claws Posted August 17, 2014 ID:867613 Share Posted August 17, 2014 Whilst uninstalling unnecessary programs to improve the speed and efficiency of my laptop, I found a program called Yontoo, which I found out was software that was needed to be removed. I tried this the usual way, though an error came up and found this thread of another user with the same problem. Following this advice, I have ran the scan with OTL and have below the OTL.Txt and Extras.Txt files pasted below. Thank you in advance to anyone who can assist me. OTL.Txt OTL logfile created on: 8/17/2014 5:50:45 PM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\chloe\Downloads64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.11.9600.17239)Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy 1.87 Gb Total Physical Memory | 0.55 Gb Available Physical Memory | 29.34% Memory free3.74 Gb Paging File | 1.58 Gb Available in Paging File | 42.28% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 149.04 Gb Total Space | 107.18 Gb Free Space | 71.91% Space Free | Partition Type: NTFSDrive D: | 148.65 Gb Total Space | 53.77 Gb Free Space | 36.17% Space Free | Partition Type: NTFS Computer Name: CHLOE-TOSH | User Name: chloe | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2014/08/17 17:50:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\chloe\Downloads\OTL.exePRC - [2014/08/11 20:55:43 | 002,640,408 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exePRC - [2014/08/11 20:55:42 | 001,820,184 | ---- | M] (AVG Secure Search) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exePRC - [2014/08/11 20:55:42 | 000,159,768 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exePRC - [2014/08/11 14:51:00 | 003,244,048 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exePRC - [2014/08/11 14:42:34 | 005,187,088 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2014\avgui.exePRC - [2014/08/11 14:36:28 | 000,289,328 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exePRC - [2014/08/07 04:20:57 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exePRC - [2014/07/14 18:21:46 | 001,390,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exePRC - [2014/07/14 18:21:06 | 001,767,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exePRC - [2014/06/26 11:23:07 | 000,130,104 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.3.12\NST.exePRC - [2013/06/26 19:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exePRC - [2013/06/26 19:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exePRC - [2011/01/14 11:55:14 | 000,572,712 | ---- | M] (Nero AG) -- c:\Program Files (x86)\Nero\Update\NASvc.exePRC - [2010/12/03 14:57:16 | 000,304,560 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exePRC - [2010/08/27 17:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exePRC - [2010/08/15 19:54:50 | 000,034,160 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exePRC - [2009/07/28 20:26:42 | 000,062,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exePRC - [2009/03/10 18:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe ========== Modules (No Company Name) ========== MOD - [2014/08/11 20:55:43 | 002,640,408 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exeMOD - [2014/08/11 20:55:43 | 001,654,296 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\TBAPI.dllMOD - [2014/08/11 20:55:43 | 000,519,704 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\log4cplusU.dllMOD - [2014/08/07 04:20:55 | 000,353,096 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppgooglenaclpluginchrome.dllMOD - [2014/08/07 04:20:53 | 008,537,928 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dllMOD - [2014/08/07 04:20:49 | 000,718,152 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libglesv2.dllMOD - [2014/08/07 04:20:47 | 000,126,280 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libegl.dllMOD - [2014/08/07 04:20:46 | 001,732,936 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ffmpegsumo.dll ========== Services (SafeList) ========== SRV:64bit: - [2014/07/25 14:00:25 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)SRV:64bit: - [2013/05/27 06:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)SRV:64bit: - [2010/09/28 12:30:28 | 000,489,384 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)SRV:64bit: - [2010/02/05 17:44:48 | 000,137,560 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)SRV:64bit: - [2009/07/28 14:48:06 | 000,140,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)SRV - [2014/08/11 20:55:42 | 001,820,184 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe -- (vToolbarUpdater18.1.9)SRV - [2014/08/11 14:51:00 | 003,244,048 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe -- (AVGIDSAgent)SRV - [2014/08/11 14:36:28 | 000,289,328 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe -- (avgwd)SRV - [2014/07/14 18:21:46 | 001,390,176 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)SRV - [2014/07/14 18:21:06 | 001,767,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)SRV - [2014/07/08 21:03:13 | 000,262,320 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)SRV - [2014/06/26 11:23:07 | 000,130,104 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.3.12\NST.exe -- (NCO)SRV - [2014/03/20 23:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)SRV - [2013/10/23 09:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)SRV - [2013/09/11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)SRV - [2013/06/26 19:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)SRV - [2013/06/26 19:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)SRV - [2011/02/10 09:25:36 | 000,112,080 | ---- | M] (Toshiba Europe GmbH) [On_Demand | Stopped] -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe -- (TemproMonitoringService)SRV - [2011/01/14 11:55:14 | 000,572,712 | ---- | M] (Nero AG) [Auto | Running] -- c:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)SRV - [2010/08/27 17:20:14 | 001,811,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)SRV - [2010/01/28 16:44:40 | 000,249,200 