Solved windows 7 boots to black screen with CMD boxed window

pcbugfixer · 2013/06/06

Continue - OTL - Extras / Reports

OTL logfile created on: 6/06/2013 2:30:37 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ralph\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.99 Gb Total Physical Memory | 1.16 Gb Available Physical Memory | 58.12% Memory free
3.98 Gb Paging File | 2.95 Gb Available in Paging File | 74.22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 422.84 Gb Free Space | 90.79% Space Free | Partition Type: NTFS

Computer Name: RALPH-PC | User Name: ralph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/06 13:48:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ralph\Desktop\OTL.exe
PRC - [2013/05/24 06:11:42 | 000,119,056 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2013/05/16 10:56:34 | 001,033,688 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
PRC - [2013/05/16 10:56:30 | 001,817,560 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
PRC - [2013/05/15 13:21:32 | 000,171,928 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
PRC - [2013/05/10 17:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/01/27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/01/27 11:11:06 | 000,947,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/11/23 12:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2011/02/25 15:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

========== Modules (No Company Name) ==========

MOD - [2013/05/29 20:47:16 | 000,008,704 | ---- | M] () -- C:\Users\ralph\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.2.gadget\GetCoreTempInfoNET.dll
MOD - [2013/05/29 20:47:16 | 000,007,680 | ---- | M] () -- C:\Users\ralph\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.2.gadget\SystemInfo.dll
MOD - [2013/05/29 20:47:16 | 000,006,144 | ---- | M] () -- C:\Users\ralph\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.2.gadget\CoreTempReader.dll
MOD - [2013/05/16 10:55:26 | 000,113,496 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
MOD - [2013/05/16 10:55:24 | 000,416,600 | ---- | M] () -- C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
MOD - [2013/05/16 08:43:45 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013/01/13 13:48:09 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013/01/13 13:48:03 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013/01/13 13:47:52 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDWSCService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService)
SRV - [2013/05/24 06:11:42 | 000,119,056 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2013/05/15 21:33:13 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/10 17:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/03/01 12:11:32 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/27 11:11:46 | 000,295,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2013/01/27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/11/20 22:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/11/20 22:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/11/20 22:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010/08/26 17:12:34 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/14 11:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 11:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{88C36BBF-7D4F-4B86-9B9A-BE89D4BEA799}\MpKsl1c1c6aa3.sys -- (MpKsl1c1c6aa3)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\ralph\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2013/01/20 15:59:04 | 000,100,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012/12/21 13:54:00 | 000,014,920 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv)
DRV - [2012/12/21 13:53:58 | 000,009,160 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2011/07/23 02:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/13 07:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/11/20 20:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 19:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/24 06:02:56 | 000,043,008 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2009/07/14 09:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2008/05/06 16:06:00 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wdcsam.sys -- (WDC_SAM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-AU
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8A E1 00 FA 44 9C CC 01 [binary data]
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:21320

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.1-fec1: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\ralph\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\ralph\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\findlyrics@findlyrics.co: C:\Program Files\FindLyrics\FF\ [2013/06/05 13:58:39 | 000,000,000 | ---D | M]

