Problems with Whitesmoke

Armanatar · December 31, 2012

Been wrestling with Whitesmoke toolbar for weeks, and I've exhausted my modest arsenal of tactics. Logs are attached per instructions.

dds.txt

attach.txt

MrCharlie · December 31, 2012

Welcome to the forum.

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for adware, toolbar and potentially unwanted programs.
AdwCleaner is a tool that deletes :
· Adwares (software ads)
· PUP/LPI (Potentially Undesirable Program)
· Toolbars
· Hijacker (Hijack of the browser's homepage)
It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode.

Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
Now click on the Search tab.
Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Please look over what was found, we're going to delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

MrC

Armanatar · December 31, 2012

# AdwCleaner v2.104 - Logfile created 12/31/2012 at 16:44:46

# Updated 29/12/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : JDC - JUSTIN

# Boot Mode : Normal

# Running from : C:\Documents and Settings\JDC\My Documents\Downloads\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\Documents and Settings\JDC\Local Settings\Application Data\Conduit

***** [Registry] *****

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\SmartBar

***** [internet Browsers] *****

-\\ Internet Explorer v6.0.2900.5512

[OK] Registry is clean.

-\\ Mozilla Firefox v7.0.1 (en-US)

File : C:\Documents and Settings\JDC\Application Data\Mozilla\Firefox\Profiles\otx2cpr2.default\prefs.js

[OK] File is clean.

-\\ Chromium v window_placement: {

bottom: 728

File : C:\Documents and Settings\JDC\Local Settings\Application Data\Chromium\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [327727 octets] - [31/12/2012 16:05:18]

AdwCleaner[R2].txt - [1124 octets] - [31/12/2012 16:44:46]

AdwCleaner[s1].txt - [5559 octets] - [31/12/2012 16:05:41]

########## EOF - C:\AdwCleaner[R2].txt - [1244 octets] ##########

MrCharlie · December 31, 2012

Some adware found....lets clear it out.....

Please re-run AdwCleaner
Click on Delete button.
Confirm each time with OK if asked.
Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

~~~~~~~~~~~~~~~~~

Next..........

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

MrC

Armanatar · December 31, 2012

# AdwCleaner v2.104 - Logfile created 12/31/2012 at 17:16:16

# Updated 29/12/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : JDC - JUSTIN

# Boot Mode : Normal

# Running from : C:\Documents and Settings\JDC\My Documents\Downloads\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Documents and Settings\JDC\Local Settings\Application Data\Conduit

***** [Registry] *****

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\SmartBar

***** [internet Browsers] *****

-\\ Internet Explorer v6.0.2900.5512

[OK] Registry is clean.

-\\ Mozilla Firefox v7.0.1 (en-US)

File : C:\Documents and Settings\JDC\Application Data\Mozilla\Firefox\Profiles\otx2cpr2.default\prefs.js

[OK] File is clean.

-\\ Chromium v window_placement: {

bottom: 728

File : C:\Documents and Settings\JDC\Local Settings\Application Data\Chromium\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [327727 octets] - [31/12/2012 16:05:18]

AdwCleaner[R2].txt - [1313 octets] - [31/12/2012 16:44:46]

AdwCleaner[s1].txt - [5559 octets] - [31/12/2012 16:05:41]

AdwCleaner[s2].txt - [1250 octets] - [31/12/2012 17:16:16]

########## EOF - C:\AdwCleaner[s2].txt - [1310 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.3.2 (12.29.2012:3)

OS: Microsoft Windows XP x86

Ran by JDC on Mon 12/31/2012 at 17:19:43.43

Blog: http://thisisudax.blogspot.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_current_user\software\fixcleaner

Successfully deleted: [Registry Key] hkey_local_machine\software\fixcleaner

Successfully deleted: [Registry Key] hkey_local_machine\software\systweak

