cherokeechief Posted December 27, 2013 Report Share Posted December 27, 2013 hi there flassh or pete, i am working on my roomys' daughters laptop again. she seems to think it is infected. here is the MBAM log, Malwarebytes Anti-Malware 1.75.0.1300www.malwarebytes.orgDatabase version: v2013.12.27.01Windows XP Service Pack 3 x86 NTFSInternet Explorer 8.0.6001.18702Amber Herslow :: D1GCW1G1 [administrator]12/26/2013 9:26:26 PMmbam-log-2013-12-26 (21-26-26).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 261777Time elapsed: 11 minute(s), 16 second(s)Memory Processes Detected: 1C:\Program Files\Fast Free Converter\FastFreeConverterUpdt.exe (PUP.Optional.FastFreeConverter.A) -> 2852 -> Delete on reboot.Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 22HKCR\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKCR\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKCR\esrv.mysearchdialESrvc.1 (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKCR\esrv.mysearchdialESrvc (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{3004627E-F8E9-4E8B-909D-316753CBA923} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{B67B3DBB-C1C9-49D2-B016-2748B0B5017E} (PUP.Optional.BatBrowse.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B67B3DBB-C1C9-49D2-B016-2748B0B5017E} (PUP.Optional.BatBrowse.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.HKLM\SYSTEM\CurrentControlSet\Services\FastFreeConverterUpdt (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fast Free Converter (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.HKCR\CLSID\{C3E50543-BC36-4C80-8070-38A97E02DEB2} (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C3E50543-BC36-4C80-8070-38A97E02DEB2} (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C3E50543-BC36-4C80-8070-38A97E02DEB2} (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C3E50543-BC36-4C80-8070-38A97E02DEB2} (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.HKCU\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\MYSEARCHDIAL (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.Registry Values Detected: 2HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: zr2X2X1G1S1F2V1S2Q0V -> Quarantined and deleted successfully.HKCU\Software\mysearchdial|TM (PUP.Optional.MySearchDial.A) -> Data: 0138 -> Quarantined and deleted successfully.Registry Data Items Detected: 2HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.MySearchDial.A) -> Bad: (http://start.mysearchdial.com/?f=1&a=dstrmsd&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0BtAyC0FyByDzytBtAyE0DtN0D0Tzu0CyCyByCtN1L2XzutBtFtBtFzztFtCtByEyBtN1L1Czu1Q1B2Z1C1H1B1Q&cr=281256000&ir=) Good: (http://www.google.com) -> Quarantined and repaired successfully.HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.MySearchDial.A) -> Bad: (http://start.mysearchdial.com/?f=1&a=dstrmsd&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0BtAyC0FyByDzytBtAyE0DtN0D0Tzu0CyCyByCtN1L2XzutBtFtBtFzztFtCtByEyBtN1L1Czu1Q1B2Z1C1H1B1Q&cr=281256000&ir=) Good: (http://www.google.com) -> Quarantined and repaired successfully.Folders Detected: 9C:\Program Files\Fast Free Converter (PUP.Optional.FastFreeConverter.A) -> Delete on reboot.C:\Program Files\Fast Free Converter\Extensions (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\Extensions\FastFreeConverter (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\FastFreeConverter (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\My Documents\Optimizer Pro (PUP.Optional.OptimizerPro.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Application Data\mysearchdial (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Application Data\mysearchdial\icons_2.2.8.1247 (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Application Data\mysearchdial\mysearchdial (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Application Data\mysearchdial\UpdateProc (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.Files Detected: 21C:\Documents and Settings\Amber Herslow\My Documents\Downloads\ExtremeMediaPlayer_100_Installer.exe (PUP.Optional.InstallIQ) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\temp\UpdateTask.exe.3065640 (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\temp\is1275519350\1300993_stp.EXE (PUP.Optional.OptimizerPro.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\temp\is1275519350\631452_stp.EXE (PUP.Optional.OptimizerPro.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\temp\is1275519350\1300867_stp\setup.exe (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\temp\is1275519350\631426_stp\BatBrowseSetup.exe (PUP.Optional.BatBrowse.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\temp\ExtremeFlashPlayer\Conduit\SPIdentifier.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\temp\ExtremeFlashPlayer\PIPAskToolbar\Offercast2802_HKCIE_.exe (PUP.Optional.Spigot.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\mysearchdial-speeddial.crx (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\install.ico (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\FastFreeConverterUpdt.exe (PUP.Optional.FastFreeConverter.A) -> Delete on reboot.C:\Program Files\Fast Free Converter\uninstall.exe (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\Extensions\FastFreeConverter\background.html (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\Extensions\FastFreeConverter\content_script.js (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\Extensions\FastFreeConverter\manifest.json (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\FastFreeConverter\FastFreeConverter.dll (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Program Files\Fast Free Converter\FastFreeConverter\uninstall_plugin.exe (PUP.Optional.FastFreeConverter.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\My Documents\Optimizer Pro\CookiesException.txt (PUP.Optional.OptimizerPro.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage (PUP.Optional.FunMoods.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Application Data\mysearchdial\icons_2.2.8.1247\62.ico (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.C:\Documents and Settings\Amber Herslow\Application Data\mysearchdial\icons_2.2.8.1247\80.ico (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.(end) i am going to uninstall my search dial.but if you can think of anything else let me know. i am thinking of upgraading this laptop to windows 7. then i will install her university office pro. Link to post Share on other sites