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe -- (cfWiMAXService)SRV - [2009/10/06 09:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)SRV - [2009/03/10 18:51:20 | 000,046,448 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service) ========== Driver Services (SafeList) ========== DRV:64bit: - [2014/08/11 20:55:44 | 000,050,976 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)DRV:64bit: - [2014/06/30 12:43:02 | 000,152,344 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgdiska.sys -- (Avgdiska)DRV:64bit: - [2014/06/17 16:21:34 | 000,235,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)DRV:64bit: - [2014/06/17 16:07:12 | 000,328,984 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)DRV:64bit: - [2014/06/17 16:06:58 | 000,269,080 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)DRV:64bit: - [2014/06/17 16:06:24 | 000,190,744 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)DRV:64bit: - [2014/06/17 16:06:22 | 000,242,968 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)DRV:64bit: - [2014/06/17 16:06:20 | 000,123,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)DRV:64bit: - [2014/06/17 16:06:06 | 000,031,512 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)DRV:64bit: - [2014/01/22 08:52:10 | 000,206,080 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)DRV:64bit: - [2013/09/27 20:23:26 | 000,162,392 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NSTx64\7DE07030.00C\ccSetx64.sys -- (ccSet_NST)DRV:64bit: - [2013/08/29 02:29:52 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)DRV:64bit: - [2013/06/26 19:21:50 | 000,023,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)DRV:64bit: - [2013/06/26 19:21:48 | 000,028,840 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)DRV:64bit: - [2013/06/26 19:21:46 | 000,273,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)DRV:64bit: - [2013/06/26 19:21:44 | 000,767,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)DRV:64bit: - [2013/02/06 07:42:08 | 000,102,936 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)DRV:64bit: - [2012/11/16 18:19:14 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)DRV:64bit: - [2012/11/16 18:19:14 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)DRV:64bit: - [2012/11/16 18:19:14 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)DRV:64bit: - [2012/11/16 18:19:14 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)DRV:64bit: - [2012/03/01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)DRV:64bit: - [2011/07/19 20:32:25 | 000,020,592 | ---- | M] (Compal Electronics, INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CeKbFilter.sys -- (CeKbFilter)DRV:64bit: - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2011/02/08 19:07:00 | 000,038,096 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)DRV:64bit: - [2010/11/21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)DRV:64bit: - [2010/11/21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2010/11/21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)DRV:64bit: - [2010/11/02 16:48:38 | 001,103,464 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)DRV:64bit: - [2010/09/24 14:11:18 | 000,349,800 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)DRV:64bit: - [2010/03/22 10:55:20 | 000,046,192 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LPCFilter.sys -- (LPCFilter)DRV:64bit: - [2010/03/10 18:51:32 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)DRV:64bit: - [2010/02/21 00:24:36 | 010,300,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)DRV:64bit: - [2010/01/07 09:05:46 | 000,232,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)DRV:64bit: - [2009/07/30 19:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)DRV:64bit: - [2009/07/14 15:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV:64bit: - [2009/06/04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)DRV:64bit: - [2008/04/16 15:49:34 | 000,028,416 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {08DF9062-2335-487B-9D3A-29C7C07C3E27}IE:64bit: - HKLM\..\SearchScopes\{08DF9062-2335-487B-9D3A-29C7C07C3E27}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBoxIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKLM\..\SearchScopes,DefaultScope = {08DF9062-2335-487B-9D3A-29C7C07C3E27}IE - HKLM\..\SearchScopes\{08DF9062-2335-487B-9D3A-29C7C07C3E27}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylon.com/?affID=113959&tt=120912_ccp_3812_1&babsrc=HP_ss&mntrId=542b79770000000000007c4fb5d02d0eIE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = http://search.babylon.com/?affID=113959&tt=120912_ccp_3812_1&babsrc=HP_ss&mntrId=542b79770000000000007c4fb5d02d0eIE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba.msn.comIE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://toshiba.eu/places?touch=4&cat=1 [binary data]IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.shinysearch.com/myhome.php?theme=kissme<ext=Search%20meIE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.max-start.com/?q={searchTerms}&affID=113959&tt=120912_ccp_3812_1&babsrc=SP_ss_mib2&mntrId=542b79770000000000007c4fb5d02d0eIE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={F3191A67-1B29-4D2B-873B-4B846BB240C4}&mid=ece95645610447d1b1686939b2259529-4d67aa0326d0045943eadd6b520b9658832c4705〈=en&ds=AVG&pr=fr&d=2013-08-07 18:02:33&v=15.4.