~~~ Files

Successfully deleted: [File] C:\eula.1028.txt

Successfully deleted: [File] C:\eula.1031.txt

Successfully deleted: [File] C:\eula.1033.txt

Successfully deleted: [File] C:\eula.1036.txt

Successfully deleted: [File] C:\eula.1040.txt

Successfully deleted: [File] C:\eula.1041.txt

Successfully deleted: [File] C:\eula.1042.txt

Successfully deleted: [File] C:\eula.1049.txt

Successfully deleted: [File] C:\eula.2052.txt

Successfully deleted: [File] C:\install.res.1028.dll

Successfully deleted: [File] C:\install.res.1031.dll

Successfully deleted: [File] C:\install.res.1033.dll

Successfully deleted: [File] C:\install.res.1036.dll

Successfully deleted: [File] C:\install.res.1040.dll

Successfully deleted: [File] C:\install.res.1041.dll

Successfully deleted: [File] C:\install.res.1042.dll

Successfully deleted: [File] C:\install.res.1049.dll

Successfully deleted: [File] C:\install.res.2052.dll

Successfully deleted: [File] C:\install.res.3082.dll

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\codec-c"

Successfully deleted: [Folder] "C:\Documents and Settings\JDC\Application Data\fixcleaner"

Successfully deleted: [Folder] "C:\Program Files\fixcleaner"

~~~ FireFox

Successfully deleted: [Folder] C:\Documents and Settings\JDC\Application Data\mozilla\firefox\profiles\otx2cpr2.default\extensions\searchtoolbar@zugo.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 12/31/2012 at 17:24:03.76

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

MrCharlie · December 31, 2012

Is it gone now?? MrC

Armanatar · December 31, 2012

Nope, still there.

MrCharlie · December 31, 2012

In what browser??

-------------------------------------------

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://www.itxassoci...T-Tools/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

The scan will take about 10 minutes...depends on your hard drive size.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

Armanatar · December 31, 2012

Browser is Chrome. Doing scan now.

Armanatar · December 31, 2012

OTL logfile created on: 12/31/2012 6:00:14 PM - Run 1

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\JDC\My Documents\Downloads

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 2.69 Gb Available Physical Memory | 77.06% Memory free

5.33 Gb Paging File | 4.48 Gb Available in Paging File | 83.90% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 931.51 Gb Total Space | 689.51 Gb Free Space | 74.02% Space Free | Partition Type: NTFS

Drive D: | 219.15 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: JUSTIN | User Name: JDC | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/12/31 17:58:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\JDC\My Documents\Downloads\OTL.exe

PRC - [2012/12/07 23:23:29 | 001,354,736 | ---- | M] (Valve Corporation) -- C:\Program Files\Steam\steam.exe

PRC - [2012/12/04 20:15:17 | 001,242,728 | ---- | M] (Google Inc.) -- C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

PRC - [2012/10/17 17:49:56 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe

PRC - [2012/07/31 02:37:02 | 002,596,984 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgtray.exe

PRC - [2012/02/14 03:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe

PRC - [2011/02/19 07:55:18 | 000,826,368 | ---- | M] (ActMask Co.,Ltd - http://www.all2pdf.com) -- C:\WINDOWS\system32\PrintDisp.exe

PRC - [2010/11/11 17:08:06 | 001,011,712 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\Realtek\11n USB Wireless LAN Utility\RtWLan.exe

PRC - [2010/06/14 16:10:32 | 000,153,672 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Gaming Software\LWEMon.exe

PRC - [2010/04/05 23:41:46 | 000,116,224 | ---- | M] (Brio) -- C:\Program Files\FolderSize\FolderSizeSvc.exe

PRC - [2009/10/28 18:59:48 | 000,065,536 | ---- | M] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\WINDOWS\system32\PrintCtrl.exe

PRC - [2009/02/22 22:43:55 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe

PRC - [2008/04/14 07:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/11/08 23:55:04 | 000,884,696 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageEchoWorkstation\TimounterMonitor.exe

PRC - [2007/11/08 23:53:54 | 000,136,472 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

PRC - [2007/11/08 23:53:50 | 000,423,192 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

PRC - [2007/11/08 23:52:22 | 001,274,600 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageEchoWorkstation\TrueImageMonitor.exe

PRC - [2005/02/03 10:34:58 | 000,102,400 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe

PRC - [2005/02/03 03:08:52 | 000,294,912 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe

PRC - [2004/07/27 09:08:22 | 000,262,144 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\memcard.exe

PRC - [2004/07/25 19:50:00 | 000,401,667 | ---- | M] (Dritek System Inc.) -- C:\Program Files\KEMailKb\KEMailKb.EXE

========== Modules (No Company Name) ==========

MOD - [2012/12/20 15:33:22 | 000,647,168 | ---- | M] () -- C:\Program Files\Steam\sdl.dll

MOD - [2012/12/20 15:32:38 | 020,320,240 | ---- | M] () -- C:\Program Files\Steam\bin\libcef.dll

MOD - [2012/12/20 15:32:32 | 001,100,800 | ---- | M] () -- C:\Program Files\Steam\bin\avcodec-53.dll

MOD - [2012/12/20 15:32:32 | 000,969,280 | ---- | M] () -- C:\Program Files\Steam\bin\chromehtml.dll

MOD - [2012/12/20 15:32:32 | 000,192,000 | ---- | M] () -- C:\Program Files\Steam\bin\avformat-53.dll

MOD - [2012/12/20 15:32:32 | 000,124,416 | ---- | M] () -- C:\Program Files\Steam\bin\avutil-51.dll

MOD - [2012/12/04 20:15:15 | 000,460,904 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.97\ppgooglenaclpluginchrome.dll

MOD - [2012/12/04 20:15:14 | 004,008,040 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.97\pdf.dll

MOD - [2012/12/04 20:14:29 | 000,587,880 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.97\libglesv2.dll

MOD - [2012/12/04 20:14:28 | 000,124,520 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.97\libegl.dll

MOD - [2012/12/04 20:14:21 | 000,157,304 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.97\avutil-51.dll

MOD - [2012/12/04 20:14:20 | 000,275,576 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.97\avformat-54.dll

MOD - [2012/12/04 20:14:19 | 002,168,952 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.97\avcodec-54.dll

MOD - [2009/12/09 20:20:06 | 000,126,976 | ---- | M] () -- C:\Program Files\Realtek\11n USB Wireless LAN Utility\EnumDevLib.dll

MOD - [2008/09/16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

MOD - [2008/04/14 07:00:00 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll

MOD - [2008/04/14 07:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll

MOD - [2007/11/08 22:46:04 | 001,328,408 | ---- | M] () -- C:\Program Files\Acronis\TrueImageEchoWorkstation\fox.dll

MOD - [2007/07/12 10:11:54 | 001,163,264 | ---- | M] () -- C:\Program Files\Realtek\11n USB Wireless LAN Utility\acAuth.dll

MOD - [2005/02/03 10:34:58 | 000,102,400 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe

MOD - [2005/02/03 03:08:52 | 000,294,912 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe

MOD - [2005/02/03 03:07:16 | 000,036,864 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\JetPrint.dll

MOD - [2005/02/03 03:06:50 | 000,061,440 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\JetScan.dll

MOD - [2005/02/03 03:05:54 | 000,135,168 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\JetDecmp.dll

MOD - [2005/02/03 03:05:40 | 000,065,536 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\JetImage.dll

MOD - [2005/02/03 03:05:21 | 000,028,672 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\JetPDF.dll

MOD - [2005/02/03 03:05:05 | 000,036,864 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\JetFunc.dll

MOD - [2004/10/08 13:47:26 | 000,075,264 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBUPP5C.DLL

MOD - [2004/07/29 16:54:20 | 000,061,440 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\ConvDIB.dll

MOD - [2004/07/27 09:08:22 | 000,262,144 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 942\memcard.exe

========== Services (SafeList) ==========

SRV - File not found [Auto | Running] -- C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe WMP54GSv1_1.exe -- (WMP54GSSVC)

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Turbine\Turbine Download Manager\TurbineNetworkService.exe -- (LiveTurbineNetworkService)

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Turbine\Turbine Download Manager\TurbineMessageService.exe -- (LiveTurbineMessageService)

SRV - [2012/12/13 14:27:28 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012/11/09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012/10/24 16:50:55 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- C:\Program Files\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe -- (DAUpdaterSvc)

SRV - [2012/10/17 17:49:56 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)

SRV - [2012/09/23 09:28:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)

SRV - [2012/08/13 02:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)

SRV - [2012/02/14 03:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)

SRV - [2011/08/15 10:02:12 | 000,130,976 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2010/10/29 11:48:33 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)

SRV - [2010/04/05 23:41:46 | 000,116,224 | ---- | M] (Brio) [Auto | Running] -- C:\Program Files\FolderSize\FolderSizeSvc.exe -- (FolderSize)

SRV - [2009/10/28 18:59:48 | 000,065,536 | ---- | M] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) [Auto | Running] -- C:\WINDOWS\system32\PrintCtrl.exe -- (Printer Control)

SRV - [2009/02/22 22:43:55 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)

SRV - [2007/11/08 23:53:50 | 000,423,192 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)

SRV - [2004/10/25 16:13:32 | 000,421,888 | ---- | M] (Dell) [On_Demand | Stopped] -- C:\WINDOWS\system32\dlbucoms.exe -- (dlbu_device)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)

DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\JDC\LOCALS~1\Temp\gtermddo.sys -- (gtermddo)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\TEMP\cpuz135\cpuz135_x32.sys -- (cpuz135)

DRV - File not found [Kernel | System | Stopped] -- -- (Changer)

DRV - [2012/08/24 14:43:18 | 000,301,920 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)

DRV - [2012/07/26 02:21:30 | 000,237,408 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)

DRV - [2012/07/03 10:25:19 | 000,124,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)

DRV - [2012/04/19 03:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\avgidshx.sys -- (AVGIDSHX)

DRV - [2012/01/31 03:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)

DRV - [2011/12/26 14:34:30 | 000,010,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\ampa.sys -- (ampa)

DRV - [2011/12/23 12:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)

DRV - [2011/12/23 12:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsshimx.sys -- (AVGIDSShim)

DRV - [2011/12/23 12:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)

DRV - [2011/12/23 12:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)

DRV - [2011/05/26 21:31:52 | 000,218,688 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV - [2010/11/05 10:13:10 | 000,606,056 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8192su.sys -- (RTL8192su)

DRV - [2010/04/27 16:57:28 | 000,066,632 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmXlCore.sys -- (WmXlCore)

DRV - [2010/04/27 16:57:28 | 000,015,048 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmVirHid.sys -- (WmVirHid)

DRV - [2010/04/27 16:57:22 | 000,022,856 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmBEnum.sys -- (WmBEnum)

DRV - [2010/04/27 14:01:26 | 000,037,704 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WmFilter.sys -- (WmFilter)

DRV - [2010/02/03 14:56:56 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)

DRV - [2010/01/26 12:41:50 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)

DRV - [2009/07/16 16:11:43 | 000,454,688 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\timntr.sys -- (timounter)

DRV - [2009/07/16 16:11:43 | 000,043,008 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)

DRV - [2009/07/16 16:11:39 | 000,129,248 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\snapman.sys -- (snapman)

DRV - [2009/07/07 05:59:03 | 001,810,560 | R--- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ctafilt.sys -- (Ctafilt)

DRV - [2009/02/25 12:55:00 | 000,009,088 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\RivaTuner v2.24\RivaTuner32.sys -- (RivaTuner32)

DRV - [2008/05/13 18:08:04 | 000,049,904 | ---- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)

DRV - [2008/05/06 16:06:00 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)

DRV - [2008/04/17 03:33:00 | 004,707,328 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)

DRV - [2008/04/13 23:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2008/01/15 20:12:39 | 000,098,944 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2006/10/15 22:58:36 | 000,472,832 | ---- | M] (D-Link Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\A3AB.sys -- (A3AB)

DRV - [2004/12/22 00:32:12 | 000,369,024 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2003/09/25 21:15:32 | 000,015,872 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\GTNDIS5.sys -- (GTNDIS5)

DRV - [2001/08/17 11:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman)

DRV - [2001/08/17 11:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1)

DRV - [2001/08/17 11:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k)

DRV - [2001/08/17 11:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie'>http://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ie

IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie'>http://www.google.com/ie

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://xfinity.comcast.net/?cid=insDate08232012

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie'>http://www.google.com/ie

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\..\SearchScopes\{180780f0-b348-4b44-8210-94a8f3ee15b2}: "URL" = http://search.comcast.net/search/?cat=Web&con=toolbar&q={searchTerms}

IE - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "XFINITY"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://agc.deskslave.org/"