========== Chrome ==========

CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = http://www.bing.com/search?setmkt=en-AU&q={searchTerms}
CHR - default_search_provider: suggest_url = http://api.bing.com/osjson.aspx?query={searchTerms}&language={language}
CHR - homepage: http://www.google.com
CHR - plugin: Silverlight (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\ralph\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\ralph\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Gmail = C:\Users\ralph\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2013/06/06 13:21:48 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000..\RunServices: [] File not found
O4 - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000..\RunServicesOnce: [] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.21.2)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C74850B9-22DD-43DB-B1D1-36C960682058}: DhcpNameServer = 192.168.0.254
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 07:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/06/06 14:27:38 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/06/06 14:27:27 | 000,000,000 | ---D | C] -- C:\JRT
[2013/06/06 13:49:08 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\ralph\Desktop\JRT.exe
[2013/06/06 13:48:51 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\ralph\Desktop\OTL.exe
[2013/06/06 13:24:00 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/06/06 13:23:59 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Local\temp
[2013/06/06 12:40:25 | 005,077,725 | R--- | C] (Swearware) -- C:\Users\ralph\Desktop\ComboFix.exe
[2013/06/06 11:31:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2013/06/06 00:44:53 | 000,000,000 | ---D | C] -- C:\Users\ralph\Documents\ProcAlyzer Dumps
[2013/06/05 14:00:22 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Local\Downloaded Installations
[2013/06/05 13:59:59 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\2V2Z1C1P1H1P1Q1F2W1G1I1F1T1QtAtB
[2013/06/05 13:58:39 | 000,000,000 | ---D | C] -- C:\Program Files\FindLyrics
[2013/06/05 13:43:26 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2013/06/05 12:58:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013/06/05 12:57:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2013/06/05 12:57:25 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\Windows\System32\sdnclean.exe
[2013/06/05 12:57:20 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
[2013/06/05 12:48:01 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\SUPERAntiSpyware.com
[2013/06/05 12:47:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2013/06/05 12:47:52 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2013/06/05 12:47:52 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2013/06/05 00:11:13 | 000,000,000 | R--D | C] -- C:\Users\ralph\Desktop\CD and DVD Programs
[2013/06/05 00:03:40 | 000,000,000 | R--D | C] -- C:\Users\ralph\Desktop\Ralphs Office
[2013/06/05 00:02:53 | 000,000,000 | R--D | C] -- C:\Users\ralph\Desktop\PC Maintenance
[2013/06/04 17:57:54 | 000,000,000 | R--D | C] -- C:\Users\ralph\Desktop\PC-Bug Fixer 970 80 601
[2013/06/04 17:11:08 | 000,000,000 | ---D | C] -- C:\FRST
[2013/06/04 00:19:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013/06/04 00:19:30 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013/06/03 23:58:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Partition Master 9.2.1 Professional Edition
[2013/06/03 23:58:22 | 000,000,000 | ---D | C] -- C:\Program Files\EaseUS
[2013/06/03 23:56:25 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013/06/03 23:56:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013/06/03 23:55:45 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\WinRAR
[2013/06/03 23:55:26 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2013/06/03 00:03:43 | 000,000,000 | ---D | C] -- C:\Program Files\Belarc
[2013/06/01 09:54:37 | 000,012,872 | ---- | C] (SurfRight B.V.) -- C:\Windows\System32\bootdelete.exe
[2013/06/01 09:25:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
[2013/06/01 09:24:25 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro
[2013/06/01 09:24:06 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2013/05/29 21:04:21 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Registry Crawler
[2013/05/29 21:04:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Crawler
[2013/05/29 21:04:17 | 000,000,000 | ---D | C] -- C:\OSD
[2013/05/29 20:48:42 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\Windows SideBar
[2013/05/29 17:55:00 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Local\Programs
[2013/05/29 17:54:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2013/05/20 20:08:55 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\Ihony
[2013/05/20 10:15:47 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\Oxhe
[2013/05/20 10:15:47 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\Edkona
[2013/05/20 10:15:47 | 000,000,000 | ---D | C] -- C:\Users\ralph\AppData\Roaming\Axobt
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/06/06 14:33:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/06 14:32:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/06 14:31:09 | 000,022,576 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/06 14:31:09 | 000,022,576 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/06 14:26:43 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\FindLyrics Update.job
[2013/06/06 14:23:53 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/06 14:23:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/06 14:23:42 | 1602,347,008 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/06 14:03:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2917188583-2753293597-2095739363-1000UA.job