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\SearchScopes\{BF3B5A12-8CFB-448A-BFAD-6D5B018794D6}: "URL" = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\SearchScopes\{DC34233D-99C8-4DF1-A015-CF4CD43D07E8}: "URL" = http://rover.ebay.com/rover/1/710-44557-9400-9/4?satitle={searchTerms}IE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\SearchScopes\{FBF5BDB3-70FF-4AA1-BD35-CC5BEAEA371F}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBoxIE - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll File not foundFF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\chloe\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\15.4.0.5FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F04D2D30-776C-4d02-8627-8E4385ECA58D}: C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2014.7.3.12\coFFPlgn\ [2012/09/20 11:38:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions ========== Chrome ========== CHR - default_search_provider: (Enabled)CHR - default_search_provider: search_url = CHR - default_search_provider: suggest_url = CHR - plugin: Error reading preferences fileCHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\chloe\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0\CHR - Extension: Google Wallet = C:\Users\chloe\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\ O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O2:64bit: - BHO: (Norton Identity Protection) - {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.3.12\CoIEPlg.dll (Symantec Corporation)O2:64bit: - BHO: (Skype Click to Call for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.786\AVG Secure Search_toolbar.dll (AVG Secure Search)O2 - BHO: (Skype Click to Call for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O3:64bit: - HKLM\..\Toolbar: (Norton Identity Safe Toolbar) - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.3.12\CoIEPlg.dll (Symantec Corporation)O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.786\AVG Secure Search_toolbar.dll (AVG Secure Search)O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [igfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)O4:64bit: - HKLM..\Run: [smartFaceVWatcher] C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe (TOSHIBA Corporation)O4:64bit: - HKLM..\Run: [smoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)O4:64bit: - HKLM..\Run: [Toshiba Registration] C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe (Toshiba Europe GmbH)O4:64bit: - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH)O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2014\avgui.exe (AVG Technologies CZ, s.r.o.)O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)O4 - HKLM..\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe (TOSHIBA CORPORATION)O4 - HKLM..\Run: [NBAgent] c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)O4 - HKLM..\Run: [sVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA CORPORATION)O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()O4 - HKU\.DEFAULT..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)O4 - HKU\S-1-5-18..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)O4 - HKU\S-1-5-19..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-19..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)O4 - HKU\S-1-5-20..\Run: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)O4 - HKU\S-1-5-20..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)O4 - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002..\Run: [Facebook Update] C:\Users\chloe\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)O4 - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (TOSHIBA)O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not foundO4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not foundO4 - HKU\S-1-5-21-1164766913-1964459141-3821851673-1002..\RunOnce: [iDSS_STARTUP] C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.3.12\coSAStub.exe (Symantec Corporation)O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)O4 - Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1O8:64bit: - Extra context menu item: Add to TOSHIBA Bulletin Board - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)O8 - Extra context menu item: Add to TOSHIBA Bulletin Board - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)O9:64bit: - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)O9:64bit: - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom64.dll (TODO: <会社名>)O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom64.dll (TODO: <会社名>)O9 - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)O9 - Extra Button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)O9 - Extra 'Tools' menuitem : @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll (TODO: <会社名>)O1364bit: - gopher Prefix: missingO13 - gopher Prefix: missingO16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CD02107F-780C-4ADE-AC9A-21DB3BDF618A}: DhcpNameServer = 192.168.1.1 0.0.0.0O18:64bit: - Protocol\Handler\linkscanner - No CLSID value foundO18:64bit: - Protocol\Handler\livecall - No CLSID value foundO18:64bit: - Protocol\Handler\msnim - No CLSID value foundO18:64bit: - Protocol\Handler\skype4com - No CLSID value foundO18:64bit: - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\viprotocol - No CLSID value foundO18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value foundO18:64bit: - Protocol\Handler\wlpg - No CLSID value foundO18 - Protocol\Handler\linkscanner - No CLSID value foundO18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)O18 - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O32 - HKLM CDRom: AutoRun - 1O33 - MountPoints2\{496d5a0c-8284-11e3-b54a-806e6f6e6963}\Shell - "" = AutoRunO33 - MountPoints2\{496d5a0c-8284-11e3-b54a-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exeO33 - MountPoints2\F\Shell - "" = AutoRunO33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exeO34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2014/08/17 15:57:05 | 000,162,392 | R--- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\NSTx64\7DE07030.00C\ccSetx64.sys[2014/08/17 15:56:50 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NSTx64[2014/08/17 15:56:50 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\NSTx64\7DE07030.00C[2014/08/17 15:56:49 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Identity Safe[2014/08/17 15:56:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton Identity Safe[2014/08/17 15:52:52 | 000,000,000 | -HSD | C] -- C:\Config.Msi[2014/08/17 15:37:37 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Roaming\AVG2014[2014/08/17 15:35:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG[2014/08/17 15:35:02 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2014[2014/08/17 15:27:42 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\Avg2014[2014/08/17 15:05:50 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{79E72899-3ED1-4C0B-ADB2-FA104E87CC59}[2014/08/16 14:19:27 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{D1641104-ABE5-4636-8564-5CFBE3E01E3F}[2014/08/16 11:03:13 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{479D5BD3-C838-4B59-956F-B055734E77E5}[2014/08/16 08:53:07 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{11C6EBE6-79AC-4B96-B53D-3FD80E18B085}[2014/08/15 10:19:22 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{97D49561-D1B7-482B-8119-32599D627FF6}[2014/08/14 20:50:24 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{204DCEB2-098A-4419-B316-988884DB6DB9}[2014/08/13 11:52:25 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{793A92CA-5B2D-4D69-B9DE-E623F538FD6A}[2014/08/12 19:44:48 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{E677AB98-23EC-4513-B677-6F4078A7A2E6}[2014/08/12 10:06:29 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{68FE8684-6EDF-4F96-A441-E44C17B1F10E}[2014/08/11 20:54:09 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{0BFB6DB2-71C7-432B-8E01-3B80500AE65D}[2014/08/10 20:44:42 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{CC449288-1842-41EC-B769-DD4DA58D115E}[2014/08/09 20:40:37 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{36CA7B6D-5C8C-40A9-902F-060D3449BE84}[2014/08/08 19:59:53 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{B614DB35-0D54-4116-9476-1ED160DAB89B}[2014/08/07 20:14:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype[2014/08/07 20:12:14 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{49CAF0DA-0FA6-4597-822E-44438F36D7DB}[2014/08/06 21:30:10 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{826581E4-DCC9-4E65-8A79-359A25F72156}[2014/08/05 18:15:43 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{D44AF15C-1D1D-4308-8105-1917D830BE43}[2014/08/04 20:10:20 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{A3138118-9689-4264-9C78-909784ADD328}[2014/08/03 19:39:48 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{A2FEF342-DE55-41B6-9204-98A8AE0C1667}[2014/08/02 20:20:57 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{700C93A8-5FBA-437A-B6F9-F13235ED9026}[2014/08/01 18:44:52 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{89735DD8-3204-4483-B2E2-5F21F28D93BB}[2014/07/29 10:20:21 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{4734C6D4-7724-48A7-ABF5-11154C0A4522}[2014/07/27 18:37:09 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{61B4ED0B-CC24-4113-A10D-608A635EDE58}[2014/07/26 20:28:48 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{5B04F2A1-3A3A-4AAA-B615-32AB6918F9D9}[2014/07/25 21:37:14 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{C3800D2D-59F3-403E-8B37-E976F28E1946}[2014/07/24 20:58:00 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{76370F07-FFAA-4E3E-80F8-DCDF031DC823}[2014/07/24 19:02:57 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{F4CE01B1-485A-4B58-A648-5687AD88D62D}[2014/07/23 19:04:54 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{F7C96B94-5B0F-43BB-970F-BDCA1E22FE63}[2014/07/23 10:03:50 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{97F0B5B7-EFA1-44CF-B5E4-7EDA41AB84BF}[2014/07/22 22:20:18 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{4BBAB4A9-BE05-47BB-BEEB-92E47201524E}[2014/07/21 18:21:38 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{D6FC97EA-FCFC-4788-BAF7-D363B638C9A5}[2014/07/20 19:19:15 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{62BC3386-04E7-4B40-9B4C-AABABB6EBDBC}[2014/07/20 17:08:30 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{43B96178-1F1B-482D-A860-0ACE9AD1E76E}[2014/07/19 19:44:40 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{1920113A-13D2-4CA7-8429-2C235A1573DE}[2014/07/19 10:01:46 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{44735AB2-2F69-4530-8D4C-1F590B262268}[2014/07/18 18:41:33 | 000,000,000 | ---D | C] -- C:\Users\chloe\AppData\Local\{71B5AAD4-AA04-4456-A9C2-D240AA2A1882}[37 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ][1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ][1 C:\Users\chloe\Documents\*.tmp files -> C:\Users\chloe\Documents\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2014/08/17 17:28:01 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job[2014/08/17 17:05:49 | 000,783,400 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2014/08/17 17:05:49 | 000,667,564 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2014/08/17 17:05:49 | 000,126,950 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2014/08/17 17:04:35 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job[2014/08/17 17:04:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2014/08/17 16:16:02 | 000,000,926 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1164766913-1964459141-3821851673-1002UA.job[2014/08/17 15:57:46 | 000,002,494 | ---- | M] () -- C:\Users\Public\Desktop\Norton Identity Safe.LNK[2014/08/17 15:35:58 | 000,000,932 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2014.lnk[2014/08/17 15:12:34 | 000,025,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2014/08/17 15:12:34 | 000,025,120 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2014/08/17 15:04:08 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job[2014/08/17 15:03:31 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job[2014/08/17 15:02:48 | 1504,354,304 | -HS- | M] () -- C:\hiberfil.sys[2014/08/16 20:13:20 | 000,275,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT[2014/08/15 01:16:01 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1164766913-1964459141-3821851673-1002Core.job[2014/08/13 12:54:05 | 000,002,150 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk[2014/08/11 20:55:44 | 000,050,976 | ---- | M] (AVG Technologies) -- C:\Windows\SysNative\drivers\avgtpx64.sys[37 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ][1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ][1 