Harbour151 Posted November 17, 2013 ID:754536 Share Posted November 17, 2013 Hi all my browsers have been hijacked with aartemis. Ive tries your free antivirus with no luck. Ive researched online and tried all manual removals i could find to no avail. I would greatly appreciate any and all help u can give me. Thank u in advance! Harbour151 Link to post Share on other sites More sharing options...
Harbour151 Posted November 17, 2013 Author ID:754542 Share Posted November 17, 2013 OTL logfile created on: 16/11/2013 9:46:42 PM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\mike 1\Downloads64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.10.9200.16736)Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy 3.80 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 51.17% Memory free7.60 Gb Paging File | 5.53 Gb Available in Paging File | 72.73% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 451.01 Gb Total Space | 250.53 Gb Free Space | 55.55% Space Free | Partition Type: NTFSDrive D: | 681.00 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: HOME-PC | User Name: mike 1 | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current user | Include 64bit ScansCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\mike 1\Downloads\OTL.exe (OldTimer Tools)PRC - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (APN LLC.)PRC - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (APN)PRC - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)PRC - C:\Program Files (x86)\Anvisoft\Cloud System Booster\CloudSystemBooster.exe (Anvisoft)PRC - C:\Program Files (x86)\UtilityChest_49\bar\1.bin\49barsvc.exe (COMPANYVERS_NAME)PRC - C:\ProgramData\Search Protection\SearchProtection.exe (Lavasoft)PRC - C:\Program Files (x86)\Anvisoft\Cloud System Booster\tools\Anvi_RAM_Booster\Anvi_RAM_Booster.exe (Anvisoft Corporation)PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)PRC - C:\Program Files (x86)\Anvisoft\Cloud System Booster\CSBSvc.exe ()PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) ========== Modules (No Company Name) ========== MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll () ========== Services (SafeList) ========== SRV:64bit: - (LavasoftAdAwareService11) -- C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.0.4555.0\AdAwareService.exe ()SRV:64bit: - (NisSrv) -- c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)SRV:64bit: - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)SRV:64bit: - (appdrvrem01) -- C:\Windows\SysNative\appdrvrem01.exe (Protection Technology)SRV:64bit: - (ZuneWlanCfgSvc) -- C:\Program Files\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)SRV:64bit: - (WMZuneComm) -- C:\Program Files\Zune\WMZuneComm.exe (Microsoft Corporation)SRV:64bit: - (ZuneNetworkSvc) -- C:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)SRV:64bit: - (wltrysvc) -- C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE (Dell Inc.)SRV:64bit: - (btwdins) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)SRV - (APNMCP) -- C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (APN LLC.)SRV - (UtilityChest_49Service) -- C:\Program Files (x86)\UtilityChest_49\bar\1.bin\49barsvc.exe (COMPANYVERS_NAME)SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)SRV - (AnviCsbSvc) -- C:\Program Files (x86)\Anvisoft\Cloud System Booster\CSBSvc.exe ()SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (esgiguard) -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not foundDRV:64bit: - (gfibto) -- C:\Windows\SysNative\drivers\gfibto.sys (GFI Software)DRV:64bit: - (Trufos) -- C:\Windows\SysNative\drivers\Trufos.sys (BitDefender S.R.L.)DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)DRV:64bit: - (appdrv01) -- C:\Windows\SysNative\drivers\appdrv01.sys (Protection Technology)DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)DRV:64bit: - (BCM42RLY) -- C:\Windows\SysNative\drivers\bcm42rly.sys (Broadcom Corporation)DRV:64bit: - (BcmVWL) -- C:\Windows\SysNative\drivers\bcmvwl64.sys (Broadcom Corporation)DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://aartemis.com/?type=hp&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZRIE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=ds&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZR&q={searchTerms}IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=ds&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZR&q={searchTerms}IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://aartemis.com/?type=hp&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZRIE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRCIE:64bit: - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.aartemis.com/web/?type=ds&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZR&q={searchTerms}IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://aartemis.com/?type=hp&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZRIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=ds&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZR&q={searchTerms}IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=ds&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZR&q={searchTerms}IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://aartemis.com/?type=hp&ts=1384630306&from=tugs&uid=ST9500325AS_6VEGTSZRXXXX6VEGTSZRIE - HKLM\..\URLSearchHook: {f9bbf004-6e40-4019-8214-c43a37e1d058} - No CLSID value foundIE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRCIE - HKLM\..\SearchScopes\{84dc9f6c-c9a5-4c64-ab67-d6ef60f963c8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^ZO^fox000^YY^&ptb=34B29736-7C33-408C-9C76-ECC9C99D12BC&ind=2013071516&n=77fd089c&psa=&st=sb&searchfor={searchTerms}IE - HKLM\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = ${SEARCH_URL}{searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = PreserveIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www,google.ca/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-CAIE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SRIE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:25.0.1FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@UtilityChest_49.com/Plugin: C:\Program Files (x86)\UtilityChest_49\bar\1.bin\NP49Stub.dll (MindSpark)FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Users\mike 1\AppData\Local\Roblox\Versions\version-27973050fb3b494f\\NPRobloxProxy.dll ()FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\mike 1\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll File not foundFF - HKCU\Software\MozillaPlugins\bebomedia.com/OfferMosquitoIEHelper: C:\Users\mike 1\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll File not found 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\IB UPDATER\FIREFOX64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}: C:\PROGRAM FILES\IB UPDATER\FIREFOXFF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013/01/17 19:08:24 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\49ffxtbr@UtilityChest_49.com: C:\Program Files (x86)\UtilityChest_49\bar\1.bin [2013/11/16 13:28:11 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\componentsFF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/11/15 16:33:44 | 000,000,000 | ---D | M] [2013/07/08 14:55:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mike 1\AppData\Roaming\Mozilla\Extensions[2013/11/16 14:07:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mike 1\AppData\Roaming\Mozilla\Firefox\Profiles\um6yubwv.default\extensions[2013/11/16 