FF - prefs.js..extensions.enabledAddons: info@allpremiumplay.info:1.0

FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145

FF - prefs.js..extensions.enabledAddons: {F53C93F1-07D5-430c-86D4-C9531B27DFAF}:12.0.0.2189

FF - prefs.js..extensions.enabledAddons: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:12.0.0.2191

FF - prefs.js..extensions.enabledAddons: btpersonas@brandthunder.com:1.6.2.8

FF - prefs.js..extensions.enabledItems: activegs@freetoolsassociation.com:2.4.26

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872

FF - prefs.js..extensions.enabledItems: cacaoweb@cacaoweb.org:1.0.9

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: lookingforgroupboom@lookingforgroup.com:1.2.4

FF - prefs.js..extensions.enabledItems: {75623d5d-4683-402a-b610-ac4bab767c86}:3.0.4

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/09/11 07:40:04 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/04/29 20:27:03 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/02 12:52:52 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/04 00:51:25 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/08/24 09:22:03 | 000,000,000 | ---D | M]

[2009/10/01 15:21:56 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\JDC\Application Data\Mozilla\Extensions

[2009/10/01 15:21:56 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\JDC\Application Data\Mozilla\Extensions\mozswing@mozswing.org

[2012/12/31 17:23:56 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\JDC\Application Data\Mozilla\Firefox\Profiles\otx2cpr2.default\extensions

[2009/09/02 08:20:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\JDC\Application Data\Mozilla\Firefox\Profiles\otx2cpr2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/03/08 21:25:24 | 000,000,000 | ---D | M] (Torbutton) -- C:\Documents and Settings\JDC\Application Data\Mozilla\Firefox\Profiles\otx2cpr2.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}

[2010/03/08 21:25:13 | 000,000,000 | ---D | M] (ActiveGS) -- C:\Documents and Settings\JDC\Application Data\Mozilla\Firefox\Profiles\otx2cpr2.default\extensions\activegs@freetoolsassociation.com

[2012/11/13 00:49:03 | 000,000,000 | ---D | M] ("Default Theme Engine - Personas Interactive") -- C:\Documents and Settings\JDC\Application Data\Mozilla\Firefox\Profiles\otx2cpr2.default\extensions\btpersonas@brandthunder.com

[2012/09/13 11:48:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2010/04/30 13:41:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010/08/03 10:47:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010/10/12 21:22:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011/01/02 13:23:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011/03/01 09:30:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

[2011/06/22 21:21:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2012/07/29 23:31:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012/09/13 11:48:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2012/07/02 12:52:52 | 000,000,000 | ---D | M] (AVG Do Not Track) -- C:\PROGRAM FILES\AVG\AVG2012\FIREFOX\DONOTTRACK

[2012/09/11 07:40:04 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG2012\FIREFOX4

[2012/04/29 20:27:03 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5

[2012/02/04 00:51:24 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2007/02/12 14:30:16 | 000,164,352 | ---- | M] (Indiepath Ltd) -- C:\Program Files\mozilla firefox\plugins\npigl.dll

[2007/03/09 18:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll

[2012/02/04 00:51:20 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012/02/28 15:04:46 | 000,020,569 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\xfinity.xml

CHR - Extension: No name found = C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\

CHR - Extension: No name found = C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: No name found = C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: No name found = C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif\10.13.20.29_0\

CHR - Extension: No name found = C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\12.0.0.2166_0\

CHR - Extension: No name found = C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

CHR - Extension: No name found = C:\Documents and Settings\JDC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/11/23 15:18:24 | 000,444,793 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.0scan.com

O1 - Hosts: 127.0.0.1 0scan.com

O1 - Hosts: 127.0.0.1 1000gratisproben.com

O1 - Hosts: 127.0.0.1 www.1000gratisproben.com

O1 - Hosts: 127.0.0.1 1001namen.com

O1 - Hosts: 127.0.0.1 www.1001namen.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 www.1-2005-search.com

O1 - Hosts: 127.0.0.1 1-2005-search.com

O1 - Hosts: 15279 more lines...