[2013/06/06 13:49:19 | 000,632,031 | ---- | M] () -- C:\Users\ralph\Desktop\adwcleaner.exe
[2013/06/06 13:49:08 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\ralph\Desktop\JRT.exe
[2013/06/06 13:48:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ralph\Desktop\OTL.exe
[2013/06/06 13:21:48 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013/06/06 12:36:54 | 005,077,725 | R--- | M] (Swearware) -- C:\Users\ralph\Desktop\ComboFix.exe
[2013/06/06 00:44:10 | 000,000,243 | ---- | M] () -- C:\Boot.ini
[2013/06/05 21:16:44 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2917188583-2753293597-2095739363-1000Core.job
[2013/06/05 13:43:40 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013/06/05 13:24:21 | 000,000,779 | ---- | M] () -- C:\Windows\wininit.ini
[2013/06/05 01:46:22 | 000,295,936 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/06/05 00:36:27 | 000,025,185 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2013/06/05 00:23:45 | 000,002,129 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Security Essentials.lnk
[2013/06/04 15:53:24 | 000,649,776 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/06/04 15:53:24 | 000,116,022 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/06/03 00:53:40 | 000,235,553 | ---- | M] () -- C:\Users\ralph\AppData\Local\census.cache
[2013/06/03 00:53:39 | 000,105,661 | ---- | M] () -- C:\Users\ralph\AppData\Local\ars.cache
[2013/06/03 00:31:36 | 000,000,036 | ---- | M] () -- C:\Users\ralph\AppData\Local\housecall.guid.cache
[2013/06/03 00:03:44 | 000,002,094 | ---- | M] () -- C:\Users\ralph\Application Data\Microsoft\Internet Explorer\Quick Launch\Belarc Advisor.lnk
[2013/06/01 09:54:37 | 000,012,872 | ---- | M] (SurfRight B.V.) -- C:\Windows\System32\bootdelete.exe
[2013/05/31 00:35:23 | 000,000,354 | -HS- | M] () -- C:\Boot.ini.saved
[2013/05/31 00:34:50 | 000,000,210 | ---- | M] () -- C:\Boot.BAK
[2013/05/30 00:57:49 | 000,000,343 | ---- | M] () -- C:\Users\ralph\AppData\Roaming\Drives Meter_Settings.ini
[2013/05/29 21:04:21 | 000,000,696 | ---- | M] () -- C:\Users\ralph\Desktop\Registry Crawler.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/06/06 13:49:19 | 000,632,031 | ---- | C] () -- C:\Users\ralph\Desktop\adwcleaner.exe
[2013/06/06 13:34:59 | 000,000,696 | ---- | C] () -- C:\Users\ralph\Desktop\Registry Crawler.lnk
[2013/06/05 22:28:22 | 016,300,032 | ---- | C] () -- C:\Windows\VTS_01_1.VOB
[2013/06/05 13:58:42 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\FindLyrics Update.job
[2013/06/05 13:43:35 | 000,002,156 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2013/06/05 13:23:46 | 000,000,779 | ---- | C] () -- C:\Windows\wininit.ini
[2013/06/05 12:57:28 | 000,002,174 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2013/06/05 00:36:27 | 000,025,185 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2013/06/05 00:20:03 | 000,002,129 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Security Essentials.lnk
[2013/06/04 16:18:04 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2013/06/03 23:58:37 | 000,019,840 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2013/06/03 23:58:36 | 002,468,520 | ---- | C] () -- C:\Windows\System32\BootMan.exe
[2013/06/03 23:58:36 | 000,087,112 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe
[2013/06/03 23:58:36 | 000,014,920 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2013/06/03 23:58:36 | 000,009,160 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2013/06/03 00:44:04 | 000,235,553 | ---- | C] () -- C:\Users\ralph\AppData\Local\census.cache
[2013/06/03 00:43:52 | 000,105,661 | ---- | C] () -- C:\Users\ralph\AppData\Local\ars.cache
[2013/06/03 00:31:36 | 000,000,036 | ---- | C] () -- C:\Users\ralph\AppData\Local\housecall.guid.cache
[2013/06/03 00:03:44 | 000,002,094 | ---- | C] () -- C:\Users\ralph\Application Data\Microsoft\Internet Explorer\Quick Launch\Belarc Advisor.lnk
[2013/06/03 00:03:44 | 000,002,082 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Belarc Advisor.lnk
[2013/05/31 00:36:42 | 000,000,243 | ---- | C] () -- C:\Boot.ini
[2013/05/29 20:59:15 | 000,000,343 | ---- | C] () -- C:\Users\ralph\AppData\Roaming\Drives Meter_Settings.ini
[2012/10/09 15:21:02 | 000,026,588 | ---- | C] () -- C:\Users\ralph\AppData\Roaming\UserTile.png
[2011/11/02 09:50:36 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf05a.dat
[2011/11/02 09:49:01 | 000,106,496 | ---- | C] () -- C:\Windows\System32\BrMuSNMP.dll
[2011/10/22 15:52:14 | 000,007,609 | ---- | C] () -- C:\Users\ralph\AppData\Local\Resmon.ResmonCfg
[2011/06/29 14:31:09 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/06/29 14:31:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/06/29 14:31:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/06/29 14:31:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/06/29 14:31:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/06/24 15:50:33 | 000,000,127 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011/06/17 18:58:42 | 000,001,336 | -HS- | C] () -- C:\Users\ralph\AppData\Local\1p320v8nn616o318056t
[2011/06/17 18:58:42 | 000,001,336 | -HS- | C] () -- C:\ProgramData\1p320v8nn616o318056t
[2010/10/03 13:23:30 | 000,000,000 | ---- | C] () -- C:\Users\ralph\jagex__preferences3.dat
[2010/10/03 13:23:11 | 000,000,099 | ---- | C] () -- C:\Users\ralph\jagex_runescape_preferences2.dat
[2010/10/03 13:20:29 | 000,000,046 | ---- | C] () -- C:\Users\ralph\jagex_runescape_preferences.dat
[2010/09/24 16:07:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

========== ZeroAccess Check ==========

[2009/07/14 14:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shell32.dll -- [2013/02/27 14:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 22:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 11:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/04/14 22:42:15 | 000,000,000 | ---D | M] -- C:\Users\Guest\AppData\Roaming\OpenOffice.org
[2013/06/05 13:59:59 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\2V2Z1C1P1H1P1Q1F2W1G1I1F1T1QtAtB
[2013/05/22 10:13:55 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\Axobt
[2011/07/02 13:50:10 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1
[2010/09/07 14:21:06 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\DraftSight
[2013/05/20 10:15:47 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\Edkona
[2013/05/28 15:33:14 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\Ihony
[2011/04/15 16:28:32 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\jsjhpwcnrx2td1gkyv3ah2hwotgbpxk2
[2012/05/16 13:13:52 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\Marine Aquarium Lite
[2010/09/07 14:00:54 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\OpenOffice.org
[2013/05/26 09:34:20 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\Oxhe
[2012/08/29 15:23:56 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\PC Utility Kit
[2011/09/13 07:46:48 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\Windows Live Writer
[2013/05/29 20:48:42 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\Windows SideBar
[2011/04/15 16:28:32 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\xnnqmzhsumrefab12fnodp2ppacvzsln2

========== Purity Check ==========

< End of report >

==================================================

OTL Extras logfile created on: 6/06/2013 2:30:37 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\ralph\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1.99 Gb Total Physical Memory | 1.16 Gb Available Physical Memory | 58.12% Memory free
3.98 Gb Paging File | 2.95 Gb Available in Paging File | 74.22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 422.84 Gb Free Space | 90.79% Space Free | Partition Type: NTFS

Computer Name: RALPH-PC | User Name: ralph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CA861C0-89F2-4899-BBC6-51828B61E298}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1E7C49BD-C2E2-4FBF-AAA5-29AD6DCD3B87}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1F37A7CD-36DF-4789-9E20-63FEB8853CF5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{21E28F61-B25B-4E20-A4CB-CE7312F365FE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{22DE325E-610D-4CE7-A522-D45796D65C31}" = rport=445 | protocol=6 | dir=out | app=system |
"{2EECB6A7-507E-4CB8-9FAE-4CC6302C26A5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{31C235DD-5764-42E2-989F-74BAA9F12BC6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{376EBDC0-7ED2-4E8B-ADBB-7E991CE894F6}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{43150167-2778-4025-8759-625A49981ACF}" = lport=139 | protocol=6 | dir=in | app=system |
"{4733EA0F-7768-4BA9-83EF-99B51E4A1F34}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{485F5B4D-73CF-4DA4-8A16-205F16DEED13}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5179BBFF-FF92-47B6-BA73-5D1702DBA2EE}" = lport=137 | protocol=17 | dir=in | app=system |
"{52D45956-56B6-4B36-92AA-BD38B52E2F7B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5F9A506D-B8A0-4D4A-AFBD-33D193AB8EDD}" = lport=138 | protocol=17 | dir=in | app=system |
"{606F1AB1-0FA2-4A05-8757-15AE5F7EC69C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6334749F-400D-4F7D-B7C6-E5FA1E022DEF}" = rport=138 | protocol=17 | dir=out | app=system |
"{8257CDA6-C9CB-4522-9CFB-49C964FA667E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{8AAE0A81-A591-4B69-8D19-6A1CC7B8C1B7}" = lport=10243 | protocol=6 | dir=in | app=system |
"{8BD431E2-CC28-4C40-B828-928B1CDF82F6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{996212D1-AD4D-4EB6-956F-E76C176E6A31}" = rport=10243 | protocol=6 | dir=out | app=system |
"{9E6A5D8E-92E6-4768-B2CC-8F999834A1E3}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{A26B1D73-DD83-48E9-8807-1968323C7DFC}" = lport=445 | protocol=6 | dir=in | app=system |
"{AA9F08CF-0F01-4095-B6F8-AFDCFF10EB14}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AC214C5C-3176-47DB-85BC-0BDF512F2B9E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{B3AED979-46C2-49C5-96FC-EBB3CB4AD0F2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B9202F26-00BA-49E2-8781-79E6D6F7BE11}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{BE613FB1-66BF-4E18-A26C-D547600165BD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C169819C-64FB-4D73-90EF-8CB2023BF632}" = rport=137 | protocol=17 | dir=out | app=system |
"{C3D21144-F77E-489A-8C85-87AF715A6763}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D3B7C994-F957-4F37-9CBC-037512CEDA66}" = rport=139 | protocol=6 | dir=out | app=system |
"{DF5E69BD-BFE4-40AA-B93D-0E9DC7B43969}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E1E679CA-1A4A-4884-9F91-9F0FED7DE4DD}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F436C229-AA42-4147-AC3F-DA0D050D60C5}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FB15555B-4B99-4356-AF81-D6E516F82376}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{FF48E2BE-78D6-45FD-9A08-902F8EB52427}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0715218A-246E-4267-A86F-DAFE73778591}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0AB0369B-E857-4080-98F7-AC454157CA8F}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{1B6204D8-7EEC-4C46-8242-BE3AFDD4A978}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{22E15022-75FD-44A9-95C6-51DD4EFA4DE1}" = protocol=6 | dir=out | app=system |
"{410621AD-3250-40E4-9FCC-2310231807C3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{47E08CAE-5F42-42AA-91CD-586BEBE27C1F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5EE147C3-9FA4-4CF8-B5EA-51A1656C8F78}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{61FF9B5A-4934-4E6C-8CED-3D27AFBB3193}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6CEA86F8-93E2-4AE4-84C1-5E0110CA6B8E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{87834E91-E5A1-425D-9C23-C5FBEDE54AFE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{9E65C9BE-8900-45DC-82D5-3203BAFFB320}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{A6A233E3-4A31-4795-AF68-479D3BAF2A5F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B098ECA7-F0A5-43F3-8C95-4D553F2CBDA4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BA8BF072-F038-481C-9C46-7090ACFB895A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D4AC55AA-0B2E-4EBF-99F2-C509A99E0C28}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{DEA4F3BD-941D-44C1-897F-0A15B62B291E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{E688B3F6-11BA-4AB0-BF06-AA70B734FA22}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E8240992-8753-4154-BE88-1AB5CE213A04}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EC7FD815-6BFE-4F9C-9E81-287B4982766A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F4DF889F-943A-40EF-A640-F1C7B4877CC7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{77DD389F-9D2D-4552-B00F-499B40E2766D}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{7C9DAA23-F9EE-4784-B72E-ED9BD3AA8BA3}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{A274BB52-18F8-4826-8B34-AC5545FED768}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{DEBB8CD9-B360-42E3-A7EC-191A252EB1A1}C:\windows\system32\taskhost.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskhost.exe |
"UDP Query User{0C6E39B3-B9EC-45AA-AB2B-97E334A2711E}C:\windows\system32\taskhost.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskhost.exe |
"UDP Query User{450F1150-5257-43A7-A924-FC34D183D33F}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{6AC400BC-9BB9-4DBC-8941-8F9D8AFEC3E9}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{94E21E47-4673-41C8-AD13-C0824431DC99}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{247C5DDA-FFD7-44E0-8BF7-79BC80A0BF87}" = Windows Live Family Safety
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2D6E3D97-1FDF-4993-AC75-72F59EC445C5}" = Windows Live Family Safety
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{390DD8BB-BB57-4942-A029-2D913E4E9D74}" = Microsoft Security Client
"{398DA395-DF34-4A03-8DE9-3E7A8680BB51}" = Telstra Plus Premium Support
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skypeâ„¢ 6.3
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}" = OpenOffice.org 3.4.1
"{A0087DDE-69D0-11E2-AD57-43CA6188709B}" = Adobe AIR
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A75BC59B-10BF-6B87-DCC7-3501F158ACC6}" = Times Reader
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.7)
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CC9A62E0-B3D2-48EB-B3CE-05B04E5AD657}" = DraftSight
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Belarc Advisor" = Belarc Advisor 8.3
"CCleaner" = CCleaner
"com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1" = Times Reader
"EaseUS Partition Master Professional Edition_is1" = EaseUS Partition Master 9.2.1 Professional
"findlyrics@findlyrics.co" = FindLyrics
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HitmanPro37" = HitmanPro 3.7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft Security Client" = Microsoft Security Essentials
"Registry Crawler" = Registry Crawler
"TVWiz" = Intel(R) TV Wizard
"VLC media player" = VLC media player 1.0.1-fec1
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.20 (32-bit)

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2917188583-2753293597-2095739363-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"OpenOffice Packages" = OpenOffice Packages

< End of report >

=========================================

End of 4 reports

Regards
Roger H.

broni · 2013/06/06

Make sure you reinstall AVG as soon as possible.

Run OTL

Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDWSCService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService)
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService)
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{88C36BBF-7D4F-4B86-9B9A-BE89D4BEA799}\MpKsl1c1c6aa3.sys -- (MpKsl1c1c6aa3)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\ralph\AppData\Local\Temp\catchme.sys -- (catchme)
IE - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyServer" = localhost:21320
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll File not found
O4 - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000..\RunServices: [] File not found
O4 - HKU\S-1-5-21-2917188583-2753293597-2095739363-1000..\RunServicesOnce: [] File not found
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found
[2011/06/17 18:58:42 | 000,001,336 | -HS- | C] () -- C:\Users\ralph\AppData\Local\1p320v8nn616o318056t
[2011/06/17 18:58:42 | 000,001,336 | -HS- | C] () -- C:\ProgramData\1p320v8nn616o318056t
[2013/06/05 13:59:59 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\2V2Z1C1P1H1P1Q1F2W1G1I1F1T1QtAtB
[2011/04/15 16:28:32 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\jsjhpwcnrx2td1gkyv3ah2hwotgbpxk2
[2011/04/15 16:28:32 | 000,000,000 | ---D | M] -- C:\Users\ralph\AppData\Roaming\xnnqmzhsumrefab12fnodp2ppacvzsln2

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.

NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

Last scans...

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services

Windows Firewall

System Restore

Security Center

Windows Update

Windows Defender

Other Services

Press "Scan ".

It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, click on List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

pcbugfixer · 2013/06/06

AVG not on system - Was uninstalled prior to my involvement

G'day Broni,

AVG not on system - Was uninstalled prior to my involvement

These items previously reported are not on the system,

AV: AVG Internet Security 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Internet Security 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}

I used regedit and Registry Crawler v4.5 to hunt these down and All I could find are the search items that I looked for and Legacy entries.

I will look again !

Note that The AVG that was installed is an old 2011 version and if we need to reinstall it, I would try and find a copy of it.
Obviously the key if Ralph had one, is lost for it.

I will wait for your reply regarding AVG, before I proceed !!!

Regards
Roger H.

pcbugfixer · 2013/06/06

OTL fix

All processes killed
Error: Unable to interpret <Code: > in the current context!
========== OTL ==========
Service SDWSCService stopped successfully!
Service SDWSCService deleted successfully!
File C:\Program Files\Spybot not found.
Service SDUpdateService stopped successfully!
Service SDUpdateService deleted successfully!
File C:\Program Files\Spybot not found.
Service SDScannerService stopped successfully!
Service SDScannerService deleted successfully!
File C:\Program Files\Spybot not found.
Service MpKsl1c1c6aa3 stopped successfully!
Service MpKsl1c1c6aa3 deleted successfully!
File c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{88C36BBF-7D4F-4B86-9B9A-BE89D4BEA799}\MpKsl1c1c6aa3.sys not found.
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\Users\ralph\AppData\Local\Temp\catchme.sys not found.
HKU\S-1-5-21-2917188583-2753293597-2095739363-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@java.com/JavaPlugin\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2917188583-2753293597-2095739363-1000\Software\Microsoft\Windows\CurrentVersion\RunServices\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2917188583-2753293597-2095739363-1000\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
C:\Users\ralph\AppData\Local\1p320v8nn616o318056t moved successfully.
C:\ProgramData\1p320v8nn616o318056t moved successfully.
C:\Users\ralph\AppData\Roaming\2V2Z1C1P1H1P1Q1F2W1G1I1F1T1QtAtB\OpenOffice Packages folder moved successfully.
C:\Users\ralph\AppData\Roaming\2V2Z1C1P1H1P1Q1F2W1G1I1F1T1QtAtB folder moved successfully.
C:\Users\ralph\AppData\Roaming\jsjhpwcnrx2td1gkyv3ah2hwotgbpxk2 folder moved successfully.
C:\Users\ralph\AppData\Roaming\xnnqmzhsumrefab12fnodp2ppacvzsln2 folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 57472 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: DefaultAppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56504 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 4009 bytes

User: Public
->Temp folder emptied: 0 bytes

User: ralph
->Temp folder emptied: 116224 bytes
->Temporary Internet Files folder emptied: 2916787 bytes
->Java cache emptied: 177270 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 57983 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 3.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: DefaultAppPool

User: Guest
->Java cache emptied: 0 bytes

User: Public

User: ralph
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: DefaultAppPool
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Public

User: ralph
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 06062013_160715
Files\Folders moved on Reboot...
File\Folder C:\Users\ralph\AppData\Local\Temp\~DF3A87AC0624CEE041.TMP not found!
File\Folder C:\Users\ralph\AppData\Local\Temp\~DF8EB344DAB05EE280.TMP not found!
File\Folder C:\Users\ralph\AppData\Local\Temp\~DF9938D00E9DCDD10E.TMP not found!
File\Folder C:\Users\ralph\AppData\Local\Temp\~DFB47498A351767190.TMP not found!
File\Folder C:\Users\ralph\AppData\Local\Temp\~DFB6440CB33760FBB7.TMP not found!
File\Folder C:\Users\ralph\AppData\Local\Temp\~DFCD0382A50A2AB02D.TMP not found!
C:\Users\ralph\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R4JR1OBN\fastbutton[1].htm moved successfully.
C:\Users\ralph\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R4JR1OBN\xd_arbiter[1].htm moved successfully.
C:\Users\ralph\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O7H6B1V6\105525-active-windows-7-boots-black-screen-cmd-boxed-window-2[1].htm moved successfully.
C:\Users\ralph\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KMFKBDKE\xd_arbiter[1].htm moved successfully.
C:\Users\ralph\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9LVWH26M\like[1].htm moved successfully.
File move failed. C:\Users\ralph\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...

pcbugfixer · 2013/06/06

SecurityCheck - FSS - TFC - ESET Reports

Results of screen317's Security Check version 0.99.64
Windows 7 Service Pack 1 x86 (UAC is disabled!)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
(On Access scanning disabled!)
Error obtaining update status for antivirus!
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
SUPERAntiSpyware
Malwarebytes Anti-Malware version 1.75.0.1300
CCleaner
Java 7 Update 21
Adobe Flash Player 11.7.700.202
Adobe Reader 10.1.7 Adobe Reader out of Date!
Google Chrome 27.0.1453.110
Google Chrome 27.0.1453.94
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

===========================================

Farbar Service Scanner Version: 31-05-2013 01
Ran by ralph (administrator) on 06-06-2013 at 16:46:54
Running from "C:\Users\ralph\Desktop "
Windows 7 Home Premium Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.

Windows Firewall:
=============
Firewall Disabled Policy:
==================

System Restore:
============
System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============
Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware "=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

==========================================

Getting user folders.

Stopping running processes.

Emptying Temp folders.

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: DefaultAppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: ralph
->Temp folder emptied: 1600 bytes
->Temporary Internet Files folder emptied: 1875146 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 492 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2468 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 11743085 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 741 bytes

Emptying RecycleBin. Do not interrupt.

RecycleBin emptied: 0 bytes
Process complete!

Total Files Cleaned = 13.00 mb

============================================

C:\Program Files\FindLyrics\chrome.crx Win32/Adware.AddLyrics.F application deleted - quarantined
C:\Program Files\FindLyrics\flcsur.exe Win32/Adware.AddLyrics.D application cleaned by deleting - quarantined
C:\Program Files\FindLyrics\FF\chrome\content\main.js Win32/Adware.AddLyrics.F application cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Program Files\FindLyrics\FiNDlyrics.dll.vir Win32/Adware.AddLyrics.D application cleaned by deleting - quarantined

========================================

End of Reports

Regards
Roger H.

broni · 2013/06/06

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions (if present).
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

==================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

8. Run Temporary File Cleaner (TFC) weekly.

9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

11. (Windows XP only) Run defrag at your convenience.

12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

14. Please, let me know, how your computer is doing.

pcbugfixer · 2013/06/07

G'day Broni,

Thank you for all your help and the expert input in solving this issue.

Here is the report you asked for - Item 1.
--------------------------------------------------------------
All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 57472 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: DefaultAppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: ralph
->Temp folder emptied: 3666834 bytes
->Temporary Internet Files folder emptied: 2042814 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 842911 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 58180 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6994 bytes
RecycleBin emptied: 77 bytes

Total Files Cleaned = 6.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: DefaultAppPool
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Public

User: ralph
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: DefaultAppPool

User: Guest
->Java cache emptied: 0 bytes

User: Public

User: ralph
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 06072013_133132

Files\Folders moved on Reboot...
C:\Users\ralph\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
--------------------------------------------------------------

Item 2. Was completed.

Item 3. Was completed in this instant.
This we normally do every 2nd Wednesday of a month. Microsoft issue their updated every 2nd Tuesday of a month and as we are approximately 18 hour ahead of their time, it becomes Wednesday in Australia to perform the Microsoft / Windows updates.

Item 4. No important passwords are saved on this workstation !!

Item 5. Plugins were updated. Slight issue with the latest Adobe 11.0.3 which I am sure will rectify itself in the next week or so.

Item 6. WOT to be completed when Ralph gets here to choose his details and password.

Item 7. A full scan was conducted with MalwareBytes returning a "0 found" result.

Item 8. I had already installed CCleaner v 4.0.2.4115 (the latest version) which in the initial clean, cleaned 2.3GB of rubbish from this system.
We then made some alterations to customize this utility.

Item 9. Was installed with 3rd option as we also have FileChecker (item 10) installed.

Item 10. Installed and customized.

Item 11. Was performed on this Win 7 HP SP1 system.

Item 12. We Perform nothing but "Custom" installations to avoid the "foistware" and will instruct Ralph to insure that he understands this 100%.

Item 13. Ralph will be instructed to read these articles.

Item 14. Thanks again for all your help in this issue.

I will mark the Topic as Resolved. (option not available to me ??? why not?)

Regards
Roger H.
pcbugfixer

broni · 2013/06/07

Way to go!!
Good luck and stay safe

pcbugfixer · 2013/06/07

Unable mark this as Resolved -Option not on my menu

G'day Broni,

Can you please mark this Topic as Resolved !

Option is not available on the "Thread Tools" Drop down menu
- have no idea why not, unless Arnie is responsible for blocking this ?

Regards
Roger H. (pcbugfixer)

broni · 2013/06/07

I did already

pcbugfixer · 2013/06/08

Broni,

This link does not work ?
Any specific alternative please to / for it ?

Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tuto...r-safe-online/

Regards

broni · 2013/06/08

Sorry about it
http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

pcbugfixer · 2013/06/08

Thank you

broni · 2013/06/08

Log in or Sign up

Solved windows 7 boots to black screen with CMD boxed window

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

pcbugfixer Inactive Thread Starter

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved windows 7 boots to black screen with CMD boxed window

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

pcbugfixer Inactive Thread Starter

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

pcbugfixer Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches