Solved getting redirected again

[Resolved] getting redirected again

Hi, i was trying to download adobe, after it downloaded, i'm getting redirected, i see stuff like adyealdmanager and serachconduit. There is also a search box in the upper bar now that wasn't there before. I ran advast, found nothing, ran superantispyware and it found several threats and one trogen. I ran the advast again on quick scan and it had several items it said it couldn't find. so here are the logs:
Internet Explorer 9.0.8112.16421
jerry :: JERRY-PC [administrator]

5/28/2013 6:37:55 AM
mbam-log-2013-05-28 (06-37-55).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 212928
Time elapsed: 15 minute(s), 18 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Home Basic
Boot Device: \Device\HarddiskVolume2
Install Date: 12/15/2008 1:48:52 PM
System Uptime: 5/28/2013 6:08:55 AM (0 hours ago)
.
Motherboard: Acer | | Nile
Processor: AMD Athlon(tm) Processor 2650e | Socket M2/S1G1 | 1600/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 70 GiB total, 27.061 GiB free.
D: is FIXED (NTFS) - 70 GiB total, 69.315 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Acer Assist
Acer Empowering Technology
Acer eRecovery Management
Acer Mobility Center Plug-In
Acer Registration
Acrobat.com
Adobe Flash Player 11 ActiveX
Aloha Solitaire
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft VideoImpression 2
ATI Catalyst Install Manager
ATT-PRT22
avast! Free Antivirus
BellSouth FastAccess DSL Help Center
Cake Mania Main Street
Cake Mania: To the Max!
Canon Easy-PhotoPrint EX
Canon Easy-WebPrint EX
Canon MP Navigator EX 4.0
Canon MP280 series MP Drivers
Canon MP280 series User Registration
Canon My Printer
Canon Solution Menu EX
Catalina Savings Printer
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization Czech
Catalyst Control Center Localization Danish
Catalyst Control Center Localization Dutch
Catalyst Control Center Localization Finnish
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Greek
Catalyst Control Center Localization Hungarian
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Norwegian
Catalyst Control Center Localization Polish
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Russian
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Swedish
Catalyst Control Center Localization Thai
Catalyst Control Center Localization Turkish
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CDBurnerXP
Compatibility Pack for the 2007 Office system
Coupon Printer for Windows
Cradle of Persia
DefaultTab
Diamond Detective
Diner Dash
Diner Dash 2
Download Updater (AOL Inc.)
Free Ride Games Player
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Photo Creations
InterVideo WinDVD 8
Intuit SiteBuilder
Java 7 Update 7
Java(TM) 6 Update 31
Launch Manager
Lernout & Hauspie TruVoice American English TTS Engine
LightScribe 1.4.142.1
Malwarebytes Anti-Malware version 1.75.0.1300
Micro Innovations Optical Scroll Mouse
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Office 2000 Small Business
Microsoft Office Suite Activation Assistant
Microsoft Silverlight
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual J# 2.0 Redistributable Package
Microsoft Works
MixiDJ V31 Toolbar
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2721691)
MSXML 4.0 SP3 Parser (KB2758694)
MSXML 4.0 SP3 Parser (KB973685)
MyDSC2
Mystery P.I. - The Vegas Heist (remove only)
Orion
PlayMemories Home
Primo
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Runtime
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Sing Along
Skins
Skype™ 6.3
Street Atlas USA 8.0
SUPERAntiSpyware
swMSM
Synaptics Pointing Device Driver
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
VIVA MEDIA GAME CENTER
WOT for Internet Explorer
ZEN Entertainment
.
==== End Of File ===========================


DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 9.0.8112.16483
Run by jerry at 6:55:00 on 2013-05-28
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2813.1533 [GMT -4:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Free Ride Games\GPlayer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\taskeng.exe
C:\Windows\notepad.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k netsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
uURLSearchHooks: MixiDJ V31 Toolbar: {988919ff-0cd8-4d0c-bc7e-60d55a49eb64} - c:\program files\mixidj_v31\prxtbMixi.dll
mURLSearchHooks: MixiDJ V31 Toolbar: {988919ff-0cd8-4d0c-bc7e-60d55a49eb64} - c:\program files\mixidj_v31\prxtbMixi.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>
BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll
BHO: Sing Along: {6492E171-2427-4932-B414-33574A089F5E} - c:\program files\singalong\singalng.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} - c:\users\jerry\appdata\roaming\defaulttab\defaulttab\DefaultTabBHO.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: MixiDJ V31 Toolbar: {988919ff-0cd8-4d0c-bc7e-60d55a49eb64} - c:\program files\mixidj_v31\prxtbMixi.dll
BHO: WOT Helper: {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - c:\program files\wot\WOT.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: WOT: {71576546-354D-41C9-AAE8-31F2EC22BF0D} - c:\program files\wot\WOT.dll
TB: MixiDJ V31 Toolbar: {988919FF-0CD8-4D0C-BC7E-60D55A49EB64} - c:\program files\mixidj_v31\prxtbMixi.dll
TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
TB: WOT: {71576546-354D-41c9-AAE8-31F2EC22BF0D} - c:\program files\wot\WOT.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: MixiDJ V31 Toolbar: {988919ff-0cd8-4d0c-bc7e-60d55a49eb64} - c:\program files\mixidj_v31\prxtbMixi.dll
EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [Exetender] "c:\program files\free ride games\GPlayer.exe" /runonstartup
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe "
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [CanonSolutionMenuEx] c:\program files\canon\solution menu ex\CNSEMAIN.EXE /logon
mRun: [PMBVolumeWatcher] c:\program files\sony\playmemories home\PMBVolumeWatcher.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRun: [Exetender] "c:\program files\free ride games\GPlayer.exe" /runonstartup
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/Arctic%20Quest%202/Images/armhelper.ocx
TCP: NameServer = 10.0.0.1
TCP: Interfaces\{1E6644C9-C18A-4664-A766-F3140C986261} : DHCPNameServer = 10.0.0.1
TCP: Interfaces\{4936F3D3-BDF4-442B-B0A1-A396ACE2AEE6} : DHCPNameServer = 192.168.1.254 192.168.1.254
TCP: Interfaces\{B57DE832-10A4-4AB6-A41E-080FD9154FD3} : DHCPNameServer = 192.168.1.254 192.168.1.254
TCP: Interfaces\{D00B9979-42B9-4910-94EB-250C116767D1} : DHCPNameServer = 192.168.1.254 192.168.1.254
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2013-5-1 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2013-5-1 174664]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-9-9 765736]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-9-9 368944]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-8-11 116608]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-9-9 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-9-9 66336]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-9-9 46808]
R2 DefaultTabUpdate;DefaultTabUpdate;c:\users\jerry\appdata\roaming\defaulttab\defaulttab\DTUpdate.exe [2013-5-27 107520]
R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2008-12-15 24576]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\sony\playmemories home\PMBDeviceInfoProvider.exe [2012-3-16 476728]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]
R2 X6XSEx_Pr143;X6XSEx_Pr143;c:\program files\free ride games\X6XSEx_Pr143.sys [2013-1-4 47432]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-4-19 161384]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2013-05-28 10:30:49 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-05-27 11:08:44 -------- d-----w- c:\program files\Uninstaller
2013-05-27 11:07:07 -------- d-----w- c:\program files\Conduit
2013-05-27 11:06:28 -------- d-----w- c:\users\jerry\appdata\local\Conduit
2013-05-27 11:06:28 -------- d-----w- c:\program files\MixiDJ_V31
2013-05-27 11:05:38 -------- d-----w- c:\program files\DefaultTab
2013-05-27 11:04:33 -------- d-----w- c:\users\jerry\appdata\roaming\DefaultTab
2013-05-27 11:02:35 -------- d-----w- c:\program files\SingAlong
2013-05-24 16:50:10 7016152 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{1b0d1fe1-0b7d-4283-a9d0-a29efd7ddcd6}\mpengine.dll
2013-05-16 07:38:36 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2013-05-16 07:02:59 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-15 10:06:42 638328 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 10:06:42 37376 ----a-w- c:\windows\system32\cdd.dll
2013-05-15 10:05:57 2049024 ----a-w- c:\windows\system32\win32k.sys
2013-05-14 01:16:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-05-12 21:47:41 4096000 ----a-w- c:\program files\GUT66CE.tmp
2013-05-12 21:47:41 -------- d-----w- c:\program files\GUM66CD.tmp
2013-05-02 12:38:01 2162336 ----a-w- c:\users\jerry\appdata\local\BcsKtYcHW.dll
2013-05-01 14:04:29 174664 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-05-01 14:04:27 49376 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
.
==================== Find3M ====================
.
2013-05-15 02:58:15 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 02:58:14 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-09 08:59:10 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-05-09 08:59:09 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:58:37 41664 ----a-w- c:\windows\avastSS.scr
2013-05-02 06:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-04 22:11:34 1800704 ----a-w- c:\windows\system32\jscript9.dll
2013-04-04 22:02:17 1129472 ----a-w- c:\windows\system32\wininet.dll
2013-04-04 21:58:51 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-04 21:57:45 420864 ----a-w- c:\windows\system32\vbscript.dll
2013-03-11 13:25:50 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25:50 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45:04 49152 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-09 01:28:08 64000 ----a-w- c:\windows\system32\smss.exe
2013-03-08 03:53:50 376320 ----a-w- c:\windows\system32\winsrv.dll
2013-03-08 03:52:22 2067968 ----a-w- c:\windows\system32\mstscax.dll
2013-03-03 19:07:52 1082232 ----a-w- c:\windows\system32\drivers\ntfs.sys
.
============= FINISH: 6:56:53.55 ===============
thanks, jerry

 

internet explorer is the browser

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : jerry [Admin rights]
Mode : Remove -- Date : 05/28/2013 20:00:45
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD16 00BEVT-22ZCT0 SCSI Disk Device +++++
--- User ---
[MBR] 3cc9fe40bde09045362c2c919a02afed
[BSP] 0f071cfbe77f754bc10c577fc5353435 : Acer MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 10244 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 20981760 | Size: 71192 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 166782976 | Size: 71189 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[2]_D_05282013_02d2000.txt >>
RKreport[1]_S_05282013_02d1957.txt ; RKreport[2]_D_05282013_02d2000.txt


mbar scan found nothing

 

still getting redirected alot, even when i came in here and clicked on malware subtitle to get to this post. and getting alot of internet explore not responding.

 

ok, i ran the combofix, it must of restarted my computer cause when i got back to check how the scan was going, i noticed my advast was running, i disabled it until restart, so i dont know if that makes any difference. When i just now came in here to post the log, when i clicked on malware forum, a window still opened to a site that the wot says is bad, not sure if this is a redirect or what, here is the log
ComboFix 13-05-30.01 - jerry 05/29/2013 18:28:10.5.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2813.1453 [GMT -4:00]
Running from: c:\users\jerry\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\DefaultTab
c:\program files\DefaultTab\DefaultTab.crx
c:\program files\DefaultTab\uid
c:\users\jerry\AppData\Local\BcsKtYcHW.dll
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\addon.ico
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\amazon_ie.ico
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.cfg
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabStart.exe
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabStart64.exe
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabUninstaller.exe
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabWrap.dll
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabWrap64.dll
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DT.ico
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\ebay_ie.ico
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\facebook_ie.ico
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\search_ie.ico
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\searchhere.ico
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\twitter_ie.ico
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\uninstalldt.exe
c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\wikipedia_ie.ico
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_DefaultTabUpdate
-------\Service_DefaultTabUpdate
.
.
((((((((((((((((((((((((( Files Created from 2013-04-28 to 2013-05-29 )))))))))))))))))))))))))))))))
.
.
2013-05-29 22:50 . 2013-05-29 23:00 -------- d-----w- c:\users\jerry\AppData\Local\temp
2013-05-29 22:50 . 2013-05-29 22:50 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-05-29 22:50 . 2013-05-29 22:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-29 00:09 . 2013-05-29 00:31 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-05-28 21:54 . 2013-05-13 06:19 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{05BE149A-2A47-4C41-A1DD-D46487BCB561}\mpengine.dll
2013-05-28 10:30 . 2013-04-04 18:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-05-27 11:08 . 2013-05-27 11:08 -------- d-----w- c:\program files\Uninstaller
2013-05-27 11:07 . 2013-05-27 11:07 -------- d-----w- c:\program files\Conduit
2013-05-27 11:06 . 2013-05-27 11:06 -------- d-----w- c:\program files\MixiDJ_V31
2013-05-27 11:06 . 2013-05-27 11:06 -------- d-----w- c:\users\jerry\AppData\Local\Conduit
2013-05-27 11:04 . 2013-05-29 22:49 -------- d-----w- c:\users\jerry\AppData\Roaming\DefaultTab
2013-05-27 11:02 . 2013-05-27 11:02 -------- d-----w- c:\program files\SingAlong
2013-05-22 09:11 . 2013-05-22 09:11 -------- d-----w- c:\program files\Common Files\Skype
2013-05-16 07:38 . 2013-05-05 19:12 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2013-05-16 07:02 . 2013-04-04 22:02 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-15 10:06 . 2013-04-15 14:20 638328 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 10:06 . 2013-04-13 10:56 37376 ----a-w- c:\windows\system32\cdd.dll
2013-05-15 10:05 . 2013-04-09 01:36 2049024 ----a-w- c:\windows\system32\win32k.sys
2013-05-14 01:16 . 2013-05-28 10:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-05-12 21:47 . 2013-05-12 23:20 4096000 ----a-w- c:\program files\GUT66CE.tmp
2013-05-12 21:47 . 2013-05-12 21:48 -------- d-----w- c:\program files\GUM66CD.tmp
2013-05-01 14:04 . 2013-05-09 08:59 174664 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-05-01 14:04 . 2013-05-09 08:59 49376 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-15 02:58 . 2012-05-16 23:56 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 02:58 . 2011-05-16 08:16 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-09 08:59 . 2012-09-09 23:28 368944 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-05-09 08:59 . 2012-09-09 23:28 56080 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2012-09-09 23:28 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-05-09 08:59 . 2012-09-09 23:28 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-05-09 08:59 . 2012-09-09 23:28 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:59 . 2012-09-09 23:28 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:58 . 2012-09-09 23:08 41664 ----a-w- c:\windows\avastSS.scr
2013-05-09 08:58 . 2012-09-09 23:08 229648 ----a-w- c:\windows\system32\aswBoot.exe
2013-05-02 06:06 . 2009-10-03 00:54 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-03-12 22:53 . 2013-03-12 22:53 45056 ----a-r- c:\users\jerry\AppData\Roaming\Microsoft\Installer\{4956ACE3-F537-4418-BB45-FD52395275A7}\UNINST_Uninstall_C_EBD1846850A64C858760A659B987DCFF.exe
2013-03-12 22:53 . 2013-03-12 22:53 45056 ----a-r- c:\users\jerry\AppData\Roaming\Microsoft\Installer\{4956ACE3-F537-4418-BB45-FD52395275A7}\ARPPRODUCTICON.exe
2013-03-11 13:25 . 2013-04-10 01:10 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25 . 2013-04-10 01:10 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-10 01:10 49152 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-10 01:10 64000 ----a-w- c:\windows\system32\smss.exe
2013-03-08 03:53 . 2013-04-10 01:10 376320 ----a-w- c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-10 01:10 2067968 ----a-w- c:\windows\system32\mstscax.dll
2013-03-03 19:07 . 2013-04-10 01:11 1082232 ----a-w- c:\windows\system32\drivers\ntfs.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-05-24 4760816]
"Exetender "= "c:\program files\Free Ride Games\GPlayer.exe" [2012-12-04 4936152]
"Skype "= "c:\program files\Skype\Phone\Skype.exe" [2013-04-19 18678376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon "= "c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2516296]
"CanonSolutionMenuEx "= "c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"PMBVolumeWatcher "= "c:\program files\Sony\PlayMemories Home\PMBVolumeWatcher.exe" [2012-03-17 728120]
"avast "= "c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Exetender "= "c:\program files\Free Ride Games\GPlayer.exe" [2012-12-04 4936152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Assist Launcher]
2007-11-19 22:17 1261568 ----a-w- c:\program files\Acer\Acer Assist\launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Product Registration]
2007-11-26 18:21 3387392 ----a-w- c:\program files\Acer\Acer Registration\ACE1.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMOFFICE4DMOUSE]
2009-07-20 22:09 356352 ----a-w- c:\program files\Micro Innovations\Optical Scroll\mouse32a.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2008-07-23 03:05 846344 ----a-w- c:\progra~1\LAUNCH~1\LManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MotiveReportAgent]
2004-06-25 18:14 204800 ----a-w- c:\program files\Common Files\Motive\McciBootStrapper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-19 00:56 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 20:17 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-02-22 03:50 1037608 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tgcmd]
2005-06-11 04:41 1277952 ----a-w- c:\program files\Support.com\BellSouth\hcenter.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:33 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:35 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001
.
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-16 02:58]
.
2013-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-09 23:28]
.
2013-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-09 23:28]
.
2013-05-29 c:\windows\Tasks\Sing Along Update.job
- c:\program files\SingAlong\SingalngUpdater.exe [2013-05-10 08:28]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
TCP: DhcpNameServer = 10.0.0.1
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
AddRemove-DefaultTab - c:\users\jerry\AppData\Roaming\DefaultTab\DefaultTab\uninstalldt.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-29 18:59
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
c:\windows\TEMP\_avast_\unp50185633.tmp 8712 bytes
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Acer\Empowering Technology\Service\ETService.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
**************************************************************************
.
Completion time: 2013-05-29 19:12:35 - machine was rebooted
ComboFix-quarantined-files.txt 2013-05-29 23:12
.
Pre-Run: 29,214,146,560 bytes free
Post-Run: 28,826,542,080 bytes free
.
- - End Of File - - 080B37EB7ED3A736AA30D3163F20529B

 

# AdwCleaner v2.301 - Logfile created 05/30/2013 at 05:35:31
# Updated 16/05/2013 by Xplode
# Operating system : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# User : jerry - JERRY-PC
# Boot Mode : Normal
# Running from : C:\Users\jerry\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\END
Folder Deleted : C:\Program Files\Common Files\Software Update Utility
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\iWin
Folder Deleted : C:\Program Files\MixiDJ_V31
Folder Deleted : C:\Program Files\ParetoLogic
Folder Deleted : C:\Program Files\SingAlong
Folder Deleted : C:\Program Files\Trymedia
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\GamesBar
Folder Deleted : C:\ProgramData\iWin
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\ProgramData\WeCareReminder
Folder Deleted : C:\Users\jerry\AppData\Local\Conduit
Folder Deleted : C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Folder Deleted : C:\Users\jerry\AppData\Local\OpenCandy
Folder Deleted : C:\Users\jerry\AppData\LocalLow\AVG Security Toolbar
Folder Deleted : C:\Users\jerry\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\jerry\AppData\LocalLow\FunWebProducts
Folder Deleted : C:\Users\jerry\AppData\LocalLow\Media Access Startup
Folder Deleted : C:\Users\jerry\AppData\LocalLow\MixiDJ_V31
Folder Deleted : C:\Users\jerry\AppData\LocalLow\MyWebSearch
Folder Deleted : C:\Users\jerry\AppData\Roaming\Babylon
Folder Deleted : C:\Users\jerry\AppData\Roaming\DefaultTab
Folder Deleted : C:\Users\jerry\AppData\Roaming\iWin
Folder Deleted : C:\Users\jerry\AppData\Roaming\OpenCandy

***** [Registry] *****

Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\AppDataLow\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}
Key Deleted : HKCU\Software\AppDataLow\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\DefaultTab
Key Deleted : HKCU\Software\AppDataLow\Software\Fun Web Products
Key Deleted : HKCU\Software\AppDataLow\Software\FunWebProducts
Key Deleted : HKCU\Software\AppDataLow\Software\Media Access Startup
Key Deleted : HKCU\Software\AppDataLow\Software\MixiDJ_V31
Key Deleted : HKCU\Software\AppDataLow\Software\MyWebSearch
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Default Tab
Key Deleted : HKCU\Software\DefaultTab
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MixiDJ_V31 Toolbar
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\mywebsearch bar uninstall
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6492E171-2427-4932-B414-33574A089F5E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6492E171-2427-4932-B414-33574A089F5E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\DefaultTabBHO.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{61F6DAF6-F6DE-4A6E-8862-D87E8C98EF1A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6492E171-2427-4932-B414-33574A089F5E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX
Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX.1
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3298567
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\Default Tab
Key Deleted : HKLM\Software\DefaultTab
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7BE7D705-6879-4E33-BEB7-0FC927EAD8B0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B84DC150-3D03-4E85-A131-3C97FA0B9050}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F84D69AA-3E20-4305-984E-18E640D7F7FF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6492E171-2427-4932-B414-33574A089F5E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{61F6DAF6-F6DE-4A6E-8862-D87E8C98EF1A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixiDJ_V31 Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Deleted : HKLM\Software\MixiDJ_V31
Key Deleted : HKLM\Software\PIP
Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [singalong@xenophesoft.com]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{988919FF-0CD8-4D0C-BC7E-60D55A49EB64}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16483

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - SearchAssistant] = hxxp://toolbar.inbox.com/search/ie.aspx?tbid=80227 --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - CustomizeSearch] = hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80227 --> hxxp://www.google.com

-\\ Google Chrome v [Unable to get version]

File : C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [4783 octets] - [08/09/2012 13:33:10]
AdwCleaner[R2].txt - [9746 octets] - [30/05/2013 05:32:49]
AdwCleaner[S1].txt - [9198 octets] - [30/05/2013 05:35:31]

########## EOF - C:\AdwCleaner[S1].txt - [9258 octets] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Basic x86
Ran by jerry on Thu 05/30/2013 at 5:44:21.64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4E624B15-EC61-4CE6-9263-8FE490E5CF60}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9EF525D8-2469-4469-947A-F19A9760D4D0}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}



~~~ Files

Successfully deleted: [File] "C:\Windows\couponprinter.ocx "



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\big fish games "
Successfully deleted: [Folder] "C:\ProgramData\free ride games "
Successfully deleted: [Folder] "C:\Users\jerry\AppData\Roaming\big fish games "
Successfully deleted: [Folder] "C:\Program Files\coupons "
Successfully deleted: [Folder] "C:\Program Files\free ride games "
Successfully deleted: [Folder] "C:\Users\jerry\AppData\Roaming\microsoft\windows\start menu\programs\free ride games "



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 05/30/2013 at 5:48:59.05
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

OTL logfile created on: 5/30/2013 5:55:00 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\jerry\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 62.89% Memory free
5.71 Gb Paging File | 4.61 Gb Available in Paging File | 80.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.52 Gb Total Space | 26.69 Gb Free Space | 38.39% Space Free | Partition Type: NTFS
Drive D: | 69.52 Gb Total Space | 69.32 Gb Free Space | 99.70% Space Free | Partition Type: NTFS

Computer Name: JERRY-PC | User Name: jerry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/30 05:31:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/09/08 22:05:48 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2012/03/16 21:39:58 | 000,476,728 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
PRC - [2012/03/16 21:34:50 | 000,728,120 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe
PRC - [2010/04/02 10:18:54 | 001,185,112 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2010/03/24 22:50:00 | 002,516,296 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/11/28 14:56:06 | 000,024,576 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
PRC - [2008/01/20 22:34:20 | 000,020,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RacAgent.exe
PRC - [2007/12/06 20:15:28 | 000,110,592 | ---- | M] () -- C:\ACER\Mobility Center\MobilityService.exe
PRC - [2007/01/04 23:48:50 | 000,112,152 | ---- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/03 10:39:28 | 001,310,752 | ---- | M] () -- C:\Program Files\WOT\WOT.dll
MOD - [2008/07/03 23:37:36 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll


========== Services (SafeList) ==========

SRV - [2013/05/14 22:58:51 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2013/04/19 15:14:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/09/08 22:05:48 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2012/03/16 21:39:58 | 000,476,728 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2008/11/28 14:56:06 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService)
SRV - [2008/01/20 22:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/06 20:15:28 | 000,110,592 | ---- | M] () [Auto | Running] -- C:\ACER\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - [2007/01/04 23:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Auto | Running] -- C:\Program Files\Free Ride Games\X6XSEx_Pr143.Sys -- (X6XSEx_Pr143)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\RTKVHDA.sys -- (IntcAzAudAddService)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2013/05/09 04:59:10 | 000,765,736 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/05/09 04:59:10 | 000,368,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/05/09 04:59:10 | 000,174,664 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2013/02/11 21:57:27 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb8023.sys -- (USB_RNDIS_XP)
DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/01/26 18:17:09 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2009/01/26 18:17:08 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2008/10/01 14:04:16 | 000,012,832 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)
DRV - [2008/08/06 22:40:40 | 000,129,552 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2008/07/28 03:53:48 | 000,919,552 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008/07/04 02:35:40 | 003,847,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/06/10 06:54:36 | 000,123,904 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/04/28 09:26:42 | 000,014,352 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie)
DRV - [2007/05/03 11:21:08 | 000,029,056 | ---- | M] (Service & Quality Technology.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Capt905c.sys -- (SQTECH905C)
DRV - [2007/04/18 00:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\regi.sys -- (regi)
DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006/11/02 09:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes,DefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4}
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@exent.com/npExentCtl,version=7.0.0.0: C:\Program Files\Free Ride Games\npExentCtl.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@realarcade.com/RAClient: C:\ProgramData\RealArcade\npraclient.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\www.exent.com/GameTreatWidget: C:\Program Files\Free Ride Games\NPGameTreatPlugin.dll File not found
FF - HKCU\Software\MozillaPlugins\CouponNetwork.com/CMDUniversalCouponPrintActivator: C:\Users\jerry\AppData\Roaming\CATALI~2\NPBCSK~1.DLL (Catalina Marketing Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.270.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U27 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Chrome NaCl (Disabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\pdf.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1777_0\plugins/avgnpss.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: Homestead SiteBuilder Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nphssb.dll
CHR - plugin: RealArcade NPAPI Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npraclient.dll
CHR - plugin: Exent\u00AE AOD Gecko Plugin (Enabled) = C:\Program Files\Free Ride Games\npExentCtl.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll
CHR - plugin: WorldWinner Firefox Launcher Plugin (Enabled) = C:\Program Files\WorldWinner.com, Inc\WorldWinner Games\npwwload.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2013/05/29 18:55:41 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKU\.DEFAULT..\Run: [Exetender] "C:\Program Files\Free Ride Games\GPlayer.exe" /runonstartup File not found
O4 - HKU\S-1-5-18..\Run: [Exetender] "C:\Program Files\Free Ride Games\GPlayer.exe" /runonstartup File not found
O4 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000..\Run: [Exetender] "C:\Program Files\Free Ride Games\GPlayer.exe" /runonstartup File not found
O4 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Arctic%20Quest%202/Images/armhelper.ocx (ArmHelper Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E6644C9-C18A-4664-A766-F3140C986261}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4936F3D3-BDF4-442B-B0A1-A396ACE2AEE6}: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B57DE832-10A4-4AB6-A41E-080FD9154FD3}: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D00B9979-42B9-4910-94EB-250C116767D1}: DhcpNameServer = 192.168.1.254 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/30 05:44:09 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/05/30 05:43:46 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/30 05:31:16 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
[2013/05/30 05:30:57 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\jerry\Desktop\JRT.exe
[2013/05/29 19:12:44 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/05/29 18:57:00 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2013/05/29 18:50:52 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Local\temp
[2013/05/29 18:23:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/05/29 18:23:21 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/05/29 18:23:21 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/05/29 18:23:08 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/05/29 18:18:28 | 005,075,099 | R--- | C] (Swearware) -- C:\Users\jerry\Desktop\ComboFix.exe
[2013/05/28 20:09:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2013/05/28 20:04:06 | 000,000,000 | ---D | C] -- C:\Users\jerry\Desktop\mbar-1.06.0.1003
[2013/05/28 19:48:50 | 000,000,000 | ---D | C] -- C:\Users\jerry\Desktop\RK_Quarantine
[2013/05/28 06:54:07 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\jerry\Desktop\dds.com
[2013/05/28 06:30:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/05/28 06:30:49 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/05/28 06:25:37 | 010,285,040 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\jerry\Desktop\mbam-setup-1.75.0.1300.exe
[2013/05/27 07:08:44 | 000,000,000 | ---D | C] -- C:\Program Files\Uninstaller
[2013/05/27 06:49:47 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2013/05/22 05:11:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013/05/13 21:16:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/30 05:56:32 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/30 05:47:45 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/30 05:39:02 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/30 05:38:55 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/30 05:38:28 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/30 05:38:10 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2013/05/30 05:38:08 | 000,000,368 | ---- | M] () -- C:\Windows\tasks\Sing Along Update.job
[2013/05/30 05:37:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/30 05:31:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
[2013/05/30 05:30:58 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\jerry\Desktop\JRT.exe
[2013/05/30 05:30:09 | 000,632,031 | ---- | M] () -- C:\Users\jerry\Desktop\adwcleaner.exe
[2013/05/29 18:55:41 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013/05/29 18:20:28 | 005,075,099 | R--- | M] (Swearware) -- C:\Users\jerry\Desktop\ComboFix.exe
[2013/05/28 19:47:29 | 013,169,742 | ---- | M] () -- C:\Users\jerry\Desktop\mbar-1.06.0.1003.zip
[2013/05/28 19:38:03 | 000,816,128 | ---- | M] () -- C:\Users\jerry\Desktop\RogueKiller.exe
[2013/05/28 06:54:11 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\jerry\Desktop\dds.com
[2013/05/28 06:30:59 | 000,000,870 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/28 06:28:37 | 010,285,040 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\jerry\Desktop\mbam-setup-1.75.0.1300.exe
[2013/05/27 16:48:46 | 000,604,752 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/05/27 16:48:46 | 000,104,420 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/05/27 07:05:10 | 000,000,258 | RHS- | M] () -- C:\Users\jerry\ntuser.pol
[2013/05/26 20:29:04 | 000,922,944 | ---- | M] () -- C:\Users\jerry\AppData\Local\a.zip
[2013/05/23 11:07:43 | 000,003,015 | ---- | M] () -- C:\Windows\SA8.ini
[2013/05/23 11:07:42 | 000,001,484 | ---- | M] () -- C:\Users\jerry\Desktop\startup.sa8
[2013/05/23 11:07:42 | 000,000,421 | ---- | M] () -- C:\Windows\SA4_WKSP.INI
[2013/05/16 03:59:35 | 000,302,920 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/05/12 14:59:25 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013/05/09 17:18:40 | 000,000,045 | ---- | M] () -- C:\Windows\SA4_DRAW.INI
[2013/05/09 04:59:10 | 000,765,736 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013/05/09 04:59:10 | 000,368,944 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013/05/09 04:59:10 | 000,174,664 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2013/05/09 04:59:10 | 000,049,376 | ---- | M] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2013/05/09 04:58:37 | 000,041,664 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2013/05/09 04:58:28 | 000,229,648 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/30 05:30:08 | 000,632,031 | ---- | C] () -- C:\Users\jerry\Desktop\adwcleaner.exe
[2013/05/29 18:23:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/05/29 18:23:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/05/29 18:23:21 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/05/29 18:23:21 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/05/29 18:23:21 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/05/28 19:39:01 | 013,169,742 | ---- | C] () -- C:\Users\jerry\Desktop\mbar-1.06.0.1003.zip
[2013/05/28 19:37:54 | 000,816,128 | ---- | C] () -- C:\Users\jerry\Desktop\RogueKiller.exe
[2013/05/28 06:30:59 | 000,000,870 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/27 07:05:10 | 000,000,258 | RHS- | C] () -- C:\Users\jerry\ntuser.pol
[2013/05/27 07:02:37 | 000,000,368 | ---- | C] () -- C:\Windows\tasks\Sing Along Update.job
[2013/05/01 10:04:29 | 000,174,664 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/05/01 10:04:27 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/03/12 19:03:38 | 000,922,944 | ---- | C] () -- C:\Users\jerry\AppData\Local\a.zip
[2011/10/31 11:28:15 | 000,000,474 | ---- | C] () -- C:\Users\jerry\AppData\Roaming\wklnhst.dat
[2011/06/23 08:41:36 | 000,115,369 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2011/06/23 08:41:36 | 000,097,859 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2010/02/15 16:27:21 | 000,001,356 | ---- | C] () -- C:\Users\jerry\AppData\Local\d3d9caps.dat
[2009/07/29 11:51:28 | 000,003,762 | ---- | C] () -- C:\Users\jerry\profiles.xml
[2009/06/07 14:52:25 | 000,003,840 | ---- | C] () -- C:\Users\jerry\AppData\Local\slot1.mm1
[2009/02/03 23:44:41 | 000,009,216 | ---- | C] () -- C:\Users\jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 08:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Acer GameZone Console
[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Acer GameZone Console
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Abra Academy2
[2009/02/01 06:49:37 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Acer
[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Acer GameZone Console
[2009/09/13 15:11:27 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Aisle 5 Games, Inc
[2012/12/27 00:04:28 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Alawar
[2009/09/01 21:21:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Alterlab
[2009/08/21 15:30:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Amaranth Games
[2012/02/02 23:02:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Anabel
[2012/02/28 11:20:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Artifex Mundi
[2009/09/27 23:26:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Artogon
[2012/09/09 08:35:17 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\AVG
[2013/01/20 17:21:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\AzuazGames
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BeachPartyCraze
[2009/07/17 22:08:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BlamGames
[2009/07/27 13:06:26 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\blg
[2009/11/18 21:07:20 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Blitware
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BloodTies
[2009/07/20 21:12:42 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Boolat Games
[2012/12/03 23:21:42 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Boomzap
[2009/06/18 20:49:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BrandX Games
[2009/07/17 16:31:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Camel101
[2012/07/23 22:54:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Canneverbe Limited
[2013/04/22 09:52:56 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Canon
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Catalina Marketing Corp
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Catalina – Print Savings
[2012/02/13 01:30:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\cerasus.media
[2009/08/11 15:04:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Chicken Chase
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Coyotes Tale
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\CupcakeCafe
[2013/01/04 00:28:14 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\DailyMagic
[2012/08/27 17:12:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\EleFun Games
[2012/02/21 22:06:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ElementalsTheMagicKey
[2012/12/11 01:47:14 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Elephant Games
[2009/08/02 22:50:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enchanted Katya
[2009/09/10 14:06:28 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enlightenus
[2012/02/28 12:22:41 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enlightenus_Real
[2012/12/13 20:11:44 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ERS Game Studios
[2013/01/04 17:32:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Exent Technologies
[2009/06/25 15:55:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Fabulous Finds
[2009/07/30 16:07:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Fever Frenzy
[2012/01/26 23:11:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Flood Light Games
[2012/09/03 19:07:56 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Floodlight Games
[2009/03/23 22:20:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FloodLightGames
[2012/01/20 20:39:21 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FlyWheelGames
[2009/04/01 12:11:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ForgottenRiddles2
[2012/08/11 20:07:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Freezetag
[2009/04/01 12:42:00 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Friday's games
[2009/07/24 16:04:36 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FrimaStudio
[2011/06/02 12:19:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FrostWire
[2009/08/12 23:49:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gaijin Ent
[2012/09/05 21:48:02 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameDevo
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameHouse
[2012/08/08 21:49:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameHousev1002
[2012/02/21 20:49:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameInvest
[2009/08/04 15:34:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gamelab
[2009/09/15 15:54:44 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Games
[2009/04/13 19:33:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GamesCafe
[2009/09/02 20:01:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Go-Go Gourmet Chef of the Year
[2012/03/04 12:40:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gogii
[2009/07/05 14:36:25 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gogii Games
[2009/06/25 22:17:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gold Casual Games
[2009/08/15 23:04:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GraveyardShift
[2012/12/29 18:27:17 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Happyville__
[2009/09/27 13:48:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\HSA
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\HuruBeachParty
[2009/12/16 21:14:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\InterVideo
[2009/06/25 20:05:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ITTNord
[2012/05/20 21:23:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\iWing
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel Family Hero
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel 3
[2009/03/25 12:01:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jetsetter
[2010/06/20 22:18:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\KewlBoxPrefs
[2012/02/06 08:18:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\KranX Productions
[2009/02/01 06:49:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Leadertech
[2013/01/03 13:07:02 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\LegacyInteractive
[2009/07/17 23:08:47 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ludia
[2009/09/10 15:22:08 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MA
[2009/03/25 14:58:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Magic Academy
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Magic3
[2011/07/08 01:38:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\margrave3_full
[2009/07/19 00:52:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Mean Hamster
[2009/07/26 21:46:27 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MegaplexMadnessSummerBlockbuster
[2009/07/18 19:46:04 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Meridian93
[2012/02/12 15:36:04 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Merscom
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\mjusbsp
[2012/09/05 21:58:12 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MumboJumbo
[2009/08/06 23:40:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\My Games
[2010/07/24 09:50:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MysteryStudio
[2010/03/14 21:16:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Mysteryville2
[2010/06/20 23:17:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Namco
[2009/09/01 23:38:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberon
[2009/08/19 12:29:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberon Games
[2009/03/22 14:31:59 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1001
[2009/06/08 15:44:42 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1002
[2009/06/24 23:21:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1005
[2009/10/19 13:06:07 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ohana Games
[2012/12/04 21:20:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Orneon
[2011/06/30 06:52:00 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Paige Harper and the Tome of Mystery
[2009/07/02 22:42:07 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\panoramik
[2010/10/18 19:14:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PetsFunHouse
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PetShowCraze
[2012/02/16 23:24:17 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ph03nixNewMedia
[2009/08/17 17:15:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Pi Eye Games
[2012/12/27 22:24:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PlayFirst
[2009/06/17 15:52:57 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Playrix Entertainment
[2012/02/13 00:16:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PoBros
[2009/08/10 22:15:08 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Pogo Games
[2012/04/15 13:28:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PokerCreations
[2009/09/10 22:33:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Princess Isabella
[2012/02/20 15:11:43 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\QB9
[2009/04/04 20:59:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Reflexivev1001
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoe
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoeOM
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoeRA
[2009/07/26 19:34:56 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Sandlot Games
[2009/03/30 14:27:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SecretIslandEng
[2009/08/15 23:10:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Shape games
[2012/02/20 11:35:05 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ShinyTales
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Shockwave_DressUpRush
[2012/02/27 13:56:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Silverback Productions
[2009/09/23 10:45:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Skunk Studios
[2012/12/05 19:58:13 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Specialbit
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SpinTop
[2012/02/21 11:08:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SpinTop Games
[2012/02/19 16:54:09 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SulusGames
[2012/01/31 20:40:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TeleportGamesLtd
[2011/10/31 11:30:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Template
[2009/03/30 06:38:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TheScruffs
[2012/01/19 18:00:51 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TitanicMystery
[2013/04/29 22:23:25 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TOMI3
[2012/02/20 16:39:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Total Eclipse
[2012/12/30 23:09:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TripleHippo
[2012/09/07 23:06:53 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TuneUp Software
[2009/07/23 09:04:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\UClick
[2009/03/29 14:43:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\URSE Games
[2012/08/10 20:39:01 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\V-Games
[2012/02/26 13:27:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Valusoft
[2011/07/03 02:36:41 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\VampireSaga
[2011/05/19 21:53:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Vasilek Games
[2009/07/31 19:38:40 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ViquaSoft
[2009/06/09 21:56:26 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\VisualShape
[2009/11/09 22:30:28 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Wild Tangent
[2012/07/25 21:41:19 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\WildTangent
[2009/07/30 09:16:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\World-LooM
[2009/06/18 07:42:52 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Yatec Games
[2009/07/24 15:58:40 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\YoudaGames
[2011/01/12 22:55:47 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ZEN
[2012/05/28 21:54:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ZEN Entertainment

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 181 bytes -> C:\ProgramData\TEMP:BEE39E9B
@Alternate Data Stream - 177 bytes -> C:\ProgramData\TEMP:CAC06C34
@Alternate Data Stream - 177 bytes -> C:\ProgramData\TEMP:AAA06E15
@Alternate Data Stream - 177 bytes -> C:\ProgramData\TEMP:A6D6E537
@Alternate Data Stream - 175 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 172 bytes -> C:\ProgramData\TEMP:9BAC4211
@Alternate Data Stream - 172 bytes -> C:\ProgramData\TEMP:6B709AD7
@Alternate Data Stream - 171 bytes -> C:\ProgramData\TEMP:3EC5BC08
@Alternate Data Stream - 170 bytes -> C:\ProgramData\TEMP:B54E4B5A
@Alternate Data Stream - 166 bytes -> C:\ProgramData\TEMP:491270B8
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:0EC7A545

< End of report >

 

OTL logfile created on: 5/30/2013 5:55:00 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\jerry\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 62.89% Memory free
5.71 Gb Paging File | 4.61 Gb Available in Paging File | 80.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.52 Gb Total Space | 26.69 Gb Free Space | 38.39% Space Free | Partition Type: NTFS
Drive D: | 69.52 Gb Total Space | 69.32 Gb Free Space | 99.70% Space Free | Partition Type: NTFS

Computer Name: JERRY-PC | User Name: jerry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/05/30 05:31:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
PRC - [2013/05/09 04:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/09/08 22:05:48 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2012/03/16 21:39:58 | 000,476,728 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
PRC - [2012/03/16 21:34:50 | 000,728,120 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe
PRC - [2010/04/02 10:18:54 | 001,185,112 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2010/03/24 22:50:00 | 002,516,296 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/11/28 14:56:06 | 000,024,576 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
PRC - [2008/01/20 22:34:20 | 000,020,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RacAgent.exe
PRC - [2007/12/06 20:15:28 | 000,110,592 | ---- | M] () -- C:\ACER\Mobility Center\MobilityService.exe
PRC - [2007/01/04 23:48:50 | 000,112,152 | ---- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/03 10:39:28 | 001,310,752 | ---- | M] () -- C:\Program Files\WOT\WOT.dll
MOD - [2008/07/03 23:37:36 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll


========== Services (SafeList) ==========

SRV - [2013/05/14 22:58:51 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/09 04:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2013/04/19 15:14:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/09/08 22:05:48 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2012/03/16 21:39:58 | 000,476,728 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2008/11/28 14:56:06 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService)
SRV - [2008/01/20 22:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/06 20:15:28 | 000,110,592 | ---- | M] () [Auto | Running] -- C:\ACER\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - [2007/01/04 23:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Auto | Running] -- C:\Program Files\Free Ride Games\X6XSEx_Pr143.Sys -- (X6XSEx_Pr143)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\RTKVHDA.sys -- (IntcAzAudAddService)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2013/05/09 04:59:10 | 000,765,736 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/05/09 04:59:10 | 000,368,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/05/09 04:59:10 | 000,174,664 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 04:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2013/02/11 21:57:27 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb8023.sys -- (USB_RNDIS_XP)
DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/01/26 18:17:09 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2009/01/26 18:17:08 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2008/10/01 14:04:16 | 000,012,832 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)
DRV - [2008/08/06 22:40:40 | 000,129,552 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2008/07/28 03:53:48 | 000,919,552 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008/07/04 02:35:40 | 003,847,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/06/10 06:54:36 | 000,123,904 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/04/28 09:26:42 | 000,014,352 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie)
DRV - [2007/05/03 11:21:08 | 000,029,056 | ---- | M] (Service & Quality Technology.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Capt905c.sys -- (SQTECH905C)
DRV - [2007/04/18 00:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\regi.sys -- (regi)
DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006/11/02 09:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes,DefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4}
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@exent.com/npExentCtl,version=7.0.0.0: C:\Program Files\Free Ride Games\npExentCtl.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@realarcade.com/RAClient: C:\ProgramData\RealArcade\npraclient.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\www.exent.com/GameTreatWidget: C:\Program Files\Free Ride Games\NPGameTreatPlugin.dll File not found
FF - HKCU\Software\MozillaPlugins\CouponNetwork.com/CMDUniversalCouponPrintActivator: C:\Users\jerry\AppData\Roaming\CATALI~2\NPBCSK~1.DLL (Catalina Marketing Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.270.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U27 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Chrome NaCl (Disabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\pdf.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1777_0\plugins/avgnpss.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: Homestead SiteBuilder Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nphssb.dll
CHR - plugin: RealArcade NPAPI Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npraclient.dll
CHR - plugin: Exent\u00AE AOD Gecko Plugin (Enabled) = C:\Program Files\Free Ride Games\npExentCtl.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll
CHR - plugin: WorldWinner Firefox Launcher Plugin (Enabled) = C:\Program Files\WorldWinner.com, Inc\WorldWinner Games\npwwload.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2013/05/29 18:55:41 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKU\.DEFAULT..\Run: [Exetender] "C:\Program Files\Free Ride Games\GPlayer.exe" /runonstartup File not found
O4 - HKU\S-1-5-18..\Run: [Exetender] "C:\Program Files\Free Ride Games\GPlayer.exe" /runonstartup File not found
O4 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000..\Run: [Exetender] "C:\Program Files\Free Ride Games\GPlayer.exe" /runonstartup File not found
O4 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Arctic%20Quest%202/Images/armhelper.ocx (ArmHelper Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E6644C9-C18A-4664-A766-F3140C986261}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4936F3D3-BDF4-442B-B0A1-A396ACE2AEE6}: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B57DE832-10A4-4AB6-A41E-080FD9154FD3}: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D00B9979-42B9-4910-94EB-250C116767D1}: DhcpNameServer = 192.168.1.254 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/30 05:44:09 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/05/30 05:43:46 | 000,000,000 | ---D | C] -- C:\JRT
[2013/05/30 05:31:16 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
[2013/05/30 05:30:57 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\jerry\Desktop\JRT.exe
[2013/05/29 19:12:44 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/05/29 18:57:00 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2013/05/29 18:50:52 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Local\temp
[2013/05/29 18:23:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/05/29 18:23:21 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/05/29 18:23:21 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/05/29 18:23:08 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/05/29 18:18:28 | 005,075,099 | R--- | C] (Swearware) -- C:\Users\jerry\Desktop\ComboFix.exe
[2013/05/28 20:09:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2013/05/28 20:04:06 | 000,000,000 | ---D | C] -- C:\Users\jerry\Desktop\mbar-1.06.0.1003
[2013/05/28 19:48:50 | 000,000,000 | ---D | C] -- C:\Users\jerry\Desktop\RK_Quarantine
[2013/05/28 06:54:07 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\jerry\Desktop\dds.com
[2013/05/28 06:30:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/05/28 06:30:49 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/05/28 06:25:37 | 010,285,040 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\jerry\Desktop\mbam-setup-1.75.0.1300.exe
[2013/05/27 07:08:44 | 000,000,000 | ---D | C] -- C:\Program Files\Uninstaller
[2013/05/27 06:49:47 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2013/05/22 05:11:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013/05/13 21:16:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/05/30 05:56:32 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/30 05:47:45 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/30 05:39:02 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/30 05:38:55 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/30 05:38:28 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/30 05:38:10 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2013/05/30 05:38:08 | 000,000,368 | ---- | M] () -- C:\Windows\tasks\Sing Along Update.job
[2013/05/30 05:37:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/30 05:31:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
[2013/05/30 05:30:58 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\jerry\Desktop\JRT.exe
[2013/05/30 05:30:09 | 000,632,031 | ---- | M] () -- C:\Users\jerry\Desktop\adwcleaner.exe
[2013/05/29 18:55:41 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013/05/29 18:20:28 | 005,075,099 | R--- | M] (Swearware) -- C:\Users\jerry\Desktop\ComboFix.exe
[2013/05/28 19:47:29 | 013,169,742 | ---- | M] () -- C:\Users\jerry\Desktop\mbar-1.06.0.1003.zip
[2013/05/28 19:38:03 | 000,816,128 | ---- | M] () -- C:\Users\jerry\Desktop\RogueKiller.exe
[2013/05/28 06:54:11 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\jerry\Desktop\dds.com
[2013/05/28 06:30:59 | 000,000,870 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/28 06:28:37 | 010,285,040 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\jerry\Desktop\mbam-setup-1.75.0.1300.exe
[2013/05/27 16:48:46 | 000,604,752 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/05/27 16:48:46 | 000,104,420 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/05/27 07:05:10 | 000,000,258 | RHS- | M] () -- C:\Users\jerry\ntuser.pol
[2013/05/26 20:29:04 | 000,922,944 | ---- | M] () -- C:\Users\jerry\AppData\Local\a.zip
[2013/05/23 11:07:43 | 000,003,015 | ---- | M] () -- C:\Windows\SA8.ini
[2013/05/23 11:07:42 | 000,001,484 | ---- | M] () -- C:\Users\jerry\Desktop\startup.sa8
[2013/05/23 11:07:42 | 000,000,421 | ---- | M] () -- C:\Windows\SA4_WKSP.INI
[2013/05/16 03:59:35 | 000,302,920 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/05/12 14:59:25 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2013/05/09 17:18:40 | 000,000,045 | ---- | M] () -- C:\Windows\SA4_DRAW.INI
[2013/05/09 04:59:10 | 000,765,736 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013/05/09 04:59:10 | 000,368,944 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013/05/09 04:59:10 | 000,174,664 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/05/09 04:59:10 | 000,056,080 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2013/05/09 04:59:10 | 000,049,376 | ---- | M] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/05/09 04:59:09 | 000,066,336 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2013/05/09 04:59:09 | 000,049,760 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2013/05/09 04:59:08 | 000,029,816 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2013/05/09 04:58:37 | 000,041,664 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2013/05/09 04:58:28 | 000,229,648 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/05/30 05:30:08 | 000,632,031 | ---- | C] () -- C:\Users\jerry\Desktop\adwcleaner.exe
[2013/05/29 18:23:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/05/29 18:23:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/05/29 18:23:21 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/05/29 18:23:21 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/05/29 18:23:21 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/05/28 19:39:01 | 013,169,742 | ---- | C] () -- C:\Users\jerry\Desktop\mbar-1.06.0.1003.zip
[2013/05/28 19:37:54 | 000,816,128 | ---- | C] () -- C:\Users\jerry\Desktop\RogueKiller.exe
[2013/05/28 06:30:59 | 000,000,870 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/27 07:05:10 | 000,000,258 | RHS- | C] () -- C:\Users\jerry\ntuser.pol
[2013/05/27 07:02:37 | 000,000,368 | ---- | C] () -- C:\Windows\tasks\Sing Along Update.job
[2013/05/01 10:04:29 | 000,174,664 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/05/01 10:04:27 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/03/12 19:03:38 | 000,922,944 | ---- | C] () -- C:\Users\jerry\AppData\Local\a.zip
[2011/10/31 11:28:15 | 000,000,474 | ---- | C] () -- C:\Users\jerry\AppData\Roaming\wklnhst.dat
[2011/06/23 08:41:36 | 000,115,369 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2011/06/23 08:41:36 | 000,097,859 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2010/02/15 16:27:21 | 000,001,356 | ---- | C] () -- C:\Users\jerry\AppData\Local\d3d9caps.dat
[2009/07/29 11:51:28 | 000,003,762 | ---- | C] () -- C:\Users\jerry\profiles.xml
[2009/06/07 14:52:25 | 000,003,840 | ---- | C] () -- C:\Users\jerry\AppData\Local\slot1.mm1
[2009/02/03 23:44:41 | 000,009,216 | ---- | C] () -- C:\Users\jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 08:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Acer GameZone Console
[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Acer GameZone Console
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Abra Academy2
[2009/02/01 06:49:37 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Acer
[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Acer GameZone Console
[2009/09/13 15:11:27 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Aisle 5 Games, Inc
[2012/12/27 00:04:28 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Alawar
[2009/09/01 21:21:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Alterlab
[2009/08/21 15:30:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Amaranth Games
[2012/02/02 23:02:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Anabel
[2012/02/28 11:20:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Artifex Mundi
[2009/09/27 23:26:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Artogon
[2012/09/09 08:35:17 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\AVG
[2013/01/20 17:21:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\AzuazGames
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BeachPartyCraze
[2009/07/17 22:08:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BlamGames
[2009/07/27 13:06:26 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\blg
[2009/11/18 21:07:20 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Blitware
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BloodTies
[2009/07/20 21:12:42 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Boolat Games
[2012/12/03 23:21:42 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Boomzap
[2009/06/18 20:49:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BrandX Games
[2009/07/17 16:31:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Camel101
[2012/07/23 22:54:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Canneverbe Limited
[2013/04/22 09:52:56 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Canon
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Catalina Marketing Corp
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Catalina "“ Print Savings
[2012/02/13 01:30:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\cerasus.media
[2009/08/11 15:04:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Chicken Chase
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Coyotes Tale
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\CupcakeCafe
[2013/01/04 00:28:14 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\DailyMagic
[2012/08/27 17:12:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\EleFun Games
[2012/02/21 22:06:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ElementalsTheMagicKey
[2012/12/11 01:47:14 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Elephant Games
[2009/08/02 22:50:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enchanted Katya
[2009/09/10 14:06:28 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enlightenus
[2012/02/28 12:22:41 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enlightenus_Real
[2012/12/13 20:11:44 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ERS Game Studios
[2013/01/04 17:32:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Exent Technologies
[2009/06/25 15:55:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Fabulous Finds
[2009/07/30 16:07:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Fever Frenzy
[2012/01/26 23:11:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Flood Light Games
[2012/09/03 19:07:56 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Floodlight Games
[2009/03/23 22:20:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FloodLightGames
[2012/01/20 20:39:21 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FlyWheelGames
[2009/04/01 12:11:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ForgottenRiddles2
[2012/08/11 20:07:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Freezetag
[2009/04/01 12:42:00 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Friday's games
[2009/07/24 16:04:36 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FrimaStudio
[2011/06/02 12:19:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FrostWire
[2009/08/12 23:49:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gaijin Ent
[2012/09/05 21:48:02 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameDevo
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameHouse
[2012/08/08 21:49:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameHousev1002
[2012/02/21 20:49:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameInvest
[2009/08/04 15:34:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gamelab
[2009/09/15 15:54:44 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Games
[2009/04/13 19:33:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GamesCafe
[2009/09/02 20:01:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Go-Go Gourmet Chef of the Year
[2012/03/04 12:40:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gogii
[2009/07/05 14:36:25 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gogii Games
[2009/06/25 22:17:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gold Casual Games
[2009/08/15 23:04:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GraveyardShift
[2012/12/29 18:27:17 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Happyville__
[2009/09/27 13:48:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\HSA
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\HuruBeachParty
[2009/12/16 21:14:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\InterVideo
[2009/06/25 20:05:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ITTNord
[2012/05/20 21:23:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\iWing
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel Family Hero
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel 3
[2009/03/25 12:01:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jetsetter
[2010/06/20 22:18:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\KewlBoxPrefs
[2012/02/06 08:18:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\KranX Productions
[2009/02/01 06:49:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Leadertech
[2013/01/03 13:07:02 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\LegacyInteractive
[2009/07/17 23:08:47 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ludia
[2009/09/10 15:22:08 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MA
[2009/03/25 14:58:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Magic Academy
[2013/04/29 22:23:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Magic3
[2011/07/08 01:38:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\margrave3_full
[2009/07/19 00:52:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Mean Hamster
[2009/07/26 21:46:27 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MegaplexMadnessSummerBlockbuster
[2009/07/18 19:46:04 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Meridian93
[2012/02/12 15:36:04 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Merscom
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\mjusbsp
[2012/09/05 21:58:12 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MumboJumbo
[2009/08/06 23:40:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\My Games
[2010/07/24 09:50:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MysteryStudio
[2010/03/14 21:16:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Mysteryville2
[2010/06/20 23:17:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Namco
[2009/09/01 23:38:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberon
[2009/08/19 12:29:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberon Games
[2009/03/22 14:31:59 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1001
[2009/06/08 15:44:42 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1002
[2009/06/24 23:21:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1005
[2009/10/19 13:06:07 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ohana Games
[2012/12/04 21:20:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Orneon
[2011/06/30 06:52:00 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Paige Harper and the Tome of Mystery
[2009/07/02 22:42:07 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\panoramik
[2010/10/18 19:14:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PetsFunHouse
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PetShowCraze
[2012/02/16 23:24:17 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ph03nixNewMedia
[2009/08/17 17:15:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Pi Eye Games
[2012/12/27 22:24:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PlayFirst
[2009/06/17 15:52:57 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Playrix Entertainment
[2012/02/13 00:16:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PoBros
[2009/08/10 22:15:08 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Pogo Games
[2012/04/15 13:28:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PokerCreations
[2009/09/10 22:33:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Princess Isabella
[2012/02/20 15:11:43 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\QB9
[2009/04/04 20:59:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Reflexivev1001
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoe
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoeOM
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoeRA
[2009/07/26 19:34:56 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Sandlot Games
[2009/03/30 14:27:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SecretIslandEng
[2009/08/15 23:10:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Shape games
[2012/02/20 11:35:05 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ShinyTales
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Shockwave_DressUpRush
[2012/02/27 13:56:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Silverback Productions
[2009/09/23 10:45:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Skunk Studios
[2012/12/05 19:58:13 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Specialbit
[2013/04/29 22:23:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SpinTop
[2012/02/21 11:08:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SpinTop Games
[2012/02/19 16:54:09 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SulusGames
[2012/01/31 20:40:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TeleportGamesLtd
[2011/10/31 11:30:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Template
[2009/03/30 06:38:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TheScruffs
[2012/01/19 18:00:51 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TitanicMystery
[2013/04/29 22:23:25 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TOMI3
[2012/02/20 16:39:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Total Eclipse
[2012/12/30 23:09:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TripleHippo
[2012/09/07 23:06:53 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TuneUp Software
[2009/07/23 09:04:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\UClick
[2009/03/29 14:43:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\URSE Games
[2012/08/10 20:39:01 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\V-Games
[2012/02/26 13:27:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Valusoft
[2011/07/03 02:36:41 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\VampireSaga
[2011/05/19 21:53:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Vasilek Games
[2009/07/31 19:38:40 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ViquaSoft
[2009/06/09 21:56:26 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\VisualShape
[2009/11/09 22:30:28 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Wild Tangent
[2012/07/25 21:41:19 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\WildTangent
[2009/07/30 09:16:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\World-LooM
[2009/06/18 07:42:52 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Yatec Games
[2009/07/24 15:58:40 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\YoudaGames
[2011/01/12 22:55:47 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ZEN
[2012/05/28 21:54:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ZEN Entertainment

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 181 bytes -> C:\ProgramData\TEMP:BEE39E9B
@Alternate Data Stream - 177 bytes -> C:\ProgramData\TEMP:CAC06C34
@Alternate Data Stream - 177 bytes -> C:\ProgramData\TEMP:AAA06E15
@Alternate Data Stream - 177 bytes -> C:\ProgramData\TEMP:A6D6E537
@Alternate Data Stream - 175 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 172 bytes -> C:\ProgramData\TEMP:9BAC4211
@Alternate Data Stream - 172 bytes -> C:\ProgramData\TEMP:6B709AD7
@Alternate Data Stream - 171 bytes -> C:\ProgramData\TEMP:3EC5BC08
@Alternate Data Stream - 170 bytes -> C:\ProgramData\TEMP:B54E4B5A
@Alternate Data Stream - 166 bytes -> C:\ProgramData\TEMP:491270B8
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:0EC7A545

< End of report >

 

OTL Extras logfile created on: 5/30/2013 5:55:00 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\jerry\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 62.89% Memory free
5.71 Gb Paging File | 4.61 Gb Available in Paging File | 80.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.52 Gb Total Space | 26.69 Gb Free Space | 38.39% Space Free | Partition Type: NTFS
Drive D: | 69.52 Gb Total Space | 69.32 Gb Free Space | 99.70% Space Free | Partition Type: NTFS

Computer Name: JERRY-PC | User Name: jerry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{40E03882-C642-47D5-992B-6BC75737BAF1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D72CA09B-28A2-4E0E-A631-4F93773CD803}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{55D274BF-550D-4C55-B9CF-E926CB3F8BEA}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8F532E8F-51EB-49C2-85DE-CCB092126219}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{9196C6D4-C5FC-4BFF-AD63-76440901DEC4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B11C1288-D447-44BF-8A8C-7FB70D0D03C5}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{2A7371B5-1C79-43DC-A07D-47083E6C3AB3}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{5B2566AC-5798-4054-9000-0ED41E363F2D}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{DBDC1E2C-EDDC-43EA-A3A4-3F88DFD26B36}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{FD9C6010-8A54-4BEB-9C17-8A4983EE43B1}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00030409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Small Business
"{071EA6A1-4189-3D9C-6B3F-0BE15495CE80}" = Catalyst Control Center Core Implementation
"{08137BF5-9879-EBDA-6462-79D3C6D113B2}" = Catalyst Control Center Localization Portuguese
"{09621381-D4B0-2D6A-AB14-E8CE4CD424D9}" = Catalyst Control Center Graphics Previews Vista
"{09D3675D-E1BB-1B3D-3F35-0338F7AAB0FD}" = Catalyst Control Center Localization Czech
"{0AD63C23-3DE8-82FF-4DF2-BDD0784F3348}" = Diamond Detective
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series" = Canon MP280 series MP Drivers
"{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1DE63D16-8A5E-74AB-1A5F-6E1834234229}" = CCC Help Chinese Standard
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"{254C0471-5FDF-D591-1219-112ABECED882}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{285432CE-2033-7317-27FC-DFB027E24F33}" = Catalyst Control Center Localization French
"{29E1DB75-A926-D7A5-6773-E24477526D49}" = CCC Help Chinese Traditional
"{2B7BDADB-EC8C-4C54-B5DD-CE45A016D3A7}" = Free Ride Games Player
"{2B82EEF1-A86E-CE6A-E7E6-ED114131E383}" = Catalyst Control Center Graphics Full New
"{2F3FC1A5-37B4-7685-7295-37FD1B3FE806}" = CCC Help Danish
"{32EBA2B9-23F8-82A8-E229-0F283EE902B0}" = CCC Help Portuguese
"{3A2536D9-53FF-CD79-F46C-9E3902D2EEBA}" = CCC Help English
"{3A6CE5E6-7416-37A1-1DA2-2BCB0A9CF444}" = Catalyst Control Center Localization Japanese
"{3A7D9B34-E8A9-A352-20C1-0607B1D5F8B6}" = Catalyst Control Center Localization Chinese Traditional
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F9544A3-63B0-E523-D212-5C010368E492}" = Catalyst Control Center Localization Spanish
"{41802C9A-1BF6-9A4E-D903-C6587560D758}" = Catalyst Control Center Localization Chinese Standard
"{4956ACE3-F537-4418-BB45-FD52395275A7}" = Catalina Savings Printer
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{5339885F-4597-4343-BD3B-74280CC79424}" = ArcSoft VideoImpression 2
"{553C904F-57A2-4113-888E-BA0C3D1C69C0}" = Microsoft VC9 runtime libraries
"{58D9BD9C-C96F-F308-5D72-371A9D3CC939}" = CCC Help Dutch
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6165BE73-8AC5-A2B6-8910-963387FE5B9B}" = Catalyst Control Center Localization Russian
"{6190B8CA-366D-A8E1-9976-7EE50B7DC39E}" = Aloha Solitaire
"{67A8747E-0517-75EF-244F-9E219C440107}" = ATI Catalyst Install Manager
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6A25BA91-82D1-0841-FC65-57CE27540922}" = Catalyst Control Center Localization Danish
"{6A41CE62-8379-2A4D-E690-AA5D4DA8A279}" = ccc-core-static
"{6BB99DE2-D79C-B223-8D4F-E3D80A478D0F}" = CCC Help Polish
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6E52D2FB-5FB5-334E-86F9-4316EEDC2926}" = ccc-utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72BBB36F-D323-0746-4F92-083E4C5EAC52}" = CCC Help Czech
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7DDF474C-2AF9-4A3B-57E0-FBF31ED2C913}" = Catalyst Control Center Localization Polish
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E992D2F-5D9F-0A2A-302E-E4AC8FB79F47}" = Catalyst Control Center Graphics Full Existing
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{83d96ed0-98aa-4515-8ddc-816f3efdd104}" = MyDSC2
"{84DB8DAE-531B-FDA4-E683-8C82F0F81F26}" = Catalyst Control Center Localization Turkish
"{865A7423-1322-E68E-4604-BEB0EEBFB624}" = Catalyst Control Center Localization Norwegian
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9B35344F-7FA4-B6BA-E64B-930A5BDB9585}" = Catalyst Control Center InstallProxy
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FFC6670-6711-387B-3566-7D0DA1808531}" = CCC Help Swedish
"{A8176277-4272-EA16-CDAE-1E37C62E14B2}" = CCC Help Italian
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9E38025-D8D8-FB5E-0DDB-12691243EF1F}" = CCC Help Norwegian
"{AFE52E73-FADF-7AEC-9F2E-9C490C77AB61}" = Catalyst Control Center Localization German
"{B16469A5-D2FA-A0C8-D371-2F4C8D5707D4}" = CCC Help Finnish
"{B463846D-85B8-5B31-59BD-AA68307ECC69}" = CCC Help Spanish
"{B483D67F-8223-F1C5-1CBD-59B13676019E}" = CCC Help Greek
"{B7BA5747-159E-B1E7-B73D-E3B7575D783A}" = CCC Help Thai
"{BC4FBC02-B2B7-ACCA-C983-FFF31FC3C1C9}" = CCC Help Japanese
"{C08B098D-E9A6-649F-120D-9263C0527C2E}" = Catalyst Control Center Localization Swedish
"{C0DA129B-1E45-494D-A362-5CD0109C306B}" = WOT for Internet Explorer
"{C22EDAB3-B9C3-3189-6FE5-8DC4CFADED81}" = CCC Help Hungarian
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C4FA4F86-63E8-9CD5-8CD3-25E4AC0E8861}" = Catalyst Control Center Localization Finnish
"{C63225DD-4956-D968-E563-30371AA23FD8}" = Skins
"{C7D5F833-4603-B3A3-4DB7-178022D73CC6}" = Catalyst Control Center Localization Dutch
"{CC4AD2ED-C8C8-6548-BAB0-59058B3FA658}" = Catalyst Control Center Localization Greek
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{D04DA284-0680-277B-832E-B795D9302F8D}" = CCC Help Turkish
"{D5B90069-DC5F-E482-D86A-B0CBBBD0E50E}" = CCC Help Russian
"{D9029DA7-CFA1-AC76-018D-AE0E596374D5}" = Cradle of Persia
"{DABF43D9-1104-4764-927B-5BED1274A3B0}" = Runtime
"{DF7A3C71-08FD-9154-BF1C-81BC491F4C2C}" = CCC Help French
"{E03CD71A-F595-49DF-9ADC-0CFC93B1B211}" = PlayMemories Home
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{EA78289C-35D1-10D4-CA0D-7C653B2E212A}" = Catalyst Control Center Localization Hungarian
"{EAE06CC6-8838-CA77-347C-BD3E9DEC6C93}" = Catalyst Control Center Localization Italian
"{EB18E9CE-A633-1192-BDF6-4EA15DA97785}" = Catalyst Control Center Graphics Light
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{ECA47E2A-51B0-2F2F-67D3-A2A0639092B1}" = Catalyst Control Center Localization Korean
"{ED5085E1-BA8E-1464-2E3D-400086526EDE}" = Catalyst Control Center Localization Thai
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFA58E6D-8053-18D7-C9BB-C76312C1E12C}" = CCC Help Korean
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"ATT-PRT22" = ATT-PRT22
"avast" = avast! Free Antivirus
"BellSouth" = BellSouth FastAccess DSL Help Center
"Canon MP280 series User Registration" = Canon MP280 series User Registration
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"Diner Dash" = Diner Dash
"Diner Dash 2" = Diner Dash 2
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"exent_653850" = Cake Mania Main Street
"exent_713750" = Cake Mania: To the Max!
"HP Photo Creations" = HP Photo Creations
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"Intuit SiteBuilder" = Intuit SiteBuilder
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Micro Innovations Optical Scroll Mouse" = Micro Innovations Optical Scroll Mouse
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"Mystery P.I. - The Vegas Heist" = Mystery P.I. - The Vegas Heist (remove only)
"singalong@xenophesoft.com" = Sing Along
"Street Atlas USA 8.0" = Street Atlas USA 8.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"VIVAGplayer" = VIVA MEDIA GAME CENTER

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ZEN Entertainment" = ZEN Entertainment

< End of report >

 

All processes killed
========== OTL ==========
Service X6XSEx_Pr143 stopped successfully!
Service X6XSEx_Pr143 deleted successfully!
File C:\Program Files\Free Ride Games\X6XSEx_Pr143.Sys not found.
Service NwlnkFwd stopped successfully!
Service NwlnkFwd deleted successfully!
File system32\DRIVERS\nwlnkfwd.sys not found.
Service NwlnkFlt stopped successfully!
Service NwlnkFlt deleted successfully!
File system32\DRIVERS\nwlnkflt.sys not found.
Service MRESP50a64 stopped successfully!
Service MRESP50a64 deleted successfully!
File C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS not found.
Service MREMP50a64 stopped successfully!
Service MREMP50a64 deleted successfully!
File C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS not found.
Service IpInIp stopped successfully!
Service IpInIp deleted successfully!
File system32\DRIVERS\ipinip.sys not found.
Service IntcAzAudAddService stopped successfully!
Service IntcAzAudAddService deleted successfully!
File system32\drivers\RTKVHDA.sys not found.
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\ComboFix\catchme.sys not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@exent.com/npExentCtl,version=7.0.0.0\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\www.exent.com/GameTreatWidget\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}\ not found.
File C:\Program Files\AVG\AVG2012\Firefox4 not found.
File C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1777_0\plug ins/avgnpss.dll not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\\Exetender deleted successfully.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\Exetender not found.
Registry value HKEY_USERS\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Exetender deleted successfully.
Starting removal of ActiveX control {7530BFB8-7293-4D34-9923-61A11451AFC5}
C:\Windows\Downloaded Program Files\OnlineScanner.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
C:\Users\jerry\AppData\Roaming\AVG\AWL2012\TuningIndex folder moved successfully.
C:\Users\jerry\AppData\Roaming\AVG\AWL2012\StartUp Manager folder moved successfully.
C:\Users\jerry\AppData\Roaming\AVG\AWL2012\Dashboard folder moved successfully.
C:\Users\jerry\AppData\Roaming\AVG\AWL2012\Backups folder moved successfully.
C:\Users\jerry\AppData\Roaming\AVG\AWL2012 folder moved successfully.
C:\Users\jerry\AppData\Roaming\AVG folder moved successfully.
ADS C:\ProgramData\TEMP:BEE39E9B deleted successfully.
ADS C:\ProgramData\TEMP:CAC06C34 deleted successfully.
ADS C:\ProgramData\TEMP:AAA06E15 deleted successfully.
ADS C:\ProgramData\TEMP:A6D6E537 deleted successfully.
ADS C:\ProgramData\TEMP:206470A5 deleted successfully.
ADS C:\ProgramData\TEMP:9BAC4211 deleted successfully.
ADS C:\ProgramData\TEMP:6B709AD7 deleted successfully.
ADS C:\ProgramData\TEMP:3EC5BC08 deleted successfully.
ADS C:\ProgramData\TEMP:B54E4B5A deleted successfully.
ADS C:\ProgramData\TEMP:491270B8 deleted successfully.
ADS C:\ProgramData\TEMP:0EC7A545 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: jerry
->Temp folder emptied: 1495668 bytes
->Temporary Internet Files folder emptied: 35537026 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 506 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3244 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 35.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: jerry
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: jerry
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 05302013_184144

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

Results of screen317's Security Check version 0.99.64
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
SUPERAntiSpyware
Java(TM) 6 Update 31
Java 7 Update 7
Java version out of Date!
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1 %
````````````````````End of Log``````````````````````

 

Farbar Service Scanner Version: 25-05-2013
Ran by jerry (administrator) on 30-05-2013 at 18:58:35
Running from "C:\Users\jerry\Desktop "
Windows Vista (TM) Home Basic Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-02-13 10:01] - [2013-01-04 07:28] - 0905576 ____A (Microsoft Corporation) 74E2D020C47BB2B2FCCBA29A518A7EB4

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

 

still downloading the eset, it seems to be stuck at 4%, i'll just give it more time.

 

i checked back on the download and its stuck at 4% with message in red: cannot get update,is proxy configured?. I went to the site and checked their help, it said i should get a screen to download activex control which i didnt get?