14:07:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mike 1\AppData\Roaming\Mozilla\Firefox\Profiles\um6yubwv.default\extensions\{c1211069-1163-4ba8-b8b3-32fc724766be}[2013/11/15 16:33:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions[2013/11/15 16:33:43 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}[2013/11/15 16:33:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions[2013/11/15 16:34:45 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}[2013/11/16 11:31:47 | 000,000,553 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\aartemis.xml[2013/04/11 17:15:41 | 000,000,628 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\adawaretb.xml O1 HOSTS File: ([2013/11/16 11:55:08 | 000,450,660 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO1 - Hosts: 127.0.0.1 www.007guard.comO1 - Hosts: 127.0.0.1 007guard.comO1 - Hosts: 127.0.0.1 008i.comO1 - Hosts: 127.0.0.1 www.008k.comO1 - Hosts: 127.0.0.1 008k.comO1 - Hosts: 127.0.0.1 www.00hq.comO1 - Hosts: 127.0.0.1 00hq.comO1 - Hosts: 127.0.0.1 010402.comO1 - Hosts: 127.0.0.1 www.032439.comO1 - Hosts: 127.0.0.1 032439.comO1 - Hosts: 127.0.0.1 www.0scan.comO1 - Hosts: 127.0.0.1 0scan.comO1 - Hosts: 127.0.0.1 www.1000gratisproben.comO1 - Hosts: 127.0.0.1 1000gratisproben.comO1 - Hosts: 127.0.0.1 1001namen.comO1 - Hosts: 127.0.0.1 www.1001namen.comO1 - Hosts: 127.0.0.1 100888290cs.comO1 - Hosts: 127.0.0.1 www.100888290cs.comO1 - Hosts: 127.0.0.1 www.100sexlinks.comO1 - Hosts: 127.0.0.1 100sexlinks.comO1 - Hosts: 127.0.0.1 www.10sek.comO1 - Hosts: 127.0.0.1 10sek.comO1 - Hosts: 127.0.0.1 www.1-2005-search.comO1 - Hosts: 127.0.0.1 1-2005-search.comO1 - Hosts: 127.0.0.1 www.123fporn.infoO1 - Hosts: 15467 more lines...O2:64bit: - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.O2:64bit: - BHO: (Ad-Aware Security Add-on) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx64.dll ()O2:64bit: - BHO: (SeeSimilar) - {7549CA81-7BB5-41AF-AF7D-4689F5CF8340} - C:\Program Files (x86)\SeeSimilar\ScriptHost64.dll (SeeSimilar.com)O2 - BHO: (Search Assistant BHO) - {06e05b40-77fa-40b6-9077-ed1a7577b1ef} - C:\Program Files (x86)\UtilityChest_49\bar\1.bin\49SrcAs.dll (MindSpark)O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)O2 - BHO: (Toolbar BHO) - {58f7b5ca-1162-42e8-8bbc-d543b4edd780} - C:\Program Files (x86)\UtilityChest_49\bar\1.bin\49bar.dll (MindSpark)O2 - BHO: (Ad-Aware Security Add-on) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll ()O2 - BHO: (SeeSimilar) - {7549CA81-7BB5-41AF-AF7D-4689F5CF8340} - C:\Program Files (x86)\SeeSimilar\ScriptHost.dll (SeeSimilar.com)O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)O2 - BHO: (OfferMosquito) - {82B16A3D-F03E-4565-A532-666B219C9A53} - C:\Users\mike 1\AppData\Local\ext_offermosquito\OfferMosquitoIEPlaceholder.dll (Bebo Media Ltd)O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\31.0.1650.57\npchrome_frame.dll (Google Inc.)O3:64bit: - HKLM\..\Toolbar: (Ad-Aware Security Add-on) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx64.dll ()O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKLM\..\Toolbar: (Ad-Aware Security Add-on) - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll ()O3 - HKLM\..\Toolbar: (Utility Chest) - {cf67755f-9265-449c-87cf-b945519e073b} - C:\Program Files (x86)\UtilityChest_49\bar\1.bin\49bar.dll (MindSpark)O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKCU\..\Toolbar\WebBrowser: (Utility Chest) - {CF67755F-9265-449C-87CF-B945519E073B} - C:\Program Files (x86)\UtilityChest_49\bar\1.bin\49bar.dll (MindSpark)O4:64bit: - HKLM..\Run: [AdAwareTray] C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.0.4555.0\AdAwareTray.exe ()O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [igfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [utility Chest Home Page Guard 64 bit] C:\Program Files (x86)\UtilityChest_49\bar\1.bin\AppIntegrator64.exe ()O4:64bit: - HKLM..\Run: [Zune Launcher] C:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)O4 - HKLM..\Run: [ApnTBMon] C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (APN)O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe ()O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()O4 - HKLM..\Run: [search Protection] C:\ProgramData\Search Protection\SearchProtection.exe (Lavasoft)O4 - HKCU..\Run: [CloudSystemBooster] C:\Program Files (x86)\Anvisoft\Cloud System Booster\CloudSystemBooster.exe (Anvisoft)O4 - HKCU..\Run: [DataMgr] C:\Users\mike 1\AppData\Roaming\DataMgr\DataMgr.exe (HTTO Group, Ltd.)O4 - HKCU..\Run: [intermediate] C:\Users\mike 1\AppData\Roaming\Intermediate\Intermediate.exe ()O4 - HKCU..\Run: [mmonitor] C:\Program Files (x86)\Anvisoft\Cloud System Booster\tools\Anvi_RAM_Booster\Anvi_RAM_Booster.exe (Anvisoft Corporation)O4 - HKCU..\Run: [sSync] C:\Users\mike 1\AppData\Roaming\SSync\SSync.exe ()O4 - Startup: C:\Users\mike 1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk = C:\Program Files (x86)\FrostWire 5\FrostWire.exe (FrostWire)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 181O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousUserGroupPolicy = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousMachineGroupPolicy = 0O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O1364bit: - gopher Prefix: missingO13 - gopher Prefix: missingO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.45.2)O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.45.2)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3DCDFA65-7DB9-48C7-9929-A37E9C7F7B20}: DhcpNameServer = 64.71.255.205 64.71.255.253O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4E47460E-2E89-4530-917C-ADE87B2CE41B}: DhcpNameServer = 192.168.2.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C6CE6CF0-3B37-45D1-8288-CB117C07E28A}: DhcpNameServer = 192.168.2.1O18:64bit: - Protocol\Handler\gcf - No CLSID value foundO18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value foundO18:64bit: - Protocol\Handler\ms-help - No CLSID value foundO18:64bit: - Protocol\Handler\ms-itss - No CLSID value foundO18:64bit: - Protocol\Handler\skype4com - No CLSID value foundO18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value foundO18 - Protocol\Handler\gcf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\31.0.1650.57\npchrome_frame.dll (Google Inc.)O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)O20 - Winlogon\Notify\igfxcui: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not foundO21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2013/11/16 16:04:00 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]O32 - AutoRun File - [2010/10/27 01:27:51 | 000,000,047 | R--- | M] () - D:\autorun.inf -- [ CDFS ]O33 - MountPoints2\{8d1b1191-4e6e-11e1-8dc5-806e6f6e6963}\Shell - "" = AutoRunO33 - MountPoints2\{8d1b1191-4e6e-11e1-8dc5-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup.exe -- [2011/02/23 07:47:39 | 001,910,600 | R--- | M] ()O34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) CREATERESTOREPOINTRestore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2013/11/16 19:31:23 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anvisoft[2013/11/16 19:31:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Anvisoft[2013/11/16 19:20:00 | 000,000,000 | -HSD | C] -- C:\Config.Msi[2013/11/16 16:02:23 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group[2013/11/16 15:59:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard[2013/11/16 14:06:06 | 000,000,000 | ---D | C] -- C:\Users\mike 1\Desktop\Old Firefox Data[2013/11/16 13:49:14 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\Lavasoft[2013/11/16 13:35:30 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Local\adawarebp[2013/11/16 13:02:27 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\Malwarebytes[2013/11/16 12:58:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware[2013/11/16 12:58:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2013/11/16 12:58:16 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys[2013/11/16 12:58:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware[2013/11/16 12:52:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus[2013/11/16 12:51:43 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft[2013/11/16 12:51:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Search Protection[2013/11/16 12:51:17 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars[2013/11/16 12:50:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Toolbar Cleaner[2013/11/16 12:50:34 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\SecureSearch[2013/11/16 12:49:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft[2013/11/16 12:47:56 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\LavasoftStatistics[2013/11/16 12:47:36 | 000,047,496 | ---- | C] (GFI Software) -- C:\Windows\SysNative\sbbd.exe[2013/11/16 12:37:46 | 000,000,000 | ---D | C] -- C:\Program Files\Google[2013/11/16 12:12:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Lavasoft[2013/11/15 16:33:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox[2013/11/13 23:20:13 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll[2013/11/13 23:20:11 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll[2013/11/13 23:20:09 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe[2013/11/13 23:20:09 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll[2013/11/13 23:20:09 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll[2013/11/13 23:20:09 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll[2013/11/13 23:20:09 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll[2013/11/13 23:20:08 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll[2013/11/13 23:20:08 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll[2013/11/13 23:20:08 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe[2013/11/13 23:20:08 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe[2013/11/13 23:20:04 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll[2013/11/13 23:20:03 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll[2013/11/13 23:20:03 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll[2013/11/13 23:20:02 | 003,959,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll[2013/11/12 16:13:14 | 001,474,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll[2013/11/12 16:13:05 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll[2013/11/12 16:13:05 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll[2013/11/12 16:13:04 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\credui.dll[2013/11/12 16:13:04 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SmartcardCredentialProvider.dll[2013/11/12 16:13:04 | 000,152,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SmartcardCredentialProvider.dll[2013/11/12 16:13:01 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll[2013/11/12 16:13:01 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll[2013/11/12 16:13:01 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll[2013/11/12 16:13:01 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll[2013/11/12 16:13:01 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll[2013/11/12 16:12:59 | 000,404,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll[2013/11/12 16:12:58 | 000,324,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FWPUCLNT.DLL[2013/11/12 16:12:57 | 000,830,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\nshwfp.dll[2013/11/12 16:12:57 | 000,656,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\nshwfp.dll[2013/11/12 16:12:57 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\FWPUCLNT.DLL[2013/10/21 14:26:48 | 000,000,000 | ---D | C] -- C:\Windows\CheckSur[2013/10/20 11:35:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight[2013/10/20 11:33:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight[2013/10/20 11:33:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight[2013/10/20 11:33:30 | 000,000,000 | ---D | C] -- C:\history[2013/10/20 11:26:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ljkb[2013/10/20 11:25:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle[2013/10/19 11:14:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java[2013/10/19 11:14:12 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe[2013/10/19 11:14:07 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe[2013/10/19 11:14:07 | 000,174,504 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe[2013/10/19 11:14:07 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll[2013/10/19 11:13:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java[2013/10/19 07:58:12 | 000,000,000 | ---D | C] -- C:\Users\mike 1\Documents\SEGA Genesis Classic Collection[2013/10/19 06:00:57 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Local\ext_offermosquito[2013/10/19 06:00:40 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\SSync[2013/10/19 06:00:40 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\Intermediate[2013/10/19 06:00:40 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\DataMgr[2013/10/19 05:56:20 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\Common[2013/10/19 05:56:19 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\OfferMosquito[2013/10/19 05:52:33 | 000,000,000 | ---D | C] -- C:\Users\mike 1\AppData\Roaming\SeeSimilar[2013/10/19 05:52:27 | 000,000,000 | ---D | C] -- C:\Users\mike 1\Desktop\X-Plane 9 Demo[2013/10/19 05:52:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SeeSimilar[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/11/16 21:46:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-733539148-3254458405-2432132980-1000UA.job[2013/11/16 21:46:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-733539148-3254458405-2432132980-1000Core.job[2013/11/16 21:42:45 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job[2013/11/16 21:22:00 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-733539148-3254458405-2432132980-1003UA.job[2013/11/16 21:11:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job[2013/11/16 20:27:55 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2013/11/16 20:27:55 | 000,014,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2013/11/16 20:27:05 | 000,779,306 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2013/11/16 20:27:05 | 000,665,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2013/11/16 20:27:05 | 000,125,712 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2013/11/16 20:20:01 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job[2013/11/16 20:18:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2013/11/16 20:18:42 | 3061,202,944 | -HS- | M] () -- C:\hiberfil.sys[2013/11/16 19:31:23 | 000,001,294 | ---- | M] () -- C:\Users\mike 1\Desktop\Cloud System Booster.lnk[2013/11/16 18:22:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-733539148-3254458405-2432132980-1003Core.job[2013/11/16 16:04:00 | 000,000,000 | ---- | M] () -- C:\autoexec.bat[2013/11/16 12:58:22 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk[2013/11/16 12:52:25 | 000,001,327 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk[2013/11/16 12:47:35 | 000,047,496 | ---- | M] (GFI Software) -- C:\Windows\SysNative\sbbd.exe[2013/11/16 12:47:35 | 000,014,456 | ---- | M] (GFI Software) -- C:\Windows\SysNative\drivers\gfibto.sys[2013/11/16 12:36:45 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe[2013/11/16 12:36:45 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl[2013/11/16 11:55:08 | 000,450,660 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts[2013/11/16 11:31:48 | 000,001,327 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk[2013/11/16 11:31:47 | 000,001,587 | ---- | M] () -- C:\Users\mike 1\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk[2013/10/21 14:15:31 | 000,004,483 | ---- | M] () -- C:\Windows\wininit.ini[2013/10/20 14:20:53 | 000,450,642 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20131116-115507.backup[2013/10/19 10:42:15 | 000,000,017 | ---- | M] () -- C:\Users\mike 1\AppData\Local\resmon.resmoncfg[2013/10/19 06:34:33 | 000,000,080 | ---- | M] () -- C:\Users\mike 1\AppData\Local\X-Plane Installer.prf[2013/10/19 05:51:47 | 002,324,898 | ---- | M] () -- C:\Users\mike 1\Desktop\X-PlaneDemoInstallerWindows.zip[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013/11/16 19:31:23 | 000,001,294 | ---- | C] () -- C:\Users\mike 1\Desktop\Cloud System Booster.lnk[2013/11/16 16:04:00 | 000,000,000 | ---- | C] () -- C:\autoexec.bat[2013/11/16 12:58:22 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk[2013/11/16 12:52:25 | 000,001,327 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk[2013/10/19 10:42:15 | 000,000,017 | ---- | C] () -- C:\Users\mike 1\AppData\Local\resmon.resmoncfg[2013/10/19 06:34:32 | 000,000,080 | ---- | C] () -- C:\Users\mike 1\AppData\Local\X-Plane Installer.prf[2013/10/19 05:51:38 | 002,324,898 | ---- | C] () -- C:\Users\mike 1\Desktop\X-PlaneDemoInstallerWindows.zip[2013/10/04 18:18:32 | 000,000,000 | ---- | C] () -- C:\Users\mike 1\AppData\Roaming\wklnhst.dat[2013/08/23 20:08:52 | 001,169,609 | ---- | C] () -- C:\Windows\unins001.exe[2013/08/23 20:08:52 | 000,086,529 | ---- | C] () -- C:\Windows\unins001.dat[2013/01/28 18:03:35 | 000,004,483 | ---- | C] () -- C:\Windows\wininit.ini[2013/01/12 10:30:35 | 000,721,694 | ---- | C] () -- C:\Windows\unins000.exe[2013/01/12 10:30:35 | 000,013,925 | ---- | C] () -- C:\Windows\unins000.dat[2012/05/14 17:51:11 | 000,765,218 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2012/01/10 20:29:54 | 013,904,384 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll ========== ZeroAccess Check ========== [2009/07/13 20:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64"" = C:\Windows\SysNative\shell32.dll -- [2013/07/25 18:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]"" = %SystemRoot%\system32\shell32.dll -- [2013/07/25 17:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 17:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 04:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 17:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013/07/12 04:42:43 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\.minecraft[2013/07/18 04:37:41 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\Ad-Aware Antivirus[2013/10/19 05:56:20 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\Common[2013/10/19 06:00:40 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\DataMgr[2013/07/12 03:37:32 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\ftblauncher[2013/10/19 06:00:41 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\Intermediate[2013/10/19 05:56:19 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\OfferMosquito[2013/11/16 12:50:34 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\SecureSearch[2013/10/19 05:52:33 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\SeeSimilar[2013/10/19 06:00:40 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\SSync[2013/01/10 14:32:33 | 000,000,000 | ---D | M] -- C:\Users\mike 1\AppData\Roaming\TuneUp Software ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < MD5 for: EXPLORER.EXE >[2011/02/25 22:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe[2011/02/25 21:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe[2009/07/13 17:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe[2011/02/25 21:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe[2010/09/07 10:20:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe[2011/02/25 21:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe[2011/02/24 22:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe[2011/02/24 22:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe[2011/02/25 22:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe[2010/11/20 04:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe[2010/09/07 10:17:02 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe[2011/02/24 21:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe[2011/02/24 21:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe[2010/09/07 10:20:51 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe[2010/09/07 10:17:02 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe[2010/11/20 05:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe[2010/09/07 10:20:51 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe[2010/09/07 10:17:02 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe[2009/07/13 17:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe[2010/09/07 10:20:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe[2011/02/25 22:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe[2010/09/07 10:17:02 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: SERVICES.EXE >[2009/07/13 17:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\SysNative\services.exe[2009/07/13 17:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe < MD5 for: SVCHOST.EXE >[2009/07/13 17:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe[2009/07/13 17:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe[2009/07/13 17:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe[2009/07/13 17:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe < MD5 for: USERINIT.EXE >[2010/11/20 04:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe[2010/11/20 04:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe[2009/07/13 17:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe[2009/07/13 17:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe[2010/11/20 05:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe[2010/11/20 05:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WINLOGON.EXE >[2010/11/20 05:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe[2010/11/20 05:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe[2009/07/13 17:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe[2010/09/07 10:20:51 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe[2010/09/07 10:20:51 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < %systemroot%\*. /rp /s > < %systemdrive%\$Recycle.Bin|@;true;true;true /fp > ========== Drive Information ========== Physical Drives--------------- Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk mediaInterface type: IDEMedia Type: Fixed hard disk mediaModel: ST9500325AS ATA DevicePartitions: 3Status: OKStatus Info: 0 Partitions--------------- DeviceID: Disk #0, Partition #0PartitionType: UnknownBootable: FalseBootPartition: FalsePrimaryPartition: TrueSize: 102.00MBStarting Offset: 32256Hidden sectors: 0 DeviceID: Disk #0, Partition #1PartitionType: Installable File SystemBootable: TrueBootPartition: TruePrimaryPartition: TrueSize: 15.00GBStarting Offset: 106928640Hidden sectors: 0 DeviceID: Disk #0, Partition #2PartitionType: Installable File SystemBootable: FalseBootPartition: FalsePrimaryPartition: TrueSize: 451.00GBStarting Offset: 15835568640Hidden sectors: 0 < End of report > Link to post Share on other sites More sharing options...
Harbour151 Posted November 17, 2013 Author ID:754544 Share Posted November 17, 2013 OTL Extras logfile created on: 16/11/2013 9:46:42 PM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\mike 1\Downloads64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.10.9200.16736)Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy 3.80 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 51.17% Memory free7.60 Gb Paging File | 5.53 Gb Available in Paging File | 72.73% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 451.01 Gb Total Space | 250.53 Gb Free Space | 55.55% Space Free | Partition Type: NTFSDrive D: | 681.00 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: HOME-PC | User Name: mike 1 | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current user | Include 64bit ScansCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation).url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation).html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htafile [open] -- "%1" %*htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)http [open] -- Reg Error: Key error.https [open] -- Reg Error: Key error.inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htafile [open] -- "%1" %*htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)http [open] -- Reg Error: Key error.https [open] -- Reg Error: Key error.inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== System Restore Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"DisableNotifications" = 0"EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"DisableNotifications" = 0"EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"DisableNotifications" = 0"EnableFirewall" = 1 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{0A149053-3A55-4BE6-BC6C-AC76D904F54A}" = rport=445 | protocol=6 | dir=out | app=system |"{14F9FBA3-DD2E-468F-A8C3-D1E11DFAF214}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |"{16212DFE-0781-44D6-A152-A46D2C14D3BF}" = lport=138 | protocol=17 | dir=in | app=system |"{201119F6-D52E-49F7-A7E3-477AD13B822F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |"{4A3AD7AF-6B7D-4E2F-A54D-0C6390DCEEC6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |"{5B25778E-52CB-42AD-9BD3-96363AFBDFF0}" = lport=2869 | protocol=6 | dir=in | app=system |"{60D5BB3C-743D-4ADE-8279-601E37BD45C6}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |"{6E8FED15-F59B-4A29-ACCB-D5B315888E0D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |"{6FF875DD-5D0F-4D44-8777-BA127BE8D743}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |"{7142E107-D683-499F-841F-CAE9E4C814F5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |"{721CEA31-FC3B-4971-AC5E-062516DBDE03}" = rport=139 | protocol=6 | dir=out | app=system |"{985FD37A-149E-405A-985F-C27972186124}" = rport=10243 | protocol=6 | dir=out | app=system |"{A3DA6069-006C-45D5-BE08-CFCBD5C226A2}" = rport=138 | protocol=17 | dir=out | app=system |"{B50D35D7-56B9-43C6-9C6B-CED4201F63C0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |"{B76723CF-0134-4F8B-B9AE-9A449B94D4BB}" = lport=139 | protocol=6 | dir=in | app=system |"{C3721BBB-AF2D-4866-AF47-C3E405108EA0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |"{C511D1C1-E722-4B67-BBB6-ED3C0CD1E44C}" = rport=137 | protocol=17 | dir=out | app=system |"{CFF2FDEC-1DE4-4AB6-9D33-443F46812905}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |"{D28BF10C-F6FE-455F-9FC0-83AC1135567B}" = lport=445 | protocol=6 | dir=in | app=system |"{DCA61131-20F8-4066-8E71-401D657ADF44}" = lport=10243 | protocol=6 | dir=in | app=system |"{E6DB427B-91A0-46B1-9EB8-028C9E094C3E}" = lport=137 | protocol=17 | dir=in | app=system |"{F091689E-4A33-4D4B-912C-1A7EF3BFE8CB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{15A703D3-7957-418C-85D9-40D2F4A1C417}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |"{20B6493F-60E9-462C-98A8-B0FE8EFDC7CC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |"{21E186BF-4860-42E0-ACE2-5AA4BC1A28C7}" = dir=in | app=c:\users\home\appdata\local\torch\plugins\torrent\torchtorrent.exe |"{2A546582-537A-410A-B8CB-FC62FD3ABEF0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |"{2EE9FF92-DDCA-4E12-80AC-30A5F2139A3D}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |"{303BE99B-8CBC-4268-8492-B65DEDEBCAED}" = protocol=6 | dir=in | app=c:\program files (x86)\frostwire 5\frostwire.exe |"{39811874-F8EC-473D-B1C1-E268AC53896B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |"{4A632466-F555-47A1-AE8A-39AADCB62928}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{4B5E5FD9-B872-44E7-848B-3C312AE16305}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe |"{4D591F27-AF55-458E-B181-DE1B5A4F9903}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{5017DD68-344C-46CA-BAE0-CA235C5C563B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |"{53D7B4DB-22CE-48D7-807B-1A638CE52942}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |"{588E2418-0D34-4DF1-865B-27A159FE9970}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |"{62EE242F-B241-401F-84A7-136BEF86640D}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |"{637711DA-1F71-491E-A074-B282A3FEF1E1}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |"{65541DF3-D906-4D56-B9CF-8E9EFF1EF280}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |"{68E3E874-B1D4-47D2-9033-B58AECA68142}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe |"{69171801-FCD8-4D37-9CD7-A612EF8A7FCE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{73E5CF9B-D2B6-4D3C-BA01-3F4C14492650}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |"{75D196C9-C235-4B34-82FF-444766A04D3D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |"{7C1C0EAC-B74A-4094-A2A9-939F05ADD40B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |"{7D9E54CE-0973-4730-8D6A-E53A0682F7DC}" = protocol=6 | dir=in | app=c:\program files (x86)\lavasoft\adaware securesearch toolbar\dtuser.exe |"{848F4C4D-7A7D-4EB0-8D2F-EE2BB23ED87D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |"{8C1A4C28-0787-41DF-BB2E-BC2414B27865}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe |"{902123A5-15B1-46E1-89E2-FAC8D019493A}" = protocol=6 | dir=out | app=system |"{91F4E2D9-6466-4EC5-93D6-D072DF36073D}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |"{931AAAD5-868D-44E2-8CCE-9C2F152B2EB3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |"{99B77348-6A4C-4BC7-ADB3-C46E60373063}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{9B19B756-64FD-424B-8CE9-8772196377D6}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |"{A54BCA81-AEE1-4E79-9A3B-2933579F4A26}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |"{B19E604F-AA6B-4105-B9F0-44895FB7AC1C}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |"{B6AFCCF1-A108-40E6-9209-80AEBDC6B15F}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |"{C397C915-60EC-4EAB-A333-E823CBBB4C5C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |"{CB5474DA-D872-404F-ABA1-2C355118BE52}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |"{D8128F39-9C82-4965-837C-91173D9E1352}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |"{DBBD87D8-75C9-4096-A562-EF0EF7458A28}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe |"{DC62AB60-2573-4778-AC79-32D2ECB142F5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |"{E602D495-53ED-4FDF-949A-C909DC2CA72E}" = protocol=17 | dir=in | app=c:\program files (x86)\frostwire 5\frostwire.exe |"{E660B3AB-599A-475A-BBA3-290650662204}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |"{E96FCFB4-5D03-4CCC-8F47-5945DD6EDACE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |"{F166B3F4-42E6-4D95-B702-4D34B9C5A3F8}" = protocol=17 | dir=in | app=c:\program files (x86)\lavasoft\adaware securesearch toolbar\dtuser.exe |"{F2792D93-8BCA-4C2E-B2FB-5263428A86F1}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |"{FCFBB866-4AB7-40E5-BA96-7145F50A7121}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |"TCP Query User{0F43895F-DA01-429D-BE30-5D72CD1FD238}C:\program files (x86)\growl for windows\growl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\growl for windows\growl.exe |"TCP Query User{38CF9F9D-197C-4B0D-8D90-B2A5574C6317}C:\program files (x86)\frostwire 5\frostwire.exe" = protocol=6 | dir=in | app=c:\program files (x86)\frostwire 5\frostwire.exe |"TCP Query User{4A6BDC3D-CB03-47BC-9AA1-084B8274A34B}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |"TCP Query User{7ECB26C2-2DDE-4020-A1D6-2F8EEF29600D}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |"TCP Query User{81720C00-4430-44BB-9644-7B2EB67A8E9F}C:\users\home\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\home\appdata\local\akamai\netsession_win.exe |"TCP Query User{83D048E0-AF0F-45DD-A944-79E8974846B9}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |"TCP Query User{A4ADBCCA-AAC5-4234-BC7D-C8BA2F6A51F3}C:\users\home\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\home\appdata\local\akamai\netsession_win.exe |"TCP Query User{B84900DC-4B9D-4600-85E0-05043E1795E5}C:\program files (x86)\ea games\american mcgee's alice\alice.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\american mcgee's alice\alice.exe |"TCP Query User{B9FD6F5F-23B6-4881-A9EA-AB47DCBFBC9A}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |"TCP Query User{D82C8B06-C113-4E0D-B6E9-7D1001425279}C:\users\mike 1\desktop\x-plane 9 demo\x-plane.exe" = protocol=6 | dir=in | app=c:\users\mike 1\desktop\x-plane 9 demo\x-plane.exe |"TCP Query User{D8FB16FC-50B0-4F15-83CE-E4FCF3BC4B07}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |"TCP Query User{E0A32D08-FAE5-4954-BCE4-2F9D1F854B30}C:\program files (x86)\growl for windows\growl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\growl for windows\growl.exe |"TCP Query User{E2AF5628-1F00-4E80-A955-15FFAC4D21F4}C:\program files (x86)\bywifi\bywifi.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bywifi\bywifi.exe |"UDP Query User{03D5250D-8685-4F59-9FFF-C44F5451BAED}C:\users\home\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\home\appdata\local\akamai\netsession_win.exe |"UDP Query User{2811C32F-7F2C-42B0-81A2-A98675465189}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |"UDP Query User{2FDEB6FB-4E5D-4563-86A4-26F6F7CC347B}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |"UDP Query User{52E1F864-3686-47D0-90A6-C966E2C66985}C:\program files (x86)\frostwire 5\frostwire.exe" = protocol=17 | dir=in | app=c:\program files (x86)\frostwire 5\frostwire.exe |"UDP Query User{69A89309-2CF9-4338-95FE-8F7B0205F73F}C:\users\mike 1\desktop\x-plane 9 demo\x-plane.exe" = protocol=17 | dir=in | app=c:\users\mike 1\desktop\x-plane 9 demo\x-plane.exe |"UDP Query User{70AAB35C-C783-4C17-ABE2-20F4CD517290}C:\program files (x86)\ea games\american mcgee's alice\alice.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\american mcgee's alice\alice.exe |"UDP Query User{75034060-83C3-4B66-BE63-15159EC947A4}C:\program files (x86)\bywifi\bywifi.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bywifi\bywifi.exe |"UDP Query User{A6C9AE26-C293-47B7-B23B-24E525903E44}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |"UDP Query User{A955307F-8D77-406F-86A2-3B52E3BF2EA0}C:\program files (x86)\growl for windows\growl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\growl for windows\growl.exe |"UDP Query User{B13ABF0F-D33D-42B5-AA4C-FFE1A51F6157}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |"UDP Query User{BB67BE7B-A7DD-4B0C-B54B-F4FD36082482}C:\users\home\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\home\appdata\local\akamai\netsession_win.exe |"UDP Query User{C15ED15C-C6BE-4D57-BFEC-26660F923220}C:\program files (x86)\growl for windows\growl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\growl for windows\growl.exe |"UDP Query User{F6B6BE96-BA74-4A86-8B19-055FE0992232}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)"{07EEE598-5F21-4B57-B40B-46592625B3D9}" = Zune Language Pack (PTB)"{0A087CE7-F643-4FE8-A5D2-0BBAF4A7B032}" = AdAwareUpdater"{0A087CE7-F643-4FE8-A5D2-0BBAF4A7B032}_AdAwareUpdater" = Ad-Aware Antivirus"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)"{2A9DFFD8-4E09-4B91-B957-454805B0D7C4}" = Zune Language Pack (CHS)"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support"{3589A659-F732-4E65-A89A-5438C332E59D}" = Zune Language Pack (ELL)"{51C839E1-2BE4-4E77-A1BA-CCEA5DAFA741}" = Zune Language Pack (KOR)"{57C51D56-B287-4C11-9192-EC3C46EF76A4}" = Zune Language Pack (RUS)"{5C93E291-A1CC-4E51-85C6-E194209FCDB4}" = Zune Language Pack (PTG)"{5DEFD397-4012-46C3-B6DA-E8013E660772}" = Zune Language Pack (NOR)"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161"{600DEB42-433A-40AF-BC14-082E40577BF2}" = AntimalwareEngine"{6740BCB0-5863-47F4-80F4-44F394DE4FE2}" = Zune Language Pack (NLD)"{6B33492E-FBBC-4EC3-8738-09E16E395A10}" = Zune Language Pack (ESP)"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour"{6EB931CD-A7DA-4A44-B74A-89C8EB50086F}" = Zune Language Pack (SVE)"{76BA306B-2AA0-47C0-AB6B-F313AB56C136}" = Zune Language Pack (MSL)"{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17"{8960A0A1-BB5A-479E-92CF-65AB9D684B43}" = Zune Language Pack (PLK)"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8B112338-2B08-4851-AF84-E7CAD74CEB32}" = Zune Language Pack (DAN)"{8D26D58C-3464-4C03-BB61-5695F984EFEF}" = Microsoft Security Client"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007"{92ECE3F9-591E-4C12-8A62-B9FCE38BF646}" = Zune Language Pack (IND)"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{9B75648B-6C30-4A0D-9DE6-0D09D20AF5A5}" = Zune"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad"{A5A53EA8-A11E-49F0-BDF5-AE536426A31A}" = Zune Language Pack (CHT)"{A8F2E50B-86E2-4D96-9BD2-9758BCC6F9B3}" = Zune Language Pack (CSY)"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)"{B4870774-5F3A-46D9-9DFE-06FB5599E26B}" = Zune Language Pack (FIN)"{BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}" = Zune Language Pack (DEU)"{C5D37FFA-7483-410B-982B-91E93FD3B7DA}" = Zune Language Pack (ITA)"{C68D33B1-0204-4EBE-BC45-A6E432B1D13A}" = Zune Language Pack (FRA)"{C6BE19C6-B102-4038-B2A6-1C313872DBB4}" = Zune Language Pack (HUN)"{D8A781C9-3892-4E2E-9320-480CF896CFBB}" = Zune Language Pack (JPN)"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319"{EBE1D498-A767-489E-A0DD-F317A8B83579}" = AdAwareInstaller"{EC8A40B2-096A-4EA4-B11A-167F87F293A7}" = iCloud"{F2CB8C3C-9C9E-4FAB-9067-655601C5F748}" = Windows Mobile Device Updater Component"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile"DW WLAN Card Utility" = DW WLAN Card Utility"GIMP-2_is1" = GIMP 2.8.2"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended"Microsoft Security Client" = Microsoft Security Essentials"Zune" = Zune [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{01CC173C-5A66-49BA-9849-D2E3E770DA2B}_is1" = Iconimize 1.0"{02A5C383-FE94-3B52-9627-CE70B9301A0F}" = Google Chrome Frame"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java 6 Update 31"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 45"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729"{46575637-0076-A76A-76A7-A758B70C0700}" = Frostwire Toolbar"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4E316621-FC7D-4C09-A7F0-6BA974CDB0B2}" = Growl for Windows"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module"{55D65D27-C0CD-4375-9021-F3D3D024ED90}_is1" = Minecraft PC Gamer Demo version 1.5"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{77B5AD60-8F14-11D4-9BC9-0050041A1090}" = American McGee's Alice"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{A724605D-B399-4304-B8C7-33B3EF7D4677}" = Bully Scholarship Edition"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287"{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}" = System Requirements Lab for Intel"{CE75C837-4BA9-4CF8-B912-C3ED5BD0EAAC}" = You Don't Know Jack®"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables"1ClickDownload" = TornTV"adawaretb" = Ad-Aware Security Add-on"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin"Audacity_is1" = Audacity 2.0.2"BFGC" = Big Fish: Game Manager"Cloud System Booster" = Cloud System Booster"DivX Setup" = DivX Setup"ENTERPRISE" = Microsoft Office Enterprise 2007"FrostWire 5" = FrostWire 5.6.3"HulkOnDesk" = HulkOnDesk"IcoFX 2_is1" = IcoFX 2.3.1"InstallShield_{A724605D-B399-4304-B8C7-33B3EF7D4677}" = Bully Scholarship Edition"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300"Mozilla Firefox 25.0.1 (x86 en-US)" = Mozilla Firefox 25.0.1 (x86 en-US)"MozillaMaintenanceService" = Mozilla Maintenance Service"Palringo" = Palringo"Scratch" = Scratch"SeeSimilar" = SeeSimilar"SEGAGenesisClassicCollection_Gold Edition" = SEGA Genesis Classic Collection: Gold Edition"SONAR85LE_is1" = SONAR LE"TeamViewer 7" = TeamViewer 7"UntouchableHacks" = Untouchable Hacks"UtilityChest_49bar Uninstall" = Utility Chest Toolbar"Vgrabber1 Toolbar" = Vgrabber1 Toolbar"Video Downloader" = Video Downloader"Video Downloader_is1" = Video Downloader version 2.0 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = ROBLOX Player for mike 1"VisualBee for Microsoft PowerPoint" = VisualBee for Microsoft PowerPoint ========== Last 20 Event Log Errors ========== [ Application Events ]Error - 12/11/2013 8:03:43 PM | Computer Name = Home-PC | Source = Application Hang | ID = 1002Description = The program iTunes.exe version 11.0.4.4 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: cf8 Start Time: 01cee003912c9814 Termination Time: 6 Application Path: C:\Program Files (x86)\iTunes\iTunes.exeReport Id: Error - 13/11/2013 8:31:12 PM | Computer Name = Home-PC | Source = SideBySide | ID = 16842815Description = Activation context generation failed for "c:\program files (x86)\spybot - search & destroy\DelZip179.dll".Error in manifest or policy file "c:\programfiles (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" ofattribute "language" in element "assemblyIdentity" is invalid. Error - 14/11/2013 3:13:03 AM | Computer Name = Home-PC | Source = Windows Search Service | ID = 3007Description = Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer. Context: Application, SystemIndex Catalog Error - 14/11/2013 4:33:35 AM | Computer Name = Home-PC | Source = SideBySide | ID = 16842815Description = Activation context generation failed for "c:\program files (x86)\spybot - search & destroy\DelZip179.dll".Error in manifest or policy file "c:\programfiles (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" ofattribute "language" in element "assemblyIdentity" is invalid. Error - 15/11/2013 6:10:49 PM | Computer Name = Home-PC | Source = SideBySide | ID = 16842815Description = Activation context generation failed for "c:\program files (x86)\spybot - search & destroy\DelZip179.dll".Error in manifest or policy file "c:\programfiles (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" ofattribute "language" in element "assemblyIdentity" is invalid. Error - 16/11/2013 3:38:41 PM | Computer Name = Home-PC | Source = Application Hang | ID = 1002Description = The program IEXPLORE.EXE version 10.0.9200.16736 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 42d4 Start Time: 01cee302ce532487 Termination Time: 29 Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Report Id: Error - 16/11/2013 3:39:19 PM | Computer Name = Home-PC | Source = Application Hang | ID = 1002Description = The program iexplore.exe version 10.0.9200.16736 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 3338 Start Time: 01cee302cdb1d91b Termination Time: 0 Application Path: C:\Program Files\Internet Explorer\iexplore.exe Report Id: Error - 16/11/2013 4:28:07 PM | Computer Name = Home-PC | Source = Application Hang | ID = 1002Description = The program firefox.exe version 25.0.1.5064 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: ecc Start Time: 01cee30a394a9563 Termination Time: 31 Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Report Id: 953c0b23-4efd-11e3-b83d-f04da26277b7 Error - 16/11/2013 6:33:47 PM | Computer Name = Home-PC | Source = Application Error | ID = 1000Description = Faulting application name: BingDesktop.exe, version: 1.3.309.0, time stamp: 0x5235c0bd Faulting module name: BingDesktop.exe, version: 1.3.309.0, time stamp: 0x5235c0bd Exception code: 0xc00000fd Fault offset: 0x001569f7 Faulting process id: 0xfa8 Faulting application start time: 0x01cee31b12e2119b Faulting application path: C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe Faulting module path: C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe Report Id: 283c767d-4f0f-11e3-b06b-f04da26277b7 Error - 17/11/2013 1:18:33 AM | Computer Name = Home-PC | Source = SideBySide | ID = 16842815Description = Activation context generation failed for "c:\program files (x86)\spybot - search & destroy\DelZip179.dll".Error in manifest or policy file "c:\programfiles (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" ofattribute "language" in element "assemblyIdentity" is invalid. [ Broadcom Wireless LAN Events ]Error - 04/02/2012 9:43:31 AM | Computer Name = Home-PC | Source = WLAN-Tray | ID = 0Description = 05:43:28, Sat, Feb 04, 12 Error - Unable to gain access to user store [ System Events ]Error - 12/01/2013 11:54:41 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7006Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 12/01/2013 11:54:49 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7006Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 18/01/2013 10:37:47 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7006Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 18/01/2013 10:39:04 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7006Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 18/01/2013 10:39:14 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7006Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 19/01/2013 5:59:31 PM | Computer Name = Home-PC | Source = Schannel | ID = 36887Description = The following fatal alert was received: 40. Error - 21/01/2013 10:46:13 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7006Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 21/01/2013 10:46:51 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7043Description = The AVGIDSAgent service did not shut down properly after receiving a preshutdown control. Error - 21/01/2013 10:48:29 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7006Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 Error - 21/01/2013 10:48:36 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7006Description = The ScRegSetValueExW call failed for FailureActions with the following error: %%5 < End of report > Link to post Share on other sites More sharing options...
Harbour151 Posted November 17, 2013 Author ID:754546 Share Posted November 17, 2013 aswMBR version 0.9.9.1771 Copyright© 2011 AVAST SoftwareRun date: 2013-11-16 22:15:56-----------------------------22:15:56.395 OS Version: Windows x64 6.1.7601 Service Pack 122:15:56.395 Number of processors: 4 586 0x250522:15:56.395 ComputerName: HOME-PC UserName: mike 122:15:57.757 Initialize success22:16:07.958 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-022:16:07.958 Disk 0 Vendor: ST9500325AS D005DEM1 Size: 476940MB BusType: 1122:16:08.051 Disk 0 MBR read successfully22:16:08.051 Disk 0 MBR scan22:16:08.067 Disk 0 Windows 7 default MBR code22:16:08.067 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 101 MB offset 6322:16:08.067 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 15000 MB offset 20884522:16:08.082 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 461837 MB offset 3092884522:16:08.114 Disk 0 scanning C:\Windows\system32\drivers22:16:18.544 Service scanning22:16:37.173 Modules scanning22:16:37.173 Disk 0 trace - called modules:22:16:37.189 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys22:16:37.205 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004bb5060]22:16:37.205 3 CLASSPNP.SYS[fffff8800141743f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800492f060]22:16:37.205 Scan finished successfully22:17:03.358 Disk 0 MBR has been saved successfully to "C:\Users\mike 1\Documents\MBR.dat"22:17:03.405 The log file has been saved successfully to "C:\Users\mike 1\Documents\aswMBR.txt" Link to post Share on other sites More sharing options...
Harbour151 Posted November 17, 2013 Author ID:754549 Share Posted November 17, 2013 im not sure how to attach the zipped file Link to post Share on other sites More sharing options...
Harbour151 Posted November 18, 2013 Author ID:754844 Share Posted November 18, 2013 why wont anyone help me with this? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 18, 2013 Root Admin ID:754857 Share Posted November 18, 2013 Because you've failed to read the following and you've been self-medicating the problem. Please take the time and read that post. I'm infected - What do I do now? I will attempt to help you but I'm going on vacation in a couple of days so not sure if we can finish up in time or not but we'll try. Please delete all your current logs. Reboot the computer and then run through the following steps and post back only the logs requested.General P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.Before we proceed further, please read all of the following instructions carefully.If there is anything that you do not understand kindly ask before proceeding.If needed please print out these instructions.Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text. If the log is too large then you can use attachments by clicking on the More Reply Options button. Please enable your system to show hidden files: How to see hidden files in Windows Make sure you're subscribed to this topic:Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly [*]Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive [*]Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you. [*]The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone. [*]Perform everything in the correct order. Sometimes one step requires the previous one. [*]If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue. [*]You can check here if you're not sure if your computer is 32-bit or 64-bit [*]Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners. [*]When we are done, I'll give you instructions on how to cleanup all the tools and logs [*]Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. [*]Your topic will be closed if you haven't replied within 3 days [*](If I have not responded within 24 hours, please send me a Private Message as a reminder)STEP 0RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processesso that your normal security software can then run and clean your computer of infections.When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policiesthat stop us from using certain tools. When finished it will display a log file that shows the processes that wereterminated while the program was running.As RKill only terminates a program's running process, and does not delete any files, after running it you should not rebootyour computer as any malware processes that are configured to start automatically will just be started again.Instead, after running RKill you should immediately scan your computer using the requested scans I've included.Please download Rkill by Grinler from one of the links below and save it to your desktop.Link 1Link 2On Windows XP double-click on the Rkill desktop icon to run the tool. On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully. If not, delete the file, then download and use the one provided in Link 2. If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs. If the tool does not run from any of the links provided, please let me know. Do not reboot the computer, you will need to run the application again.STEP 01Backup the Registry:Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.Please download ERUNT from one of the following links: Link1 | Link2 | Link3 ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed. Double click on erunt-setup.exe to Install ERUNT by following the prompts. NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO. Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process. Choose a location for the backup.Note: the default location is C:\Windows\ERDNT which is acceptable. [*]Make sure that at least the first two check boxes are selected. [*]Click on OK [*]Then click on YES to create the folder. [*]Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exeSTEP 02Please download RogueKiller and save it to your desktop.You can check here if you're not sure if your computer is 32-bit or 64-bitRogueKiller 32-bit | RogueKiller 64-bit Quit all running programs. For Windows XP, double-click to start. For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run. Read and accept the EULA (End User Licene Agreement) Click Scan to scan the system. When the scan completes Close the program > Don't Fix anything! Don't run any other options, they're not all bad!! Post back the report which should be located on your desktop. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 20, 2013 Root Admin ID:755785 Share Posted November 20, 2013 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts