setup - Core
"82A44D22-9452-49FB-00FB-CEC7DCAF7E23" = EA SPORTS online 2007
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5_is1" = DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.2.2
"DVDFab 8 Qt_is1" = DVDFab 8.2.0.8 (29/08/2012) Qt
"DVDFab 8_is1" = DVDFab 8.0.8.5 (19/03/2011)
"DVDFab Decrypter_is1" = DVDFab Decrypter 3.0.8.0
"DVDFab Gold 4_is1" = DVDFab Gold 4.0.6.2
"DVDFab HD Decrypter 4_is1" = DVDFab HD Decrypter 4.0.6.2
"ESET Online Scanner" = ESET Online Scanner v3
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Intel(R) Configuration Center" = Intel® Viiv™ Software
"Lexmark 1200 Series" = Lexmark 1200 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.0.1400
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 15.0.1 (x86 en-US)" = Mozilla Firefox 15.0.1 (x86 en-US)
"PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
"RealPlayer 15.0" = RealPlayer
"ViewpointMediaPlayer" = Viewpoint Media Player
"WildTangent hpdesktop Master Uninstall" = My HP Games
"WinRAR archiver" = WinRAR archiver
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1083133115-3377555592-1284217255-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 10/4/2012 6:29:09 PM | Computer Name = brock-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe_iphlpsvc, version 6.0.6001.18000,
time stamp 0x47918b89, faulting module ntdll.dll, version 6.0.6002.18541, time
stamp 0x4ec3e3d5, exception code 0xc0000374, fault offset 0x000b06b7, process id
0x4a4, application start time 0x01cda27e1bb59b77.

Error - 10/5/2012 12:28:03 AM | Computer Name = brock-PC | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =

Error - 10/5/2012 1:06:52 AM | Computer Name = brock-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe_Winmgmt, version 6.0.6001.18000,
time stamp 0x47918b89, faulting module ntdll.dll, version 6.0.6002.18541, time stamp
0x4ec3e3d5, exception code 0xc0000005, fault offset 0x00038a82, process id 0x4ec,
application start time 0x01cda283d357955f.

Error - 10/5/2012 1:07:02 AM | Computer Name = brock-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe_WinDefend, version 6.0.6001.18000,
time stamp 0x47918b89, faulting module mpengine.dll, version 1.1.8800.0, time stamp
0x503f207c, exception code 0xc0000005, fault offset 0x003d093f, process id 0x43c,
application start time 0x01cda283d2f39b75.

Error - 10/5/2012 1:07:26 AM | Computer Name = brock-PC | Source = Application Error | ID = 1000
Description = Faulting application ehtray.exe, version 6.0.6001.18000, time stamp
0x4791938f, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception
code 0xc0000005, fault offset 0x00000000, process id 0xd50, application start time
0x01cda283f69a81a5.

Error - 10/5/2012 1:07:59 AM | Computer Name = brock-PC | Source = Application Error | ID = 1000
Description = Faulting application services.exe, version 6.0.6002.18005, time stamp
0x49e01a51, faulting module ntdll.dll, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000374, fault offset 0x000b06b7, process id 0x320, application
start time 0x01cda283d190ee00.

Error - 10/6/2012 12:52:21 AM | Computer Name = brock-PC | Source = EventSystem | ID = 4609
Description =

Error - 10/6/2012 1:06:17 AM | Computer Name = brock-PC | Source = EventSystem | ID = 4609
Description =

Error - 10/6/2012 1:12:03 AM | Computer Name = brock-PC | Source = EventSystem | ID = 4609
Description =

Error - 10/6/2012 1:13:54 AM | Computer Name = brock-PC | Source = Microsoft-Windows-CAPI2 | ID = 131584
Description =

[ Media Center Events ]
Error - 4/2/2008 12:23:41 AM | Computer Name = brock-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 4/17/2008 7:12:39 AM | Computer Name = brock-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 6/1/2008 7:29:37 AM | Computer Name = brock-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 8/28/2008 6:08:08 AM | Computer Name = brock-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/14/2008 2:53:02 AM | Computer Name = brock-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 10/6/2012 1:12:44 AM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 10/6/2012 1:12:44 AM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 10/6/2012 1:12:44 AM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 10/6/2012 1:12:44 AM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 10/6/2012 1:12:44 AM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 10/6/2012 1:12:47 AM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 10/6/2012 1:13:52 AM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 10/6/2012 1:15:07 AM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 10/6/2012 12:16:15 PM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 10/6/2012 11:52:48 PM | Computer Name = brock-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >

 

[Broni]

Unless you installed Viewpoint Manager knowledgeably...
Go Start>Control Panel>Add\Remove (Programs and Features in Vista), and...
Uninstall any of the following programs associated with Viewpoint:
* Viewpoint Manager
* Viewpoint Media Player
* Viewpoint Toolbar
This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware ("drive-by-install") as it is installed without your consent through programs like AOl, AIM, Compuserve, etc.

====================================

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  O15 - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
  O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
  O37 - HKU\S-1-5-21-1083133115-3377555592-1284217255-1001\...com [@ = ComFile] -- Reg Error: Key error. File not found
  [2012/09/04 13:10:06 | 000,000,184 | ---- | C] () -- C:\ProgramData\-krDrsJZ4zQCuX2r
  [2012/09/04 13:10:05 | 000,000,160 | ---- | C] () -- C:\ProgramData\-krDrsJZ4zQCuX2
  [2012/09/04 13:10:00 | 000,000,368 | ---- | C] () -- C:\ProgramData\krDrsJZ4zQCuX2
  [2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
  
  [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  
  [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  
  [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
  "ThreadingModel" = Apartment
  
  [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
  "ThreadingModel" = Free
  
  [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  "" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
  "ThreadingModel" = Both
  @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:DD160878
  
  :Commands
  [purity]
  [emptytemp]
  [emptyjava]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.

NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

==================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  
  NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

3. Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
• Click on Delete.
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

Next...

• Double click on adwcleaner.exe to run the tool.
• Click on Uninstall.
• Confirm with yes.

4. Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

5. Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
• Tick the box next to YES, I accept the Terms of Use
• Click Start
• Accept any security warnings from your browser.
• Check Scan archives
• Click Start
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click on List of found threats
• Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• NOTE. If Eset won't find any threats, it won't produce any log.

 

[Brockr11]

All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-1083133115-3377555592-1284217255-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\objects\ deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_USERS\S-1-5-21-1083133115-3377555592-1284217255-1001_Classes\.com\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1083133115-3377555592-1284217255-1001_Classes\ComFile\ not found.
HKEY_LOCAL_MACHINE\Software\Classes\.com\\|comfile /E : value set successfully!
C:\ProgramData\-krDrsJZ4zQCuX2r moved successfully.
C:\ProgramData\-krDrsJZ4zQCuX2 moved successfully.
C:\ProgramData\krDrsJZ4zQCuX2 moved successfully.
C:\Windows\assembly\Desktop.ini moved successfully.
File EY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] not found.
File EY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] not found.
File EY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] not found.
Folder EY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]\ not found.
Folder EY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]\ not found.
ADS C:\ProgramData\TEMPD160878 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: brock
->Temp folder emptied: 287978 bytes
->Temporary Internet Files folder emptied: 394649 bytes
->Java cache emptied: 25588020 bytes
->FireFox cache emptied: 697588988 bytes
->Google Chrome cache emptied: 393424740 bytes
->Apple Safari cache emptied: 1784832 bytes
->Flash cache emptied: 1266570 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: IUSR_NMPR
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
->Flash cache emptied: 348 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4749 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,068.00 mb


[EMPTYJAVA]

User: All Users

User: brock
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: IUSR_NMPR

User: Mcx1

User: Public

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: brock
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: IUSR_NMPR

User: Mcx1
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 10072012_132551

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\nmsmc_DQLWinService.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

[Brockr11]

Results of screen317's Security Check version 0.99.51
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
`````````Anti-malware/Other Utilities Check:`````````
SUPERAntiSpyware Free Edition
Malwarebytes Anti-Malware version 1.65.0.1400
JavaFX 2.1.1
Java(TM) 6 Update 31
Java 7 Update 7
Java(TM) SE Runtime Environment 6
Java(TM) SE Runtime Environment 6 Update 1
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player11.4.402.265
Adobe Reader 7 Adobe Reader out of Date!
Mozilla Firefox (15.0.1)
Google Chrome 21.0.1180.83
Google Chrome 21.0.1180.89
Google Chrome 22.0.1229.79
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0 %
````````````````````End of Log``````````````````````

 

[Brockr11]

Farbar Service Scanner Version: 19-09-2012
Ran by brock (administrator) on 07-10-2012 at 13:37:24
Running from "C:\Users\brock\Desktop"
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Security Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.
Other Services:
==============
File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
**** End of log ****

 

[Brockr11]

# AdwCleaner v2.004 - Logfile created 10/07/2012 at 13:38:59
# Updated 06/10/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : brock - BROCK-PC
# Boot Mode : Normal
# Running from : C:\Users\brock\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Program Files\Viewpoint
Folder Deleted : C:\ProgramData\Viewpoint

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Viewpoint Manager
Key Deleted : HKLM\Software\Viewpoint

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.6002.18005

[OK] Registry is clean.

-\\ Mozilla Firefox v15.0.1 (en-US)

Profile name : default
File : C:\Users\brock\AppData\Roaming\Mozilla\Firefox\Profiles\etr2fqqs.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v22.0.1229.79

File : C:\Users\brock\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [1517 octets] - [07/10/2012 13:38:59]

########## EOF - C:\AdwCleaner[S1].txt - [1577 octets] ##########

 

[Brockr11]

Eset didn't produce a log. No threats found.

 

[Broni]

Update Adobe Flash Player
Download the Latest Adobe Flash for Firefox and IE Without Any Extras: http://www.404techsupport.com/2010/...-flash-for-firefox-and-ie-without-any-extras/

=============================

Update Adobe Reader

You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions (if present).
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

============================

We need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it.

• Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Do NOT post JavaRa log.

===============================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

13. Please, let me know, how your computer is doing.

 

[Brockr11]

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: brock
->Temp folder emptied: 287627 bytes
->Temporary Internet Files folder emptied: 339307 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 6629535 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: IUSR_NMPR
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 149 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 7.00 mb


[EMPTYFLASH]

User: All Users

User: brock
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: IUSR_NMPR

User: Mcx1
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: brock
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: IUSR_NMPR

User: Mcx1

User: Public

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 10102012_005623

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\nmsmc_DQLWinService.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

[Brockr11]

Btw, my pc seems to be running very well.

 

[Broni]

Way to go!!
Good luck and stay safe

 

[Brockr11]

Thank you for the help! I appreciate it.

 

[Broni]

You're very welcome