C:\Users\chloe\Documents\*.tmp files -> C:\Users\chloe\Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2014/08/17 15:57:46 | 000,002,494 | ---- | C] () -- C:\Users\Public\Desktop\Norton Identity Safe.LNK[2014/08/17 15:56:51 | 000,008,202 | R--- | C] () -- C:\Windows\SysNative\drivers\NSTx64\7DE07030.00C\ccSetx64.cat[2014/08/17 15:56:51 | 000,000,855 | R--- | C] () -- C:\Windows\SysNative\drivers\NSTx64\7DE07030.00C\ccSetx64.inf[2014/08/17 15:56:50 | 000,000,172 | ---- | C] () -- C:\Windows\SysNative\drivers\NSTx64\7DE07030.00C\isolate.ini[2014/08/17 15:35:57 | 000,000,932 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2014.lnk[2014/03/31 22:23:45 | 000,370,479 | ---- | C] () -- C:\Users\chloe\AppData\Roaming\UserTile.png[2013/08/16 00:06:03 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat[2013/02/08 19:43:52 | 000,114,176 | ---- | C] () -- C:\Users\chloe\AppData\Roaming\BabMaint.exe[2012/02/27 18:05:43 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat ========== ZeroAccess Check ========== [2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64"" = C:\Windows\SysNative\shell32.dll -- [2014/06/25 03:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]"" = %SystemRoot%\system32\shell32.dll -- [2014/06/25 02:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013/08/07 18:06:30 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\AVG2013[2014/08/17 15:37:37 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\AVG2014[2013/02/10 20:34:48 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\BabSolution[2012/09/20 11:38:07 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\Babylon[2012/12/02 19:05:00 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\Fighters[2014/07/18 22:12:27 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\File Scout[2013/10/31 00:24:42 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\SoftGrid Client[2012/01/01 12:14:27 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\Toshiba[2011/12/25 11:56:58 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\TOSHIBA Online Product Information[2011/12/31 22:58:39 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\TP[2013/08/07 18:02:54 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\TuneUp Software[2012/05/26 21:17:10 | 000,000,000 | ---D | M] -- C:\Users\chloe\AppData\Roaming\Windows Live Writer[2013/01/31 11:38:50 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software[2013/01/31 11:38:50 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software[2012/01/01 23:16:23 | 000,000,000 | ---D | M] -- C:\Users\Guest\AppData\Roaming\Toshiba ========== Purity Check ========== < End of report > Extras.Txt OTL Extras logfile created on: 8/17/2014 5:50:45 PM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\chloe\Downloads64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.11.9600.17239)Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy 1.87 Gb Total Physical Memory | 0.55 Gb Available Physical Memory | 29.34% Memory free3.74 Gb Paging File | 1.58 Gb Available in Paging File | 42.28% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 149.04 Gb Total Space | 107.18 Gb Free Space | 71.91% Space Free | Partition Type: NTFSDrive D: | 148.65 Gb Total Space | 53.77 Gb Free Space | 36.17% Space Free | Partition Type: NTFS Computer Name: CHLOE-TOSH | User Name: chloe | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.).url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation).html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) [HKEY_USERS\S-1-5-21-1164766913-1964459141-3821851673-1002\SOFTWARE\Classes\<extension>].html [@ = ChromeHTML] -- Reg Error: Key error. File not found ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [edit] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\Easy Media Player\emp.exe" --started-from-file --playlist-enqueue "%1" ()Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [PlayWithVLC] -- "C:\Program Files (x86)\Easy Media Player\emp.exe" --started-from-file --no-playlist-enqueue "%1" ()Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [edit] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\Easy Media Player\emp.exe" --started-from-file --playlist-enqueue "%1" ()Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [PlayWithVLC] -- "C:\Program Files (x86)\Easy Media Player\emp.exe" --started-from-file --no-playlist-enqueue "%1" ()Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"EnableFirewall" = 1"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"EnableFirewall" = 1"DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{007AB149-A35E-469D-90C7-8375F0AB466C}" = lport=138 | protocol=17 | dir=in | app=system | "{1281B58E-09C3-41E5-A757-5307AF0900A8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{12DF4980-8818-4361-85F6-08ADB3C10B05}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{1BA2C763-744D-4C9D-AAFF-E0FB0F498D47}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{1D8CA608-0127-44C7-B92A-2CC691F28495}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{2E7E50BD-CE7D-4FCF-BE82-8C8A3F7080AC}" = lport=5353 | protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe | "{3B580DD7-725A-4EA4-A872-2D740A12F906}" = rport=10243 | protocol=6 | dir=out | app=system | "{3FE2C3D1-9F18-473C-8A99-D895294C8C44}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{5FA64AC4-3B60-4196-8C6F-D6B0ECD3AD2E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{6098B546-DEAA-48AC-BD45-E6855CA75523}" = lport=137 | protocol=17 | dir=in | app=system | "{6271963D-AABB-400E-9C08-30EDFC01AA8D}" = lport=10243 | protocol=6 | dir=in | app=system | "{6C827E51-128E-41C3-9A59-B360C3E16401}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{78AD9F70-0773-481A-A7FF-4E0F521DAFB1}" = rport=137 | protocol=17 | dir=out | app=system | "{7C10E373-935B-447F-ACFD-6E3513B807F8}" = rport=138 | protocol=17 | dir=out | app=system | "{7D575B95-87DC-42B5-B5C1-1299177D1729}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | "{95D9D505-78D6-4A19-9271-5144B48AC431}" = rport=139 | protocol=6 | dir=out | app=system | "{9891B17A-A085-4CB5-81CC-B324407852D9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{A1233A78-4F51-4C9C-94E4-21DF8993B1CE}" = rport=445 | protocol=6 | dir=out | app=system | "{C042A2A3-E34B-48D0-AA3B-035C4750CBC2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{C9CD6360-7CCB-4CC5-8F9C-ABDA6CE40F62}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{CCDA5E1A-DD3E-4026-BBBB-CC2468A7AB64}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{E41CEAF3-61F2-495D-B661-656E8CBA3ECD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{EC1212F7-5F12-44A3-A22B-0EAEBC6C138C}" = lport=445 | protocol=6 | dir=in | app=system | "{EE0212B2-2FFD-49FA-8EF8-69C7BE839FF7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{F3117492-DBDF-4A06-B54F-E2264C94F976}" = lport=139 | protocol=6 | dir=in | app=system | "{FB52795F-189F-49B4-A4B1-868AE7CEC539}" = lport=2869 | protocol=6 | dir=in | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{025C8C0F-B010-4A4F-827B-4AAAFB9A2083}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | "{0BD183CD-5305-45BD-BB26-8D6BCE60E539}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{193826E6-2191-4F89-AFD4-78D856E365EE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{2340AB01-A7F9-480E-989A-C14E6A5E3E4F}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2014\avgmfapx.exe | "{2A6A7002-D80D-403C-8B40-C05D63A8F669}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2014\avgnsa.exe | "{2D924BC2-F70A-4351-AA83-63C1AB98F081}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{31E79DC5-F2EC-445E-896E-325D7D1FD561}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{3D67A40D-22DB-4998-A7C2-E1583A36CFD7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{40E4022E-3003-4589-A24B-469A74C5E608}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | "{41F113D7-5268-4151-82FD-92302DED2FB0}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2014\avgmfapx.exe | "{4961535D-32F3-4DA3-A41F-5D59BE89478A}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2014\avgemca.exe | "{50D8BB4B-D91F-4171-BD33-121FD573462E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{572E9EED-DDF3-41B2-A081-1999DF1152DD}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2014\avgdiagex.exe | "{60374FD8-E40D-49DA-8339-9BE7BC827E39}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{612DF67C-C235-46A3-A1ED-54DF13CEFF53}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{6767B87C-7564-4A30-9890-1EDA2639570A}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2014\avgdiagex.exe | "{6C096917-F7AA-40EC-AC5D-3B1A2E10A1FC}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2014\avgemca.exe | "{7FC2B264-F182-41CA-8395-E62BBDE789E3}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{8D5F75AB-8570-4EC0-B9D9-127B33E79CD6}" = protocol=6 | dir=out | app=system | "{91A90914-8658-473A-902B-C2085E8AF8B0}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{92A287A9-4426-46DC-BC0D-B83C77B3B70B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{A9EF3752-54F9-4C16-9EBA-D42A59564D20}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{ADA1CBD5-BF51-4826-B015-6B44286EC611}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{C0A52D08-D669-4D46-830F-1C59F2253B3C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{C19D1500-6C72-4685-9B50-051922750B4A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{C324B5DB-1ACA-43C1-8F67-6710E38BF813}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{CE61CFA1-4C93-4A52-9364-52EE68D23BAB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{DB505EAA-4BE2-474A-B931-A20FA8DABB0D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{E5E31EC7-5EAD-45F5-AAFC-05FE5F865051}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{E62FFC6A-2A16-485C-A9C0-9E7CCD62EF1F}" = dir=in | app=c:\users\chloe\appdata\local\facebook\video\skype\facebookvideocalling.exe | "{EB7B98B2-7DD9-4B0C-8013-DC79F9426C36}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "{FAEBB0C9-5DF1-4376-B57D-114940767820}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2014\avgnsa.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX410_series" = Canon MX410 series MP Drivers"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables"{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime"{43DBC64B-3DD1-47E2-8788-D3C3B110C574}" = TOSHIBA Bulletin Board"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources"{6C9778CB-2167-402E-B37E-10431C01F4C4}" = AVG 2014"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8C775E70-A791-4DA8-BCC3-6AB7136F4484}" = Visual Studio 2012 x64 Redistributables"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service"{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORMCLauncher"{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition"{FBEE8270-48A4-4C27-9A52-23997142E3E7}" = AVG 2014"AVG" = AVG 2014"CCleaner" = CCleaner"SynTPDeinstKey" = Synaptics Pointing Device Driver [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer"{0FF68F26-416C-4954-ACA5-6AD5F9DE99C1}" = Nero Multimedia Suite 10 Essentials"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions"{2091F234-EB58-4B80-8C96-8EB78C808CF7}" = Facebook Video Calling 3.1.0.521"{2290A680-4083-410A-ADCC-7092C67FC052}" = TOSHIBA Online Product Information"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java 6 Update 20"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger"{2C303EE0-A595-3543-A71A-931C7AC40EDE}" = Microsoft Primary Interoperability Assemblies 2005"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery"{38C52F7D-A6CB-4CE7-A189-8AABE8774D8A}" = TOSHIBA ConfigFree"{3D047C6C-19EE-46E3-C14B-9FA84260DF9B}" = Photo Service - powered by myphotobook"{461F6F0D-7173-4902-9604-AB1A29108AF2}" = TOSHIBA Places Icon Utility"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack"{5BA99779-6E12-49EF-BE49-F35B1EDB4DF9}" = TOSHIBA Wireless LAN Indicator"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10"{6D1221A9-17BF-4EC0-81F2-27D30EC30701}" = Skype Click to Call"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10"{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}" = TOSHIBA Web Camera Application"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TOSHIBA Recovery Media Creator Reminder"{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}" = Skype™ 6.18"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT"{8FDC1610-3FB5-4EF2-A0D0-CEDC3A525A25}" = THE SETTLERS - Heritage of Kings"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English"{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}" = Toshiba Manuals"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader"{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}" = TOSHIBA Media Controller"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9D3D8C60-A55F-4fed-B2B9-173001290E16}" = Realtek WLAN Driver"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR"{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}" = TOSHIBA Assist"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger"{F082CB11-4794-4259-99A1-D91BA762AD15}" = TOSHIBA TEMPRO"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver"{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}" = TOSHIBA Media Controller Plug-in"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 14 ActiveX"AVG Secure Search" = AVG Security Toolbar"Canon MX410 series User Registration" = Canon MX410 series User Registration"eu.myphotobook.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1" = Photo Service - powered by myphotobook"Google Chrome" = Google Chrome"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package"InstallShield_{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver"InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime"InstallShield_{43DBC64B-3DD1-47E2-8788-D3C3B110C574}" = TOSHIBA Bulletin Board"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility"InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}" = TOSHIBA Web Camera Application"InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}" = TOSHIBA Recovery Media Creator Reminder"InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert"InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}" = TRORMCLauncher"InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.0.2.1012"NST" = Norton Identity Safe"Office14.Click2Run" = Microsoft Office Click-to-Run 2010"WinLiveSuite" = Windows Live Essentials ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-1164766913-1964459141-3821851673-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] ========== Last 20 Event Log Errors ========== [ Application Events ]Error - 8/14/2014 5:53:12 PM | Computer Name = chloe-TOSH | Source = Application Error | ID = 1000Description = Faulting application name: shopwit.exe, version: 1.1.0.2, time stamp: 0x5371dc97 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000Exception code: 0xc0000005 Fault offset: 0x5e5fc033 Faulting process id: 0xc4c Faulting application start time: 0x01cfb7f8c27b890f Faulting application path: C:\Users\chloe\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exeFaulting module path: unknown Report Id: 62951798-23fd-11e4-b00c-b870f4c17cda Error - 8/15/2014 5:17:50 AM | Computer Name = chloe-TOSH | Source = WinMgmt | ID = 10Description = Error - 8/15/2014 2:19:38 PM | Computer Name = chloe-TOSH | Source = WinMgmt | ID = 10Description = Error - 8/16/2014 3:51:38 AM | Computer Name = chloe-TOSH | Source = WinMgmt | ID = 10Description = Error - 8/16/2014 6:01:37 AM | Computer Name = chloe-TOSH | Source = WinMgmt | ID = 10Description = Error - 8/16/2014 7:59:04 AM | Computer Name = chloe-TOSH | Source = WinMgmt | ID = 10Description = Error - 8/16/2014 9:17:38 AM | Computer Name = chloe-TOSH | Source = WinMgmt | ID = 10Description = Error - 8/16/2014 3:14:20 PM | Computer Name = chloe-TOSH | Source = WinMgmt | ID = 10Description = Error - 8/17/2014 10:04:20 AM | Computer Name = chloe-TOSH | Source = WinMgmt | ID = 10Description = Error - 8/17/2014 10:58:08 AM | Computer Name = chloe-TOSH | Source = Application Hang | ID = 1002Description = The program InstStub.exe version 20.5.0.28 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 13e4 Start Time: 01cfba2aff423e70 Termination Time: 15 Application Path: C:\Program Files (x86)\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360\2454B0AB\20.5.0.28\InstStub.exe Report Id: [ System Events ]Error - 7/24/2014 2:03:08 PM | Computer Name = chloe-TOSH | Source = NetBT | ID = 4321Description = The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.5. The computer with the IP address 192.168.1.3 did not allow the name to be claimed by this computer. Error - 7/24/2014 2:24:38 PM | Computer Name = chloe-TOSH | Source = Service Control Manager | ID = 7009Description = A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect. Error - 7/24/2014 2:24:38 PM | Computer Name = chloe-TOSH | Source = Service Control Manager | ID = 7000Description = The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: %%1053 Error - 7/26/2014 3:28:29 PM | Computer Name = chloe-TOSH | Source = Service Control Manager | ID = 7011Description = A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Spooler service. Error - 7/26/2014 3:47:17 PM | Computer Name = chloe-TOSH | Source = DCOM | ID = 10010Description = Error - 7/26/2014 3:47:17 PM | Computer Name = chloe-TOSH | Source = Service Control Manager | ID = 7011Description = A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service. Error - 8/10/2014 5:21:26 PM | Computer Name = chloe-TOSH | Source = Service Control Manager | ID = 7023Description = The Windows Time service terminated with the following error: %%1115 Error - 8/13/2014 6:51:21 AM | Computer Name = chloe-TOSH | Source = Service Control Manager | ID = 7024Description = The Windows Search service terminated with service-specific error %%-1073473535. Error - 8/13/2014 6:51:21 AM | Computer Name = chloe-TOSH | Source = Service Control Manager | ID = 7031Description = The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. Error - 8/14/2014 8:53:17 AM | Computer Name = chloe-TOSH | Source = DCOM | ID = 10010Description = < End of report > Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted August 17, 2014 ID:867615 Share Posted August 17, 2014 Hello, They call me TwinHeadedEagle around here, and I'll be working with you. Before we start please read and note the following: Limit your internet access to posting here, some infections just wait to steal typed-in passwords. Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good. Do not paste the logs in your posts, attachments make my work easier. There is a Attach Files option below which you can use to attach your reports. Always attach reports from all tools. Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational. Note that we may live in totally different time zones, what may cause some delays between answers. Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it. If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. I can't foresee everything, so if anything unexpected happens, please stop and inform me! There are no silly questions. Never be afraid to ask if in doubt! P2P/Piracy Warning:If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens, etc. on the system, please remove or uninstall them now and read the policy on Piracy. Scan with Malwarebytes' Anti-Malware Please re-run Malwarebytes' Anti-Malware.First of all, select update.Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.Click the Scan tab, choose Threat Scan is checked and click Scan Now.If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.Upon completion of the scan (or after the reboot), click the History tab.Click Application Logs and double-click the newest Scan Log.At the bottom click Export and choose Text file.Save the file to your desktop and include its content in your next reply. Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.Only one of them will run on your system, that will be the right version. Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Link to post Share on other sites More sharing options...
claws Posted August 17, 2014 Author ID:867648 Share Posted August 17, 2014 Thank you for the quick reply, I have done as suggested and have the requested documents attached Addition.txtFRST.txtmbam-log-2014-08-17(18-36-52).txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted August 17, 2014 ID:867654 Share Posted August 17, 2014 Go to Control Panel and remove:- Yontoo 1.10.02 Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop: Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please attach it to your reply. Fix with AdwCleaner Please download AdwCleaner by Xplode and save the file to your desktop.Right-click on icon and select Run as Administrator to start the tool.Follow the prompts and click Scan.When finished, please click Clean.Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.Please include the contents of that file in your reply.fixlist.txt Link to post Share on other sites More sharing options...
claws Posted August 17, 2014 Author ID:867658 Share Posted August 17, 2014 Setup initialization error comes up when I try to remove by Tarma Installer, if that helps. Are the steps below to be taken after Yontoo is removed, or to assist in removing Yontoo? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted August 17, 2014 ID:867660 Share Posted August 17, 2014 To assist in removing. Link to post Share on other sites More sharing options...
claws Posted August 17, 2014 Author ID:867679 Share Posted August 17, 2014 I have done the FRST scan and scanned on AdwCleaner, but after I clicked 'Clean', a window popped up [AdwCleaner - Closing Programs] with "All programs will be closed in order to proceed correctly to the removal of the infections. Please save any work in progress and then click [OK]". I clicked [OK], but now I am unable to use AdwCleaner as nothing is happening. I can still use laptop but the Cleaner seems to have stopped working. Link to post Share on other sites More sharing options...
claws Posted August 17, 2014 Author ID:867684 Share Posted August 17, 2014 The requested documents have been attached. I have checked Control Panel and see that Yontoo has been removed Many thanks! Is there anything else I need to do?AdwCleanerS0.txtFixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted August 18, 2014 ID:867807 Share Posted August 18, 2014 Yes, we're done. PC is clean Below you will find my thoughts about securing your machine. Go ahead through it, you will benefit from some useful advice about safe computing. Recommended reading:MUST READ - security tips: Computer Security - a short guide to staying safer online. Simple and easy ways to keep your computer safe and secure on the Internet MUST READ - general maintenance: What to do if your Computer is running slowly? Recommended additional software:TFC - to clean unneeded temporary files.Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.McShield - to prevent infections spread by removable media.CryptoPrevent - to secure yourself from very severe CryptoLocker infection.Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.FiheHippo.com Update Checker - to keep your programs up-to-date.Adblock - to surf the web without annoying ads! • The following will implement some post-cleanup procedures: => Please download DelFix by Xplode to your Desktop. Run the tool and check the following boxes below; Remove disinfection tools Create registry backup Purge System Restore Click Run button and wait a few seconds for the programme completes his work.At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt) The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFixTool deletes old system restore points and create a fresh system restore point after cleaning. My help is free for everybody.If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation: Thank you! Stay safe,TwinHeadedEagle Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 21, 2014 Root Admin ID:869212 Share Posted August 21, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts