Rollups? How can I remove them? Also, redirects?

Cyclops62 · December 31, 2013

HALP!! I have been plagued by both redirects and rollups. Are they related? They seem to be Advertising generated, I think. MBAM has not found anything in the scans, nor has Spybot. (I run them once a week, separately, and offline with my everyday 'normal', AVG Free, off.) Is there any way to get rid of these very annoying things?

Maniac · January 2, 2014

Hello Cyclops62 and :welcome: ! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Please follow the instructions here and then post your log files in a new reply in this thread:

http://forums.malwarebytes.org/index.php?showtopic=9573

Cyclops62 · January 2, 2014

Hi..here are the files you wanted. I have MBAM's also if you want.

attach.txt

dds.txt

Maniac · January 2, 2014

Please post your MBAM too.

Take a look at my notes:

Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Cyclops62 · January 3, 2014

www.malwarebytes.org

Database version: v2014.01.01.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
OWNER :: HP-05E77DB9975B [administrator]

1/2/2014 2:43:09 PM
MBAM-log-2014-01-02 (15-00-21).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 206869
Time elapsed: 15 minute(s), 10 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_DRVFLTIP (Rogue.UnVirex) -> No action taken.
HKLM\System\CurrentControlSet\Services\DrvFltIp (Rogue.UnVirex) -> No action taken.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 3
C:\Documents and Settings\OWNER\Local Settings\Temp\parent.txt (PUP.Optional.BundleInstaller.A) -> No action taken.
C:\Documents and Settings\OWNER\Local Settings\Temp\d3d5db3b-ea69-4871-9afa-33f6b47329720\parent.txt (PUP.Optional.BundleInstaller.A) -> No action taken.
C:\Documents and Settings\OWNER\Local Settings\Temp\DrvFltIp (Rogue.UnVirex) -> No action taken.

(end)

Maniac · January 5, 2014

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as StreamTorrent, TorrentPrivacy or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Next, generate a new fresh DDS log files and post them in your next reply.

Cyclops62 · January 5, 2014

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.45.2
Run by OWNER at 8:55:06 on 2014-01-05
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1527.596 [GMT -5:00]
.
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: ESET NOD32 antivirus system 2.70 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ================
.
C:\PROGRA~1\Enigma Software Group\SpyHunter\SH4Service.exe
C:\Program Files\HitmanPro\hmpsched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Documents and Settings\All Users\Application Data\FileOpen\Services\FileOpenManagerSvc32.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Ashampoo\Ashampoo FireWall PRO\FireWall.exe
G:\program files\update\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\KeyScrambler\keyscrambler.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanCU.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [Preallocate.exe] c:\preallocate\Preallocate.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mRun: [DrvLsnr] c:\program files\analog devices\soundmax\DrvLsnr.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [Ashampoo FireWall PRO] "c:\program files\ashampoo\ashampoo firewall pro\FireWall.exe" -TRAY
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [Wondershare Helper Compact.exe] c:\program files\common files\wondershare\wondershare helper compact\WSHelper.exe
mRun: [TkBellExe] "g:\program files\update\realsched.exe" -osboot
mRun: [smapp] c:\program files\analog devices\soundmax\SMTray.exe
mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [20131121] c:\program files\avast software\avast\setup\emupdate\707299fd-bc02-42ae-b12f-8b8ee030ef9e.exe /check
mRun: [AVG_UI] "c:\program files\avg\avg2014\avgui.exe" /TRAYONLY
mRun: [KeyScrambler] c:\program files\keyscrambler\keyscrambler.exe /a
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OABNAEUASAAtAFIAWQBHAEEANAAtAFAAUABCAFIAOAAtAFcAUQBWADcAQQAtADcAOABVADIAOQAtADgARQBNAEIAUgA"&"inst=NwA2AC0ANQAxADcANAAyADcANgA4ADgALQBYAE8AMwA2ACsAMQAtAEQAMwA4ADEATAArADUALQBQAEwAKwA5AC0ATgAxAEQAKwAxAA"&"prod=52"&"ver=9.0.872
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\onenote 2007 screen clipper and launcher.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wireless configuration utility.lnk - c:\program files\trendnet\tew-641pc_tew-643pi\WlanCU.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoResolveTrack = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

TCP: NameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{1DDB58F2-9414-4E54-AF7F-A2F49B3F32B1} : DHCPNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{61C627C6-7587-4F7D-AD24-C13F18FE17F5} : DHCPNameServer = 209.18.47.61 209.18.47.62
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\adp3awj1.default\

FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\adp3awj1.default\extensions\keyscrambler@qfx.software.corporation\components\KeyScramblerIE.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20913.0\npctrlui.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1200112.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_9_900_170.dll
FF - plugin: g:\program files\netscape6\nppl3260.dll
FF - plugin: g:\program files\netscape6\nprjplug.dll
FF - plugin: g:\program files\netscape6\nprpplugin.dll
FF - plugin: g:\program files\tracker software\pdf viewer\npPDFXCviewNPPlugin.dll
FF - ExtSQL: 2013-12-03 20:33; firefoxaddon@youtubeenhancer.com; c:\documents and settings\owner\application data\mozilla\firefox\profiles\adp3awj1.default\extensions\firefoxaddon@youtubeenhancer.com.xpi
FF - ExtSQL: 2013-12-08 17:44; {c1970c0d-dbe6-4d91-804f-c9c0de643a57}; c:\documents and settings\owner\application data\mozilla\firefox\profiles\adp3awj1.default\extensions\{c1970c0d-dbe6-4d91-804f-c9c0de643a57}.xpi
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2013-10-24 147768]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2013-10-31 222520]
R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2013-10-1 102712]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2013-9-10 27448]
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);c:\windows\system32\drivers\tdrpm251.sys [2010-5-17 902432]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [2013-11-5 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2013-11-4 209176]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2013-9-17 22840]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2013-10-31 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-8-1 193848]
R2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\common files\acronis\cdp\afcdpsrv.exe [2010-5-17 2326920]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2014\avgidsagent.exe [2013-11-11 3478544]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2014\avgwdsvc.exe [2013-9-24 348008]
R2 FileOpenManagerSvc;FileOpenManagerSvc;c:\documents and settings\all users\application data\fileopen\services\FileOpenManagerSvc32.exe [2011-3-9 212352]
R2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\hitmanpro\hmpsched.exe [2014-1-1 106280]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-2-18 418376]
R2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\enigma software group\spyhunter\SH4Service.exe [2012-1-18 737184]
R2 WLNdis50;Wireless Lan NDIS Protocol I/O Control;c:\windows\system32\drivers\WLNdis50.sys [2013-2-17 20480]
R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [2010-5-17 159168]
R3 DrvFltIp;DrvFltIp;c:\documents and settings\owner\local settings\temp\DrvFltIp [2014-1-1 29184]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2010-10-15 209016]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-12-25 22856]
R3 RTL819xp;TRENDnet Wireless N PC Card / PCI Adapter NT Driver;c:\windows\system32\drivers\rtl819xp.sys [2013-2-17 519168]
S1 avgtp;avgtp;\??\c:\windows\system32\drivers\avgtpx86.sys --> c:\windows\system32\drivers\avgtpx86.sys [?]
S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-12-25 701512]
S2 WLSVC;WLSVC;c:\program files\trendnet\tew-641pc_tew-643pi\WLSVC.exe [2013-2-17 167936]
S3 ATMFBUS;A600 USB Composite Device Driver;c:\windows\system32\drivers\ATMFBUS.sys [2011-7-10 38528]
S3 ATMFCVsp;A600 Cricket CM Port;c:\windows\system32\drivers\ATMFCVsp.sys [2011-7-10 54656]
S3 ATMFFLT;A600 USB Modem Installation CD;c:\windows\system32\drivers\ATMFFLT.sys [2011-7-10 11520]
S3 ATMFMdm;A600 Cricket EVDO Modem;c:\windows\system32\drivers\ATMFMdm.sys [2011-7-10 54528]
S3 ATMFNET;A600 Cricket EVDO Network Adapter;c:\windows\system32\drivers\ATMFNET.sys [2011-7-10 103424]
S3 ATMFNVsp;A600 Cricket NMEA Port Serial Port;c:\windows\system32\drivers\ATMFNVsp.sys [2011-7-10 54656]
S3 ATMFVsp;A600 Cricket Diagnostics Port;c:\windows\system32\drivers\ATMFVsp.sys [2011-7-10 54656]
S3 DfSdkS;Defragmentation-Service;c:\program files\ashampoo\ashampoo winoptimizer 7\DfSdkS.exe [2011-7-30 406016]
S3 esgiguard;esgiguard;c:\program files\enigma software group\spyhunter\esgiguard.sys [2011-5-6 13904]
S3 OverwolfUpdaterService;Overwolf Updater Service;c:\program files\overwolf\overwolfupdater.exe --> c:\program files\overwolf\OverwolfUpdater.exe [?]
.
=============== Created Last 30 ================
.
2014-01-01 19:41:03   --------   d-----w-   c:\documents and settings\owner\local settings\application data\RadarSync
2014-01-01 17:18:50   --------   d-----w-   c:\program files\HitmanPro
2014-01-01 17:18:15   --------   d-----w-   c:\documents and settings\all users\application data\HitmanPro
2013-12-30 16:31:08   --------   d-----w-   c:\documents and settings\owner\dwhelper
2013-12-27 03:38:58   --------   d-----w-   c:\documents and settings\all users\application data\Big Fish
2013-12-27 03:18:19   --------   d-----w-   c:\documents and settings\owner\local settings\application data\Big Fish
2013-12-27 03:18:13   --------   d-----w-   c:\documents and settings\all users\application data\BigFishCache
2013-12-24 16:59:40   --------   d-----w-   c:\documents and settings\owner\AppData
2013-12-24 16:59:25   632656   ----a-w-   c:\windows\system32\msvcr80.dll
2013-12-24 16:59:25   554832   ----a-w-   c:\windows\system32\msvcp80.dll
2013-12-24 16:59:25   479232   ----a-w-   c:\windows\system32\msvcm80.dll
2013-12-22 01:29:05   --------   d-----w-   c:\windows\ERUNT
2013-12-22 01:19:00   --------   d-----w-   C:\AdwCleaner
2013-12-08 18:45:24   --------   d-----w-   c:\documents and settings\owner\application data\AVG2014
2013-12-08 18:43:29   --------   d-----w-   c:\documents and settings\owner\application data\TuneUp Software
2013-12-08 18:42:53   --------   d--h--w-   C:\$AVG
2013-12-08 18:42:53   --------   d-----w-   c:\documents and settings\all users\application data\AVG2014
2013-12-08 18:41:48   --------   d-----w-   c:\program files\AVG
.
==================== Find3M ====================
.
2014-01-01 19:38:00   71048   -c--a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-01 19:38:00   692616   -c--a-w-   c:\windows\system32\FlashPlayerApp.exe
2013-11-13 02:59:42   150528   ----a-w-   c:\windows\system32\imagehlp.dll
2013-11-07 05:38:51   591360   ----a-w-   c:\windows\system32\rpcrt4.dll
2013-11-06 02:50:48   120600   ----a-w-   c:\windows\system32\drivers\avgdiskx.sys
2013-11-06 01:03:31   7168   ----a-w-   c:\windows\system32\xpsp4res.dll
2013-11-05 02:57:30   209176   ----a-w-   c:\windows\system32\drivers\avgidsdriverx.sys
2013-11-01 04:00:28   176952   ----a-w-   c:\windows\system32\drivers\avgldx86.sys
2013-11-01 03:30:08   222520   ----a-w-   c:\windows\system32\drivers\avglogx.sys
2013-10-30 02:26:17   1879040   ----a-w-   c:\windows\system32\win32k.sys
2013-10-29 07:57:34   920064   ----a-w-   c:\windows\system32\wininet.dll
2013-10-29 07:57:33   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2013-10-29 07:57:33   18944   ----a-w-   c:\windows\system32\corpol.dll
2013-10-29 07:57:33   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2013-10-29 00:45:02   385024   ----a-w-   c:\windows\system32\html.iec
2013-10-25 03:28:32   147768   ----a-w-   c:\windows\system32\drivers\avgidshx.sys
2013-10-23 23:45:49   172032   ----a-w-   c:\windows\system32\scrrun.dll
2013-10-12 15:56:19   278528   ----a-w-   c:\windows\system32\oakley.dll
2013-10-09 13:12:48   287744   ----a-w-   c:\windows\system32\gdi32.dll
2013-10-08 11:50:41   94632   ----a-w-   c:\windows\system32\WindowsAccessBridge.dll
2013-10-08 11:29:36   145408   ----a-w-   c:\windows\system32\javacpl.cpl
2013-04-07 11:57:04   439704   -c--a-w-   c:\program files\msgr11us.exe
2013-02-22 16:11:13   4126720   -c--a-w-   c:\program files\GUT12.tmp
.
============= FINISH: 8:55:43.00 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 5/16/2010 10:42:18 PM
System Uptime: 1/5/2014 7:43:57 AM (1 hours ago)
.
Motherboard: Hewlett-Packard | | 085Ch
Processor: Intel® Pentium® 4 CPU 3.06GHz | XU1 PROCESSOR | 3059/533mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 21.51 GiB free.
D: is CDROM (CDFS)
G: is FIXED (NTFS) - 932 GiB total, 653.022 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Broadcom NetXtreme Gigabit Ethernet for hp
Device ID: PCI\VEN_14E4&DEV_1696&SUBSYS_12BC103C&REV_03\4&3A321F38&0&10F0
Manufacturer: Broadcom
Name: Broadcom NetXtreme Gigabit Ethernet for hp
PNP Device ID: PCI\VEN_14E4&DEV_1696&SUBSYS_12BC103C&REV_03\4&3A321F38&0&10F0
Service: b57w2k
.
Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: PS/2 Compatible Mouse
Device ID: ACPI\PNP0F13\4&369939D9&0
Manufacturer: Microsoft
Name: PS/2 Compatible Mouse
PNP Device ID: ACPI\PNP0F13\4&369939D9&0
Service: i8042prt
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: avast! Firewall NDIS Filter Miniport
Device ID: ROOT\SW_ASWNDISMP\0000
Manufacturer: ALWIL Software
Name: avast! Firewall NDIS Filter Miniport
PNP Device ID: ROOT\SW_ASWNDISMP\0000
Service: aswNdis
.
==== System Restore Points ===================
.
RP646: 12/26/2013 4:24:30 PM - System Checkpoint
RP647: 12/27/2013 7:33:18 PM - System Checkpoint
RP648: 12/29/2013 9:39:55 AM - System Checkpoint
RP649: 12/29/2013 1:29:05 PM - Spybot-S&D Spyware removal
RP650: 12/30/2013 8:21:00 PM - System Checkpoint
RP651: 12/31/2013 8:45:17 PM - System Checkpoint
RP652: 1/1/2014 11:53:20 PM - System Checkpoint
RP653: 1/3/2014 12:40:22 AM - System Checkpoint
RP654: 1/4/2014 12:26:39 PM - System Checkpoint
.
==== Installed Programs ======================
.
ABBYY FineReader 6.0 Sprint
Acronis True Image Home
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Shockwave Player 12.0
Apple Application Support
Apple Software Update
Ashampoo Burning Studio 10 v.10.0.15
Ashampoo Burning Studio 2010 Advanced 9.25
Ashampoo ClipFinder HD v.2.18
Ashampoo FireWall PRO 1.14
Ashampoo Office 2008 (C:\Program Files\Ashampoo\Ashampoo Office 2008)
Ashampoo Photo Commander 7.60
Ashampoo WinOptimizer 7 v.7.26
AVG 2014
Bonjour
Broadcom Management Programs
Broadcom NetXtreme Ethernet Controller
Canasis Games (Aug 27 2006)
DAK Time Dodger PRO
DAK Wave MP3 Editor PRO v7.1b
DVD Decoder Pak for Windows XP
FileOpen Client
Format Twister PRO
FoxTab Video Converter
Free Audio Editor
Free Video to MP3 Converter version 5.0.22.128
HitmanPro 3.7
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2779562)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel® Extreme Graphics 2 Driver
iTunes
IZArc 4.1.6
Java 7 Update 45
Java Auto Updater
Java 6 Update 31
K-Lite Codec Pack 6.6.0 (Full)
KeyScrambler
Ledger
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
MotoHelper MergeModules
Mozilla Firefox 26.0 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 11 InfoTool
Nero 7 Ultra Edition
Nero Core Components 11
Nero InfoTool 11
Nero InfoTool 11 Help (CHM)
nero.prerequisites.msi
neroxml
PDF-Viewer
PFPortChecker 1.0.39
plusdeck2
Pretty Good Solitaire version 12.4.0
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2817641) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827329) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office Outlook 2007 (KB2825644) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2827330) 32-Bit Edition
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2792100)
Security Update for Windows Internet Explorer 8 (KB2797052)
Security Update for Windows Internet Explorer 8 (KB2809289)
Security Update for Windows Internet Explorer 8 (KB2817183)
Security Update for Windows Internet Explorer 8 (KB2829530)
Security Update for Windows Internet Explorer 8 (KB2846071)
Security Update for Windows Internet Explorer 8 (KB2847204)
Security Update for Windows Internet Explorer 8 (KB2862772)
Security Update for Windows Internet Explorer 8 (KB2870699)
Security Update for Windows Internet Explorer 8 (KB2879017)
Security Update for Windows Internet Explorer 8 (KB2888505)
Security Update for Windows Internet Explorer 8 (KB2898785)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB2834904-v2)
Security Update for Windows Media Player (KB2834904)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219-v2)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135-v2)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2778344)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2799494)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2808735)
Security Update for Windows XP (KB2813170)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2820197)
Security Update for Windows XP (KB2820917)
Security Update for Windows XP (KB2829361)
Security Update for Windows XP (KB2834886)
Security Update for Windows XP (KB2839229)
Security Update for Windows XP (KB2845187)
Security Update for Windows XP (KB2847311)
Security Update for Windows XP (KB2849470)
Security Update for Windows XP (KB2850851)
Security Update for Windows XP (KB2850869)
Security Update for Windows XP (KB2859537)
Security Update for Windows XP (KB2862152)
Security Update for Windows XP (KB2862330)
Security Update for Windows XP (KB2862335)
Security Update for Windows XP (KB2864063)
Security Update for Windows XP (KB2868626)
Security Update for Windows XP (KB2876217)
Security Update for Windows XP (KB2876315)
Security Update for Windows XP (KB2876331)
Security Update for Windows XP (KB2883150)
Security Update for Windows XP (KB2892075)
Security Update for Windows XP (KB2893294)
Security Update for Windows XP (KB2893984)
Security Update for Windows XP (KB2898715)
Security Update for Windows XP (KB2900986)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
SoundMAX
Spybot - Search & Destroy
SpyHunter
Submachine 3
swMSM
TetrisZone
TRENDnet TEW-641PC/TEW-643PI Wireless Cardbus/PCI Adapter
Uninstall 1.0.0.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB2863058)
Update for Windows XP (KB2904266)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB980182)
Visual Studio 2012 x86 Redistributables
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
.
==== Event Viewer Messages From Past Week ========
.
12/30/2013 6:19:26 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgtp
12/29/2013 11:14:18 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: agp440 avgtp IntelIde
12/29/2013 11:07:00 AM, error: PlugPlayManager [11] - The device Root\LEGACY_DRVFLTIP\0000 disappeared from the system without first being prepared for removal.
1/1/2014 12:12:24 PM, error: Service Control Manager [7034] - The FileOpenManagerSvc service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The SpyHunter 4 Service service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The SoundMAX Agent Service service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The NMIndexingService service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The MBAMScheduler service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The HitmanPro Scheduler service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The Acronis Scheduler2 Service service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7034] - The Acronis Nonstop Backup service service terminated unexpectedly. It has done this 1 time(s).
1/1/2014 1:02:07 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
.
==== End Of File ===========================

I went to Wikipedia to find out what a keygen was...I still don't totally understand what they are/do. If you find something that is one and I am ignorant of it, let me know so I can remove it.

Maniac · January 5, 2014

Note: Please do not run this tool without special supervision and instructions of someone authorized to do so. Otherwise, you could end up with serious problems. For more details, read this article: ComboFix usage, Questions, Help? - Look here

Please visit this webpage and read the ComboFix User's Guide:

Once you've read the article and are ready to use the program you can download it directly from the link below.
Important! - Please make sure you save combofix to your desktop and do not run it from your browser
Direct download link for: ComboFix.exe
Please make sure you disable your security applications before running ComboFix.
Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
Please copy/paste the contents or attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt
NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

Cyclops62 · January 6, 2014

About 4 years ago, I had ESET NOD32 on this machine. I uninstalled it per their instructions. Apparently it was a bad uninstall, as the log says that it is still on here and enabled. I did a search and nothing came up for anything ESET NOD32. mmmm...
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1527.974 [GMT -5:00]
Running from: c:\documents and settings\OWNER\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\OWNER\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: ESET NOD32 antivirus system 2.70 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Documents\Windows\explorer.exe
c:\documents and settings\OWNER\Recent\Thumbs.db
C:\Preallocate
c:\preallocate\Preallocate.exe
C:\VDM41.tmp
C:\VDM42.tmp
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\msssc.dll
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_LEVEL_QUALITY_WATCHER
.
.
(((((((((((((((((((((((((   Files Created from 2013-12-06 to 2014-01-06 )))))))))))))))))))))))))))))))
.
.
2014-01-01 19:41 . 2014-01-01 19:41   --------   d-----w-   c:\documents and settings\OWNER\Local Settings\Application Data\RadarSync
2014-01-01 17:18 . 2014-01-01 17:50   --------   d-----w-   c:\documents and settings\All Users\Application Data\HitmanPro
2013-12-30 16:31 . 2013-12-30 16:31   --------   d-----w-   c:\documents and settings\OWNER\dwhelper
2013-12-27 03:38 . 2013-12-27 04:46   --------   d-----w-   c:\documents and settings\All Users\Application Data\Big Fish
2013-12-27 03:18 . 2013-12-27 03:39   --------   d-----w-   c:\documents and settings\OWNER\Local Settings\Application Data\Big Fish
2013-12-27 03:18 . 2013-12-27 04:46   --------   d-----w-   c:\documents and settings\All Users\Application Data\BigFishCache
2013-12-24 16:59 . 2013-12-24 16:59   --------   d-----w-   c:\documents and settings\OWNER\AppData
2013-12-24 16:59 . 2013-09-30 15:53   632656   ----a-w-   c:\windows\system32\msvcr80.dll
2013-12-24 16:59 . 2013-09-30 15:53   554832   ----a-w-   c:\windows\system32\msvcp80.dll
2013-12-24 16:59 . 2013-09-30 15:53   479232   ----a-w-   c:\windows\system32\msvcm80.dll
2013-12-22 01:29 . 2013-12-22 01:29   --------   d-----w-   c:\windows\ERUNT
2013-12-22 01:19 . 2014-01-02 02:49   --------   d-----w-   C:\AdwCleaner
2013-12-08 18:45 . 2013-12-08 18:45   --------   d-----w-   c:\documents and settings\OWNER\Application Data\AVG2014
2013-12-08 18:43 . 2013-12-08 18:43   --------   d-----w-   c:\documents and settings\OWNER\Application Data\TuneUp Software
2013-12-08 18:42 . 2013-12-08 18:43   --------   d-----w-   c:\documents and settings\All Users\Application Data\AVG2014
2013-12-08 18:42 . 2013-12-08 18:42   --------   d-----w-   C:\$AVG
2013-12-08 18:41 . 2013-12-08 18:41   --------   d-----w-   c:\program files\AVG
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-01 19:38 . 2012-04-04 15:25   692616   -c--a-w-   c:\windows\system32\FlashPlayerApp.exe
2014-01-01 19:38 . 2011-05-20 18:14   71048   -c--a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-01 17:15 . 2014-01-01 17:15   5376   ----a-w-   c:\windows\system32\drivers\usbd.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   32384   ----a-w-   c:\windows\system32\drivers\usbccgp.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   30336   ----a-w-   c:\windows\system32\drivers\usbehci.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   14976   ----a-w-   c:\windows\system32\drivers\usbscan.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   144128   ----a-w-   c:\windows\system32\drivers\usbport.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   71168   ----a-w-   c:\windows\system32\drivers\dxg.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   25088   ----a-w-   c:\windows\system32\drivers\hidparse.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   27448   ----a-w-   c:\windows\system32\drivers\avgrkx86.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   22840   ----a-w-   c:\windows\system32\drivers\avgidsshimx.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   222520   ----a-w-   c:\windows\system32\drivers\avglogx.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   193848   ----a-w-   c:\windows\system32\drivers\avgtdix.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   176952   ----a-w-   c:\windows\system32\drivers\avgldx86.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   102712   ----a-w-   c:\windows\system32\drivers\avgmfx86.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   209176   ----a-w-   c:\windows\system32\drivers\avgidsdriverx.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   147768   ----a-w-   c:\windows\system32\drivers\avgidshx.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   120600   ----a-w-   c:\windows\system32\drivers\avgdiskx.sys.bak
2013-11-13 02:59 . 2008-04-14 10:41   150528   ----a-w-   c:\windows\system32\imagehlp.dll
2013-11-07 05:38 . 2008-04-14 10:42   591360   ----a-w-   c:\windows\system32\rpcrt4.dll
2013-11-06 02:50 . 2013-11-06 02:50   120600   ----a-w-   c:\windows\system32\drivers\avgdiskx.sys
2013-11-06 01:03 . 2010-05-17 14:31   7168   ----a-w-   c:\windows\system32\xpsp4res.dll
2013-11-05 02:57 . 2013-11-05 02:57   209176   ----a-w-   c:\windows\system32\drivers\avgidsdriverx.sys
2013-11-01 04:00 . 2013-11-01 04:00   176952   ----a-w-   c:\windows\system32\drivers\avgldx86.sys
2013-11-01 03:30 . 2013-11-01 03:30   222520   ----a-w-   c:\windows\system32\drivers\avglogx.sys
2013-10-31 07:45 . 2013-02-22 16:01   236840   ----a-w-   c:\windows\system32\aswBoot.exe
2013-10-30 02:26 . 2008-04-14 06:00   1879040   ----a-w-   c:\windows\system32\win32k.sys
2013-10-29 07:57 . 2008-04-14 10:42   920064   ----a-w-   c:\windows\system32\wininet.dll
2013-10-29 07:57 . 2008-04-14 10:42   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2013-10-29 07:57 . 2008-04-14 10:41   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2013-10-29 07:57 . 2008-04-14 10:41   18944   ----a-w-   c:\windows\system32\corpol.dll
2013-10-29 00:45 . 2008-04-14 05:07   385024   ----a-w-   c:\windows\system32\html.iec
2013-10-25 03:28 . 2013-10-25 03:28   147768   ----a-w-   c:\windows\system32\drivers\avgidshx.sys
2013-10-23 23:45 . 2008-04-14 10:42   172032   ----a-w-   c:\windows\system32\scrrun.dll
2013-10-12 15:56 . 2008-04-14 10:42   278528   ----a-w-   c:\windows\system32\oakley.dll
2013-10-09 13:12 . 2008-04-14 10:41   287744   ----a-w-   c:\windows\system32\gdi32.dll
2013-10-08 11:50 . 2013-10-19 16:00   94632   ----a-w-   c:\windows\system32\WindowsAccessBridge.dll
2013-10-08 11:29 . 2012-03-22 16:49   145408   ----a-w-   c:\windows\system32\javacpl.cpl
2013-04-07 11:57 . 2013-04-07 11:56   439704   -c--a-w-   c:\program files\msgr11us.exe
2013-02-22 16:11 . 2013-02-22 16:11   4126720   -c--a-w-   c:\program files\GUT12.tmp
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2009-09-12 357384]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"Ashampoo FireWall PRO"="c:\program files\Ashampoo\Ashampoo FireWall PRO\FireWall.exe" [2006-12-21 3543552]
"TkBellExe"="g:\program files\update\realsched.exe" [2012-05-18 296056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2013-11-08 4956176]
"KeyScrambler"="c:\program files\KeyScrambler\keyscrambler.exe" [2013-11-14 508144]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OABNAEUASAAtAFIAWQBHAEEANAAtAFAAUABCAFIAOAAtAFcAUQBWADcAQQAtADcAOABVADIAOQAtADgARQBNAEIAUgA&inst=NwA2AC0ANQAxADcANAAyADcANgA4ADgALQBYAE8AMwA2ACsAMQAtAEQAMwA4ADEATAArADUALQBQAEwAKwA5AC0ATgAxAEQAKwAxAA∏=52&ver=9.0.872" [?]
.
c:\documents and settings\OWNER\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Wireless Configuration Utility.lnk - c:\program files\TRENDnet\TEW-641PC_TEW-643PI\WlanCU.exe [2013-2-17 368640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ     autocheck autochk *\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-11-18 01:59   421160   -c--a-w-   c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 16:17   421888   -c--a-w-   c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-09-12 20:30   5048488   -c--a-w-   c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Torrentprivacy\\SSHTunel.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [10/24/2013 10:28 PM 147768]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [10/31/2013 10:30 PM 222520]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/10/2013 12:43 AM 27448]
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);c:\windows\system32\drivers\tdrpm251.sys [5/17/2010 8:05 AM 902432]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [11/5/2013 9:50 PM 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [11/4/2013 9:57 PM 209176]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [9/17/2013 12:57 AM 22840]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/31/2013 11:00 PM 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [8/1/2013 4:08 PM 193848]
R2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [5/17/2010 8:05 AM 2326920]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [9/24/2013 1:33 AM 348008]
R2 FileOpenManagerSvc;FileOpenManagerSvc;c:\documents and settings\All Users\Application Data\FileOpen\Services\FileOpenManagerSvc32.exe [3/9/2011 5:02 PM 212352]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2/18/2013 3:59 PM 418376]
R2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\Enigma Software Group\SpyHunter\SH4Service.exe [1/18/2012 5:21 AM 737184]
R2 WLNdis50;Wireless Lan NDIS Protocol I/O Control;c:\windows\system32\drivers\WLNdis50.sys [2/17/2013 2:01 PM 20480]
R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [5/17/2010 8:05 AM 159168]
R3 DrvFltIp;DrvFltIp;c:\documents and settings\OWNER\Local Settings\temp\DrvFltIp [1/5/2014 6:59 PM 29184]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [10/15/2010 5:10 PM 209016]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/25/2010 12:06 PM 22856]
R3 RTL819xp;TRENDnet Wireless N PC Card / PCI Adapter NT Driver;c:\windows\system32\drivers\rtl819xp.sys [2/17/2013 2:01 PM 519168]
S1 avgtp;avgtp;\??\c:\windows\system32\drivers\avgtpx86.sys --> c:\windows\system32\drivers\avgtpx86.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [11/11/2013 10:02 PM 3478544]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/25/2010 12:06 PM 701512]
S2 WLSVC;WLSVC;c:\program files\TRENDnet\TEW-641PC_TEW-643PI\WLSVC.exe [2/17/2013 2:01 PM 167936]
S3 ATMFBUS;A600 USB Composite Device Driver;c:\windows\system32\drivers\ATMFBUS.sys [7/10/2011 8:07 AM 38528]
S3 ATMFCVsp;A600 Cricket CM Port;c:\windows\system32\drivers\ATMFCVsp.sys [7/10/2011 8:07 AM 54656]
S3 ATMFFLT;A600 USB Modem Installation CD;c:\windows\system32\drivers\ATMFFLT.sys [7/10/2011 8:07 AM 11520]
S3 ATMFMdm;A600 Cricket EVDO Modem;c:\windows\system32\drivers\ATMFMdm.sys [7/10/2011 8:07 AM 54528]
S3 ATMFNET;A600 Cricket EVDO Network Adapter;c:\windows\system32\drivers\ATMFNET.sys [7/10/2011 8:07 AM 103424]
S3 ATMFNVsp;A600 Cricket NMEA Port Serial Port;c:\windows\system32\drivers\ATMFNVsp.sys [7/10/2011 8:07 AM 54656]
S3 ATMFVsp;A600 Cricket Diagnostics Port;c:\windows\system32\drivers\ATMFVsp.sys [7/10/2011 8:07 AM 54656]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 7\DfSdkS.exe [7/30/2011 1:19 PM 406016]
S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [5/6/2011 2:57 PM 13904]
S3 OverwolfUpdaterService;Overwolf Updater Service;c:\program files\Overwolf\OverwolfUpdater.exe --> c:\program files\Overwolf\OverwolfUpdater.exe [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
Contents of the 'Scheduled Tasks' folder
.
2014-01-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 19:38]
.
2014-01-05 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1123561945-152049171-1606980848-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 22:21]
.
2014-01-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1123561945-152049171-1606980848-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 22:21]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
FF - ProfilePath - c:\documents and settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)