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)

O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageEchoWorkstation\TimounterMonitor.exe (Acronis)

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [CtaMon] C:\WINDOWS\System32\CtaMon.dll (Creative Technology Ltd.)

O4 - HKLM..\Run: [CTAPR2] C:\Program Files\Creative\SB Arena Surround Headset\Console Launcher 3\Entertainment Console\CTAPR2.exe (Creative Technology Ltd)

O4 - HKLM..\Run: [Dell Photo AIO Printer 942] C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe ()

O4 - HKLM..\Run: [DellMCM] C:\Program Files\Dell Photo AIO Printer 942\memcard.exe ()

O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [DLBUCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBUtime.DLL ()

O4 - HKLM..\Run: [KEMailKb] C:\Program Files\KEMailKb\KEMailKb.EXE (Dritek System Inc.)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()

O4 - HKLM..\Run: [PrintDisp] C:\WINDOWS\system32\PrintDisp.exe (ActMask Co.,Ltd - http://www.all2pdf.com)

O4 - HKLM..\Run: [start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)

O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageEchoWorkstation\TrueImageMonitor.exe (Acronis)

O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SB Arena Surround Headset\Volume Panel\VolPanlu.exe (Creative Technology Ltd)

O4 - HKU\S-1-5-21-1454471165-412668190-1417001333-1003..\Run: [steam] C:\program files\steam\steam.exe (Valve Corporation)

O4 - HKU\S-1-5-21-1454471165-412668190-1417001333-1003..\RunOnce: [shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/5.0_(Windows;_U;_Windows_NT_5.1;_en-US)_AppleWebKit/533.4_(KHTML,_like_Gecko)_Chrome/5.0.375.126_Safari/533.4" -"http://homepages.paradise.net.nz/~trekker/policeboxes/replicas.html" File not found

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\REALTEK 11n USB Wireless LAN Utility.lnk = C:\Program Files\Realtek\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1454471165-412668190-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = [binary data]

O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)

O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)

O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} http://www.srtest.com/srl_bin/sysreqlab_ind.cab (System Requirements Lab Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Reg Error: Value error.)

O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)

O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package)

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPID.cab (Creative Software AutoUpdate Support Package)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5E21BF74-5EBB-49FF-891E-986AB2CA48BA}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F5C4DE01-43D1-482D-81C2-A054B9276D67}: NameServer = 208.67.222.222,208.67.220.220

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Documents and Settings\JDC\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\JDC\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/07/09 06:05:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2002/08/17 17:11:50 | 000,122,880 | R--- | M] () - D:\Autorun.exe -- [ CDFS ]

O32 - AutoRun File - [2002/08/02 14:23:28 | 000,000,136 | R--- | M] () - D:\autorun.inf -- [ CDFS ]

O33 - MountPoints2\{8c990a64-68d8-11df-b88e-0015e9fc8910}\Shell\AutoRun\command - "" = G:\__STICKYDRIVE\StickyDrive.exe

O33 - MountPoints2\{c883879a-1b58-11e0-b982-001cc0e30004}\Shell - "" = AutoRun

O33 - MountPoints2\{c883879a-1b58-11e0-b982-001cc0e30004}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c883879a-1b58-11e0-b982-001cc0e30004}\Shell\AutoRun\command - "" = "G:\WD SmartWare.exe" autoplay=true

O33 - MountPoints2\{ef8efce4-7f76-11de-97e5-0015e9fc8910}\Shell - "" = AutoRun

O33 - MountPoints2\{ef8efce4-7f76-11de-97e5-0015e9fc8910}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{ef8efce4-7f76-11de-97e5-0015e9fc8910}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/12/31 17:19:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT

[2012/12/31 17:19:26 | 000,000,000 | ---D | C] -- C:\JRT

[2012/12/31 16:26:36 | 000,000,000 | R--D | C] -- C:\Documents and Settings\JDC\Start Menu\Programs\Administrative Tools

[2012/12/16 21:42:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\JDC\Application Data\Warner Bros. Interactive Entertainment

[2012/12/14 13:57:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/12/14 13:57:37 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012/12/14 13:57:37 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012/12/13 19:00:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2012/12/13 19:00:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype

[2012/12/13 19:00:12 | 000,000,000 | R--D | C] -- C:\Program Files\Skype

[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/12/31 17:27:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2012/12/31 17:18:03 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-412668190-1417001333-1003UA.job

[2012/12/31 17:17:53 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012/12/31 17:17:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012/12/31 08:31:38 | 104,799,771 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm

[2012/12/30 20:18:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-412668190-1417001333-1003Core.job

[2012/12/28 08:22:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2012/12/25 18:19:26 | 000,344,538 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm

[2012/12/23 10:50:02 | 000,502,670 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012/12/23 10:50:02 | 000,088,450 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012/12/23 10:40:19 | 000,171,488 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012/12/20 05:18:28 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2012/12/18 01:25:31 | 000,001,686 | ---- | M] () -- C:\Documents and Settings\JDC\Desktop\Skype.lnk

[2012/12/16 21:41:15 | 000,000,182 | ---- | M] () -- C:\Documents and Settings\JDC\Desktop\LEGO Lord of the Rings.url

[2012/12/14 13:57:38 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012/12/13 19:00:13 | 000,001,878 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk

[2012/12/13 14:20:33 | 000,002,268 | ---- | M] () -- C:\Documents and Settings\JDC\Desktop\Google Chrome.lnk

[2012/12/13 14:20:33 | 000,002,246 | ---- | M] () -- C:\Documents and Settings\JDC\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2012/12/13 13:41:12 | 000,000,620 | ---- | M] () -- C:\WINDOWS\dellstat.ini

[2012/12/11 14:22:18 | 000,088,064 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012/12/04 16:31:24 | 000,027,520 | ---- | M] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\dt.dat

[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/12/18 01:25:31 | 000,001,686 | ---- | C] () -- C:\Documents and Settings\JDC\Desktop\Skype.lnk

[2012/12/16 18:41:14 | 000,000,182 | ---- | C] () -- C:\Documents and Settings\JDC\Desktop\LEGO Lord of the Rings.url

[2012/12/14 13:57:38 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012/12/04 16:31:24 | 000,027,520 | ---- | C] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\dt.dat

[2012/09/06 08:57:26 | 004,399,616 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll

[2012/07/02 19:28:06 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2012/05/17 23:06:38 | 000,000,025 | ---- | C] () -- C:\WINDOWS\popcinfot.dat

[2012/04/14 20:46:37 | 001,323,448 | ---- | C] () -- C:\WINDOWS\ampa.exe

[2012/04/14 20:46:37 | 000,010,936 | ---- | C] () -- C:\WINDOWS\System32\ampa.sys

[2012/03/08 11:03:51 | 001,101,436 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin

[2012/03/08 11:03:51 | 001,101,436 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin

[2012/03/08 11:03:51 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin

[2012/03/08 11:02:43 | 002,811,988 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data

[2012/02/15 18:14:04 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2012/01/09 22:45:18 | 000,178,688 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2011/07/20 19:06:44 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll

[2011/07/20 19:06:44 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll

[2011/07/20 19:06:44 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll

[2011/06/29 15:00:59 | 001,391,616 | ---- | C] () -- C:\WINDOWS\System32\ActPDF.dll

[2011/06/29 15:00:52 | 001,218,627 | ---- | C] () -- C:\WINDOWS\unins000.exe

[2011/06/29 15:00:52 | 000,020,714 | ---- | C] () -- C:\WINDOWS\unins000.dat

[2011/06/29 15:00:40 | 000,691,200 | ---- | C] () -- C:\WINDOWS\System32\PrintLog.exe

[2011/06/29 15:00:40 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\PrtPass.exe

[2011/05/31 10:51:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SelSet.INI

[2011/04/07 20:51:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PCFriend.INI

[2011/03/21 12:31:25 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe

[2011/03/21 12:27:59 | 000,451,072 | ---- | C] () -- C:\WINDOWS\System32\ISSRemoveSP.exe

[2011/02/28 14:26:40 | 000,000,007 | ---- | C] () -- C:\WINDOWS\treeskp.sys

[2011/02/28 14:26:40 | 000,000,007 | ---- | C] () -- C:\WINDOWS\sbacknt.bin

[2011/02/04 18:15:31 | 000,000,014 | ---- | C] () -- C:\WINDOWS\System32\systeminfo.dll

[2011/02/04 18:14:57 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2011/01/11 17:15:37 | 000,000,095 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2009/09/15 21:49:07 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\fusioncache.dat

[2009/07/22 23:40:07 | 000,088,064 | ---- | C] () -- C:\Documents and Settings\JDC\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2009/07/22 20:57:29 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2012/10/31 06:33:26 | 001,510,400 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 07:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 07:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

========== LOP Check ==========

[2009/07/16 16:14:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis

[2012/06/19 11:41:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG2012

[2011/04/21 08:08:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9

[2012/10/24 15:35:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BioWare

[2011/03/15 10:07:58 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files

[2010/01/26 12:41:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite

[2012/05/18 20:01:17 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\DSS

[2011/02/04 18:14:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DVD X Studios

[2012/03/07 18:20:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EA Core

[2012/03/10 12:51:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EA Logs

[2012/03/07 18:20:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Electronic Arts

[2011/08/01 00:35:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Gibraltar

[2011/06/29 15:00:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Iceni

[2010/10/30 17:18:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kalypso

[2012/12/31 08:31:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData

[2012/03/07 18:20:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Origin

[2011/06/15 17:28:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Stardock

[2011/10/07 00:11:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Temp

[2009/09/15 21:15:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Turbine

[2012/11/13 22:59:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VistaCodecs

[2010/10/30 14:29:36 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{1338EDEE-1DCB-4AA7-9B0F-956BE76B0A4A}

[2011/06/15 17:28:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{F8C68EDE-B8FE-4310-97A9-BF1BF0722E5E}

[2010/09/30 16:30:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\.minecraft

[2010/09/07 12:49:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\.ZMatrix

[2011/10/06 23:39:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\AVG

[2011/10/19 09:59:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\AVG2012

[2010/11/25 16:18:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\Bioshock

[2011/11/03 01:31:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\Bioshock2

[2012/08/07 16:13:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\BitTyrant

[2009/07/25 17:35:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\DAEMON Tools Lite

[2012/04/29 20:30:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\DDMSettings

[2010/10/13 17:45:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\Digiarty

[2010/07/28 19:45:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\FreeBurner

[2010/12/22 18:13:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\GetRightToGo

[2011/06/29 15:00:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\Iceni

[2009/07/09 06:13:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\InterTrust

[2010/03/02 20:32:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\LEGO Company

[2012/02/26 11:40:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\LimeWire

[2010/08/04 23:09:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\LucasArts

[2012/03/06 12:34:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\Origin

[2010/08/04 23:10:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\Petroglyph

[2009/11/13 16:24:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\runic games

[2009/09/18 13:29:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\ScripterRon

[2009/11/04 23:05:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\SecondLife

[2010/10/30 14:31:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\Stardock

[2012/11/13 22:12:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\SystemRequirementsLab

[2009/09/03 14:59:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\uTorrent

[2012/11/13 22:59:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\VistaCodecs

[2012/12/16 21:42:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\JDC\Application Data\Warner Bros. Interactive Entertainment

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\xvid.ax:SummaryInformation

@Alternate Data Stream - 368 bytes -> C:\Documents and Settings\JDC\Local Settings\Application Data\desktop.ini:722b2b1c349a06abf0e866180e5a7e63

@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\Temp:0B4227B4

< End of report >

OTL Extras logfile created on: 12/31/2012 6:00:14 PM - Run 1