flashh4 Posted December 27, 2013 Report Share Posted December 27, 2013 Hey Chief, good to see ya !I would run these 2 programs & post the logs back so i can look at them ! 1.AdwCleaner Please download adwcleaner by Xplode onto your desktop.Double click on AdwCleaner.exe to run the tool again. Windows XP : Double click on the icon to run it. Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator" *Click on the Scan button. *AdwCleaner will begin to scan your computer like it did before. *After the scan has finished ....... This time, click on the Clean button. *Press OK when asked to close all programs and follow the onscreen prompts. *Press OK again to allow AdwCleaner to restart the computer and complete the removal process. *After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically. *Copy and paste the contents of that logfile in your next reply. *A copy of that logfile will also be saved in the C:\AdwCleaner folder.NEXT2. Please download Junkware Removal Tool and save to your desk top. Shut down your protection software now to avoid potential conflicts. * Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator". * The tool will open and start scanning your system. * Please be patient as this can take a while to complete depending on your system's specifications. * On completion, a log (JRT.txt) is saved to your desktop and will automatically open. * Post the contents of JRT.txt into your next reply ! Re-Boot your computer now !! Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 laptop not letting me go to those sites it shuts page down each time. will use my pc or macbook and download it there and use external hard drive to put it on this laptop Link to post Share on other sites
flashh4 Posted December 27, 2013 Report Share Posted December 27, 2013 Or try safe mode !! Chuck Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 got them on desk top. running them now. will have logs soon. typing from my desktop.I do have a feeling it is infected good. when I hit keys to type on it, it delays showing what I typed.but will have logs soon that you requested. Link to post Share on other sites
flashh4 Posted December 27, 2013 Report Share Posted December 27, 2013 Thanks buddy ! We may have to run an OTL scan so i can pick threw it also !! Chuck Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 # AdwCleaner v3.016 - Report created 27/12/2013 at 09:56:31# Updated 23/12/2013 by Xplode# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)# Username : Amber Herslow - D1GCW1G1# Running from : C:\Documents and Settings\Amber Herslow\Desktop\adwcleaner.exe# Option : Clean***** [ Services ] ********** [ Files / Folders ] *****Folder Deleted : C:\Documents and Settings\All Users\Application Data\ViewpointFolder Deleted : C:\Program Files\File Type HelperFolder Deleted : C:\Program Files\ViewpointFolder Deleted : C:\Documents and Settings\LocalService\AppData\LocalLow\Fast Free ConverterFolder Deleted : C:\Documents and Settings\NetworkService\AppData\LocalLow\Fast Free ConverterFolder Deleted : C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\AskToolbarFolder Deleted : C:\Documents and Settings\Amber Herslow\AppData\LocalLow\Fast Free ConverterFolder Deleted : C:\Documents and Settings\Administrator\AppData\LocalLow\Fast Free Converter[!] Folder Deleted : C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdffFile Deleted : C:\END***** [ Shortcuts ] ********** [ Registry ] *****Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXEKey Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLLKey Deleted : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLLKey Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlKey Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondaryKey Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWndKey Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMPKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000FKey Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}Key Deleted : HKLM\Software\Fast Free ConverterKey Deleted : HKLM\Software\MetaStreamKey Deleted : HKLM\Software\mysearchdialKey Deleted : HKLM\Software\ViewpointKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayerKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayerKey Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536***** [ Browsers ] *****-\\ Internet Explorer v8.0.6001.18702Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]-\\ Google Chrome v31.0.1650.63[ File : C:\Documents and Settings\LocalService\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]Deleted : homepageDeleted : search_urlDeleted : urls_to_restore_on_startup[ File : C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]Deleted : homepageDeleted : icon_urlDeleted : search_urlDeleted : keywordDeleted : urls_to_restore_on_startup*************************AdwCleaner[R0].txt - [5750 octets] - [27/12/2013 09:55:00]AdwCleaner[s0].txt - [5632 octets] - [27/12/2013 09:56:31]########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [5692 octets] ########## Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.0.8 (11.05.2013:1)OS: Microsoft Windows XP x86Ran by Amber Herslow on Fri 12/27/2013 at 10:01:15.68~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry ValuesSuccessfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\DisplayNameSuccessfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\URL ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Fri 12/27/2013 at 10:06:24.60End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Link to post Share on other sites
flashh4 Posted December 27, 2013 Report Share Posted December 27, 2013 Those 2 does a good job, i like what they can clean ! I think we shoulddo an OTL log which i can pick threw & throw out some unwanted stuff !! Download OldTimer to your desk top !Links: http://oldtimer.geekstogo.com/OTL.com http://oldtimer.geekstogo.com/OTL.scr If you already have a copy of OTL delete it and use this version. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).* Double click OTL.exe to launch the program.* Check the following.o Scan all users.o Standard Output. o Lop check.o Purity check. oExtra Registry > Use SafeList * Under Extra Registry section, select Use SafeList* Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).* When finished it will produce two logs.o OTL.txt (open on your desktop).o Extras.txt (minimised in your taskbar) The Extras.txt file will only appear the very first time you run OTL.* Please post me both logs. This may have to be broken into more than one post ! I will be gone awhile Chief but will look at it and writs a fix later ! Chuck Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 ok chuck. running OTL now. Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 OTL logfile created on: 12/27/2013 10:41:58 AM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Amber Herslow\DesktopWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: | Country: | Language: | Date Format: 2.99 Gb Total Physical Memory | 2.43 Gb Available Physical Memory | 81.28% Memory free4.83 Gb Paging File | 4.36 Gb Available in Paging File | 90.15% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 291.78 Gb Total Space | 187.93 Gb Free Space | 64.41% Space Free | Partition Type: NTFS Computer Name: D1GCW1G1 | User Name: Amber Herslow | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All usersCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013/12/27 10:29:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amber Herslow\Desktop\OTL.comPRC - [2013/12/09 13:38:19 | 003,568,312 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exePRC - [2013/12/09 13:38:19 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exePRC - [2012/10/19 03:44:23 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exePRC - [2012/07/03 08:04:58 | 000,507,312 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exePRC - [2012/02/23 14:57:36 | 000,563,104 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exePRC - [2012/02/23 14:57:34 | 001,885,088 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exePRC - [2012/02/23 14:57:30 | 007,029,664 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exePRC - [2012/02/06 11:17:22 | 000,784,240 | ---- | M] () -- C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exePRC - [2012/02/06 11:17:22 | 000,214,896 | ---- | M] () -- C:\Program Files\Motorola\MotoHelper\MotoHelperService.exePRC - [2008/12/12 17:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exePRC - [2008/12/12 17:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exePRC - [2008/04/13 18:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exePRC - [2007/11/01 14:39:28 | 000,189,736 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Dell\MediaDirect\PCMService.exePRC - [2007/08/28 13:54:58 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\OEM02Mon.exePRC - [2007/07/25 15:32:50 | 000,823,296 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exePRC - [2007/07/25 15:30:36 | 000,974,848 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exePRC - [2007/07/09 21:03:06 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exePRC - [2007/07/03 12:57:38 | 001,228,800 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\quickset.exe ========== Modules (No Company Name) ========== MOD - [2013/12/27 03:56:03 | 002,153,984 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\13122700\algo.dllMOD - [2013/12/09 13:38:21 | 019,336,120 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dllMOD - [2012/02/23 14:57:38 | 000,022,944 | ---- | M] () -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinServicePS.dllMOD - [2012/02/23 14:19:16 | 000,669,696 | ---- | M] () -- C:\Program Files\Belkin\Router Setup and Monitor\gateways\GenericBelkinGatewayLOC.dllMOD - [2012/02/06 11:17:22 | 000,784,240 | ---- | M] () -- C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exeMOD - [2012/02/06 11:17:22 | 000,214,896 | ---- | M] () -- C:\Program Files\Motorola\MotoHelper\MotoHelperService.exeMOD - [2011/09/27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dllMOD - [2011/09/27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dllMOD - [2010/08/22 19:01:36 | 007,187,456 | ---- | M] () -- C:\Program Files\Belkin\Router Setup and Monitor\QtGui4.dllMOD - [2010/08/22 19:01:08 | 000,325,632 | ---- | M] () -- C:\Program Files\Belkin\Router Setup and Monitor\QtXml4.dllMOD - [2010/08/22 19:01:06 | 001,954,304 | ---- | M] () -- C:\Program Files\Belkin\Router Setup and Monitor\QtCore4.dllMOD - [2010/08/22 19:01:06 | 000,847,360 | ---- | M] () -- C:\Program Files\Belkin\Router Setup and Monitor\QtNetwork4.dllMOD - [2010/08/22 18:32:34 | 000,119,808 | ---- | M] () -- C:\Program Files\Belkin\Router Setup and Monitor\imageformats\qjpeg4.dllMOD - [2008/12/12 17:11:26 | 000,148,480 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dllMOD - [2008/12/12 17:11:26 | 000,097,280 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dllMOD - [2007/07/03 12:56:56 | 000,098,304 | ---- | M] () -- C:\Program Files\Dell\QuickSet\dadkeyb.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)SRV - [2013/12/12 17:52:07 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)SRV - [2013/12/09 13:38:19 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)SRV - [2012/10/19 03:44:23 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)SRV - [2012/07/13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)SRV - [2012/02/23 14:57:36 | 000,563,104 | ---- | M] (Affinegy, Inc.) [Auto | Running] -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe -- (AffinegyService)SRV - [2012/02/06 11:17:22 | 000,214,896 | ---- | M] () [Auto | Running] -- C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe -- (MotoHelper)SRV - [2008/12/12 17:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)SRV - [2007/07/25 15:32:34 | 000,294,912 | ---- | M] (Intel® Corporation) [Auto | Stopped] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)DRV - File not found [Kernel | System | Stopped] -- -- (Changer)DRV - File not found [Kernel | Auto | Stopped] -- -- (ASCTRM)DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\AFGMp50.sys -- (AFGMp50)DRV - [2013/12/09 13:38:23 | 000,774,392 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\aswSnx.sys -- (aswSnx)DRV - [2013/12/09 13:38:23 | 000,403,440 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)DRV - [2013/12/09 13:38:23 | 000,178,304 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\aswVmm.sys -- (aswVmm)DRV - [2013/12/09 13:38:23 | 000,070,384 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswMonFlt.sys -- (aswMonFlt)DRV - [2013/12/09 13:38:23 | 000,057,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)DRV - [2013/12/09 13:38:23 | 000,049,944 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\aswRvrt.sys -- (aswRvrt)DRV - [2013/12/09 13:38:23 | 000,035,656 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)DRV - [2013/12/09 13:38:22 | 000,054,832 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)DRV - [2012/10/19 05:36:10 | 000,024,064 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamchameleon.sys -- (mbamchameleon)DRV - [2010/08/22 19:01:54 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AFGSp50.sys -- (AFGSp50)DRV - [2010/07/15 14:18:22 | 000,120,136 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP)DRV - [2008/12/12 17:05:20 | 000,025,264 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\purendis.sys -- (purendis)DRV - [2008/12/12 17:05:18 | 000,023,984 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pnarp.sys -- (pnarp)DRV - [2007/12/02 17:26:22 | 000,989,952 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)DRV - [2007/12/02 17:26:20 | 000,731,136 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)DRV - [2007/12/02 17:26:20 | 000,211,200 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)DRV - [2007/10/10 17:03:00 | 000,235,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OEM02Dev.sys -- (OEM02Dev)DRV - [2007/08/12 17:05:34 | 002,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32)DRV - [2007/07/10 14:07:56 | 000,045,568 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)DRV - [2007/07/10 13:22:22 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)DRV - [2007/07/10 13:22:20 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)DRV - [2007/07/10 13:22:18 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)DRV - [2007/07/09 21:03:04 | 001,222,840 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)DRV - [2007/06/07 17:00:02 | 000,141,376 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\OEM02Afx.sys -- (OEM02Afx)DRV - [2007/03/05 10:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OEM02Vfx.sys -- (OEM02Vfx)DRV - [2003/01/10 14:13:04 | 000,033,588 | R--- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6080415IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6080415IE - HKLM\..\SearchScopes,DefaultScope =IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRCIE - HKLM\..\SearchScopes\{57F8A76D-3B48-0C1C-E432-5477391318CD}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6080415IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6080415IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.comIE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehpIE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-usIE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D8 68 31 3A AA D5 CC 01 [binary data]IE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\..\SearchScopes,DefaultScope = {57F8A76D-3B48-0C1C-E432-5477391318CD}IE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRCIE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\..\SearchScopes\{57F8A76D-3B48-0C1C-E432-5477391318CD}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_enIE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) [2012/07/05 01:04:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Amber Herslow\Application Data\Mozilla\Extensions ========== Chrome ========== CHR - default_search_provider: Mysearchdial (Enabled)CHR - default_search_provider: search_url = http://www.google.comCHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms},CHR - homepage: http://www.google.comCHR - plugin: Shockwave Flash (Disabled) = C:\Program Files\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dllCHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewerCHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dllCHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\31.0.1650.63\pdf.dllCHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dllCHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dllCHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dllCHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dllCHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dllCHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dllCHR - plugin: Java Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dllCHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dllCHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dllCHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dllCHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dllCHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dllCHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dllCHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dllCHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dllCHR - Extension: YouTube = C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\CHR - Extension: Google Search = C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\CHR - Extension: Google Wallet = C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\CHR - Extension: Gmail = C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2012/01/10 13:23:41 | 000,000,736 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.O3 - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)O4 - HKLM..\Run: [DELL Webcam Manager] C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.)O4 - HKLM..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter File not foundO4 - HKLM..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup File not foundO4 - HKLM..\Run: [instaLAN] C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)O4 - HKLM..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)O4 - HKLM..\Run: [intelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)O4 - HKLM..\Run: [OEM02Mon.exe] C:\WINDOWS\OEM02Mon.exe (Creative Technology Ltd.)O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)O4 - HKLM..\Run: [sigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)O4 - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006..\Run: [Facebook Update] C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)O4 - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not foundO6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 0O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1350630042859 (MUWebControl Class)O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Reg Error: Value error.)O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{86F2FA1B-8EDF-4186-BDB8-A4A8287E6054}: DhcpNameServer = 192.168.0.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A553C7CC-D9C6-4B76-83F7-10D36F2D505A}: DhcpNameServer = 192.168.0.1O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)O24 - Desktop WallPaper: C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)O32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *)O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013/12/27 10:34:29 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Amber Herslow\Desktop\OTL.exe[2013/12/27 10:31:38 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Amber Herslow\Desktop\OTL.com[2013/12/27 10:00:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT[2013/12/27 09:54:50 | 000,000,000 | ---D | C] -- C:\AdwCleaner[2013/12/27 09:50:06 | 001,034,531 | ---- | C] (Thisisu) -- C:\Documents and Settings\Amber Herslow\Desktop\JRT.exe[2013/12/26 21:41:20 | 000,000,000 | ---D | C] -- C:\Avenger[2013/12/09 22:17:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Amber Herslow\Application Data\AVAST Software[2013/12/09 13:39:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Avast[6 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/12/27 10:44:00 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{F7167227-9382-4F76-AA43-0BFAFD861441}.job[2013/12/27 10:41:21 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{F6A1802E-4066-497D-B50A-A0B6A95B25FE}.job[2013/12/27 10:41:20 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{4CCF2986-730A-4C58-9877-41609CEF0867}.job[2013/12/27 10:37:01 | 000,001,030 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-3182525879-1036338671-3458721902-1006UA.job[2013/12/27 10:32:56 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amber Herslow\Desktop\OTL.exe[2013/12/27 10:29:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amber Herslow\Desktop\OTL.com[2013/12/27 10:27:03 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job[2013/12/27 10:10:59 | 000,000,364 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job[2013/12/27 10:10:34 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job[2013/12/27 10:10:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2013/12/27 10:10:22 | 3210,780,672 | -HS- | M] () -- C:\hiberfil.sys[2013/12/27 09:51:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job[2013/12/27 09:49:08 | 001,034,531 | ---- | M] (Thisisu) -- C:\Documents and Settings\Amber Herslow\Desktop\JRT.exe[2013/12/27 09:48:50 | 001,233,962 | ---- | M] () -- C:\Documents and Settings\Amber Herslow\Desktop\adwcleaner.exe[2013/12/26 21:57:59 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk[2013/12/26 21:21:34 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk[2013/12/26 21:15:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2013/12/14 17:18:13 | 000,180,240 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2013/12/14 14:39:50 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK[2013/12/14 14:38:29 | 001,350,301 | ---- | M] () -- C:\Documents and Settings\Amber Herslow\My Documents\Employee of the Month.TPX[2013/12/12 17:52:07 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe[2013/12/12 17:52:07 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl[2013/12/12 17:35:25 | 000,076,288 | ---- | M] () -- C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2013/12/09 13:39:03 | 000,001,733 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk[2013/12/09 13:38:23 | 000,774,392 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys[2013/12/09 13:38:23 | 000,403,440 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys[2013/12/09 13:38:23 | 000,178,304 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswVmm.sys[2013/12/09 13:38:23 | 000,070,384 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys[2013/12/09 13:38:23 | 000,057,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys[2013/12/09 13:38:23 | 000,049,944 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys[2013/12/09 13:38:23 | 000,035,656 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys[2013/12/09 13:38:22 | 000,269,216 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe[2013/12/09 13:38:22 | 000,054,832 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys[2013/12/09 13:38:22 | 000,043,152 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr[2013/12/09 13:33:56 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT[2013/12/09 13:31:39 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk ========== Files Created - No Company Name ========== [2013/12/27 09:50:00 | 001,233,962 | ---- | C] () -- C:\Documents and Settings\Amber Herslow\Desktop\adwcleaner.exe[2013/12/26 21:57:59 | 000,002,347 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk[2013/12/26 21:57:59 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk[2013/12/14 14:38:28 | 001,350,301 | ---- | C] () -- C:\Documents and Settings\Amber Herslow\My Documents\Employee of the Month.TPX[2013/03/24 19:33:31 | 000,178,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswVmm.sys[2013/03/24 19:33:30 | 000,049,944 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys[2012/10/19 05:36:10 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\mbamchameleon.sys[2012/07/05 01:33:19 | 000,000,024 | ---- | C] () -- C:\Documents and Settings\Amber Herslow\random.dat[2012/02/14 19:15:07 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll[2012/01/06 23:36:02 | 000,017,440 | -HS- | C] () -- C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\31oqw21kkb8154eksir36vspai7ts81lfb3n62e0g86arc[2012/01/06 23:36:02 | 000,017,440 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\31oqw21kkb8154eksir36vspai7ts81lfb3n62e0g86arc[2010/07/05 14:17:16 | 000,016,384 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\atscie.msi[2010/02/01 10:56:43 | 000,000,138 | ---- | C] () -- C:\Documents and Settings\Amber Herslow\webct_upload_applet.properties[2009/09/06 08:13:09 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\fusioncache.dat[2008/04/25 16:00:44 | 000,076,288 | ---- | C] () -- C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== ZeroAccess Check ========== [2004/08/10 12:09:48 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/13 18:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 06:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 18:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both ========== LOP Check ========== [2013/11/06 15:11:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1[2013/03/28 15:12:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Affinegy[2013/12/09 13:34:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software[2013/03/28 15:16:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Belkin[2010/10/11 17:41:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Electronic Arts[2012/01/10 09:34:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ErrorEND[2009/10/23 18:59:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nova Development[2011/12/23 20:06:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PictureMover[2013/11/06 14:43:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP[2009/10/23 19:56:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems[2008/04/15 14:39:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall[2011/12/23 20:06:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Walgreens PictureMover[2010/04/05 22:22:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}[2009/10/14 08:53:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}[2013/12/09 22:17:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\AVAST Software[2013/06/11 13:18:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\Motorola[2009/10/23 18:59:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\Nova Development[2011/12/23 20:06:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\PictureMover[2010/03/22 18:32:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\tmp[2009/10/23 19:56:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\Ulead Systems[2008/09/28 17:30:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\W Photo Studio Viewer[2012/01/10 14:59:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\Windows Desktop Search[2012/10/19 00:02:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Amber Herslow\Application Data\Windows Search[2009/07/19 23:09:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\SACore ========== Purity Check ========== < End of report > Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 OTL Extras logfile created on: 12/27/2013 10:41:58 AM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Amber Herslow\DesktopWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: | Country: | Language: | Date Format: 2.99 Gb Total Physical Memory | 2.43 Gb Available Physical Memory | 81.28% Memory free4.83 Gb Paging File | 4.36 Gb Available in Paging File | 90.15% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 291.78 Gb Total Space | 187.93 Gb Free Space | 64.41% Space Free | Partition Type: NTFS Computer Name: D1GCW1G1 | User Name: Amber Herslow | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All usersCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) [HKEY_USERS\S-1-5-21-3182525879-1036338671-3458721902-1006\SOFTWARE\Classes\<extension>].html [@ = ChromeHTML] -- Reg Error: Key error. File not found ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*exefile [open] -- "%1" %*http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- C:\Program Files\File Type Helper\FileTypeHelper.exe "%1"Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"FirstRunDisabled" = 1"AntiVirusOverride" = 1"FirewallOverride" = 0"AntiVirusDisableNotify" = 0"FirewallDisableNotify" = 0"UpdatesDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]"Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]"Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"EnableFirewall" = 0"DoNotAllowExceptions" = 0"DisableNotifications" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DoNotAllowExceptions" = 0"DisableNotifications" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In) ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard Co.)"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe"C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe" = C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe:LocalSubNet:Enabled:Belkin Setup -- (Affinegy, Inc.) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)"C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" = C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe:*:Enabled:DellWMgr -- (Creative Technology Ltd.)"C:\Program Files\McAfee\SiteAdvisor\McSACore.exe" = C:\Program Files\McAfee\SiteAdvisor\McSACore.exe:*:Enabled:McSACore"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard Co.)"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Co.)"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Disabled:AOL Application Loader -- (America Online, Inc.)"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour Service -- (Apple Inc.)"C:\Program Files\Dell\MediaDirect\PCMService.exe" = C:\Program Files\Dell\MediaDirect\PCMService.exe:*:Disabled:CyberLink PowerCinema Resident Program -- (CyberLink Corp.)"C:\Program Files\FrostWire\FrostWire.exe" = C:\Program Files\FrostWire\FrostWire.exe:*:Disabled:FrostWire"C:\Program Files\FrostWire 5\FrostWire.exe" = C:\Program Files\FrostWire 5\FrostWire.exe:*:Disabled:FrostWire"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" = C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe:*:Disabled:GoogleDesktop"C:\WINDOWS\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"C:\Program Files\Digital Line Detect\DLG.exe" = C:\Program Files\Digital Line Detect\DLG.exe:LocalSubNet:Enabled:DLG -- (Avanquest Software )"C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\Amber Herslow\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin -- (Skype Limited)"C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe" = C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe:LocalSubNet:Enabled:Belkin Setup -- (Affinegy, Inc.)"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}" = Apple Mobile Device Support"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan"{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}" = mSSO"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE"{113DE59D-B57A-4075-9D4F-5803DFA69EB7}" = Walgreens PictureMover"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java 6 Update 15"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{3B1A4366-8DFA-4582-91F6-27F7A4714FCC}" = Pure Networks Platform"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA"{42E2EEB2-D48E-4A47-B181-32ECA031D93B}" = DJ_AIO_06_F2400_SW_Min"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant"{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support"{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}" = mHlpDell"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online"{5360DF11-A876-460B-9953-6817AA2BF9D5}" = Photo Explosion Deluxe"{595D0DE8-C38A-4432-B851-47DECC1A99BD}" = HP Unload DLL Patch"{5E453519-60F6-4A4D-A0BF-16663F9B3536}" = Safari"{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2}" = EarthLink Setup Files"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3"{6BAA71B6-8F43-4C72-931A-3354ABB0258A}" = F2400"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = The Simsâ„¢ 3 High-End Loft Stuff"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = The Simsâ„¢ 3 Ambitions"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting"{97F2E8BE-3018-47D2-BC2D-F0B5E92D1BF3}" = Motorola Mobile Drivers Installation 5.5.0"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.03)"{B0DF58A2-40DF-4465-AA56-38623EC9938C}" = Documentation & Support Launcher"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR"{B6884A07-0305-47AE-9969-8F26FADC17DE}" = Games, Music, & Photos Launcher"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = The Simsâ„¢ 3 World Adventures"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Simsâ„¢ 3"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2"{C197BC08-3D82-4651-8886-E68C21578A38}" = iTunes"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1"{CDBF8C2D-04B0-4F9B-9AE1-7422F7F0EC94}" = HP Deskjet F2400 All-In-One Driver Software 13.0 Rel .6"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skypeâ„¢ 5.10"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool"{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin"Adobe Shockwave Player" = Adobe Shockwave Player 11.6"Advanced Audio FX Engine" = Advanced Audio FX Engine"Advanced Video FX Engine" = Advanced Video FX Engine"avast" = avast! Free Antivirus"Belkin Setup and Router Monitor_is1" = Belkin Setup and Router Monitor"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011) "Dell Webcam Center" = Dell Webcam Center"Dell Webcam Manager" = Dell Webcam Manager"EADM" = EA Download Manager"Google Chrome" = Google Chrome"HDMI" = Intel® Graphics Media Accelerator Driver"HOMESTUDENTR" = Microsoft Office Home and Student 2007"HP Print Projects" = HP Print Projects 1.0"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs"ie7" = Windows Internet Explorer 7"ie8" = Windows Internet Explorer 8"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1"MotoHelper" = MotoHelper 2.1.41 Driver 5.5.0"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP"Network MagicUninstall" = Network Magic"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs"ProInst" = Intel® PROSet/Wireless Software"QuickTime 3.0" = QuickTime 3.0"RealPlayer 6.0" = RealPlayer Basic"SearchAssist" = SearchAssist"SynTPDeinstKey" = Dell Touchpad"Windows Media Format Runtime" = Windows Media Format 11 runtime"Windows Media Player" = Windows Media Player 11"Windows XP Service Pack" = Windows XP Service Pack 3"WinLiveSuite_Wave3" = Windows Live Essentials"WMFDist11" = Windows Media Format 11 runtime"wmp11" = Windows Media Player 11"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 ========== Last 20 Event Log Errors ========== [ Application Events ]Error - 12/27/2013 12:02:49 AM | Computer Name = D1GCW1G1 | Source = Application Error | ID = 1000Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting module unknown, version 0.0.0.0, fault address 0x023a78c8. Error - 12/27/2013 12:03:13 AM | Computer Name = D1GCW1G1 | Source = Application Error | ID = 1000Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting module unknown, version 0.0.0.0, fault address 0x023e78c8. Error - 12/27/2013 12:15:40 AM | Computer Name = D1GCW1G1 | Source = Application Hang | ID = 1002Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 12/27/2013 12:36:25 AM | Computer Name = D1GCW1G1 | Source = Windows Search Service | ID = 3013Description = The entry <C:\PROGRAM FILES\ADOBE\READER 11.0\ESL\AIODLITE.DLL> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error - 12/27/2013 12:36:25 AM | Computer Name = D1GCW1G1 | Source = Windows Search Service | ID = 3013Description = The entry <C:\PROGRAM FILES\ADOBE\READER 11.0\ESL\AIODLITE.DLL> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error - 12/27/2013 12:36:40 AM | Computer Name = D1GCW1G1 | Source = Windows Search Service | ID = 3013Description = The entry <C:\PROGRAM FILES\ADOBE\READER 11.0\READER\AIR\NPPDF32.DLL> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error - 12/27/2013 12:36:40 AM | Computer Name = D1GCW1G1 | Source = Windows Search Service | ID = 3013Description = The entry <C:\PROGRAM FILES\ADOBE\READER 11.0\READER\AIR\NPPDF32.DLL> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error - 12/27/2013 11:44:09 AM | Computer Name = D1GCW1G1 | Source = Application Error | ID = 1000Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting module unknown, version 0.0.0.0, fault address 0x023e78c8. Error - 12/27/2013 12:03:42 PM | Computer Name = D1GCW1G1 | Source = Windows Search Service | ID = 3013Description = The entry <C:\WINDOWS\SOFTWAREDISTRIBUTION\DATASTORE\LOGS\TMP.EDB> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error - 12/27/2013 12:40:00 PM | Computer Name = D1GCW1G1 | Source = Application Hang | ID = 1002Description = Hanging application OTL.exe, version 3.2.69.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. [ OSession Events ]Error - 7/5/2010 4:08:12 PM | Computer Name = D1GCW1G1 | Source = Microsoft Office 12 Sessions | ID = 7001Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.6021.5000. This session lasted 710 seconds with 300 seconds of active time. This session ended with a crash. [ System Events ]Error - 12/27/2013 11:58:39 AM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7003Description = The Intel® PROSet/Wireless Service service depends on the following nonexistent service: s24trans Error - 12/27/2013 11:58:39 AM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7001Description = The Network DDE service depends on the Network DDE DSDM service which failed to start because of the following error: %%1058 Error - 12/27/2013 11:58:39 AM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7000Description = The ASCTRM service failed to start due to the following error: %%2 Error - 12/27/2013 11:58:39 AM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7023Description = The Human Interface Device Access service terminated with the following error: %%126 Error - 12/27/2013 11:58:39 AM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7001Description = The Intel® PROSet/Wireless SSO Service service depends on the Intel® PROSet/Wireless Service service which failed to start because of the followingerror: %%1075 Error - 12/27/2013 12:10:46 PM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7003Description = The Intel® PROSet/Wireless Service service depends on the following nonexistent service: s24trans Error - 12/27/2013 12:10:46 PM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7001Description = The Network DDE service depends on the Network DDE DSDM service which failed to start because of the following error: %%1058 Error - 12/27/2013 12:10:46 PM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7000Description = The ASCTRM service failed to start due to the following error: %%2 Error - 12/27/2013 12:10:46 PM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7023Description = The Human Interface Device Access service terminated with the following error: %%126 Error - 12/27/2013 12:10:46 PM | Computer Name = D1GCW1G1 | Source = Service Control Manager | ID = 7001Description = The Intel® PROSet/Wireless SSO Service service depends on the Intel® PROSet/Wireless Service service which failed to start because of the followingerror: %%1075 < End of report > Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 will wait for your reply Link to post Share on other sites
flashh4 Posted December 27, 2013 Report Share Posted December 27, 2013 Chief, sorry .......... great grandpa seems to have that touch of putting her to sleep !! FrostWire there was some references to this P2P program ! Might want to give her a speech if she's still using it !! ========================== We need to Run an OTL fix !!Warning This fix is only relevant for this system and no other, using on another computer may cause problems.Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot * Double-click OTL.exe to start the program. * Copy and Paste the following code into the . text box of the OTL tool/program ! Start with and include the colon plus :OTL:OTLSRV - File not found [Auto | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)DRV - File not found [Kernel | System | Stopped] -- -- (Changer)DRV - File not found [Kernel | Auto | Stopped] -- -- (ASCTRM)DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\AFGMp50.sys -- (AFGMp50)IE - HKLM\..\SearchScopes,DefaultScope =IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRCIE - HKLM\..\SearchScopes\{57F8A76D-3B48-0C1C-E432-5477391318CD}: "URL" = http://www.google.co...g}&sourceid=ie7IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/searchIE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =IE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\..\SearchScopes,DefaultScope = {57F8A76D-3B48-0C1C-E432-5477391318CD}IE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRCIE - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\..\SearchScopes\{57F8A76D-3B48-0C1C-E432-5477391318CD}: "URL" = http://www.google.co...&rlz=1I7GGLL_enFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found[2012/07/05 01:04:48 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Amber Herslow\Application Data\Mozilla\ExtensionsO3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.O3 - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.O4 - HKLM..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter File not foundO4 - HKLM..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup File not foundO4 - HKU\S-1-5-21-3182525879-1036338671-3458721902-1006..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not found :Commands[emptyjava][emptyflash][EMPTYTEMP][RESETHOSTS][CREATERESTOREPOINT][Reboot]# Then click the Run Fix button at the top.# Click # Please post the contents of the fix log file back here if you are prompted to open the file. It can also be found at C:\_OTL\Moved Files as MMDDYYY_HHMMSS.log where MMDDYYY is date format and HHMMSS is time format.Remember to enable your real time protection. Post that next !!! Chuck Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 All processes killed========== OTL ==========Service HidServ stopped successfully!Service HidServ deleted successfully!File %SystemRoot%\System32\hidserv.dll not found.Service AppMgmt stopped successfully!Service AppMgmt deleted successfully!File %SystemRoot%\System32\appmgmts.dll not found.Service WDICA stopped successfully!Service WDICA deleted successfully!Service PDRFRAME stopped successfully!Service PDRFRAME deleted successfully!Service PDRELI stopped successfully!Service PDRELI deleted successfully!Service PDFRAME stopped successfully!Service PDFRAME deleted successfully!Service PDCOMP stopped successfully!Service PDCOMP deleted successfully!Service PCIDump stopped successfully!Service PCIDump deleted successfully!Service lbrtfdc stopped successfully!Service lbrtfdc deleted successfully!Service Changer stopped successfully!Service Changer deleted successfully!Service ASCTRM stopped successfully!Service ASCTRM deleted successfully!Service AFGMp50 stopped successfully!Service AFGMp50 deleted successfully!File System32\Drivers\AFGMp50.sys not found.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{57F8A76D-3B48-0C1C-E432-5477391318CD}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57F8A76D-3B48-0C1C-E432-5477391318CD}\ not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!HKEY_USERS\S-1-5-21-3182525879-1036338671-3458721902-1006\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!Registry key HKEY_USERS\S-1-5-21-3182525879-1036338671-3458721902-1006\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.Registry key HKEY_USERS\S-1-5-21-3182525879-1036338671-3458721902-1006\Software\Microsoft\Internet Explorer\SearchScopes\{57F8A76D-3B48-0C1C-E432-5477391318CD}\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57F8A76D-3B48-0C1C-E432-5477391318CD}\ not found.Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.C:\Documents and Settings\Amber Herslow\Application Data\Mozilla\Extensions folder moved successfully.Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.Registry value HKEY_USERS\S-1-5-21-3182525879-1036338671-3458721902-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DellSupportCenter deleted successfully.Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Google Desktop Search deleted successfully.Registry value HKEY_USERS\S-1-5-21-3182525879-1036338671-3458721902-1006\Software\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.========== COMMANDS ========== [EMPTYJAVA] User: Administrator User: All Users User: Amber Herslow->Java cache emptied: 6611579 bytes User: Default User User: LocalService User: NetworkService User: Owner Total Java Files Cleaned = 6.00 mb [EMPTYFLASH] User: Administrator->Flash cache emptied: 0 bytes User: All Users User: Amber Herslow->Flash cache emptied: 506 bytes User: Default User->Flash cache emptied: 0 bytes User: LocalService->Flash cache emptied: 0 bytes User: NetworkService->Flash cache emptied: 0 bytes User: Owner Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: Administrator->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 137269 bytes->Flash cache emptied: 0 bytes User: All Users User: Amber Herslow->Temp folder emptied: 2735688 bytes->Temporary Internet Files folder emptied: 11000770 bytes->Java cache emptied: 0 bytes->Google Chrome cache emptied: 352766455 bytes->Apple Safari cache emptied: 0 bytes->Flash cache emptied: 0 bytes User: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33170 bytes->Flash cache emptied: 0 bytes User: LocalService->Temp folder emptied: 66016 bytes->Temporary Internet Files folder emptied: 1207716 bytes->Google Chrome cache emptied: 819568 bytes->Flash cache emptied: 0 bytes User: NetworkService->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 33170 bytes->Flash cache emptied: 0 bytes User: Owner->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 0 bytes%systemroot%\System32 .tmp files removed: 0 bytes%systemroot%\System32\dllcache .tmp files removed: 0 bytes%systemroot%\System32\drivers .tmp files removed: 0 bytesWindows Temp folder emptied: 0 bytes%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 642726225 bytes%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytesRecycleBin emptied: 0 bytes Total Files Cleaned = 965.00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.HOSTS file reset successfullyRestore point Set: OTL Restore Point OTL by OldTimer - Version 3.2.69.0 log created on 12272013_131239Files\Folders moved on Reboot...File\Folder C:\WINDOWS\temp\_avast_\Webshlock.txt not found!PendingFileRenameOperations files...Registry entries deleted on Reboot... Link to post Share on other sites
flashh4 Posted December 27, 2013 Report Share Posted December 27, 2013 That looks good ! Clean up with OTL Right-click OTL.exe and select " Run as administrator " to run it. This will remove all the tools we used to clean your pc. Close all other programs apart from OTL as this step will require a reboot On the OTL main screen, press the CleanUp! button Say Yes to the prompt and then allow the program to reboot your computer.You can now delete any tools we used if they remain on your Desktop. I think that should show a big improvment in performance after a few normal re-boots !! How's it running ?? Chuck Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 will let you know after bit. had to do dishes. Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 so far looks good. well let know after a few restarts. may remove some unnessasary programs. like her belkin.she has java, but does she really need it? Link to post Share on other sites
flashh4 Posted December 27, 2013 Report Share Posted December 27, 2013 If she plays some games it is needed so leave that up to you & her ! My wife has to have it to play POGO games !! Link to post Share on other sites
cherokeechief Posted December 27, 2013 Author Report Share Posted December 27, 2013 ill find out what she wants to keep. she is more than likely at work at the hospital. she is off right now from college. she has 1.5 years left til she is a RN.I might still upgrade her system to win 7, since XP is losing support soon. Link to post Share on other sites
flashh4 Posted December 27, 2013 Report Share Posted December 27, 2013 Good idea to upgrade soon seeing how XP will stop supporting it !Good for her sticking it our to become a RN. I have a niece that's a RN & her mother is a nurse practictoner ! And the husband is a Lab Tech so the whole family is into Medicine !! Let us know how it's running in a few days ! Stay Safe Chief ! Chuck Link to post Share on other sites
flashh4 Posted January 2, 2014 Report Share Posted January 2, 2014 After 5 days with no reply, this topic will be locked ! If you need it re-opened please PM me or any Mod !! ThanksChuck Link to post Share on other sites
Recommended Posts