FF - ExtSQL: 2013-12-03 20:33; firefoxaddon@youtubeenhancer.com; c:\documents and settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\firefoxaddon@youtubeenhancer.com.xpi
FF - ExtSQL: 2013-12-08 17:44; {c1970c0d-dbe6-4d91-804f-c9c0de643a57}; c:\documents and settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{c1970c0d-dbe6-4d91-804f-c9c0de643a57}.xpi
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Preallocate.exe - c:\preallocate\Preallocate.exe
HKLM-Run-Wondershare Helper Compact.exe - c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-Run-Smapp - c:\program files\Analog Devices\SoundMAX\SMTray.exe
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-TkBellExe - c:\program files\real\realplayer\update\realsched.exe
AddRemove-RealPlayer 15.0 - g:\program files\Update\r1puninst.exe
AddRemove-Uninstall_is1 - c:\program files\Common Files\DVDVideoSoft\unins000.exe
AddRemove-FoxTab Video Converter - c:\program files\FoxTabVideoConverter\Uninstall\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-01-05 18:59
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ASFWHide]
"ImagePath"="\??\c:\documents and settings\OWNER\Local Settings\TEMP\ASFWHide"
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\DrvFltIp]
"ImagePath"="\??\c:\documents and settings\OWNER\Local Settings\TEMP\DrvFltIp"
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\TrueSight]
"ImagePath"="\??\"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1048)
c:\program files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
.
- - - - - - - > 'lsass.exe'(1104)
c:\program files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
.
- - - - - - - > 'explorer.exe'(1852)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
- - - - - - - > 'csrss.exe'(1024)
c:\program files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Completion time: 2014-01-05 19:04:21 - machine was rebooted
ComboFix-quarantined-files.txt 2014-01-06 00:04
.
Pre-Run: 22,913,916,928 bytes free
Post-Run: 23,023,386,624 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 327A6399385DB7356EE64854A75BD6A7
8F558EB6672622401DA993E1E865C861

Maniac · January 6, 2014

I saw it and will get rid of it.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

SecCenter::
AV: ESET NOD32 antivirus system 2.70 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
JavaClearCache::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Cyclops62 · January 6, 2014

ComboFix 14-01-04.03 - OWNER 01/06/2014 13:30:50.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1527.1062 [GMT -5:00]
Running from: c:\documents and settings\OWNER\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\OWNER\Desktop\CFScript.txt
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
(((((((((((((((((((((((((   Files Created from 2013-12-06 to 2014-01-06 )))))))))))))))))))))))))))))))
.
.
2014-01-01 19:41 . 2014-01-01 19:41   --------   d-----w-   c:\documents and settings\OWNER\Local Settings\Application Data\RadarSync
2014-01-01 17:18 . 2014-01-01 17:50   --------   d-----w-   c:\documents and settings\All Users\Application Data\HitmanPro
2013-12-30 16:31 . 2013-12-30 16:31   --------   d-----w-   c:\documents and settings\OWNER\dwhelper
2013-12-27 03:38 . 2013-12-27 04:46   --------   d-----w-   c:\documents and settings\All Users\Application Data\Big Fish
2013-12-27 03:18 . 2013-12-27 03:39   --------   d-----w-   c:\documents and settings\OWNER\Local Settings\Application Data\Big Fish
2013-12-27 03:18 . 2013-12-27 04:46   --------   d-----w-   c:\documents and settings\All Users\Application Data\BigFishCache
2013-12-24 16:59 . 2013-12-24 16:59   --------   d-----w-   c:\documents and settings\OWNER\AppData
2013-12-24 16:59 . 2013-09-30 15:53   632656   ----a-w-   c:\windows\system32\msvcr80.dll
2013-12-24 16:59 . 2013-09-30 15:53   554832   ----a-w-   c:\windows\system32\msvcp80.dll
2013-12-24 16:59 . 2013-09-30 15:53   479232   ----a-w-   c:\windows\system32\msvcm80.dll
2013-12-22 01:29 . 2013-12-22 01:29   --------   d-----w-   c:\windows\ERUNT
2013-12-22 01:19 . 2014-01-02 02:49   --------   d-----w-   C:\AdwCleaner
2013-12-08 18:45 . 2013-12-08 18:45   --------   d-----w-   c:\documents and settings\OWNER\Application Data\AVG2014
2013-12-08 18:43 . 2013-12-08 18:43   --------   d-----w-   c:\documents and settings\OWNER\Application Data\TuneUp Software
2013-12-08 18:42 . 2013-12-08 18:43   --------   d-----w-   c:\documents and settings\All Users\Application Data\AVG2014
2013-12-08 18:42 . 2013-12-08 18:42   --------   d-----w-   C:\$AVG
2013-12-08 18:41 . 2013-12-08 18:41   --------   d-----w-   c:\program files\AVG
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-01 19:38 . 2012-04-04 15:25   692616   -c--a-w-   c:\windows\system32\FlashPlayerApp.exe
2014-01-01 19:38 . 2011-05-20 18:14   71048   -c--a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-01 17:15 . 2014-01-01 17:15   5376   ----a-w-   c:\windows\system32\drivers\usbd.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   32384   ----a-w-   c:\windows\system32\drivers\usbccgp.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   30336   ----a-w-   c:\windows\system32\drivers\usbehci.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   14976   ----a-w-   c:\windows\system32\drivers\usbscan.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   144128   ----a-w-   c:\windows\system32\drivers\usbport.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   71168   ----a-w-   c:\windows\system32\drivers\dxg.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   25088   ----a-w-   c:\windows\system32\drivers\hidparse.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   27448   ----a-w-   c:\windows\system32\drivers\avgrkx86.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   22840   ----a-w-   c:\windows\system32\drivers\avgidsshimx.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   222520   ----a-w-   c:\windows\system32\drivers\avglogx.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   193848   ----a-w-   c:\windows\system32\drivers\avgtdix.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   176952   ----a-w-   c:\windows\system32\drivers\avgldx86.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   102712   ----a-w-   c:\windows\system32\drivers\avgmfx86.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   209176   ----a-w-   c:\windows\system32\drivers\avgidsdriverx.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   147768   ----a-w-   c:\windows\system32\drivers\avgidshx.sys.bak
2014-01-01 17:15 . 2014-01-01 17:15   120600   ----a-w-   c:\windows\system32\drivers\avgdiskx.sys.bak
2013-11-13 02:59 . 2008-04-14 10:41   150528   ----a-w-   c:\windows\system32\imagehlp.dll
2013-11-07 05:38 . 2008-04-14 10:42   591360   ----a-w-   c:\windows\system32\rpcrt4.dll
2013-11-06 02:50 . 2013-11-06 02:50   120600   ----a-w-   c:\windows\system32\drivers\avgdiskx.sys
2013-11-06 01:03 . 2010-05-17 14:31   7168   ----a-w-   c:\windows\system32\xpsp4res.dll
2013-11-05 02:57 . 2013-11-05 02:57   209176   ----a-w-   c:\windows\system32\drivers\avgidsdriverx.sys
2013-11-01 04:00 . 2013-11-01 04:00   176952   ----a-w-   c:\windows\system32\drivers\avgldx86.sys
2013-11-01 03:30 . 2013-11-01 03:30   222520   ----a-w-   c:\windows\system32\drivers\avglogx.sys
2013-10-31 07:45 . 2013-02-22 16:01   236840   ----a-w-   c:\windows\system32\aswBoot.exe
2013-10-30 02:26 . 2008-04-14 06:00   1879040   ----a-w-   c:\windows\system32\win32k.sys
2013-10-29 07:57 . 2008-04-14 10:42   920064   ----a-w-   c:\windows\system32\wininet.dll
2013-10-29 07:57 . 2008-04-14 10:42   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2013-10-29 07:57 . 2008-04-14 10:41   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2013-10-29 07:57 . 2008-04-14 10:41   18944   ----a-w-   c:\windows\system32\corpol.dll
2013-10-29 00:45 . 2008-04-14 05:07   385024   ----a-w-   c:\windows\system32\html.iec
2013-10-25 03:28 . 2013-10-25 03:28   147768   ----a-w-   c:\windows\system32\drivers\avgidshx.sys
2013-10-23 23:45 . 2008-04-14 10:42   172032   ----a-w-   c:\windows\system32\scrrun.dll
2013-10-12 15:56 . 2008-04-14 10:42   278528   ----a-w-   c:\windows\system32\oakley.dll
2013-10-09 13:12 . 2008-04-14 10:41   287744   ----a-w-   c:\windows\system32\gdi32.dll
2013-04-07 11:57 . 2013-04-07 11:56   439704   -c--a-w-   c:\program files\msgr11us.exe
2013-02-22 16:11 . 2013-02-22 16:11   4126720   -c--a-w-   c:\program files\GUT12.tmp
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2009-09-12 357384]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"Ashampoo FireWall PRO"="c:\program files\Ashampoo\Ashampoo FireWall PRO\FireWall.exe" [2006-12-21 3543552]
"TkBellExe"="g:\program files\update\realsched.exe" [2012-05-18 296056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2013-11-08 4956176]
"KeyScrambler"="c:\program files\KeyScrambler\keyscrambler.exe" [2013-11-14 508144]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OABNAEUASAAtAFIAWQBHAEEANAAtAFAAUABCAFIAOAAtAFcAUQBWADcAQQAtADcAOABVADIAOQAtADgARQBNAEIAUgA&inst=NwA2AC0ANQAxADcANAAyADcANgA4ADgALQBYAE8AMwA2ACsAMQAtAEQAMwA4ADEATAArADUALQBQAEwAKwA5AC0ATgAxAEQAKwAxAA∏=52&ver=9.0.872" [?]
.
c:\documents and settings\OWNER\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Wireless Configuration Utility.lnk - c:\program files\TRENDnet\TEW-641PC_TEW-643PI\WlanCU.exe [2013-2-17 368640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ     autocheck autochk *\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-11-18 01:59   421160   -c--a-w-   c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 16:17   421888   -c--a-w-   c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-09-12 20:30   5048488   -c--a-w-   c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Torrentprivacy\\SSHTunel.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [10/24/2013 10:28 PM 147768]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [10/31/2013 10:30 PM 222520]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/10/2013 12:43 AM 27448]
R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);c:\windows\system32\drivers\tdrpm251.sys [5/17/2010 8:05 AM 902432]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [11/5/2013 9:50 PM 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [11/4/2013 9:57 PM 209176]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [9/17/2013 12:57 AM 22840]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/31/2013 11:00 PM 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [8/1/2013 4:08 PM 193848]
R2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [5/17/2010 8:05 AM 2326920]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [9/24/2013 1:33 AM 348008]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2/18/2013 3:59 PM 418376]
R2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\Enigma Software Group\SpyHunter\SH4Service.exe [1/18/2012 5:21 AM 737184]
R2 WLNdis50;Wireless Lan NDIS Protocol I/O Control;c:\windows\system32\drivers\WLNdis50.sys [2/17/2013 2:01 PM 20480]
R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [5/17/2010 8:05 AM 159168]
R3 DrvFltIp;DrvFltIp;\??\c:\documents and settings\OWNER\Local Settings\TEMP\DrvFltIp --> c:\documents and settings\OWNER\Local Settings\TEMP\DrvFltIp [?]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [10/15/2010 5:10 PM 209016]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/25/2010 12:06 PM 22856]
R3 RTL819xp;TRENDnet Wireless N PC Card / PCI Adapter NT Driver;c:\windows\system32\drivers\rtl819xp.sys [2/17/2013 2:01 PM 519168]
S1 avgtp;avgtp;\??\c:\windows\system32\drivers\avgtpx86.sys --> c:\windows\system32\drivers\avgtpx86.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [11/11/2013 10:02 PM 3478544]
S2 FileOpenManagerSvc;FileOpenManagerSvc;c:\documents and settings\All Users\Application Data\FileOpen\Services\FileOpenManagerSvc32.exe [3/9/2011 5:02 PM 212352]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/25/2010 12:06 PM 701512]
S2 WLSVC;WLSVC;c:\program files\TRENDnet\TEW-641PC_TEW-643PI\WLSVC.exe [2/17/2013 2:01 PM 167936]
S3 ATMFBUS;A600 USB Composite Device Driver;c:\windows\system32\drivers\ATMFBUS.sys [7/10/2011 8:07 AM 38528]
S3 ATMFCVsp;A600 Cricket CM Port;c:\windows\system32\drivers\ATMFCVsp.sys [7/10/2011 8:07 AM 54656]
S3 ATMFFLT;A600 USB Modem Installation CD;c:\windows\system32\drivers\ATMFFLT.sys [7/10/2011 8:07 AM 11520]
S3 ATMFMdm;A600 Cricket EVDO Modem;c:\windows\system32\drivers\ATMFMdm.sys [7/10/2011 8:07 AM 54528]
S3 ATMFNET;A600 Cricket EVDO Network Adapter;c:\windows\system32\drivers\ATMFNET.sys [7/10/2011 8:07 AM 103424]
S3 ATMFNVsp;A600 Cricket NMEA Port Serial Port;c:\windows\system32\drivers\ATMFNVsp.sys [7/10/2011 8:07 AM 54656]
S3 ATMFVsp;A600 Cricket Diagnostics Port;c:\windows\system32\drivers\ATMFVsp.sys [7/10/2011 8:07 AM 54656]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 7\DfSdkS.exe [7/30/2011 1:19 PM 406016]
S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [5/6/2011 2:57 PM 13904]
S3 OverwolfUpdaterService;Overwolf Updater Service;c:\program files\Overwolf\OverwolfUpdater.exe --> c:\program files\Overwolf\OverwolfUpdater.exe [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - FileOpenWebPublisherScreenHookDriver
.
Contents of the 'Scheduled Tasks' folder
.
2014-01-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 19:38]
.
2014-01-06 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1123561945-152049171-1606980848-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 22:21]
.
2014-01-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1123561945-152049171-1606980848-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 22:21]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
FF - ProfilePath - c:\documents and settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)

FF - ExtSQL: 2013-12-03 20:33; firefoxaddon@youtubeenhancer.com; c:\documents and settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\firefoxaddon@youtubeenhancer.com.xpi
FF - ExtSQL: 2013-12-08 17:44; {c1970c0d-dbe6-4d91-804f-c9c0de643a57}; c:\documents and settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{c1970c0d-dbe6-4d91-804f-c9c0de643a57}.xpi
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-01-06 13:36
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ASFWHide]
"ImagePath"="\??\c:\documents and settings\OWNER\Local Settings\TEMP\ASFWHide"
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\DrvFltIp]
"ImagePath"="\??\c:\documents and settings\OWNER\Local Settings\TEMP\DrvFltIp"
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\TrueSight]
"ImagePath"="\??\"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1044)
c:\program files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
.
- - - - - - - > 'lsass.exe'(1100)
c:\program files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
.
- - - - - - - > 'explorer.exe'(4160)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
- - - - - - - > 'csrss.exe'(1020)
c:\program files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
.
Completion time: 2014-01-06 13:38:49
ComboFix-quarantined-files.txt 2014-01-06 18:38
ComboFix2.txt 2014-01-06 00:04
.
Pre-Run: 22,876,418,048 bytes free
Post-Run: 22,866,800,640 bytes free
.
- - End Of File - - 55C58C86D8069033790F32645E31508D
8F558EB6672622401DA993E1E865C861

Maniac · January 7, 2014

Please scan your machine with ESET OnlineScan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer.
  Save it to your Desktop.
- Double click on the to download the ESET Smart Installer. icon on your Desktop.
Check "YES, I accept the Terms of Use."
Click the Start button.
Accept any security warnings from your browser.
Under Scan Settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
- Scan potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

Cyclops62 · January 8, 2014

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\myPCBackup1.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\myPCBackup2.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
C:\Documents and Settings\OWNER\My Documents\Downloads\SuperMp3Download-4.6.3.8.Setup.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
C:\Program Files\Common Files\DVDVideoSoft\AskTB\ApnIC.dll   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined
C:\Program Files\Common Files\DVDVideoSoft\AskTB\ApnToolbarInstaller.exe   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined
C:\Program Files\Common Files\DVDVideoSoft\AskTB\DVDVideoSoftToolbar.exe   multiple threats   cleaned by deleting - quarantined
C:\Program Files\FoxTabVideoConverter\VideoConverter.exe   a variant of Win32/InstallCore.A application   cleaned by deleting - quarantined
C:\Program Files\PFPrtChecker\PFPortChecker.exe   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined
C:\Program Files\Uninstaller\Uninstall.exe   a variant of MSIL/DomaIQ.A application   cleaned by deleting - quarantined
C:\System Volume Information\_restore{78A41278-3896-4F9C-9128-ECE1BC510662}\RP654\A0348051.exe   Win32/MyPCBackup.A application   cleaned by deleting - quarantined
C:\WINDOWS\system32\Adobe\Shockwave 12\gt.exe   Win32/Bundled.Toolbar.Google.D application   cleaned by deleting - quarantined
G:\Ashampoo\ashampoo_anti-malware_1.21_sm.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\Ashampoo\ashampoo_burning_studio_2010_advanced_9.24_7733.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\Ashampoo\ashampoo_clipfinder_hd_e2.18_sm.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\Ashampoo\ashampoo_home_designer_1.0.0_7740.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\Ashampoo\ashampoo_office2008_310_sm.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\Ashampoo\ashampoo_photo_commander_7_7.60_7747.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\Ashampoo\ashampoo_snap_3_3.50_7754.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\Ashampoo\ashampoo_winoptimizer_7_7.17_sm.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\Downloads\frostwire-5.2.11.windows.exe   multiple threats   cleaned by deleting - quarantined
G:\Downloads\PFPortChecker1.0.39.exe   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined
G:\Firefox stuff\Shockwave_Installer_Slim.exe   Win32/Bundled.Toolbar.Google.D application   cleaned by deleting - quarantined
G:\FirefoxNew Folder\BitTorrent-6.4.exe   multiple threats   cleaned by deleting - quarantined
G:\FirefoxNew Folder\FreeVideoToMP3Converter.exe   multiple threats   cleaned by deleting - quarantined
G:\FirefoxNew Folder\IZArc4.1.6.exe   Win32/OpenCandy application   cleaned by deleting - quarantined
G:\Games\maroonedv2_at.exe   a variant of Win32/Bundled.Toolbar.Ask.A application   cleaned by deleting - quarantined
G:\Games\submachine6_at_tb1.exe   a variant of Win32/Bundled.Toolbar.Ask.A application   cleaned by deleting - quarantined
G:\Games\thefogfall3_at_tb2.exe   a variant of Win32/Bundled.Toolbar.Ask.A application   cleaned by deleting - quarantined
G:\My Downloads\FreeAudioConverter.exe   a variant of Win32/Toolbar.Conduit.B application   cleaned by deleting - quarantined
G:\My Downloads\pf-setup-en.exe   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined
G:\My Pictures\New Folder\6\Setup.exe   a variant of Win32/ExFriendAlert.B application   cleaned by deleting - quarantined
G:\My Videos\FreeMP4VideoConverter.exe   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined
G:\My Videos\FreeVideoToMP3Converter.exe   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined
G:\PDF stuff\PDFXVwer.exe   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined
G:\Techie stuff\PFPortChecker.exe   a variant of Win32/Bundled.Toolbar.Ask application   cleaned by deleting - quarantined

Maniac · January 9, 2014

Please download the Kaspersky Virus Removal Tool from here to your Desktop.

Double-click the Removal Tool.

Click the cog in the upper right corner:

Select down to and including your main drive.

Once done please select the Automatic Scan tab and press Start Scan.

Allow AVP to delete all infections found.

Once it has finished select the Report tab.

Select the Detected threats report from the left and press the Save button.

Save it to your Desktop and post the contents in your next reply.

Cyclops62 · January 11, 2014

Hi..this was a very difficult thing for me to do. It took me a total of 6 hours to finally download the tool. At first I was constantly redirected almost immediately away from Kaspersky's page, then all I received was a PART file, not the whole file. (Mostly all of the redirects take me to a site "shopping-guides-online"). After 2 hours (44%) it stopped! And my 'puter, too. I had to reboot to run it again. No trace of tool. Hours later I finally got it again, reran it and found NOTHING in the detected threats reports! In any of the catagories they list. I have attached the full log. `1-10-14.zip

Maniac · January 12, 2014

How are things now?

Cyclops62 · January 12, 2014

It is better. Some sites are bad, though. I visit Craigslist often. It is bad for the rollups from the bottom of the page. There are also things like words will be a different color, or will be underlined. When I run the cursor over them, something will pop-up from it. All of them are Ad related, from what they are saying.

Firefox will catch over half of the redirects now, too.

Maniac · January 12, 2014

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Please tick the Scan All users. Next, click the Quick Scan button. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

Cyclops62 · January 12, 2014

OTL Extras logfile created on: 1/12/2014 11:14:59 AM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\OWNER\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.49 Gb Total Physical Memory | 0.97 Gb Available Physical Memory | 65.20% Memory free
2.09 Gb Paging File | 1.55 Gb Available in Paging File | 74.24% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 21.11 Gb Free Space | 56.65% Space Free | Partition Type: NTFS
Drive G: | 931.51 Gb Total Space | 652.82 Gb Free Space | 70.08% Space Free | Partition Type: NTFS

Computer Name: HP-05E77DB9975B | User Name: OWNER | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1123561945-152049171-1606980848-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htafile [open] -- "%1" %*
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe" = C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home -- (Nero AG)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service -- (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Torrentprivacy\SSHTunel.exe" = C:\Torrentprivacy\SSHTunel.exe:*:Enabled:SSHTunel -- ($h@d0W's Software)
"C:\Program Files\AVG\AVG2014\avgnsx.exe" = C:\Program Files\AVG\AVG2014\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2014\avgdiagex.exe" = C:\Program Files\AVG\AVG2014\avgdiagex.exe:*:Enabled:AVG Diagnostics 2014 -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2014\avgmfapx.exe" = C:\Program Files\AVG\AVG2014\avgmfapx.exe:*:Enabled:AVG Installer -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2014\avgemcx.exe" = C:\Program Files\AVG\AVG2014\avgemcx.exe:*:Enabled:Personal Email Scanner -- (AVG Technologies CZ, s.r.o.)
"C:\WINDOWS\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox -- (Mozilla Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi
"{0984EA04-EB2C-4AC4-BD0B-94115A48C19E}" = Ledger
"{0C14B653-ED68-4BA3-B28B-9D84DC824531}" = DAK Wave MP3 Editor PRO v7.1b
"{0F17B47D-2205-403D-A2BA-7351B41A8D5D}" = Format Twister PRO
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217040FF}" = Java 7 Update 45
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B97ADB7-3DA1-4964-BC10-68384BA6A66F}" = AVG 2014
"{44DA018D-8AE5-4566-96A4-89E4B4E9C4C0}" = DAK Time Dodger PRO
"{49AEFEAB-A10B-4E8E-B577-2287ACA2B8AF}" = AVG 2014
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E0C6314-A8B8-4026-AC15-084E8B63AFB5}" = SpyHunter
"{4F75616F-49C7-4EA2-8725-7E1A7AB1949C}" = Nero InfoTool 11 Help (CHM)
"{52E225FC-FCB4-41F7-837B-6E37FB05BD7B}" = Adobe AIR
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{64BEF779-5053-48AF-A3D8-B70EBC1C70E7}" = Nero 11 InfoTool
"{6F3D2F66-F050-45E3-BEB1-6523FE6D6690}" = MotoHelper MergeModules
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{7BB045C3-D5E4-4620-B536-DC11AACD5942}" = Broadcom Management Programs
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92C5DB3D-9D6F-4324-BB11-57825F4C2635}" = DVD Decoder Pak for Windows XP
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.6
"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7125C46-3974-4268-BA37-CCA93DF83D93}" = TetrisZone
"{A90E924E-1B35-44B0-978E-3F6F89FBC960}" = Nero InfoTool 11
"{A9A1B8A2-D2EC-4A05-951D-7E337B07B5C3}" = TRENDnet TEW-641PC/TEW-643PI Wireless Cardbus/PCI Adapter
"{ABC082A6-A587-493C-83C1-5F2C60A8BAA8}" = FileOpen Client
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2F1F96A-057E-5819-B52E-FEA1D1D2933B}" = Acronis True Image Home
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF097717-F174-4144-954A-FBC4BF301033}" = Nero 7 Ultra Edition
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F870B987-18BC-45FC-9BE8-35C02DCDA10F}" = Broadcom NetXtreme Ethernet Controller
"{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"Ashampoo Burning Studio 10_is1" = Ashampoo Burning Studio 10 v.10.0.15
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced 9.25
"Ashampoo ClipFinder HD_is1" = Ashampoo ClipFinder HD v.2.18
"Ashampoo FireWall PRO_is1" = Ashampoo FireWall PRO 1.14
"Ashampoo Photo Commander 7_is1" = Ashampoo Photo Commander 7.60
"Ashampoo WinOptimizer 7_is1" = Ashampoo WinOptimizer 7 v.7.26
"AVG" = AVG 2014
"Canasis Games_is1" = Canasis Games (Aug 27 2006)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"Free Audio Editor" = Free Audio Editor
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 5.0.22.128
"ie8" = Windows Internet Explorer 8
"KeyScrambler" = KeyScrambler
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.6.0 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 26.0 (x86 en-US)" = Mozilla Firefox 26.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PFPortChecker" = PFPortChecker 1.0.39
"plusdeck23.25c" = plusdeck2
"Pretty Good Solitaire_is1" = Pretty Good Solitaire version 12.4.0
"sm-un1.u32" = Ashampoo Office 2008 (C:\Program Files\Ashampoo\Ashampoo Office 2008)
"Submachine 3_is1" = Submachine 3
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1123561945-152049171-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 1/9/2014 8:47:27 AM | Computer Name = HP-05E77DB9975B | Source = Application Hang | ID = 1002
Description = Hanging application notepad.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/9/2014 6:07:30 PM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/9/2014 6:07:30 PM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/9/2014 6:07:31 PM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved

Error - 1/9/2014 7:28:27 PM | Computer Name = HP-05E77DB9975B | Source = Application Hang | ID = 1002
Description = Hanging application notepad.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/9/2014 7:28:38 PM | Computer Name = HP-05E77DB9975B | Source = Application Hang | ID = 1002
Description = Hanging application notepad.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/11/2014 10:47:43 AM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/11/2014 10:47:43 AM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/11/2014 11:45:53 PM | Computer Name = HP-05E77DB9975B | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x0ea2ad80.

Error - 1/11/2014 11:45:58 PM | Computer Name = HP-05E77DB9975B | Source = Application Error | ID = 1001
Description = Fault bucket 07218653.

[ Application Events ]
Error - 1/9/2014 8:47:27 AM | Computer Name = HP-05E77DB9975B | Source = Application Hang | ID = 1002
Description = Hanging application notepad.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/9/2014 6:07:30 PM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/9/2014 6:07:30 PM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/9/2014 6:07:31 PM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved

Error - 1/9/2014 7:28:27 PM | Computer Name = HP-05E77DB9975B | Source = Application Hang | ID = 1002
Description = Hanging application notepad.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/9/2014 7:28:38 PM | Computer Name = HP-05E77DB9975B | Source = Application Hang | ID = 1002
Description = Hanging application notepad.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/11/2014 10:47:43 AM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/11/2014 10:47:43 AM | Computer Name = HP-05E77DB9975B | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/11/2014 11:45:53 PM | Computer Name = HP-05E77DB9975B | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x0ea2ad80.

Error - 1/11/2014 11:45:58 PM | Computer Name = HP-05E77DB9975B | Source = Application Error | ID = 1001
Description = Fault bucket 07218653.

[ System Events ]
Error - 1/7/2014 6:36:35 PM | Computer Name = HP-05E77DB9975B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   avgtp

Error - 1/7/2014 6:37:07 PM | Computer Name = HP-05E77DB9975B | Source = System Error | ID = 1003
Description = Error code 100000d1, parameter1 7ffd5010, parameter2 00000002, parameter3
00000000, parameter4 b993bd22.

Error - 1/7/2014 11:33:13 PM | Computer Name = HP-05E77DB9975B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   avgtp

Error - 1/8/2014 11:34:59 AM | Computer Name = HP-05E77DB9975B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   avgtp

Error - 1/9/2014 12:33:00 AM | Computer Name = HP-05E77DB9975B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   avgtp

Error - 1/9/2014 7:47:58 AM | Computer Name = HP-05E77DB9975B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   avgtp

Error - 1/9/2014 1:10:48 PM | Computer Name = HP-05E77DB9975B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   agp440 avgtp IntelIde

Error - 1/10/2014 9:30:57 AM | Computer Name = HP-05E77DB9975B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   agp440 avgtp IntelIde

Error - 1/11/2014 2:30:13 PM | Computer Name = HP-05E77DB9975B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   avgtp

Error - 1/11/2014 2:30:23 PM | Computer Name = HP-05E77DB9975B | Source = ipnathlp | ID = 32003
Description = The Network Address Translator (NAT) was unable to request an operation
of
the kernel-mode translation module. This may indicate misconfiguration, insufficient
resources, or an internal error. The data is the error code.

< End of report >

OTL logfile created on: 1/12/2014 11:14:59 AM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\OWNER\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.49 Gb Total Physical Memory | 0.97 Gb Available Physical Memory | 65.20% Memory free
2.09 Gb Paging File | 1.55 Gb Available in Paging File | 74.24% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 21.11 Gb Free Space | 56.65% Space Free | Partition Type: NTFS
Drive G: | 931.51 Gb Total Space | 652.82 Gb Free Space | 70.08% Space Free | Partition Type: NTFS

Computer Name: HP-05E77DB9975B | User Name: OWNER | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/01/12 11:10:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\OWNER\Desktop\OTL.exe
PRC - [2013/11/18 21:59:36 | 000,590,352 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgcsrvx.exe
PRC - [2013/11/14 13:16:14 | 000,508,144 | ---- | M] (QFX Software Corporation) -- C:\Program Files\KeyScrambler\KeyScrambler.exe
PRC - [2013/11/11 22:02:14 | 003,478,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgidsagent.exe
PRC - [2013/11/07 22:03:50 | 004,956,176 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgui.exe
PRC - [2013/11/07 22:00:48 | 000,680,976 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgemcx.exe
PRC - [2013/10/28 23:24:02 | 000,729,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgrsx.exe
PRC - [2013/10/28 23:17:36 | 000,892,976 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgnsx.exe
PRC - [2013/10/08 06:48:23 | 000,182,696 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2013/09/24 01:33:08 | 000,348,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgwdsvc.exe
PRC - [2013/04/04 13:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/05/18 05:32:17 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- G:\Program Files\Update\realsched.exe
PRC - [2012/01/18 05:21:52 | 000,737,184 | ---- | M] (Enigma Software Group USA, LLC.) -- C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
PRC - [2011/03/09 17:02:58 | 000,212,352 | ---- | M] (FileOpen Systems Inc.) -- C:\Documents and Settings\All Users\Application Data\FileOpen\Services\FileOpenManagerSvc32.exe
PRC - [2010/05/17 08:05:27 | 002,326,920 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
PRC - [2009/12/09 18:00:36 | 000,368,640 | ---- | M] () -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanCU.exe
PRC - [2009/09/12 15:31:36 | 000,357,384 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2009/09/12 15:31:30 | 000,660,520 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/06/27 18:04:00 | 001,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007/06/27 18:03:40 | 000,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2006/12/21 02:10:58 | 003,543,552 | ---- | M] () -- C:\Program Files\Ashampoo\Ashampoo FireWall PRO\FireWall.exe
PRC - [2003/05/08 10:34:32 | 000,069,632 | ---- | M] (adi) -- C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
PRC - [2002/09/20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

========== Modules (No Company Name) ==========

MOD - [2009/12/09 18:00:36 | 000,368,640 | ---- | M] () -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanCU.exe
MOD - [2009/10/08 12:21:00 | 000,233,472 | ---- | M] () -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanDll.dll
MOD - [2009/09/03 10:53:38 | 000,200,704 | ---- | M] () -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WPSCtrl.dll
MOD - [2009/03/24 14:01:00 | 000,233,472 | ---- | M] () -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanSup.dll
MOD - [2009/01/23 11:58:00 | 000,212,992 | ---- | M] () -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanCtl.dll
MOD - [2008/06/27 10:10:30 | 000,118,784 | ---- | M] () -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanWPS.dll
MOD - [2007/12/15 01:30:54 | 001,167,360 | ---- | M] () -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\acAuth.dll
MOD - [2006/12/21 02:10:58 | 003,543,552 | ---- | M] () -- C:\Program Files\Ashampoo\Ashampoo FireWall PRO\FireWall.exe
MOD - [2006/11/09 12:40:10 | 000,151,040 | ---- | M] () -- C:\Program Files\Ashampoo\Ashampoo FireWall PRO\MD5.dll

========== Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Overwolf\OverwolfUpdater.exe -- (OverwolfUpdaterService)
SRV - [2014/01/01 14:38:00 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/11/11 22:02:14 | 003,478,544 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2014\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/10/08 06:48:23 | 000,182,696 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/09/24 01:33:08 | 000,348,008 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2014\avgwdsvc.exe -- (avgwd)
SRV - [2013/04/04 13:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 13:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/01/18 05:21:52 | 000,737,184 | ---- | M] (Enigma Software Group USA, LLC.) [Auto | Running] -- C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe -- (SpyHunter 4 Service)
SRV - [2011/03/09 17:02:58 | 000,212,352 | ---- | M] (FileOpen Systems Inc.) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\FileOpen\Services\FileOpenManagerSvc32.exe -- (FileOpenManagerSvc)
SRV - [2010/05/17 08:05:27 | 002,326,920 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv)
SRV - [2009/09/12 15:31:30 | 000,660,520 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2009/08/24 21:16:36 | 000,406,016 | ---- | M] (mst software GmbH, Germany) [On_Demand | Stopped] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\DfSdkS.exe -- (DfSdkS)
SRV - [2009/02/11 19:12:38 | 000,167,936 | ---- | M] () [Auto | Stopped] -- C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WLSVC.exe -- (WLSVC)
SRV - [2002/09/20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (TrueSight)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\OWNER\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2014/01/11 13:30:14 | 000,004,096 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Documents and Settings\OWNER\Local Settings\temp\ASFWHide -- (ASFWHide)
DRV - [2013/11/05 21:50:48 | 000,120,600 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgdiskx.sys -- (Avgdiskx)
DRV - [2013/11/04 21:57:30 | 000,209,176 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2013/10/31 23:00:28 | 000,176,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2013/10/31 22:30:08 | 000,222,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avglogx.sys -- (Avglogx)
DRV - [2013/10/24 22:28:32 | 000,147,768 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2013/10/01 00:49:38 | 000,102,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2013/09/17 00:57:26 | 000,022,840 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2013/09/10 00:43:20 | 000,027,448 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2013/08/01 16:08:52 | 000,193,848 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2013/05/31 09:53:18 | 000,209,016 | ---- | M] (QFX Software Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\keyscrambler.sys -- (KeyScrambler)
DRV - [2013/04/04 13:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/05/06 14:57:10 | 000,013,904 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - [2010/05/17 08:05:30 | 000,159,168 | ---- | M] (Acronis) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afcdp.sys -- (afcdp)
DRV - [2010/05/17 08:05:21 | 000,902,432 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\tdrpm251.sys -- (tdrpman251)
DRV - [2010/05/17 08:05:18 | 000,570,016 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\timntr.sys -- (timounter)
DRV - [2010/05/17 08:05:05 | 000,157,248 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\snapman.sys -- (snapman)
DRV - [2009/05/18 18:29:24 | 000,519,168 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl819xp.sys -- (RTL819xp)
DRV - [2009/02/02 08:44:56 | 000,054,656 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATMFVsp.sys -- (ATMFVsp)
DRV - [2009/02/02 08:44:20 | 000,103,424 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATMFNET.sys -- (ATMFNET)
DRV - [2009/02/02 08:44:00 | 000,054,656 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATMFNVsp.sys -- (ATMFNVsp)
DRV - [2009/02/02 08:43:46 | 000,054,656 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATMFCVsp.sys -- (ATMFCVsp)
DRV - [2009/02/02 08:43:32 | 000,054,528 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATMFMdm.sys -- (ATMFMdm)
DRV - [2009/02/02 08:43:20 | 000,038,528 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATMFBUS.sys -- (ATMFBUS)
DRV - [2009/01/05 05:18:16 | 000,011,520 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ATMFFLT.sys -- (ATMFFLT)
DRV - [2008/07/25 00:18:32 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2008/06/06 08:15:40 | 000,098,816 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\baspxp32.sys -- (Blfp)
DRV - [2008/04/14 00:26:08 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/02/27 10:54:00 | 000,020,480 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\WLNdis50.sys -- (WLNdis50)
DRV - [2006/12/21 02:34:50 | 000,029,184 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Documents and Settings\OWNER\Local Settings\temp\DrvFltIp -- (DrvFltIp)
DRV - [2004/08/04 15:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004/08/04 15:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ss=1&scc=1&ltmpl=default&ltmplcache=2&hl=en&emr=1&elo=1"
FF - prefs.js..extensions.enabledAddons: eoWwdRD%40Qe3qzqg.com:11
FF - prefs.js..extensions.enabledAddons: nosquint%40urandom.ca:2.1.9
FF - prefs.js..extensions.enabledAddons: savedpasswordeditor%40daniel.dawson:2.7.1
FF - prefs.js..extensions.enabledAddons: showmemore%40suskind:2.3
FF - prefs.js..extensions.enabledAddons: trackerwatcher%40privacychoice.org:1.0.9
FF - prefs.js..extensions.enabledAddons: trackmenot%40mrl.nyu.edu:0.6.728
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:21.9
FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.16
FF - prefs.js..extensions.enabledAddons: %7B1A2D0EC4-75F5-4c91-89C4-3656F6E44B68%7D:0.6.3
FF - prefs.js..extensions.enabledAddons: %7B2e17e2b2-b8d4-4a67-8d7b-fafa6cc9d1d0%7D:1.2.7.0
FF - prefs.js..extensions.enabledAddons: %7B45d8ff86-d909-11db-9705-005056c00008%7D:1.1.0
FF - prefs.js..extensions.enabledAddons: %7B57068FBE-1506-42ee-AB02-BD183E7999E4%7D:4.3.1
FF - prefs.js..extensions.enabledAddons: %7BAE93811A-5C9A-4d34-8462-F7B864FC4696%7D:4.16
FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.21
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: G:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: g:\program files\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: g:\program files\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: g:\program files\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: G:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: G:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/12/20 16:49:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/12/20 16:49:22 | 000,000,000 | ---D | M]

[2010/10/15 16:32:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Extensions
[2014/01/09 22:08:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions
[2013/12/19 23:13:50 | 000,000,000 | ---D | M] ("ColorfulTabs") -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2013/12/14 08:26:34 | 000,000,000 | ---D | M] (Flagfox) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2011/09/17 07:35:29 | 000,000,000 | ---D | M] (Cookie Monster) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{45d8ff86-d909-11db-9705-005056c00008}
[2011/10/15 08:12:06 | 000,000,000 | ---D | M] (Compact Menu 2) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{57068FBE-1506-42ee-AB02-BD183E7999E4}
[2010/10/15 17:10:20 | 000,000,000 | ---D | M] (PhishTank SiteChecker) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{8bc5b5eb-0ec4-46ed-a024-ace8a3032888}
[2013/12/26 21:56:53 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/01/25 04:01:06 | 000,000,000 | ---D | M] ("BetterPrivacy") -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2010/10/15 17:10:25 | 000,000,000 | ---D | M] (Redirect Remover) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{fe0258ab-4f74-43a1-8781-bcdf340f9ee9}
[2013/12/25 11:29:45 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\anttoolbar@ant.com
[2012/01/04 18:17:35 | 000,000,000 | ---D | M] (Show Me More) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\showmemore@suskind
[2011/03/16 11:46:32 | 000,000,000 | ---D | M] ("PrivacyChoice TrackerWatcher") -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\trackerwatcher@privacychoice.org
[2011/07/15 16:05:48 | 000,000,000 | ---D | M] (TrackMeNot) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\trackmenot@mrl.nyu.edu
[2014/01/09 22:08:03 | 000,949,970 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\2.0@disconnect.me.xpi
[2013/12/22 23:58:43 | 000,147,131 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\antmark@ant.com.xpi
[2012/03/11 17:12:22 | 000,618,680 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\DarkRevisited@bluewebstudios.com.xpi
[2013/10/08 23:35:50 | 000,003,252 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\eoWwdRD@Qe3qzqg.com.xpi
[2013/11/05 22:54:06 | 001,338,622 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\firefox@ghostery.com.xpi
[2013/08/04 16:52:09 | 000,169,613 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\jid0-AocRXUCRsLTCYvn6bgJERnwfuqw@jetpack.xpi
[2013/05/03 20:04:23 | 000,114,250 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\nosquint@urandom.ca.xpi
[2013/09/22 23:17:25 | 000,215,334 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\savedpasswordeditor@daniel.dawson.xpi
[2012/06/11 07:08:56 | 000,108,965 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe80}.xpi
[2013/05/28 21:57:33 | 000,096,207 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi
[2013/03/02 21:35:32 | 000,009,253 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{2e17e2b2-b8d4-4a67-8d7b-fafa6cc9d1d0}.xpi
[2013/12/13 12:38:14 | 000,217,472 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}.xpi
[2012/06/11 07:05:01 | 000,292,116 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{ad48108d-92a6-4eb9-87e4-978aca1dbae4}.xpi
[2013/02/17 14:52:52 | 000,377,738 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2013/12/15 21:37:54 | 000,017,971 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{c1970c0d-dbe6-4d91-804f-c9c0de643a57}.xpi
[2013/09/07 19:19:22 | 000,166,436 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{c36177c0-224a-11da-8cd6-0800200c9a91}.xpi
[2013/10/09 21:30:48 | 000,915,554 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2010/11/17 16:24:23 | 000,001,504 | ---- | M] () -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\searchplugins\imdb.xml
[2013/08/11 04:10:46 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\searchplugins\search-1.xml
[2013/08/11 09:31:13 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\searchplugins\search-2.xml
[2011/05/03 14:56:07 | 000,000,705 | ---- | M] () -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\searchplugins\webster.xml
[2013/12/20 16:49:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/12/20 16:49:44 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/10/24 15:36:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012/04/18 09:21:04 | 000,170,592 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2012/05/18 05:32:56 | 000,129,144 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll

O1 HOSTS File: ([2014/01/05 18:59:16 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [Ashampoo FireWall PRO] C:\Program Files\Ashampoo\Ashampoo FireWall PRO\FireWall.exe ()
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2014\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe (adi)
O4 - HKLM..\Run: [iMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [KeyScrambler] C:\Program Files\KeyScrambler\keyscrambler.exe (QFX Software Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [TkBellExe] G:\program files\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-1123561945-152049171-1606980848-1003..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless Configuration Utility.lnk = C:\Program Files\TRENDnet\TEW-641PC_TEW-643PI\WlanCU.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1123561945-152049171-1606980848-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.45.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1DDB58F2-9414-4E54-AF7F-A2F49B3F32B1}: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{61C627C6-7587-4F7D-AD24-C13F18FE17F5}: DhcpNameServer = 209.18.47.61 209.18.47.62
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\OWNER\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\OWNER\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/16 21:39:48 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2014\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2014/01/12 11:10:50 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\OWNER\Desktop\OTL.exe
[2014/01/09 07:29:40 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2014/01/07 17:33:17 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2014/01/07 15:12:28 | 002,347,384 | ---- | C] (ESET) -- C:\Documents and Settings\OWNER\Desktop\esetsmartinstaller_enu.exe
[2014/01/05 18:48:34 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2014/01/05 12:18:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2014/01/05 12:18:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2014/01/05 12:18:08 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2014/01/05 12:18:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2014/01/05 12:17:19 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/01/05 12:17:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2014/01/05 12:12:42 | 005,160,001 | R--- | C] (Swearware) -- C:\Documents and Settings\OWNER\Desktop\ComboFix.exe
[2014/01/01 14:41:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\OWNER\Local Settings\Application Data\RadarSync
[2014/01/01 12:18:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HitmanPro
[2014/01/01 12:15:20 | 000,222,520 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avglogx.sys.bak
[2014/01/01 12:15:20 | 000,193,848 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys.bak
[2014/01/01 12:15:20 | 000,176,952 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys.bak
[2014/01/01 12:15:20 | 000,102,712 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys.bak
[2014/01/01 12:15:20 | 000,027,448 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgrkx86.sys.bak
[2014/01/01 12:15:20 | 000,022,840 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgidsshimx.sys.bak
[2014/01/01 12:15:19 | 000,209,176 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgidsdriverx.sys.bak
[2014/01/01 12:15:19 | 000,147,768 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgidshx.sys.bak
[2014/01/01 12:15:19 | 000,120,600 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgdiskx.sys.bak
[2013/12/30 11:31:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\OWNER\dwhelper
[2013/12/26 22:38:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Big Fish
[2013/12/26 22:18:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\OWNER\Local Settings\Application Data\Big Fish
[2013/12/26 22:18:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\BigFishCache
[2013/12/24 11:59:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\OWNER\AppData
[2013/12/21 20:29:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/12/21 20:19:00 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2013/12/20 16:49:14 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/04/07 06:56:27 | 000,439,704 | ---- | C] (Yahoo! Inc.) -- C:\Program Files\msgr11us.exe
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/01/12 11:18:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/01/12 11:10:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\OWNER\Desktop\OTL.exe
[2014/01/11 22:27:42 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1123561945-152049171-1606980848-1003.job
[2014/01/11 22:27:42 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1123561945-152049171-1606980848-1003.job
[2014/01/11 22:27:01 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2014/01/11 22:26:49 | 000,000,095 | ---- | M] () -- C:\Documents and Settings\OWNER\default.pls
[2014/01/11 13:30:22 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2014/01/11 13:29:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/01/11 12:37:32 | 002,637,475 | ---- | M] () -- C:\Documents and Settings\OWNER\Desktop\`1-10-14.zip
[2014/01/10 22:50:01 | 131,537,248 | ---- | M] () -- C:\Documents and Settings\OWNER\Desktop\setup_11.0.1.1245.x01_2014_01_11_05_03.exe
[2014/01/09 23:32:54 | 131,487,696 | ---- | M] () -- C:\Documents and Settings\OWNER\Desktop\setup_11.0.1.1245.x01_2014_01_10_07_03.exe.part
[2014/01/09 07:13:04 | 114,876,533 | ---- | M] () -- C:\Documents and Settings\OWNER\Desktop\setup_11.0.1.1245.x01_2014_01_09_15_03.exe.part
[2014/01/07 15:13:08 | 002,347,384 | ---- | M] (ESET) -- C:\Documents and Settings\OWNER\Desktop\esetsmartinstaller_enu.exe
[2014/01/05 18:59:16 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2014/01/05 18:48:40 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2014/01/05 12:12:42 | 005,160,001 | R--- | M] (Swearware) -- C:\Documents and Settings\OWNER\Desktop\ComboFix.exe
[2014/01/04 20:37:52 | 000,109,568 | ---- | M] () -- C:\Documents and Settings\OWNER\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/01/01 12:15:20 | 000,222,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avglogx.sys.bak
[2014/01/01 12:15:20 | 000,193,848 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys.bak
[2014/01/01 12:15:20 | 000,176,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys.bak
[2014/01/01 12:15:20 | 000,102,712 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys.bak
[2014/01/01 12:15:20 | 000,027,448 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgrkx86.sys.bak
[2014/01/01 12:15:20 | 000,022,840 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgidsshimx.sys.bak
[2014/01/01 12:15:19 | 000,209,176 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgidsdriverx.sys.bak
[2014/01/01 12:15:19 | 000,147,768 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgidshx.sys.bak
[2014/01/01 12:15:19 | 000,120,600 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgdiskx.sys.bak
[2013/12/21 23:05:38 | 000,000,997 | ---- | M] () -- C:\Documents and Settings\OWNER\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/01/11 12:37:24 | 002,637,475 | ---- | C] () -- C:\Documents and Settings\OWNER\Desktop\`1-10-14.zip
[2014/01/10 21:54:55 | 131,537,248 | ---- | C] () -- C:\Documents and Settings\OWNER\Desktop\setup_11.0.1.1245.x01_2014_01_11_05_03.exe
[2014/01/09 23:19:59 | 131,487,696 | ---- | C] () -- C:\Documents and Settings\OWNER\Desktop\setup_11.0.1.1245.x01_2014_01_10_07_03.exe.part
[2014/01/09 06:58:36 | 114,876,533 | ---- | C] () -- C:\Documents and Settings\OWNER\Desktop\setup_11.0.1.1245.x01_2014_01_09_15_03.exe.part
[2014/01/05 18:48:40 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2014/01/05 18:48:36 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2014/01/05 12:18:08 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2014/01/05 12:18:08 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2014/01/05 12:18:08 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2014/01/05 12:18:08 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2014/01/05 12:18:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2013/10/25 22:21:55 | 000,003,746 | ---- | C] () -- C:\Program Files\Mozilla Firefoxsafeguard-secure-search.xml
[2013/08/11 03:40:18 | 000,000,884 | RHS- | C] () -- C:\Documents and Settings\OWNER\ntuser.pol
[2013/08/07 20:20:21 | 000,000,175 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/07 20:20:20 | 000,000,175 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/07 20:20:20 | 000,000,175 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/02/17 14:01:14 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\drivers\WLNdis50.sys
[2012/02/14 16:34:40 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2010/12/05 10:44:11 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\OWNER\Local Settings\Application Data\PUTTY.RND
[2010/10/25 21:18:56 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\OWNER\Application Data\$_hpcst$.hpc
[2010/09/25 16:55:36 | 000,000,095 | ---- | C] () -- C:\Documents and Settings\OWNER\default.pls
[2010/09/25 16:39:08 | 000,109,568 | ---- | C] () -- C:\Documents and Settings\OWNER\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2010/10/20 18:32:08 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2010/03/09 23:33:41 | 001,509,888 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 07:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2011/08/20 13:36:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\5400 Series
[2010/05/17 08:36:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis
[2010/12/05 10:05:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ashampoo
[2013/12/08 14:27:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/12/08 13:43:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG2014
[2013/12/26 23:46:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Big Fish
[2013/04/04 17:24:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broadcom Corporation
[2013/10/25 22:21:18 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/07/17 12:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FileOpen
[2013/10/26 20:38:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FloodLightGames
[2014/01/01 12:50:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HitmanPro
[2013/10/25 22:23:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\JollyBear
[2014/01/12 09:36:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/10/20 18:41:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Motorola
[2011/02/21 17:36:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2011/07/01 04:06:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QFX Software
[2011/04/15 15:15:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SuperEasy Software
[2010/12/11 13:21:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SuperMP3Download
[2012/06/08 20:34:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\xml_param
[2010/11/21 16:14:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/08/21 07:10:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\5400 Series
[2010/09/20 17:25:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Acronis
[2011/07/06 20:34:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Ashampoo
[2011/01/15 23:15:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Ashampoo Photo Commander 7
[2013/12/08 13:45:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\AVG2014
[2010/11/16 21:18:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\BACS.exe
[2013/10/26 12:18:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\BitTorrent
[2013/03/04 15:34:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\DVDVideoSoft
[2011/07/17 12:25:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\FileOpen
[2011/03/14 19:32:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Free Audio Editor
[2010/11/21 00:18:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Goodsol
[2011/02/21 17:35:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\NCH Swift Sound
[2013/09/23 03:20:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Oracle
[2011/07/01 04:06:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\QFX Software
[2011/02/01 10:48:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\SoftMaker
[2011/03/12 15:22:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\StreamTorrent
[2011/04/15 15:17:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\SuperEasy Software
[2010/12/11 13:21:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\SuperMP3Download
[2013/12/08 13:43:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\TuneUp Software
[2013/12/21 20:22:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Uniblue
[2012/03/11 20:36:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\uTorrent
[2012/03/28 15:15:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Wondershare Video Converter Ultimate

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\OWNER\Application Data\desktop.ini:SummaryInformation

< End of report >

Maniac · January 13, 2014

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
FF - prefs.js..extensions.enabledAddons: eoWwdRD%40Qe3qzqg.com:11
[2013/10/08 23:35:50 | 000,003,252 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\eoWwdRD@Qe3qzqg.com.xpi
[2013/11/05 22:54:06 | 001,338,622 | ---- | M] () (No name found) -- C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\firefox@ghostery.com.xpi
[2013/10/26 12:18:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\BitTorrent
[2011/03/12 15:22:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\StreamTorrent
[2013/12/21 20:22:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\Uniblue
[2012/03/11 20:36:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\OWNER\Application Data\uTorrent
:files
ipconfig /flushdns /c
:Commands
[emptytemp]
[clearallrestorepoints]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Please post the OTL fix log in your next reply.

Note: A copy of an OTL fix log is saved in a text file at C:\_OTL\MovedFiles

Cyclops62 · January 13, 2014

5:50 PM 1/13/2014All processes killed
========== OTL ==========
Prefs.js: eoWwdRD%40Qe3qzqg.com:11 removed from extensions.enabledAddons
C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\eoWwdRD@Qe3qzqg.com.xpi moved successfully.
C:\Documents and Settings\OWNER\Application Data\Mozilla\Firefox\Profiles\adp3awj1.default\extensions\firefox@ghostery.com.xpi moved successfully.
C:\Documents and Settings\OWNER\Application Data\BitTorrent\dlimagecache folder moved successfully.
C:\Documents and Settings\OWNER\Application Data\BitTorrent\apps folder moved successfully.
C:\Documents and Settings\OWNER\Application Data\BitTorrent folder moved successfully.
C:\Documents and Settings\OWNER\Application Data\StreamTorrent\1.0\config folder moved successfully.
C:\Documents and Settings\OWNER\Application Data\StreamTorrent\1.0 folder moved successfully.
C:\Documents and Settings\OWNER\Application Data\StreamTorrent folder moved successfully.
C:\Documents and Settings\OWNER\Application Data\Uniblue folder moved successfully.
C:\Documents and Settings\OWNER\Application Data\uTorrent folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\OWNER\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\OWNER\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 57472 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: OWNER
->Temp folder emptied: 637506587 bytes
->Temporary Internet Files folder emptied: 1611891 bytes
->Java cache emptied: 992297 bytes
->FireFox cache emptied: 57070776 bytes
->Flash cache emptied: 58224 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 180482 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 82571 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 16384 bytes

Total Files Cleaned = 665.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 01132014_130441

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Maniac · January 13, 2014

How are things now?

Cyclops62 · January 13, 2014

It seems to be "OK". No rollups yet! It took me 5hrs to get online, with both IE and Firefox. Do you think it was one of the add-ons that were removed from Firefox? I had tested it previously by running "FF" in Safe Mode and still had the problem.

Need to leave for 3 hrs or so...

Maniac · January 16, 2014

It was extension for sure.

Still no problem, right?

Cyclops62 · January 16, 2014

Yes, no problems anymore! You are very good, Sir! When my retirement check arrives in 7 days, I will see if I can afford to contribute.

Rollups? How can I remove them? Also, redirects?

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information