1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive Unsure if its a virus - dll/win32/Microsoft problems

Discussion in 'Malware and Virus Removal Archive' started by paultess, 2013/12/11.

Page 1 of 5
  1. 2013/12/11
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    [Inactive] Unsure if its a virus - dll/win32/Microsoft problems

    I don't know if this is a virus, but would appreciate any help available. Microsoft ICE suddenly stopped working about 4 days ago. 'Games' button went from instant to 15 second delay then slow to load solitaire -error messages regarding win32 and dll files appearing.
    I tried to correct, updated windows - service pack 1 offers to load constantly despite apparently loading.
    I followed windows correction steps but stalled when 'Windows cant find wupdmgr'
    Running scans with Microsoft fixit shows no problem, same with avast.
    I had to re-install Google Chrome as files could not be found (it suddenly stopped working).
    IE also stops working but re-starts itself.
    Sounds strange but when using things that work the computer is fast, clean.

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft® Windows Vistaâ„¢ Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 24/06/2013 2:19:10 PM
    System Uptime: 10/12/2013 8:30:53 PM (11 hours ago)
    .
    Motherboard: ASUSTeK Computer INC. | | Benicia
    Processor: Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz | CPU 1 | 2200/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 456 GiB total, 161.958 GiB free.
    D: is FIXED (NTFS) - 9 GiB total, 1.22 GiB free.
    E: is CDROM ()
    F: is CDROM (CDFS)
    G: is Removable
    H: is Removable
    I: is Removable
    J: is Removable
    K: is Removable
    L: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP293: 11/12/2013 5:41:52 AM - Windows Vista Service Pack 1
    RP294: 11/12/2013 6:05:46 AM - Windows Update
    RP295: 11/12/2013 6:55:53 AM - Windows Update
    .
    ==== Installed Programs ======================
    .
    7-Zip 9.22beta
    Adobe Flash Player 11 ActiveX
    Adobe Reader Free Download Packages
    Adobe Reader XI (11.0.04)
    Advanced Uninstaller PRO - Version 11
    Allmyapps
    AM-DeadLink 4.6
    Amazon Kindle
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    µTorrent
    avast! Free Antivirus
    AVG Security Toolbar
    AVS Video Converter 8
    Awesome Duplicate Photo Finder v. 1.0
    Blink version 0.2.7
    Bonjour
    Canon Easy-WebPrint EX
    Canon Inkjet Printer/Scanner/Fax Extended Survey Program
    Canon MP Navigator EX 3.0
    Canon MP560 series MP Drivers
    Canon Utilities Easy-PhotoPrint EX
    Canon Utilities My Printer
    Canon Utilities Solution Menu
    Cards_Calendar_OrderGift_DoMorePlugout
    CCleaner
    CCleaner Free Download Packages
    Clickfree Easy Image
    Compatibility Pack for the 2007 Office system
    CyberLink DVD Suite Deluxe
    DHTML Editing Component
    Dll-Files Fixer
    DriverUpdate
    Enhanced Multimedia Keyboard Solution
    ffdshow v1.2.4422 [2012-04-09]
    File Type Assistant
    FinePixViewer Resource
    FinePixViewer Ver.5.5
    FinePixViewer YTUPL
    Foxit Reader
    Free File Viewer 2012
    Free FLV to MP3 Converter version 1.0
    GIMP 2.8.6
    Google Chrome
    Google Toolbar for Internet Explorer
    Google Update Helper
    Haali Media Splitter
    Hardware Diagnostic Tools
    Hewlett-Packard Active Check
    Hewlett-Packard Asset Agent for Health Check
    HomeBase 3
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Active Support Library
    HP Customer Experience Enhancements
    HP Customer Feedback
    HP Easy Setup - Frontend
    HP On-Screen Cap/Num/Scroll Lock Indicator
    HP Photosmart Essential 2.5
    HP Picasso Media Center Add-In
    HP Total Care Advisor
    HP Update
    HPPhotoSmartPhotobookWebPack1
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Matrix Storage Manager
    IrfanView (remove only)
    iTunes
    iTunes Free Download Packages
    Java 7 Update 45
    Java Auto Updater
    Kobo
    LabelPrint
    LightScribe System Software 1.10.16.1
    LightScribe Template Labeler
    Malwarebytes Anti-Malware version 1.75.0.1300
    Media Player Codec Pack 4.2.9
    metaCrawler
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Download Manager
    Microsoft Image Composite Editor
    Microsoft Office Home and Student 60 day trial
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office XP Professional with FrontPage
    Microsoft Security Client
    Microsoft Security Essentials
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
    Microsoft Works
    mIRC
    muvee autoProducer 6.1
    My HP Games
    office Convert Pdf to Jpg Jpeg Tiff Free 6.5
    Picasa 3
    Power2Go
    PowerDirector
    PSSWCORE
    Python 2.5
    Python 2.7.5
    QuickTime
    Realtek High Definition Audio Driver
    RegRun Reanimator
    REGSERVO
    Snapfish Picture Mover
    Soft Data Fax Modem with SmartCP
    Spark 2.6.3.12555
    Torch
    Turbo Lister 2
    UnThreat Free AntiVirus 2013
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Veetle TV
    VideoToolkit01
    VisualBee
    VLC media player 2.1.2
    VLC media player Free Download Packages
    WeatherBug Gadget
    Whilokii 1.0.0
    Windows 7 USB/DVD Download Tool
    Yahoo! Toolbar
    YTD Toolbar v8.3
    YTD Video Downloader 4.6
    .
    ==== Event Viewer Messages From Past Week ========
    .
    10/12/2013 7:25:36 AM, Error: EventLog [6008] - The previous system shutdown at 12:04:35 AM on 10/12/2013 was unexpected.
    09/12/2013 9:00:06 PM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: NT AUTHORITY\NETWORK SERVICE Error Code: 0x80070002 Error description: The system cannot find the file specified.
    09/12/2013 9:00:06 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070002 Error description: The system cannot find the file specified.
    09/12/2013 9:00:06 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: Error code: 0x80070002 Error description: The system cannot find the file specified.
    09/12/2013 4:27:01 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050800d Error description: Some history items could not be displayed. Please wait a few minutes and try again. If that doesn't work, clear the history and then try again. Signature version: 1.163.1511.0;1.163.1511.0 Engine version: 1.1.10100.0
    09/12/2013 4:26:58 AM, Error: EventLog [6008] - The previous system shutdown at 9:36:21 PM on 08/12/2013 was unexpected.
    09/12/2013 10:45:37 AM, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.100. The computer with the IP address 192.168.1.103 did not allow the name to be claimed by this computer.
    08/12/2013 8:02:19 PM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: NT AUTHORITY\NETWORK SERVICE Error Code: 0x80070002 Error description: The system cannot find the file specified.
    08/12/2013 8:02:19 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070002 Error description: The system cannot find the file specified.
    08/12/2013 8:02:19 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: Error code: 0x80070002 Error description: The system cannot find the file specified.
    08/12/2013 5:25:40 PM, Error: Service Control Manager [7030] - The avast! Antivirus service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    08/12/2013 3:29:26 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
    08/12/2013 3:17:59 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt SBRE
    08/12/2013 2:17:56 AM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: NT AUTHORITY\NETWORK SERVICE Error Code: 0x80070002 Error description: The system cannot find the file specified.
    08/12/2013 2:17:56 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070002 Error description: The system cannot find the file specified.
    08/12/2013 2:17:56 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: Error code: 0x80070002 Error description: The system cannot find the file specified.
    07/12/2013 6:19:39 AM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: NT AUTHORITY\NETWORK SERVICE Error Code: 0x80070002 Error description: The system cannot find the file specified.
    07/12/2013 6:19:39 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070002 Error description: The system cannot find the file specified.
    07/12/2013 6:19:39 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: Error code: 0x80070002 Error description: The system cannot find the file specified.
    07/12/2013 6:02:49 AM, Error: Service Control Manager [7034] - The Util Whilokii service terminated unexpectedly. It has done this 1 time(s).
    07/12/2013 5:37:45 AM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    07/12/2013 5:37:18 AM, Error: Service Control Manager [7009] - A timeout was reached (60000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.
    07/12/2013 5:32:05 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
    07/12/2013 5:32:05 AM, Error: Service Control Manager [7000] - The Search Protect by Conduit Updater service failed to start due to the following error: The system cannot find the file specified.
    07/12/2013 5:32:05 AM, Error: Service Control Manager [7000] - The Computer Backup (MyPC Backup) service failed to start due to the following error: The system cannot find the file specified.
    07/12/2013 5:31:29 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
    06/12/2013 5:10:25 AM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: NT AUTHORITY\NETWORK SERVICE Error Code: 0x80070002 Error description: The system cannot find the file specified.
    06/12/2013 5:10:25 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070002 Error description: The system cannot find the file specified.
    06/12/2013 5:10:25 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: Error code: 0x80070002 Error description: The system cannot find the file specified.
    05/12/2013 4:14:12 AM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: NT AUTHORITY\NETWORK SERVICE Error Code: 0x80070002 Error description: The system cannot find the file specified.
    05/12/2013 4:14:12 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070002 Error description: The system cannot find the file specified.
    05/12/2013 4:14:12 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: Error code: 0x80070002 Error description: The system cannot find the file specified.
    05/12/2013 11:44:28 PM, Error: Service Control Manager [7011] - A timeout (60000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
    04/12/2013 6:42:43 PM, Error: Service Control Manager [7034] - The Computer Backup (MyPC Backup) service terminated unexpectedly. It has done this 1 time(s).
    04/12/2013 3:03:23 AM, Error: Ntfs [137] - The default transaction resource manager on volume K: encountered a non-retryable error and could not start. The data contains the error code.
    04/12/2013 2:22:12 AM, Error: Microsoft Antimalware [2003] - Microsoft Antimalware has encountered an error trying to update the engine. New Engine Version: Previous Engine Version: Engine Type: Network Inspection System User: NT AUTHORITY\NETWORK SERVICE Error Code: 0x80070002 Error description: The system cannot find the file specified.
    04/12/2013 2:22:12 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 0.0.0.0 Update Source: Microsoft Malware Protection Center Update Stage: Install Source Path: http://go.microsoft.com/fwlink/?Lin...0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 0.0.0.0 Error code: 0x80070002 Error description: The system cannot find the file specified.
    04/12/2013 2:22:12 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: Update Source: User Update Stage: Install Source Path: Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: Error code: 0x80070002 Error description: The system cannot find the file specified.
    .
    ==== End Of File ===========================


    DDS (Ver_2012-11-20.01) - NTFS_x86
    Internet Explorer: 7.0.6000.16982 BrowserJavaVersion: 10.45.2
    Run by paultess at 7:12:25 on 2013-12-11
    Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6000.0.1252.2.1033.18.3062.1045 [GMT -8:00]
    .
    .
    ============== Running Processes ================
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    c:\Program Files\Microsoft Security Client\MsMpEng.exe
    C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\SLsvc.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Application Updater\ApplicationUpdater.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\ProgramData\Clickfree\FullImagingBackup\FibUac.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Users\paultess\AppData\Local\Torch\Update\TorchCrashHandler.exe
    C:\Program Files\UnThreat AntiVirus\utsvc.exe
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.2.0\ToolbarUpdater.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.2.0\loggingserver.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\Program Files\File Type Assistant\TSAssist.exe
    C:\Program Files\DriverUpdate\DriverUpdate.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\hp\support\hpsysdrv.exe
    C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\WINDOWS\RtHDVCpl.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files\HP\HP Software Update\hpwuschd2.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\igfxpers.exe
    C:\Program Files\AVG Secure Search\vprot.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    C:\Program Files\UnThreat AntiVirus\UnThreat.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
    C:\ProgramData\Clickfree\cfagent.exe
    C:\ProgramData\Clickfree\FullImagingBackup\FibReminder.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Users\paultess\AppData\Roaming\Allmyapps\Allmyapps.exe
    C:\WINDOWS\System32\C2MP\UpdateChecker.exe
    C:\Program Files\FinePixViewer\QuickDCF2.exe
    C:\Windows\system32\schtasks.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    C:\hp\kbd\kbd.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Update\29.0.0.4888\TorchUpdate.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\Downloads\ChromeSetup.exe
    C:\Users\paultess\AppData\Local\Temp\GUM1007.tmp\GoogleUpdate.exe
    C:\Users\paultess\AppData\Local\Temp\GUM1007.tmp\GoogleUpdateSetup.exe
    C:\Program Files\GUMB7F9.tmp\GoogleUpdate.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\system32\conime.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Users\paultess\AppData\Local\Torch\Application\torch.exe
    C:\Windows\notepad.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.bbc.com/
    uSearch Bar = hxxp://www.google.com/ie
    uSearch Page = hxxp://www.google.com
    uDefault_Search_URL = hxxp://www.google.com/ie
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
    mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    uURLSearchHooks: YTD Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - c:\program files\ytd toolbar\ie\8.3\ytdToolbarIE.dll
    mURLSearchHooks: VisualBee V.11 Toolbar: {7093ee04-f2e4-4637-a667-0f730797b3a0} -
    BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
    BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
    BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.9012.1008\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
    TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
    TB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file>
    TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
    TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
    EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autoRun
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
    uRun: [ClickfreeMonitor] c:\programdata\clickfree\cfagent.exe
    uRun: [FibReminder] c:\programdata\clickfree\fullimagingbackup\FibReminder.exe
    uRun: [Allmyapps] "c:\users\paultess\appdata\roaming\allmyapps\Allmyapps.exe" startup
    uRun: [Allmyapps Update] "c:\users\paultess\appdata\roaming\allmyapps\AllmyappsUpdater.exe" check startup
    mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide
    mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
    mRun: [KBD] c:\hp\kbd\KbdStub.EXE
    mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe "
    mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe "
    mRun: [RtHDVCpl] RtHDVCpl.exe
    mRun: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe "
    mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
    mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
    mRun: [vProt] "c:\program files\avg secure search\vprot.exe "
    mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
    mRun: [UnThreat] "c:\program files\unthreat antivirus\UnThreat.exe" -silent
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [SBRegRebootCleaner] "c:\program files\unthreat antivirus\SBRC.exe "
    mRun: [AvastUI.exe] "c:\program files\avast software\avast\AvastUI.exe" /nogui
    mRunOnce: [Launcher] c:\windows\sminst\launcher.exe
    mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
    dRun: [SearchProtect] \SearchProtect\bin\cltmng.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\codecp~1.lnk - c:\windows\system32\c2mp\UpdateChecker.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewer\QuickDCF2.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\snapfi~1.lnk - c:\program files\snapfish picture mover\SnapfishMediaDetector.exe
    uPolicies-Explorer: NoDriveTypeAutoRun = dword:157
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
    DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} - hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab
    TCP: NameServer = 64.59.160.15 64.59.161.69
    TCP: Interfaces\{E3C6F8A3-6BCA-4D48-8F50-7955103217FD} : DHCPNameServer = 64.59.160.15 64.59.161.69
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\17.2.0\ViProtocol.dll
    Notify: igfxcui - igfxdev.dll
    LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\30.0.1599.101\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [2013-12-8 49944]
    R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [2013-12-8 178304]
    R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-9-27 214696]
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-12-8 774392]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-12-8 403440]
    R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-10-2 37664]
    R1 MpKsl84885524;MpKsl84885524;c:\programdata\microsoft\microsoft antimalware\definition updates\{eb5be6f0-7e31-4f30-b658-f577853d808a}\MpKsl84885524.sys [2013-12-10 40392]
    R2 Application Updater;Application Updater;c:\program files\application updater\ApplicationUpdater.exe [2013-11-27 807800]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-12-8 35656]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-12-8 70384]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2013-12-8 50344]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    R2 FibUacService;FibUacService;c:\programdata\clickfree\fullimagingbackup\FibUac.exe [2013-6-25 36720]
    R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2013-10-25 66344]
    R2 TorchCrashHandler;Torch Crash Handler;c:\users\paultess\appdata\local\torch\update\TorchCrashHandler.exe [2013-6-20 1205088]
    R2 UTSvcManager3;UnThreat Service Manager;c:\program files\unthreat antivirus\utsvc.exe [2013-10-25 2804016]
    R2 vToolbarUpdater17.2.0;vToolbarUpdater17.2.0;c:\program files\common files\avg secure search\vtoolbarupdater\17.2.0\ToolbarUpdater.exe [2013-12-8 1771544]
    R3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2013-12-10 24416]
    S3 gfiark;gfiark;c:\windows\system32\drivers\gfiark.sys [2013-10-25 43368]
    S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2013-12-10 13464]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    SUnknown hhsbskou;hhsbskou; [x]
    SUnknown MpKslffb0793f;MpKslffb0793f; [x]
    .
    =============== Created Last 30 ================
    .
    2013-12-11 14:41:26 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2013-12-11 13:35:44 -------- d-----w- c:\users\paultess\appdata\roaming\Malwarebytes
    2013-12-11 13:35:05 -------- d-----w- c:\programdata\Malwarebytes
    2013-12-11 13:35:02 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
    2013-12-11 13:08:30 -------- d-----w- c:\users\paultess\appdata\local\ElevatedDiagnostics
    2013-12-11 04:26:35 50053120 ----a-w- c:\program files\GUTB7FA.tmp
    2013-12-11 04:26:35 -------- d-----w- c:\program files\GUMB7F9.tmp
    2013-12-11 04:12:35 40392 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{eb5be6f0-7e31-4f30-b658-f577853d808a}\MpKsl84885524.sys
    2013-12-11 04:04:57 35816 ----a-w- c:\windows\system32\drivers\Partizan.sys
    2013-12-11 03:59:41 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
    2013-12-11 03:56:50 -------- d-----w- c:\programdata\RegRun
    2013-12-11 03:48:11 98304 ----a-r- c:\users\paultess\appdata\roaming\microsoft\installer\{3577e42b-3347-4eb8-bfda-d36e8ed3c519}\icons.exe
    2013-12-10 16:26:51 13464 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
    2013-12-10 16:26:43 -------- d-----w- c:\program files\DriverUpdate
    2013-12-10 15:41:10 7772552 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{eb5be6f0-7e31-4f30-b658-f577853d808a}\mpengine.dll
    2013-12-10 15:36:21 -------- d-----w- C:\3e18caaeab8f96060889a595c6ac49
    2013-12-10 04:53:39 7772552 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
    2013-12-09 15:11:45 -------- d-----w- C:\a2ba7f82b59340af87a808
    2013-12-09 14:58:16 40208 ----a-w- c:\windows\system32\Partizan.exe
    2013-12-09 14:56:11 -------- d-----w- C:\@RestoreQuarantine
    2013-12-09 14:50:47 2 --shatr- c:\windows\winstart.bat
    2013-12-09 14:50:36 -------- d-----w- c:\program files\Greatis
    2013-12-09 14:06:53 -------- d-----w- c:\users\paultess\appdata\roaming\dll-files.com
    2013-12-09 14:06:46 -------- d-----w- c:\programdata\Logs
    2013-12-09 14:06:27 -------- d-----w- c:\program files\Dll-Files.com Fixer
    2013-12-09 01:27:33 -------- d-----w- c:\users\paultess\appdata\roaming\AVAST Software
    2013-12-09 01:25:41 774392 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2013-12-09 01:25:41 70384 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2013-12-09 01:25:41 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
    2013-12-09 01:25:41 178304 ----a-w- c:\windows\system32\drivers\aswVmm.sys
    2013-12-09 01:25:04 43152 ----a-w- c:\windows\avastSS.scr
    2013-12-09 01:23:34 -------- d-----w- c:\program files\AVAST Software
    2013-12-09 01:22:53 -------- d-----w- c:\programdata\AVAST Software
    2013-12-09 00:26:35 -------- d-----w- c:\programdata\REGSERVO
    2013-12-09 00:26:24 -------- d-----w- c:\program files\REGSERVO
    2013-12-09 00:01:07 -------- d-----w- c:\program files\Microsoft Download Manager
    2013-12-08 16:00:49 -------- d-----w- c:\program files\Video Downloader
    2013-12-08 16:00:20 0 ----a-w- C:\LIL5A25.tmp
    2013-12-07 13:43:42 -------- d-----w- c:\program files\GUMC023.tmp
    2013-12-07 13:42:16 -------- d-----w- c:\program files\YTD Toolbar(138)
    2013-12-07 12:11:03 -------- d-----w- c:\programdata\ErrorEND
    2013-12-07 12:03:47 -------- d-----w- c:\users\paultess\appdata\local\SlimWare Utilities Inc
    2013-12-05 02:39:33 -------- d-----w- c:\users\paultess\SyncFolder
    2013-12-04 20:07:09 -------- d-----w- c:\users\paultess\appdata\roaming\freegames4357
    2013-12-03 15:17:38 -------- d-----w- c:\program files\FinePixViewer(7)
    2013-12-03 11:16:23 -------- d-----w- c:\windows\TempE90B0C5B-CD03-291E-809E-F8D5866625A3-Signatures
    2013-12-03 08:56:48 -------- d-----w- c:\program files\Application Updater
    2013-12-03 08:56:47 -------- d-----w- c:\program files\YTD Toolbar(51)
    2013-12-03 08:56:47 -------- d-----w- c:\program files\YTD Toolbar
    2013-12-02 03:16:43 -------- d-----w- c:\program files\Audacity
    2013-11-27 21:02:47 -------- d-----w- c:\program files\YTD Toolbar(143)
    2013-11-26 18:00:04 -------- d-----w- c:\users\paultess\appdata\roaming\RealNetworks
    2013-11-26 17:53:07 -------- d-----w- c:\program files\RealNetworks
    2013-11-26 17:53:03 -------- d-----w- c:\programdata\RealNetworks
    2013-11-26 17:32:44 -------- d-----w- c:\program files\BurnAware Free
    2013-11-13 05:44:55 -------- d-----w- c:\users\paultess\appdata\roaming\KiTTY
    2013-11-12 00:24:01 -------- d-----w- c:\program files\Advanced Fix 2013
    .
    ==================== Find3M ====================
    .
    2013-12-11 01:32:25 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2013-12-11 01:32:25 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2013-12-09 14:08:40 827728 ----a-w- c:\windows\system32\msvcr100.dll
    2013-11-19 10:21:30 230048 ------w- c:\windows\system32\MpSigStub.exe
    2013-11-10 18:26:03 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
    2013-10-08 14:50:41 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
    2013-09-27 17:53:06 214696 ----a-w- c:\windows\system32\drivers\MpFilter.sys
    .
    ============= FINISH: 7:13:38.72 ===============
     
    paultess,
    #1
  2. 2013/12/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===============================

    Please, complete all steps listed HERE
    I still need MBAM log.
     
    broni,
    #2


  3. to hide this advert.

  4. 2013/12/11
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    Malwarebytes Anti-Malware 1.75.0.1300
    www.malwarebytes.org

    Database version: v2013.12.11.04

    Windows Vista x86 NTFS
    Internet Explorer 7.0.6000.16982
    paultess :: PAULTESS-PC [administrator]

    11/12/2013 6:55:33 AM
    MBAM-log-2013-12-11 (07-10-20).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 236959
    Time elapsed: 11 minute(s), 7 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 7
    C:\Users\paultess\AppData\Local\VisualBeeExe (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeExe\Dic-Eng (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeExe\GuideFiles (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeClient (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeClient\Domain (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeClient\LocalDB (PUP.Optional.Visualbee) -> No action taken.
    C:\Program Files\VisualBee_V.11 (PUP.Optional.Visualbee) -> No action taken.

    Files Detected: 0
    (No malicious items detected)

    (end)
     
    paultess,
    #3
  5. 2013/12/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    [​IMG] The above log says "No action taken ".
    Re-run MBAM, fix all issues and post new log.

    [​IMG] Download RogueKiller for 32bit or Roguekiller for 64bit to your Desktop.
    • Close all the running programs
    • Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download Malwarebytes Anti-Rootkit (MBAR) from HERE
    • Unzip downloaded file.
    • Open the folder where the contents were unzipped and run mbar.exe
    • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
    • Wait while the system shuts down and the cleanup process is performed.
    • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
    • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
     
    broni,
    #4
  6. 2013/12/12
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    Mbam

    Hello, thanks for the guidance so far. MBAM crashes when I instruct to delete. It goes to 'does not respond'.
    How do I insert a screen shot or add attachment here please?
    Paul
     
    paultess,
    #5
  7. 2013/12/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Try to re-run MBAM from safe mode.
     
    broni,
    #6
  8. 2013/12/13
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    Hi, tried safe mode - 2 things:
    1. Microsoft Security not on, will not switch on in safe mode.
    2. MBAM scanned, when I tried to remove threats, it stalled = computer froze. The only way to get out was to stop MBAM in task manager.
    Paul

    How do I send attachments to show you some of the error messages?
     
    paultess,
    #7
  9. 2013/12/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Go ahead with other steps.
     
    broni,
    #8
  10. 2013/12/13
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    RogueKiller V8.7.11 [Dec 3 2013] by Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Feedback : http://www.adlice.com/forum/
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows Vista (6.0.6000 ) 32 bits version
    Started in : Normal mode
    User : paultess [Admin rights]
    Mode : Remove -- Date : 12/13/2013 15:07:04
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 33 ¤¤¤
    [SUSP PATH] FibUac.exe -- C:\ProgramData\Clickfree\FullImagingBackup\FibUac.exe [7] -> KILLED [TermProc]
    [SUSP PATH] TorchCrashHandler.exe -- C:\Users\paultess\AppData\Local\Torch\Update\TorchCrashHandler.exe [7] -> KILLED [TermProc]
    [SUSP PATH] cfagent.exe -- C:\ProgramData\Clickfree\cfagent.exe [7] -> KILLED [TermProc]
    [SUSP PATH] FibReminder.exe -- C:\ProgramData\Clickfree\FullImagingBackup\FibReminder.exe [7] -> KILLED [TermProc]
    [SUSP PATH] Allmyapps.exe -- C:\Users\paultess\AppData\Roaming\Allmyapps\Allmyapps.exe [7] -> KILLED [TermProc]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermProc]
    [SUSP PATH] TorchUpdate.exe -- C:\Users\paultess\AppData\Local\Torch\Update\29.0.0.4888\TorchUpdate.exe [7] -> KILLED [TermProc]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]

    ¤¤¤ Registry Entries : 10 ¤¤¤
    [RUN][SUSP PATH] HKCU\[...]\Run : ClickfreeMonitor (c:\programdata\Clickfree\cfagent.exe [7]) -> DELETED
    [RUN][SUSP PATH] HKCU\[...]\Run : FibReminder (c:\programdata\Clickfree\FullImagingBackup\FibReminder.exe [7]) -> DELETED
    [RUN][SUSP PATH] HKCU\[...]\Run : Allmyapps ( "C:\Users\paultess\AppData\Roaming\Allmyapps\Allmyapps.exe" startup [7][x]) -> DELETED
    [RUN][SUSP PATH] HKCU\[...]\Run : Allmyapps Update ( "C:\Users\paultess\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe" check startup [7][x]) -> DELETED
    [RUN][SUSP PATH] HKUS\S-1-5-21-2410994966-3734587764-1746882321-1000\[...]\Run : ClickfreeMonitor (c:\programdata\Clickfree\cfagent.exe [7]) -> [0x2] The system cannot find the file specified.
    [RUN][SUSP PATH] HKUS\S-1-5-21-2410994966-3734587764-1746882321-1000\[...]\Run : FibReminder (c:\programdata\Clickfree\FullImagingBackup\FibReminder.exe [7]) -> [0x2] The system cannot find the file specified.
    [RUN][SUSP PATH] HKUS\S-1-5-21-2410994966-3734587764-1746882321-1000\[...]\Run : Allmyapps ( "C:\Users\paultess\AppData\Roaming\Allmyapps\Allmyapps.exe" startup [7][x]) -> [0x2] The system cannot find the file specified.
    [RUN][SUSP PATH] HKUS\S-1-5-21-2410994966-3734587764-1746882321-1000\[...]\Run : Allmyapps Update ( "C:\Users\paultess\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe" check startup [7][x]) -> [0x2] The system cannot find the file specified.
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

    ¤¤¤ Scheduled tasks : 5 ¤¤¤
    [V1][SUSP PATH] AllmyappsUpdateTask.job : C:\Users\paultess\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe - check startup [7][x] -> DELETED
    [V1][ROGUE ST] VisualBee-chromeinstaller.job : C:\Program Files\VisualBee\VisualBee-chromeinstaller.exe - /installcrx /agentregpath='VisualBee' /extensionfilepath='C:\Program Files\VisualBee\33906.crx' /appid=33906 /srcid='000196' /subid='verticals-shopping,intext,pops,ads' /zdata='0' /bic=8B075A8A63384AE998680C61C71A528FIE /verifier=8a0a3452e9eae3be85f4c7c863b28dc8 /installerversion=1_27_153 /installerfullversion=1.27.153.8 /installationtime=1381313866 /statsdomain=hxxp://stats.update-apps.com /errorsdomain=hxxp://errors.update-apps.com /waitforbrowser=300 /extensionid=kmkdohofefokfmbnlbgebdapndacfklg /extensionversion=1.23.27 /extensionpublickey=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHyV7VB7pfhL43MJPF6Tz99RMBQPO3ECLfDPBPcouZwWJXUSOgrfOhyGAuLw1ApUxjTpXOYvyXZmdp8XThAhKGF8vIoJaG4GjQYrGDDpExQZcxZa7JuAFp2LFqtTk1fFCjZxCvDCIYRbNwlx2IWaSgtnL3iV0W+mkl/Ap6FVfa6QIDAQAB /allusers /allprofiles /externallog='' [x][x][x][x][x][x][x] -> DELETED
    [V2][SUSP PATH] AllmyappsUpdateTask : c:\users\paultess\appdata\roaming\allmyapps\allmyappsupdater.exe - check startup [7][x] -> DELETED
    [V2][SUSP PATH] GreatArcadeHits : C:\Users\paultess\AppData\Local\GreatArcadeHits\GAHUpdate.exe [x] -> DELETED
    [V2][ROGUE ST] VisualBee-chromeinstaller : C:\Program Files\VisualBee\VisualBee-chromeinstaller.exe - /installcrx /agentregpath='VisualBee' /extensionfilepath='C:\Program Files\VisualBee\33906.crx' /appid=33906 /srcid='000196' /subid='verticals-shopping,intext,pops,ads' /zdata='0' /bic=8B075A8A63384AE998680C61C71A528FIE /verifier=8a0a3452e9eae3be85f4c7c863b28dc8 /installerversion=1_27_153 /installerfullversion=1.27.153.8 /installationtime=1381313866 /statsdomain=hxxp://stats.update-apps.com /errorsdomain=hxxp://errors.update-apps.com /waitforbrowser=300 /extensionid=kmkdohofefokfmbnlbgebdapndacfklg /extensionversion=1.23.27 /extensionpublickey=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHyV7VB7pfhL43MJPF6Tz99RMBQPO3ECLfDPBPcouZwWJXUSOgrfOhyGAuLw1ApUxjTpXOYvyXZmdp8XThAhKGF8vIoJaG4GjQYrGDDpExQZcxZa7JuAFp2LFqtTk1fFCjZxCvDCIYRbNwlx2IWaSgtnL3iV0W+mkl/Ap6FVfa6QIDAQAB /allusers /allprofiles /externallog='' [x][x][x][x][x][x][x] -> DELETED

    ¤¤¤ Startup Entries : 0 ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [LOADED] ¤¤¤

    ¤¤¤ External Hives: ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts


    127.0.0.1 localhost
    ::1 localhost


    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ SCSI) Hitachi HDP725050GLA360 +++++
    --- User ---
    [MBR] f00b5783bde34e1b4108ed49f0fa3607
    [BSP] c373a18470748344ed8b813f2061278e : MBR Code unknown
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 467286 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 957003776 | Size: 9651 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Finished : << RKreport[0]_D_12132013_150704.txt >>
    RKreport[0]_S_12132013_150628.txt


    RogueKiller V8.7.11 [Dec 3 2013] by Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Feedback : http://www.adlice.com/forum/
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows Vista (6.0.6000 ) 32 bits version
    Started in : Normal mode
    User : paultess [Admin rights]
    Mode : Scan -- Date : 12/13/2013 15:06:28
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 33 ¤¤¤
    [SUSP PATH] FibUac.exe -- C:\ProgramData\Clickfree\FullImagingBackup\FibUac.exe [7] -> KILLED [TermProc]
    [SUSP PATH] TorchCrashHandler.exe -- C:\Users\paultess\AppData\Local\Torch\Update\TorchCrashHandler.exe [7] -> KILLED [TermProc]
    [SUSP PATH] cfagent.exe -- C:\ProgramData\Clickfree\cfagent.exe [7] -> KILLED [TermProc]
    [SUSP PATH] FibReminder.exe -- C:\ProgramData\Clickfree\FullImagingBackup\FibReminder.exe [7] -> KILLED [TermProc]
    [SUSP PATH] Allmyapps.exe -- C:\Users\paultess\AppData\Roaming\Allmyapps\Allmyapps.exe [7] -> KILLED [TermProc]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermProc]
    [SUSP PATH] TorchUpdate.exe -- C:\Users\paultess\AppData\Local\Torch\Update\29.0.0.4888\TorchUpdate.exe [7] -> KILLED [TermProc]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]
    [SUSP PATH] torch.exe -- C:\Users\paultess\AppData\Local\Torch\Application\torch.exe [7] -> KILLED [TermThr]

    ¤¤¤ Registry Entries : 10 ¤¤¤
    [RUN][SUSP PATH] HKCU\[...]\Run : ClickfreeMonitor (c:\programdata\Clickfree\cfagent.exe [7]) -> FOUND
    [RUN][SUSP PATH] HKCU\[...]\Run : FibReminder (c:\programdata\Clickfree\FullImagingBackup\FibReminder.exe [7]) -> FOUND
    [RUN][SUSP PATH] HKCU\[...]\Run : Allmyapps ( "C:\Users\paultess\AppData\Roaming\Allmyapps\Allmyapps.exe" startup [7][x]) -> FOUND
    [RUN][SUSP PATH] HKCU\[...]\Run : Allmyapps Update ( "C:\Users\paultess\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe" check startup [7][x]) -> FOUND
    [RUN][SUSP PATH] HKUS\S-1-5-21-2410994966-3734587764-1746882321-1000\[...]\Run : ClickfreeMonitor (c:\programdata\Clickfree\cfagent.exe [7]) -> FOUND
    [RUN][SUSP PATH] HKUS\S-1-5-21-2410994966-3734587764-1746882321-1000\[...]\Run : FibReminder (c:\programdata\Clickfree\FullImagingBackup\FibReminder.exe [7]) -> FOUND
    [RUN][SUSP PATH] HKUS\S-1-5-21-2410994966-3734587764-1746882321-1000\[...]\Run : Allmyapps ( "C:\Users\paultess\AppData\Roaming\Allmyapps\Allmyapps.exe" startup [7][x]) -> FOUND
    [RUN][SUSP PATH] HKUS\S-1-5-21-2410994966-3734587764-1746882321-1000\[...]\Run : Allmyapps Update ( "C:\Users\paultess\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe" check startup [7][x]) -> FOUND
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Scheduled tasks : 5 ¤¤¤
    [V1][SUSP PATH] AllmyappsUpdateTask.job : C:\Users\paultess\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe - check startup [7][x] -> FOUND
    [V1][ROGUE ST] VisualBee-chromeinstaller.job : C:\Program Files\VisualBee\VisualBee-chromeinstaller.exe - /installcrx /agentregpath='VisualBee' /extensionfilepath='C:\Program Files\VisualBee\33906.crx' /appid=33906 /srcid='000196' /subid='verticals-shopping,intext,pops,ads' /zdata='0' /bic=8B075A8A63384AE998680C61C71A528FIE /verifier=8a0a3452e9eae3be85f4c7c863b28dc8 /installerversion=1_27_153 /installerfullversion=1.27.153.8 /installationtime=1381313866 /statsdomain=hxxp://stats.update-apps.com /errorsdomain=hxxp://errors.update-apps.com /waitforbrowser=300 /extensionid=kmkdohofefokfmbnlbgebdapndacfklg /extensionversion=1.23.27 /extensionpublickey=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHyV7VB7pfhL43MJPF6Tz99RMBQPO3ECLfDPBPcouZwWJXUSOgrfOhyGAuLw1ApUxjTpXOYvyXZmdp8XThAhKGF8vIoJaG4GjQYrGDDpExQZcxZa7JuAFp2LFqtTk1fFCjZxCvDCIYRbNwlx2IWaSgtnL3iV0W+mkl/Ap6FVfa6QIDAQAB /allusers /allprofiles /externallog='' [x][x][x][x][x][x][x] -> FOUND
    [V2][SUSP PATH] AllmyappsUpdateTask : c:\users\paultess\appdata\roaming\allmyapps\allmyappsupdater.exe - check startup [7][x] -> FOUND
    [V2][SUSP PATH] GreatArcadeHits : C:\Users\paultess\AppData\Local\GreatArcadeHits\GAHUpdate.exe [x] -> FOUND
    [V2][ROGUE ST] VisualBee-chromeinstaller : C:\Program Files\VisualBee\VisualBee-chromeinstaller.exe - /installcrx /agentregpath='VisualBee' /extensionfilepath='C:\Program Files\VisualBee\33906.crx' /appid=33906 /srcid='000196' /subid='verticals-shopping,intext,pops,ads' /zdata='0' /bic=8B075A8A63384AE998680C61C71A528FIE /verifier=8a0a3452e9eae3be85f4c7c863b28dc8 /installerversion=1_27_153 /installerfullversion=1.27.153.8 /installationtime=1381313866 /statsdomain=hxxp://stats.update-apps.com /errorsdomain=hxxp://errors.update-apps.com /waitforbrowser=300 /extensionid=kmkdohofefokfmbnlbgebdapndacfklg /extensionversion=1.23.27 /extensionpublickey=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHyV7VB7pfhL43MJPF6Tz99RMBQPO3ECLfDPBPcouZwWJXUSOgrfOhyGAuLw1ApUxjTpXOYvyXZmdp8XThAhKGF8vIoJaG4GjQYrGDDpExQZcxZa7JuAFp2LFqtTk1fFCjZxCvDCIYRbNwlx2IWaSgtnL3iV0W+mkl/Ap6FVfa6QIDAQAB /allusers /allprofiles /externallog='' [x][x][x][x][x][x][x] -> FOUND

    ¤¤¤ Startup Entries : 0 ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [LOADED] ¤¤¤

    ¤¤¤ External Hives: ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts


    127.0.0.1 localhost
    ::1 localhost


    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ SCSI) Hitachi HDP725050GLA360 +++++
    --- User ---
    [MBR] f00b5783bde34e1b4108ed49f0fa3607
    [BSP] c373a18470748344ed8b813f2061278e : MBR Code unknown
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 467286 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 957003776 | Size: 9651 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Finished : << RKreport[0]_S_12132013_150628.txt >>



    Malwarebytes Anti-Rootkit BETA 1.07.0.1008
    www.malwarebytes.org

    Database version: v2013.12.13.07

    Windows Vista x86 NTFS
    Internet Explorer 7.0.6000.16982
    paultess :: PAULTESS-PC [administrator]

    13/12/2013 3:13:21 PM
    mbar-log-2013-12-13 (15-13-21).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 243142
    Time elapsed: 21 minute(s), 54 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)


    Malwarebytes Anti-Rootkit BETA 1.07.0.1008
    www.malwarebytes.org

    Database version: v2013.12.13.07

    Windows Vista x86 NTFS
    Internet Explorer 7.0.6000.16982
    paultess :: PAULTESS-PC [administrator]

    13/12/2013 3:13:21 PM
    mbar-log-2013-12-13 (15-13-21).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 243142
    Time elapsed: 21 minute(s), 54 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)



    Thanks,
    Paul
     
    paultess,
    #9
  11. 2013/12/16
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
    broni,
    #10
  12. 2013/12/16
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    Hi thanks for the instructions, I am not sure regarding anti-virus, script blocking and any anti-malware real-time protection.
    I think I only have MSE and Avast and if so I can follow the instructions from the link to 'Bleeping' you gave.

    Could you confirm that is all I need to disable please.
     
    paultess,
    #11
  13. 2013/12/17
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I actually didn't notice you're running two AV programs, MSE and Avast.
    You must uninstall one of them.

    Then disable the remaining one before running Combofix.
     
    broni,
    #12
  14. 2013/12/18
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    I think I followed your instructions correctly. The file did not save automatically I used 'save as'.
    Paul

    ComboFix 13-12-18.01 - paultess 18/12/2013 13:50:32.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.2.1033.18.3062.2120 [GMT -8:00]
    Running from: c:\users\paultess\Desktop\ComboFix.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\LIL5A25.tmp
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_kmkdohofefokfmbnlbgebdapndacfklg_0
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_kmkdohofefokfmbnlbgebdapndacfklg_0\18
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_kmkdohofefokfmbnlbgebdapndacfklg_0\19
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\background.html
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\crossriderManifest.json
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\icons\actions\1.png
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\icons\icon128.png
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\icons\icon16.png
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\icons\icon48.png
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\api\chrome.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\api\cookie.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\api\message.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\app\background.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\app\extension.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\background.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\app_api.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\async_api.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\bg_app_api.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\cookie_store.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\crossriderAPI.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\data_store.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\delegate.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\events.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\installer.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\logging.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\onBGDocumentLoad.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\popupResource\newPopup.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\popupResource\popup.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\reports.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\util.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\js\lib\xhr.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\manifest.json
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.23.27_0\popup.html
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\background.html
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\crossriderManifest.json
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\manifest.xml
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins.json
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\1_base.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\101_cortica_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\102_dealply_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\103_intext_5_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\104_jollywallet_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\105_corticas_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\107_coupish_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\108_icm_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\116_ads_only_5_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\117_coupons_intext_ads_5_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\119_similar_web_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\120_luck_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\123_intext_adv_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\124_superfish_no_search_no_coupons_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\125_arcadi2_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\126_revizer_ws_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\127_revizer_p_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\128_superfish_pricora_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\129_widdit_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\13_CrossriderAppUtils.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\135_arcadi3_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\138_getdeal_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\14_CrossriderUtils.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\141_corticas_ru_m.js.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\142_intext_fa_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\155_ibario_pops_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\158_50onred_ads_only_no_fb_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\159_cortica_rollover_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\17_jQuery.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\170_icm1_5_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\171_arcadi2_sourceID_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\174_arcadi_serp_dynamic_id_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\19_CHAppAPIWrapper.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\21_debug.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\22_resources.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\28_initializer.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\32_images_hook.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\4_jquery_1_7_1.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\47_resources_background.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\5_notifications.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\64_appApiMessage.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\7_hooks.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\72_appApiValidation.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\78_CrossriderInfo.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\80_CHPopupAppAPI.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\87_ginyas_wrapper.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\9_search_engine_hook.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\91_monetizationLoader.js.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\92_superfish_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\93_superfish_no_coupons_m.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\plugins\97_resourceApiWrapper.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\userCode\background.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\extensionData\userCode\extension.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\icons\actions\1.png
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\icons\icon128.png
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\icons\icon16.png
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\icons\icon48.png
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\api\chrome.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\api\cookie.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\api\message.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\api\pageAction.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\api\pageActionBG.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\background.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\app_api.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\bg_app_api.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\consts.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\cookie_store.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\crossriderAPI.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\delegate.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\events.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\extensionDataStore.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\installer.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\logFile.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\logging.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\onBGDocumentLoad.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\popupResource\newPopup.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\popupResource\popup.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\reports.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\storageWrapper.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\updateManager.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\util.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\lib\xhr.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\js\main.js
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\manifest.json
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmkdohofefokfmbnlbgebdapndacfklg\1.25.75_0\popup.html
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg\000042.ldb
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg\000044.ldb
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg\000045.log
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg\CURRENT
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg\LOCK
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg\LOG
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg\LOG.old
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kmkdohofefokfmbnlbgebdapndacfklg\MANIFEST-000043
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_kmkdohofefokfmbnlbgebdapndacfklg_0.localstorage-journal
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_kmkdohofefokfmbnlbgebdapndacfklg_0.localstorage
    c:\users\paultess\AppData\Local\Google\Chrome\User Data\Default\Preferences
    c:\windows\system32\tempdir
    c:\windows\system32\tempdir\tinypdf.chm
    c:\windows\system32\tempdir\tinypdf.dll
    c:\windows\system32\tempdir\tinypdf1.dll
    c:\windows\system32\tempdir\tinypdf2.dll
    c:\windows\tmp
    c:\windows\tmp\dd_vcredistMSI7540.txt
    c:\windows\tmp\dd_vcredistUI7540.txt
    c:\windows\tmp\qtsingleapp-koboex-f4a6-1-lockfile
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-11-18 to 2013-12-18 )))))))))))))))))))))))))))))))
    .
    .
    2013-12-18 21:59 . 2013-12-18 21:59 -------- d-----w- c:\users\Default\AppData\Local\temp
    2013-12-18 21:59 . 2013-12-18 21:59 -------- d-----w- c:\users\Guest\AppData\Local\temp
    2013-12-18 21:47 . 2013-12-18 21:47 40392 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B208A502-2DF1-45BF-9CB3-9040C13FE7CC}\MpKsl4f747d46.sys
    2013-12-18 05:50 . 2013-12-18 05:50 -------- d-----w- c:\users\paultess\{3f365736-3943-4f74-912a-41fa93177e03}
    2013-12-18 01:53 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B208A502-2DF1-45BF-9CB3-9040C13FE7CC}\mpengine.dll
    2013-12-18 01:01 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2013-12-13 23:13 . 2013-12-14 00:04 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
    2013-12-13 23:12 . 2013-12-13 23:12 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2013-12-13 20:44 . 2010-08-14 02:06 39488 ------w- c:\windows\system32\drivers\pgusbmm3.sys
    2013-12-13 20:44 . 2010-08-14 02:06 403008 ------w- c:\windows\system32\drivers\pgusbwdm.sys
    2013-12-13 20:44 . 2013-12-13 22:17 -------- d-----w- c:\users\paultess\AppData\Local\GreatArcadeHits
    2013-12-11 14:41 . 2013-12-13 23:13 104664 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2013-12-11 13:35 . 2013-12-11 13:35 -------- d-----w- c:\users\paultess\AppData\Roaming\Malwarebytes
    2013-12-11 13:35 . 2013-12-11 13:35 -------- d-----w- c:\programdata\Malwarebytes
    2013-12-11 13:35 . 2013-04-04 22:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
    2013-12-11 13:08 . 2013-12-11 13:08 -------- d-----w- c:\users\paultess\AppData\Local\ElevatedDiagnostics
    2013-12-11 04:26 . 2013-12-11 04:26 -------- d-----w- c:\program files\GUMB7F9.tmp
    2013-12-11 04:26 . 2013-12-11 04:26 50053120 ----a-w- c:\program files\GUTB7FA.tmp
    2013-12-11 04:04 . 2013-12-11 04:04 35816 ----a-w- c:\windows\system32\drivers\Partizan.sys
    2013-12-11 03:59 . 2013-12-11 04:12 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
    2013-12-11 03:56 . 2013-12-11 04:11 -------- d-----w- c:\programdata\RegRun
    2013-12-11 03:48 . 2013-12-11 03:48 98304 ----a-r- c:\users\paultess\AppData\Roaming\Microsoft\Installer\{3577E42B-3347-4EB8-BFDA-D36E8ED3C519}\icons.exe
    2013-12-10 16:26 . 2013-12-13 22:24 13464 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
    2013-12-10 16:26 . 2013-12-10 16:26 -------- d-----w- c:\program files\DriverUpdate
    2013-12-10 15:36 . 2013-12-10 15:36 -------- d-----w- C:\3e18caaeab8f96060889a595c6ac49
    2013-12-09 15:11 . 2013-12-09 15:31 -------- d-----w- C:\a2ba7f82b59340af87a808
    2013-12-09 14:58 . 2013-12-09 14:58 40208 ----a-w- c:\windows\system32\Partizan.exe
    2013-12-09 14:56 . 2013-12-09 14:56 -------- d-----w- C:\@RestoreQuarantine
    2013-12-09 14:50 . 2013-12-09 14:50 2 --shatr- c:\windows\winstart.bat
    2013-12-09 14:50 . 2013-12-09 14:50 -------- d-----w- c:\program files\Greatis
    2013-12-09 14:06 . 2013-12-09 14:06 -------- d-----w- c:\users\paultess\AppData\Roaming\dll-files.com
    2013-12-09 14:06 . 2013-12-09 14:06 -------- d-----w- c:\programdata\Logs
    2013-12-09 14:06 . 2013-12-09 14:06 -------- d-----w- c:\program files\Dll-Files.com Fixer
    2013-12-09 01:27 . 2013-12-09 01:27 -------- d-----w- c:\users\paultess\AppData\Roaming\AVAST Software
    2013-12-09 01:25 . 2013-12-09 01:25 269216 ----a-w- c:\windows\system32\aswBoot.exe
    2013-12-09 01:25 . 2013-12-09 01:25 43152 ----a-w- c:\windows\avastSS.scr
    2013-12-09 01:23 . 2013-12-09 01:23 -------- d-----w- c:\program files\AVAST Software
    2013-12-09 01:22 . 2013-12-09 01:23 -------- d-----w- c:\programdata\AVAST Software
    2013-12-09 00:26 . 2013-12-09 00:26 -------- d-----w- c:\programdata\REGSERVO
    2013-12-09 00:26 . 2013-12-09 00:26 -------- d-----w- c:\program files\REGSERVO
    2013-12-09 00:01 . 2013-12-09 00:01 -------- d-----w- c:\program files\Microsoft Download Manager
    2013-12-08 16:00 . 2013-12-08 16:00 -------- d-----w- c:\program files\Video Downloader
    2013-12-07 13:43 . 2013-12-07 13:43 -------- d-----w- c:\program files\GUMC023.tmp
    2013-12-07 12:11 . 2013-12-07 12:11 -------- d-----w- c:\programdata\ErrorEND
    2013-12-07 12:03 . 2013-12-07 12:03 -------- d-----w- c:\users\paultess\AppData\Local\SlimWare Utilities Inc
    2013-12-05 02:39 . 2013-12-05 02:39 -------- d-----w- c:\users\paultess\SyncFolder
    2013-12-04 20:07 . 2013-12-04 20:07 -------- d-----w- c:\users\paultess\AppData\Roaming\freegames4357
    2013-12-03 15:17 . 2013-12-08 23:27 -------- d-----w- c:\program files\FinePixViewer
    2013-12-03 15:13 . 2013-12-03 15:13 -------- d-----w- c:\users\paultess\AppData\Roaming\InstallShield
    2013-12-03 11:16 . 2013-12-08 23:27 -------- d-----w- c:\windows\TempE90B0C5B-CD03-291E-809E-F8D5866625A3-Signatures
    2013-12-03 08:56 . 2013-12-09 14:58 -------- d-----w- c:\program files\Application Updater
    2013-12-03 08:56 . 2013-12-08 23:27 -------- d-----w- c:\program files\YTD Toolbar
    2013-12-02 03:19 . 2013-12-13 21:16 -------- d-----w- c:\users\paultess\AppData\Roaming\Audacity
    2013-12-02 03:16 . 2013-12-13 15:06 -------- d-----w- c:\program files\Audacity
    2013-11-26 17:51 . 2013-11-26 17:52 -------- d-----w- c:\program files\Real
    2013-11-26 17:32 . 2013-11-26 17:33 -------- d-----w- c:\program files\BurnAware Free
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-12-11 01:32 . 2013-07-30 21:03 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2013-12-11 01:32 . 2013-07-30 21:03 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2013-12-09 14:08 . 2011-02-19 07:40 827728 ----a-w- c:\windows\system32\msvcr100.dll
    2013-11-19 10:21 . 2013-06-24 22:42 230048 ------w- c:\windows\system32\MpSigStub.exe
    2013-11-10 18:26 . 2013-10-02 15:27 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
    2013-10-08 14:50 . 2013-10-22 19:55 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
    2013-10-03 23:57 . 2013-10-03 23:57 129536 ----a-w- c:\users\Public\AlexaNSISPlugin.7420.dll
    2013-09-27 17:53 . 2013-09-27 17:53 214696 ----a-w- c:\windows\system32\drivers\MpFilter.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2013-06-26 1232896]
    "WindowsWelcomeCenter "= "oobefldr.dll" [2006-11-02 2159104]
    "HPAdvisor "= "c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2007-10-04 1783136]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-06-24 39408]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv "= "c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
    "KBD "= "c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
    "OsdMaestro "= "c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
    "IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-13 178712]
    "RtHDVCpl "= "RtHDVCpl.exe" [2007-09-19 4702208]
    "SunJavaUpdateReg "= "c:\windows\system32\jureg.exe" [2007-04-07 54936]
    "MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
    "HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
    "CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-10-19 1983816]
    "CanonSolutionMenu "= "c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
    "APSDaemon "= "c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-02-27 141848]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-02-27 173592]
    "Persistence "= "c:\windows\system32\igfxpers.exe" [2009-02-27 150552]
    "SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
    "vProt "= "c:\program files\AVG Secure Search\vprot.exe" [2013-12-08 2471448]
    "ArcSoft Connection Service "= "c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2007-07-17 64000]
    "UnThreat "= "c:\program files\UnThreat AntiVirus\UnThreat.exe" [2013-04-18 14934320]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2013-11-02 152392]
    "SBRegRebootCleaner "= "c:\program files\UnThreat AntiVirus\SBRC.exe" [2013-03-11 201608]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher "= "c:\windows\SMINST\launcher.exe" [2007-10-09 44168]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    CodecPackUpdateChecker.lnk - c:\windows\System32\C2MP\UpdateChecker.exe [2013-6-12 48248]
    ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2013-12-3 303104]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
    Snapfish Media Detector.lnk - c:\program files\Snapfish Picture Mover\SnapfishMediaDetector.exe [2007-5-7 1273856]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @= "Service "
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring "=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring "=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - MPKSL4F747D46
    *NewlyCreated* - TRUESIGHT
    *Deregistered* - MBAMSwissArmy
    *Deregistered* - TrueSight
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2013-12-18 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-30 01:32]
    .
    2013-12-18 c:\windows\Tasks\DLL-Files FixerASKUSER.job
    - c:\program files\Dll-Files.com Fixer\DLLFixer.exe [2013-12-09 22:44]
    .
    2013-12-11 c:\windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job
    - c:\program files\Dll-Files.com Fixer\DLLFixer.exe [2013-12-09 22:44]
    .
    2013-12-14 c:\windows\Tasks\DLL-Files.Com Fixer_Updates.job
    - c:\program files\Dll-Files.com Fixer\DLLFixer.exe [2013-12-09 22:44]
    .
    2013-12-16 c:\windows\Tasks\DriverUpdate Startup.job
    - c:\program files\DriverUpdate\DriverUpdate.exe [2013-06-22 23:30]
    .
    2013-12-18 c:\windows\Tasks\FreeFileViewerUpdateChecker.job
    - c:\program files\FreeFileViewer\FFVCheckForUpdates.exe [2013-06-26 01:24]
    .
    2013-12-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2013-06-24 22:05]
    .
    2013-12-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2013-06-24 22:05]
    .
    2013-12-03 c:\windows\Tasks\HPCeeScheduleForpaultess.job
    - c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-11-23 00:34]
    .
    2013-12-15 c:\windows\Tasks\REGSERVO.job
    - c:\program files\REGSERVO\RegSERVO.exe [2013-07-24 07:28]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.bbc.com/
    uDefault_Search_URL = hxxp://www.google.com/ie
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
    TCP: DhcpNameServer = 64.59.160.15 64.59.161.69
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\17.2.0\ViProtocol.dll
    .
    - - - - ORPHANS REMOVED - - - -
    .
    ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
    HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    HKU-Default-Run-SearchProtect - \SearchProtect\bin\cltmng.exe
    HKLM_ActiveSetup-{8A69D345-D564-463c-AFF1-A69D9E530F96} - c:\program files\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe
    AddRemove-VisualBee - c:\program files\VisualBee\Uninstall.exe
    AddRemove-Torch - c:\users\paultess\AppData\Local\Torch\uninstall.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2013-12-18 14:00
    Windows 6.0.6000 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101 "
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled "=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe "
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker5 "
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    Completion time: 2013-12-18 14:02:41
    ComboFix-quarantined-files.txt 2013-12-18 22:02
    .
    Pre-Run: 150,914,064,384 bytes free
    Post-Run: 151,721,930,752 bytes free
    .
    - - End Of File - - C874B9454F8B448577715F53D9341241
    81CD5EC01DB0CE57EDD853F82462EF27
     
    paultess,
    #13
  15. 2013/12/18
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    Internet started ok. Still the problem with Windows closing down and Microsoft ICE not working.
     
    paultess,
    #14
  16. 2013/12/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I can see another AV program installed, UnThreat Free AntiVirus 2013.
    You must uninstall it as well.

    Next...see if you can run MBAM now.
     
    broni,
    #15
  17. 2013/12/18
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    Malwarebytes Anti-Malware 1.75.0.1300
    www.malwarebytes.org

    Database version: v2013.12.19.02

    Windows Vista x86 NTFS
    Internet Explorer 7.0.6000.16982
    paultess :: PAULTESS-PC [administrator]

    18/12/2013 5:38:26 PM
    mbam-log-2013-12-18 (17-38-26).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 237745
    Time elapsed: 7 minute(s), 48 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 11
    C:\Users\paultess\AppData\Local\GreatArcadeHits (PUP.Optional.GreatArcadeHits.A) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Local\GreatArcadeHits\{B21F5E31-B8E8-41CD-B74C-168A71A10E49} (PUP.Optional.GreatArcadeHits.A) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Local\GreatArcadeHits\{B21F5E31-B8E8-41CD-B74C-168A71A10E49}\chrome (PUP.Optional.GreatArcadeHits.A) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Local\GreatArcadeHits\{B21F5E31-B8E8-41CD-B74C-168A71A10E49}\chrome\content (PUP.Optional.GreatArcadeHits.A) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Local\VisualBeeExe (PUP.Optional.Visualbee) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Local\VisualBeeExe\GuideFiles (PUP.Optional.Visualbee) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Local\VisualBeeClient (PUP.Optional.Visualbee) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Local\VisualBeeClient\Domain (PUP.Optional.Visualbee) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Local\VisualBeeClient\LocalDB (PUP.Optional.Visualbee) -> Quarantined and deleted successfully.
    C:\Program Files\VisualBee_V.11 (PUP.Optional.Visualbee) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Roaming\freegames4357 (PUP.Optional.FreeGames.A) -> Quarantined and deleted successfully.

    Files Detected: 2
    C:\Users\paultess\AppData\Roaming\GDIPFONTCACHEV1.DAT (Trojan.Trace) -> Quarantined and deleted successfully.
    C:\Users\paultess\AppData\Roaming\freegames4357\freegames4357.crx (PUP.Optional.FreeGames.A) -> Quarantined and deleted successfully.

    (end)
    Malwarebytes Anti-Malware 1.75.0.1300
    www.malwarebytes.org

    Database version: v2013.12.19.02

    Windows Vista x86 NTFS
    Internet Explorer 7.0.6000.16982
    paultess :: PAULTESS-PC [administrator]

    18/12/2013 5:38:26 PM
    MBAM-log-2013-12-18 (17-47-13).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 237745
    Time elapsed: 7 minute(s), 48 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 11
    C:\Users\paultess\AppData\Local\GreatArcadeHits (PUP.Optional.GreatArcadeHits.A) -> No action taken.
    C:\Users\paultess\AppData\Local\GreatArcadeHits\{B21F5E31-B8E8-41CD-B74C-168A71A10E49} (PUP.Optional.GreatArcadeHits.A) -> No action taken.
    C:\Users\paultess\AppData\Local\GreatArcadeHits\{B21F5E31-B8E8-41CD-B74C-168A71A10E49}\chrome (PUP.Optional.GreatArcadeHits.A) -> No action taken.
    C:\Users\paultess\AppData\Local\GreatArcadeHits\{B21F5E31-B8E8-41CD-B74C-168A71A10E49}\chrome\content (PUP.Optional.GreatArcadeHits.A) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeExe (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeExe\GuideFiles (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeClient (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeClient\Domain (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Local\VisualBeeClient\LocalDB (PUP.Optional.Visualbee) -> No action taken.
    C:\Program Files\VisualBee_V.11 (PUP.Optional.Visualbee) -> No action taken.
    C:\Users\paultess\AppData\Roaming\freegames4357 (PUP.Optional.FreeGames.A) -> No action taken.

    Files Detected: 2
    C:\Users\paultess\AppData\Roaming\GDIPFONTCACHEV1.DAT (Trojan.Trace) -> No action taken.
    C:\Users\paultess\AppData\Roaming\freegames4357\freegames4357.crx (PUP.Optional.FreeGames.A) -> No action taken.

    (end)
     
    paultess,
    #16
  18. 2013/12/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good :)

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator ".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
    broni,
    #17
  19. 2013/12/20
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    Hello, can you let me know how to post screen shots so I can show you some of the error messages please?

    # AdwCleaner v3.015 - Report created 19/12/2013 at 08:32:34
    # Updated 10/12/2013 by Xplode
    # Operating System : Windows Vista (TM) Home Premium (32 bits)
    # Username : paultess - PAULTESS-PC
    # Running from : C:\Users\paultess\Desktop\adwcleaner.exe
    # Option : Clean

    ***** [ Services ] *****

    [#] Service Deleted : Application Updater
    [#] Service Deleted : torchcrashhandler

    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Searchprotect
    Folder Deleted : C:\ProgramData\apn
    Folder Deleted : C:\ProgramData\AVG Secure Search
    Folder Deleted : C:\ProgramData\torchcrashhandler
    Folder Deleted : C:\ProgramData\VisualBee
    Folder Deleted : C:\Program Files\Application Updater
    Folder Deleted : C:\Program Files\AVG Secure Search
    Folder Deleted : C:\Program Files\GreenTree Applications
    Folder Deleted : C:\Program Files\MetaCrawler
    Folder Deleted : C:\Program Files\optimizer pro
    Folder Deleted : C:\Program Files\Video downloader
    Folder Deleted : C:\Program Files\Whilokii
    Folder Deleted : C:\Program Files\YTD Toolbar
    Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
    Folder Deleted : C:\Program Files\Common Files\Spigot
    Folder Deleted : C:\Users\paultess\AppData\Local\AVG Secure Search
    Folder Deleted : C:\Users\paultess\AppData\Local\filetypeassistant
    Folder Deleted : C:\Users\paultess\AppData\Local\torch
    Folder Deleted : C:\Users\paultess\AppData\LocalLow\AVG Secure Search
    Folder Deleted : C:\Users\paultess\AppData\LocalLow\Conduit
    Folder Deleted : C:\Users\paultess\AppData\LocalLow\Search Settings
    Folder Deleted : C:\Users\paultess\AppData\LocalLow\VisualBee_V.11
    Folder Deleted : C:\Users\paultess\AppData\Roaming\MetaCrawler
    Folder Deleted : C:\Users\paultess\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\torch
    Folder Deleted : C:\Users\paultess\Documents\optimizer pro
    Folder Deleted : C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbcennhacfaagdopikcegfcobcadeocj
    Folder Deleted : C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj
    Folder Deleted : C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof
    Folder Deleted : C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfndaklgolladniicklehhancnlgocpp
    File Deleted : C:\END
    File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
    File Deleted : C:\Windows\system32\Uninstall.exe

    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKCU\Software\Google\Chrome\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam
    Key Deleted : HKLM\SOFTWARE\Classes\*\shell\filescout
    Key Deleted : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB
    Key Deleted : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB.1
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
    Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
    Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
    Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\torch.exe
    Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
    Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1
    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3287810
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7093EE04-F2E4-4637-A667-0F730797B3A0}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5F29E0C4-92B3-41E0-B7AB-4D5032171801}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B9600F10-A27F-4A3C-96A2-FC143AD450E9}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322392206}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355395506}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366396606}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7093EE04-F2E4-4637-A667-0F730797B3A0}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B9600F10-A27F-4A3C-96A2-FC143AD450E9}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78A96E34-1BEE-42C4-AE87-6BAE3EAE9714}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4FFCB472-9C0A-44E4-8429-AECB28E29F20}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7093EE04-F2E4-4637-A667-0F730797B3A0}]
    Key Deleted : HKCU\Software\APN PIP
    Key Deleted : HKCU\Software\AVG Secure Search
    Key Deleted : HKCU\Software\Conduit
    Key Deleted : HKCU\Software\distromatic
    Key Deleted : HKCU\Software\installedbrowserextensions
    Key Deleted : HKCU\Software\OCS
    Key Deleted : HKCU\Software\Search Settings
    Key Deleted : HKCU\Software\Softonic
    Key Deleted : HKCU\Software\torch
    Key Deleted : HKCU\Software\visualbee
    Key Deleted : HKCU\Software\Whilokii
    Key Deleted : HKCU\Software\AppDataLow\Toolbar
    Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
    Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
    Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
    Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
    Key Deleted : HKCU\Software\AppDataLow\Software\visualbee
    Key Deleted : HKCU\Software\AppDataLow\Software\VisualBee_V.11
    Key Deleted : HKLM\Software\Application Updater
    Key Deleted : HKLM\Software\AVG Secure Search
    Key Deleted : HKLM\Software\AVG Security Toolbar
    Key Deleted : HKLM\Software\Conduit
    Key Deleted : HKLM\Software\InstallCore
    Key Deleted : HKLM\Software\InstallIQ
    Key Deleted : HKLM\Software\PIP
    Key Deleted : HKLM\Software\Search Settings
    Key Deleted : HKLM\Software\SearchProtect
    Key Deleted : HKLM\Software\torch
    Key Deleted : HKLM\Software\visualbee
    Key Deleted : HKLM\Software\Whilokii
    Key Deleted : HKLM\Software\VisualBee_V.11
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Whilokii
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Amazon Browser Bar
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Optimizer Pro_is1
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\torch
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Updater Service
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\visualbee
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Whilokii
    Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
    Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

    ***** [ Browsers ] *****

    -\\ Internet Explorer v7.0.6000.16982


    *************************

    AdwCleaner[R0].txt - [11530 octets] - [19/12/2013 08:31:49]
    AdwCleaner[S0].txt - [11806 octets] - [19/12/2013 08:32:34]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11867 octets] ##########

    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.0.8 (11.05.2013:1)
    OS: Windows Vista (TM) Home Premium x86
    Ran by paultess on 19/12/2013 at 8:47:05.52
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values

    Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sbregrebootcleaner
    Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}
    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricsart
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\update whilokii



    ~~~ Files

    Successfully deleted: [File] "C:\Windows\System32\Tasks\dll-files.com fixer_monthly "
    Successfully deleted: [File] "C:\Windows\System32\Tasks\dll-files.com fixer_updates "
    Successfully deleted: [File] "C:\Windows\Tasks\dll-files.com fixer_monthly.job "
    Successfully deleted: [File] "C:\Windows\Tasks\dll-files.com fixer_updates.job "
    Successfully deleted: [File] "C:\Windows\Tasks\driverupdate startup.job "



    ~~~ Folders

    Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader "
    Successfully deleted: [Folder] "C:\Users\paultess\AppData\Roaming\dll-files.com "
    Successfully deleted: [Folder] "C:\Users\paultess\appdata\local\cre "
    Successfully deleted: [Folder] "C:\Users\paultess\appdata\local\filetypeassistant "
    Successfully deleted: [Folder] "C:\Users\paultess\appdata\locallow\ytd "
    Successfully deleted: [Folder] "C:\Program Files\dll-files.com fixer "
    Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader "



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on 19/12/2013 at 8:49:28.72
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
    paultess,
    #18
  20. 2013/12/20
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    OTL logfile created on: 19/12/2013 8:54:57 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\paultess\Downloads
    Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
    Internet Explorer (Version = 7.0.6000.16982)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    2.99 Gb Total Physical Memory | 1.68 Gb Available Physical Memory | 56.09% Memory free
    6.18 Gb Paging File | 4.84 Gb Available in Paging File | 78.37% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 456.33 Gb Total Space | 138.89 Gb Free Space | 30.44% Space Free | Partition Type: NTFS
    Drive D: | 9.42 Gb Total Space | 1.22 Gb Free Space | 12.94% Space Free | Partition Type: NTFS
    Drive E: | 9.87 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
    Drive F: | 166.66 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
    Drive K: | 931.10 Gb Total Space | 21.94 Gb Free Space | 2.36% Space Free | Partition Type: NTFS

    Computer Name: PAULTESS-PC | User Name: paultess | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2013/12/19 08:53:48 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\paultess\Downloads\OTL.exe
    PRC - [2013/12/03 18:48:06 | 000,863,184 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
    PRC - [2013/10/23 15:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
    PRC - [2013/10/23 14:55:28 | 000,948,440 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
    PRC - [2013/06/26 02:19:50 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2013/06/22 15:30:28 | 034,220,352 | ---- | M] (SlimWare Utilities, Inc.) -- C:\Program Files\DriverUpdate\DriverUpdate.exe
    PRC - [2013/05/11 02:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    PRC - [2012/10/26 07:28:33 | 000,036,720 | ---- | M] (Storage Appliance Corp.) -- C:\ProgramData\Clickfree\FullImagingBackup\FibUac.exe
    PRC - [2009/10/18 18:12:00 | 001,983,816 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    PRC - [2009/02/10 08:01:49 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
    PRC - [2007/09/19 06:50:44 | 004,702,208 | ---- | M] (Realtek Semiconductor) -- C:\WINDOWS\RtHDVCpl.exe
    PRC - [2007/07/17 12:05:16 | 000,064,000 | ---- | M] (ArcSoft) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    PRC - [2007/07/12 16:36:12 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    PRC - [2007/07/12 16:36:10 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    PRC - [2007/04/18 07:01:34 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe
    PRC - [2007/02/15 03:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    PRC - [2007/01/30 12:02:00 | 000,303,104 | ---- | M] (FUJIFILM Corporation) -- C:\Program Files\FinePixViewer\QuickDCF2.exe
    PRC - [2006/11/02 01:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\conime.exe


    ========== Modules (No Company Name) ==========

    MOD - [2013/12/03 18:48:04 | 000,399,312 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\31.0.1650.63\ppgooglenaclpluginchrome.dll
    MOD - [2013/12/03 18:48:03 | 013,586,896 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll
    MOD - [2013/12/03 18:48:02 | 004,055,504 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\31.0.1650.63\pdf.dll
    MOD - [2013/12/03 18:47:11 | 000,702,416 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\31.0.1650.63\libglesv2.dll
    MOD - [2013/12/03 18:47:11 | 000,099,792 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\31.0.1650.63\libegl.dll
    MOD - [2013/12/03 18:47:08 | 001,619,408 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll
    MOD - [2013/06/26 03:01:08 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\23281812ddf7a1fab881b5322e577ac4\System.Runtime.Remoting.ni.dll
    MOD - [2013/06/26 03:01:05 | 000,627,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ae383808b3f5ee9287358378f9a2cad3\System.EnterpriseServices.ni.dll
    MOD - [2013/06/26 03:01:05 | 000,280,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ae383808b3f5ee9287358378f9a2cad3\System.EnterpriseServices.Wrapper.dll
    MOD - [2013/06/26 03:01:04 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\b98385fbfc00adacf4fd7896ba064032\System.Transactions.ni.dll
    MOD - [2013/06/26 03:00:59 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e6001d416f7c468334934a2c6a41c631\System.Configuration.ni.dll
    MOD - [2013/06/26 02:59:38 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\7208ffa39630e9b923331f9df0947a12\System.Xml.ni.dll
    MOD - [2013/06/26 02:59:14 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1941d7639299344ae28fb6b23da65247\System.Windows.Forms.ni.dll
    MOD - [2013/06/26 02:59:04 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6312464f64727a2a50d5ce3fd73ad1bb\System.Drawing.ni.dll
    MOD - [2013/06/26 02:58:51 | 006,616,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\813556b5a2722045b0ea14467fd00227\System.Data.ni.dll
    MOD - [2013/06/26 02:58:41 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a122c56b60812fb5cbc2e941d4875a87\PresentationFramework.Aero.ni.dll
    MOD - [2013/06/26 02:58:39 | 014,327,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\29eb51a21ce62ed759b162307bd65e32\PresentationFramework.ni.dll
    MOD - [2013/06/26 02:58:20 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\dc8dccca85718096c895b74094e09e5a\PresentationCore.ni.dll
    MOD - [2013/06/26 02:58:05 | 003,313,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\c049bc39cb33f7459936a689484285d6\WindowsBase.ni.dll
    MOD - [2013/06/26 02:58:01 | 007,868,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\52e1ea3c7491e05cda766d7b3ce3d559\System.ni.dll
    MOD - [2013/06/26 02:57:47 | 011,486,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\17f572b09facdc5fda9431558eb7a26e\mscorlib.ni.dll
    MOD - [2013/06/24 14:22:40 | 002,933,248 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
    MOD - [2013/06/24 14:22:40 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
    MOD - [2013/06/24 14:22:40 | 000,113,664 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
    MOD - [2013/04/21 20:44:32 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    MOD - [2013/04/21 20:44:04 | 001,242,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    MOD - [2007/10/03 18:02:16 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Content.XmlSerializers.dll
    MOD - [2007/10/03 18:02:16 | 000,007,168 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll
    MOD - [2007/10/03 18:02:04 | 000,057,344 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
    MOD - [2007/10/03 18:01:44 | 000,036,864 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll
    MOD - [2007/10/03 18:01:36 | 000,040,960 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll
    MOD - [2007/10/03 18:01:36 | 000,028,672 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll
    MOD - [2007/10/03 18:01:36 | 000,006,144 | ---- | M] () -- C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll
    MOD - [2007/02/16 20:01:00 | 000,081,920 | ---- | M] () -- C:\Program Files\FinePixViewer\wia_register_event.dll
    MOD - [2006/11/02 01:46:09 | 000,364,544 | ---- | M] () -- C:\WINDOWS\System32\msjetoledb40.dll


    ========== Services (SafeList) ==========

    SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.2.0\ToolbarUpdater.exe -- (vToolbarUpdater17.2.0)
    SRV - [2013/12/10 17:32:29 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
    SRV - [2013/10/23 15:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
    SRV - [2013/05/11 02:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
    SRV - [2012/10/26 07:28:33 | 000,036,720 | ---- | M] (Storage Appliance Corp.) [Auto | Running] -- C:\ProgramData\Clickfree\FullImagingBackup\FibUac.exe -- (FibUacService)
    SRV - [2009/02/10 08:01:49 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
    SRV - [2007/11/22 22:15:17 | 000,265,912 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2007/07/12 16:36:12 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\zwciwaol.sys -- (zwciwaol)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIM)
    DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\SBREDrv.sys -- (SBRE)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
    DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
    DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\hewfhhna.sys -- (hewfhhna)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\paultess\AppData\Local\Temp\catchme.sys -- (catchme)
    DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
    DRV - [2013/12/19 08:38:00 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\SWDUMon.sys -- (SWDUMon)
    DRV - [2013/12/18 13:47:20 | 000,040,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B208A502-2DF1-45BF-9CB3-9040C13FE7CC}\MpKsl4f747d46.sys -- (MpKsl4f747d46)
    DRV - [2013/12/10 20:12:35 | 000,024,416 | ---- | M] (Greatis Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\regguard.sys -- (RegGuard)
    DRV - [2013/12/10 20:04:57 | 000,035,816 | ---- | M] (Greatis Software) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\System32\drivers\Partizan.sys -- (Partizan)
    DRV - [2013/11/10 10:26:03 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\avgtpx86.sys -- (avgtp)
    DRV - [2013/05/23 07:39:13 | 000,043,368 | ---- | M] (ThreatTrack Security) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\gfiark.sys -- (gfiark)
    DRV - [2008/05/08 04:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
    DRV - [2008/05/08 04:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSX_DP.sys -- (HSF_DP)
    DRV - [2007/10/18 06:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\XAudio.sys -- (XAudio)
    DRV - [2007/08/03 02:44:00 | 000,091,648 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Rtlh86.sys -- (RTL8169)
    DRV - [2005/12/12 09:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\PS2.sys -- (Ps2)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
    IE - HKLM\..\SearchScopes,DefaultScope =
    IE - HKLM\..\SearchScopes\{02C30671-2B24-44DF-BF4B-1C20FA43B666}: "URL" = http://ca.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7


    IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.com/
    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GUEA_enCA542
    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


    ========== FireFox ==========

    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
    FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
    FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
    FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/DownloadManager,version=1.1: C:\Windows\ [2013/12/19 08:47:03 | 000,000,000 | ---D | M]
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
    FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
    FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.7: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{7aca4912-f9f2-4dfc-90d2-9fd87d62af55}: C:\Program Files\LyricsArt\130.xpi
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{B21F5E31-B8E8-41CD-B74C-168A71A10E49}: C:\Users\paultess\AppData\Local\GreatArcadeHits\{B21F5E31-B8E8-41CD-B74C-168A71A10E49}\

    [2013/12/04 12:07:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\paultess\AppData\Roaming\Mozilla\Extensions
    [2013/12/04 12:07:26 | 000,000,000 | ---D | M] (Free Games (4357)) -- C:\Users\paultess\AppData\Roaming\Mozilla\Extensions\freegames4357@BestOffers
    [2013/12/04 12:07:04 | 000,000,000 | ---D | M] (Speed Test (4354)) -- C:\Users\paultess\AppData\Roaming\Mozilla\Extensions\speedtest4354@BestOffers

    ========== Chrome ==========

    CHR - default_search_provider: Google (Enabled)
    CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:eek:riginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:eek:mniboxStartMarginParameter}ie={inputEncoding}
    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
    CHR - Extension: Google Docs = C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
    CHR - Extension: Google Drive = C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1\
    CHR - Extension: YouTube = C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1\
    CHR - Extension: Google Search = C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\
    CHR - Extension: Google Wallet = C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\
    CHR - Extension: Gmail = C:\Users\paultess\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2\

    O1 HOSTS File: ([2013/12/18 14:00:02 | 000,000,027 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
    O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
    O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
    O3 - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
    O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
    O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft)
    O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
    O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
    O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
    O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
    O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
    O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
    O4 - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
    O4 - HKLM..\RunOnce: [Launcher] C:\WINDOWS\SMINST\Launcher.exe (soft thinks)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 157
    O7 - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
    O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
    O15 - HKU\S-1-5-21-2410994966-3734587764-1746882321-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
    O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.microsoft.com/downl...584-842756A66467/MicrosoftDownloadManager.cab (Microsoft Download Manager ActiveX control)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.59.160.15 64.59.161.69
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E3C6F8A3-6BCA-4D48-8F50-7955103217FD}: DhcpNameServer = 64.59.160.15 64.59.161.69
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\Users\paultess\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    O24 - Desktop BackupWallPaper: C:\Users\paultess\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2007/11/22 23:01:45 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [2012/10/18 13:35:28 | 000,000,082 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O34 - HKLM BootExecute: (Partizan)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/12/19 08:47:03 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
    [2013/12/19 08:29:04 | 000,000,000 | ---D | C] -- C:\AdwCleaner
    [2013/12/19 06:56:30 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\paul-77
    [2013/12/18 14:32:49 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\Book stuff
    [2013/12/18 14:02:50 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2013/12/18 13:47:35 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2013/12/18 13:47:35 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2013/12/18 13:47:34 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2013/12/18 13:47:34 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
    [2013/12/18 13:47:23 | 000,000,000 | ---D | C] -- C:\ComboFix
    [2013/12/18 13:47:12 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2013/12/18 13:45:55 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
    [2013/12/18 13:38:44 | 005,154,906 | R--- | C] (Swearware) -- C:\Users\paultess\Desktop\ComboFix.exe
    [2013/12/17 21:50:29 | 000,000,000 | ---D | C] -- C:\Users\paultess\{3f365736-3943-4f74-912a-41fa93177e03}
    [2013/12/14 09:13:08 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\In the Net UK - The best WEB site for the Angler_files
    [2013/12/14 07:33:46 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\Cappadocia from the ground and from the sky - Lonely Planet_files
    [2013/12/13 15:13:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    [2013/12/13 15:12:46 | 000,074,456 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamchameleon.sys
    [2013/12/13 15:12:09 | 012,582,688 | ---- | C] (Malwarebytes Corp.) -- C:\Users\paultess\Desktop\mbar-1.07.0.1008.exe
    [2013/12/13 15:11:52 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\How to create new restore point (all Windows)... - Computer Tips - Smartest Computing_files
    [2013/12/13 12:44:58 | 000,039,488 | ---- | C] (usb-audio.de) -- C:\Windows\System32\drivers\pgusbmm3.sys
    [2013/12/13 12:44:57 | 000,403,008 | ---- | C] (usb-audio.de) -- C:\Windows\System32\drivers\pgusbwdm.sys
    [2013/12/13 12:42:57 | 000,923,784 | ---- | C] (CNET Download.com) -- C:\Users\paultess\Desktop\cbsidlm-cbsi145-USB_Audio_ASIO_Driver-SEO-10066659.exe
    [2013/12/11 20:29:02 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\help
    [2013/12/11 05:59:45 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\chocolate-covered-cat eBay_files
    [2013/12/11 05:35:44 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Roaming\Malwarebytes
    [2013/12/11 05:35:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2013/12/11 05:35:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2013/12/11 05:35:02 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2013/12/11 05:08:30 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Local\ElevatedDiagnostics
    [2013/12/11 05:05:18 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell 1.0
    [2013/12/11 05:05:18 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
    [2013/12/10 20:30:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
    [2013/12/10 20:04:57 | 000,035,816 | ---- | C] (Greatis Software) -- C:\Windows\System32\drivers\Partizan.sys
    [2013/12/10 19:59:41 | 000,024,416 | ---- | C] (Greatis Software) -- C:\Windows\System32\drivers\regguard.sys
    [2013/12/10 19:56:50 | 000,000,000 | ---D | C] -- C:\ProgramData\RegRun
    [2013/12/10 08:26:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverUpdate
    [2013/12/10 08:26:43 | 000,000,000 | ---D | C] -- C:\Program Files\DriverUpdate
    [2013/12/10 08:26:34 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Downloaded Installers
    [2013/12/10 07:36:21 | 000,000,000 | ---D | C] -- C:\3e18caaeab8f96060889a595c6ac49
    [2013/12/09 07:11:45 | 000,000,000 | ---D | C] -- C:\a2ba7f82b59340af87a808
    [2013/12/09 06:58:16 | 000,040,208 | ---- | C] (Greatis Software) -- C:\Windows\System32\Partizan.exe
    [2013/12/09 06:56:11 | 000,000,000 | ---D | C] -- C:\@RestoreQuarantine
    [2013/12/09 06:51:54 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\RegRunInfo
    [2013/12/09 06:50:44 | 000,000,000 | ---D | C] -- C:\Users\paultess\Documents\RegRun2
    [2013/12/09 06:50:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reanimator
    [2013/12/09 06:50:36 | 000,000,000 | ---D | C] -- C:\Program Files\Greatis
    [2013/12/09 06:50:02 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\reanimator
    [2013/12/09 06:06:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Logs
    [2013/12/09 06:06:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dll-Files Fixer
    [2013/12/08 17:27:33 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Roaming\AVAST Software
    [2013/12/08 17:25:38 | 000,269,216 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
    [2013/12/08 17:25:04 | 000,043,152 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
    [2013/12/08 17:23:34 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
    [2013/12/08 17:22:53 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
    [2013/12/08 17:06:36 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 USB DVD Download Tool
    [2013/12/08 16:26:35 | 000,000,000 | ---D | C] -- C:\ProgramData\REGSERVO
    [2013/12/08 16:01:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Download Manager
    [2013/12/08 16:01:07 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Download Manager
    [2013/12/08 10:39:49 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\Front Row Sports - Watch Live Sports Online Now_files
    [2013/12/07 05:42:16 | 000,000,000 | ---D | C] -- C:\Program Files\YTD Toolbar(138)
    [2013/12/07 04:11:03 | 000,000,000 | ---D | C] -- C:\ProgramData\ErrorEND
    [2013/12/07 04:03:47 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Local\SlimWare Utilities Inc
    [2013/12/06 19:49:31 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\dash
    [2013/12/04 18:39:33 | 000,000,000 | ---D | C] -- C:\Users\paultess\SyncFolder
    [2013/12/03 07:19:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinePixViewer
    [2013/12/03 07:17:38 | 000,000,000 | ---D | C] -- C:\Program Files\FinePixViewer(7)
    [2013/12/03 07:17:38 | 000,000,000 | ---D | C] -- C:\Program Files\FinePixViewer
    [2013/12/03 07:13:38 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Roaming\InstallShield
    [2013/12/03 03:16:23 | 000,000,000 | ---D | C] -- C:\Windows\TempE90B0C5B-CD03-291E-809E-F8D5866625A3-Signatures
    [2013/12/03 00:56:47 | 000,000,000 | ---D | C] -- C:\Program Files\YTD Toolbar(51)
    [2013/12/01 19:19:46 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Roaming\Audacity
    [2013/12/01 19:16:43 | 000,000,000 | ---D | C] -- C:\Program Files\Audacity
    [2013/12/01 17:29:34 | 000,000,000 | ---D | C] -- C:\Users\paultess\Desktop\eCommercePlayer - Upload Manager_files
    [2013/11/27 13:02:47 | 000,000,000 | ---D | C] -- C:\Program Files\YTD Toolbar(143)
    [2013/11/26 10:00:04 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Roaming\RealNetworks
    [2013/11/26 09:53:07 | 000,000,000 | ---D | C] -- C:\Program Files\RealNetworks
    [2013/11/26 09:53:03 | 000,000,000 | ---D | C] -- C:\ProgramData\RealNetworks
    [2013/11/26 09:51:15 | 000,000,000 | ---D | C] -- C:\Program Files\Real
    [2013/11/26 09:49:02 | 000,000,000 | ---D | C] -- C:\Users\paultess\AppData\Roaming\Real
    [2013/11/26 09:47:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Real
    [2013/11/26 09:33:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BurnAware Free
    [2013/11/26 09:32:44 | 000,000,000 | ---D | C] -- C:\Program Files\BurnAware Free
    [2013/11/25 00:38:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader(163)
    [3 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2013/12/19 08:43:45 | 000,037,312 | ---- | M] () -- C:\Users\paultess\Desktop\error message-2.JPG
    [2013/12/19 08:43:28 | 000,631,724 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2013/12/19 08:43:28 | 000,110,942 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2013/12/19 08:41:01 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\FreeFileViewerUpdateChecker.job
    [2013/12/19 08:40:20 | 000,033,325 | ---- | M] () -- C:\Users\paultess\Desktop\error message-1.JPG
    [2013/12/19 08:38:00 | 000,013,464 | ---- | M] () -- C:\Windows\System32\drivers\SWDUMon.sys
    [2013/12/19 08:37:54 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2013/12/19 08:37:20 | 000,003,472 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2013/12/19 08:37:20 | 000,003,472 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2013/12/19 08:37:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2013/12/19 08:37:12 | 3211,042,816 | -HS- | M] () -- C:\hiberfil.sys
    [2013/12/19 08:35:22 | 000,057,769 | ---- | M] () -- C:\Users\paultess\Desktop\prevention.JPG
    [2013/12/19 08:32:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
    [2013/12/19 08:28:45 | 001,226,750 | ---- | M] () -- C:\Users\paultess\Desktop\adwcleaner.exe
    [2013/12/19 08:08:08 | 000,000,278 | ---- | M] () -- C:\Windows\tasks\DLL-Files FixerASKUSER.job
    [2013/12/19 07:37:00 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2013/12/18 14:00:02 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2013/12/18 13:39:14 | 005,154,906 | R--- | M] (Swearware) -- C:\Users\paultess\Desktop\ComboFix.exe
    [2013/12/15 11:20:45 | 000,001,372 | ---- | M] () -- C:\Users\paultess\Desktop\9781467526906.acsm
    [2013/12/14 09:13:08 | 000,035,593 | ---- | M] () -- C:\Users\paultess\Desktop\In the Net UK - The best WEB site for the Angler.htm
    [2013/12/14 07:33:45 | 000,079,598 | ---- | M] () -- C:\Users\paultess\Desktop\Cappadocia from the ground and from the sky - Lonely Planet.htm
    [2013/12/13 15:12:46 | 000,074,456 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamchameleon.sys
    [2013/12/13 15:12:24 | 012,582,688 | ---- | M] (Malwarebytes Corp.) -- C:\Users\paultess\Desktop\mbar-1.07.0.1008.exe
    [2013/12/13 15:11:52 | 000,102,909 | ---- | M] () -- C:\Users\paultess\Desktop\How to create new restore point (all Windows)... - Computer Tips - Smartest Computing.htm
    [2013/12/13 15:00:17 | 003,580,416 | ---- | M] () -- C:\Users\paultess\Desktop\RogueKiller.exe
    [2013/12/13 12:43:45 | 000,965,365 | ---- | M] () -- C:\Users\paultess\Desktop\usb_asio.zip
    [2013/12/13 12:42:59 | 000,923,784 | ---- | M] (CNET Download.com) -- C:\Users\paultess\Desktop\cbsidlm-cbsi145-USB_Audio_ASIO_Driver-SEO-10066659.exe
    [2013/12/13 07:50:13 | 002,358,753 | ---- | M] () -- C:\Users\paultess\Desktop\grace-how-2.pdf
    [2013/12/13 07:06:52 | 000,000,806 | ---- | M] () -- C:\Users\paultess\Desktop\Audacity.lnk
    [2013/12/11 06:16:57 | 000,000,908 | ---- | M] () -- C:\Users\paultess\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/12/11 05:03:02 | 001,441,792 | ---- | M] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
    [2013/12/11 05:03:02 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
    [2013/12/11 05:03:02 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
    [2013/12/10 20:30:51 | 000,001,997 | ---- | M] () -- C:\Users\paultess\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2013/12/10 20:30:51 | 000,001,973 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
    [2013/12/10 20:12:35 | 000,024,416 | ---- | M] (Greatis Software) -- C:\Windows\System32\drivers\regguard.sys
    [2013/12/10 20:04:57 | 000,035,816 | ---- | M] (Greatis Software) -- C:\Windows\System32\drivers\Partizan.sys
    [2013/12/10 19:48:11 | 000,002,334 | ---- | M] () -- C:\Users\paultess\Desktop\Windows 7 USB DVD Download Tool.lnk
    [2013/12/10 19:38:15 | 000,000,861 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
    [2013/12/09 06:58:16 | 000,040,208 | ---- | M] (Greatis Software) -- C:\Windows\System32\Partizan.exe
    [2013/12/09 06:50:47 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
    [2013/12/09 06:50:47 | 000,001,688 | ---- | M] () -- C:\Windows\System32\autoexec.nt
    [2013/12/09 06:50:47 | 000,000,002 | RHS- | M] () -- C:\Windows\winstart.bat
    [2013/12/09 06:50:42 | 000,000,876 | ---- | M] () -- C:\Users\paultess\Desktop\Reanimator.lnk
    [2013/12/09 06:44:43 | 012,693,214 | ---- | M] () -- C:\Users\paultess\Desktop\reanimator.zip
    [2013/12/09 06:06:41 | 000,000,911 | ---- | M] () -- C:\Users\paultess\Application Data\Microsoft\Internet Explorer\Quick Launch\Dll-Files Fixer.lnk
    [2013/12/08 17:25:04 | 000,269,216 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
    [2013/12/08 17:25:04 | 000,043,152 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
    [2013/12/08 17:18:16 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
    [2013/12/08 10:39:49 | 000,018,578 | ---- | M] () -- C:\Users\paultess\Desktop\Front Row Sports - Watch Live Sports Online Now.htm
    [2013/12/03 07:19:05 | 000,001,742 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ExifLauncher2.lnk
    [2013/12/03 02:58:03 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForpaultess.job
    [2013/12/02 22:58:51 | 007,998,040 | ---- | M] () -- C:\Users\paultess\Documents\Jackie Wilson - Lonely teardrops.mp4
    [2013/12/02 22:55:47 | 025,476,630 | ---- | M] () -- C:\Users\paultess\Documents\Jackie Wilson _Danny Boy & That's Why (I Love You So)_.mp4
    [2013/12/01 17:29:34 | 000,018,310 | ---- | M] () -- C:\Users\paultess\Desktop\eCommercePlayer - Upload Manager.htm
    [2013/11/27 19:33:09 | 298,117,406 | ---- | M] () -- C:\Users\paultess\Documents\Ray Lamontagne - Trouble [Full Album].mp4
    [2013/11/25 22:37:29 | 026,160,022 | ---- | M] () -- C:\Users\paultess\Documents\Out now! Shane MacGowan & Friends 'I Put A Spell On You' in aid of Concern Worldwide's work in Haiti.mp4
    [2013/11/25 22:33:23 | 020,519,388 | ---- | M] () -- C:\Users\paultess\Documents\Florence and the Machine's _Not Fade Away_ by Tabitha Denholm.mp4
    [2013/11/25 01:50:55 | 007,661,430 | ---- | M] () -- C:\Users\paultess\Documents\Turn Me On ~ Norah Jones.mp4
    [2013/11/25 01:04:37 | 236,582,478 | ---- | M] () -- C:\Users\paultess\Documents\_Watermelon man_ by Bloodest Saxohope & Kansas City Band.mp4
    [2013/11/25 00:52:34 | 036,086,529 | ---- | M] () -- C:\Users\paultess\Documents\Bloodest Saxophone _ Growlin'.flv
    [2013/11/25 00:40:05 | 006,482,944 | ---- | M] () -- C:\Users\paultess\Documents\Big Jay McNeely -- 3D.mp4
    [3 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2013/12/19 08:43:43 | 000,037,312 | ---- | C] () -- C:\Users\paultess\Desktop\error message-2.JPG
    [2013/12/19 08:40:17 | 000,033,325 | ---- | C] () -- C:\Users\paultess\Desktop\error message-1.JPG
    [2013/12/19 08:35:19 | 000,057,769 | ---- | C] () -- C:\Users\paultess\Desktop\prevention.JPG
    [2013/12/19 08:28:33 | 001,226,750 | ---- | C] () -- C:\Users\paultess\Desktop\adwcleaner.exe
    [2013/12/18 13:47:35 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2013/12/18 13:47:35 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2013/12/18 13:47:35 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2013/12/18 13:47:35 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2013/12/18 13:47:35 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2013/12/15 11:20:44 | 000,001,372 | ---- | C] () -- C:\Users\paultess\Desktop\9781467526906.acsm
    [2013/12/14 09:13:08 | 000,035,593 | ---- | C] () -- C:\Users\paultess\Desktop\In the Net UK - The best WEB site for the Angler.htm
    [2013/12/14 07:33:43 | 000,079,598 | ---- | C] () -- C:\Users\paultess\Desktop\Cappadocia from the ground and from the sky - Lonely Planet.htm
    [2013/12/13 15:11:50 | 000,102,909 | ---- | C] () -- C:\Users\paultess\Desktop\How to create new restore point (all Windows)... - Computer Tips - Smartest Computing.htm
    [2013/12/13 15:00:13 | 003,580,416 | ---- | C] () -- C:\Users\paultess\Desktop\RogueKiller.exe
    [2013/12/13 14:22:24 | 3211,042,816 | -HS- | C] () -- C:\hiberfil.sys
    [2013/12/13 12:43:43 | 000,965,365 | ---- | C] () -- C:\Users\paultess\Desktop\usb_asio.zip
    [2013/12/13 07:50:12 | 002,358,753 | ---- | C] () -- C:\Users\paultess\Desktop\grace-how-2.pdf
    [2013/12/13 06:24:35 | 000,000,806 | ---- | C] () -- C:\Users\paultess\Desktop\Audacity.lnk
    [2013/12/12 10:10:10 | 000,000,818 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
    [2013/12/11 05:35:11 | 000,000,908 | ---- | C] () -- C:\Users\paultess\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/12/11 05:02:36 | 001,441,792 | ---- | C] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
    [2013/12/11 05:02:36 | 000,196,608 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
    [2013/12/11 05:02:36 | 000,065,536 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
    [2013/12/10 20:30:51 | 000,001,973 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
    [2013/12/10 19:48:11 | 000,002,334 | ---- | C] () -- C:\Users\paultess\Desktop\Windows 7 USB DVD Download Tool.lnk
    [2013/12/10 08:26:51 | 000,013,464 | ---- | C] () -- C:\Windows\System32\drivers\SWDUMon.sys
    [2013/12/09 06:50:47 | 000,000,002 | RHS- | C] () -- C:\Windows\winstart.bat
    [2013/12/09 06:50:42 | 000,000,876 | ---- | C] () -- C:\Users\paultess\Desktop\Reanimator.lnk
    [2013/12/09 06:44:29 | 012,693,214 | ---- | C] () -- C:\Users\paultess\Desktop\reanimator.zip
    [2013/12/09 06:08:53 | 000,000,278 | ---- | C] () -- C:\Windows\tasks\DLL-Files FixerASKUSER.job
    [2013/12/09 06:06:41 | 000,000,911 | ---- | C] () -- C:\Users\paultess\Application Data\Microsoft\Internet Explorer\Quick Launch\Dll-Files Fixer.lnk
    [2013/12/08 10:39:48 | 000,018,578 | ---- | C] () -- C:\Users\paultess\Desktop\Front Row Sports - Watch Live Sports Online Now.htm
    [2013/12/03 07:19:05 | 000,001,742 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ExifLauncher2.lnk
    [2013/12/02 22:58:50 | 007,998,040 | ---- | C] () -- C:\Users\paultess\Documents\Jackie Wilson - Lonely teardrops.mp4
    [2013/12/02 22:55:45 | 025,476,630 | ---- | C] () -- C:\Users\paultess\Documents\Jackie Wilson _Danny Boy & That's Why (I Love You So)_.mp4
    [2013/12/01 17:29:32 | 000,018,310 | ---- | C] () -- C:\Users\paultess\Desktop\eCommercePlayer - Upload Manager.htm
    [2013/11/27 19:28:16 | 298,117,406 | ---- | C] () -- C:\Users\paultess\Documents\Ray Lamontagne - Trouble [Full Album].mp4
    [2013/11/25 22:37:09 | 026,160,022 | ---- | C] () -- C:\Users\paultess\Documents\Out now! Shane MacGowan & Friends 'I Put A Spell On You' in aid of Concern Worldwide's work in Haiti.mp4
    [2013/11/25 22:33:08 | 020,519,388 | ---- | C] () -- C:\Users\paultess\Documents\Florence and the Machine's _Not Fade Away_ by Tabitha Denholm.mp4
    [2013/11/25 01:50:51 | 007,661,430 | ---- | C] () -- C:\Users\paultess\Documents\Turn Me On ~ Norah Jones.mp4
    [2013/11/25 01:00:58 | 236,582,478 | ---- | C] () -- C:\Users\paultess\Documents\_Watermelon man_ by Bloodest Saxohope & Kansas City Band.mp4
    [2013/11/25 00:51:56 | 036,086,529 | ---- | C] () -- C:\Users\paultess\Documents\Bloodest Saxophone _ Growlin'.flv
    [2013/11/25 00:40:03 | 006,482,944 | ---- | C] () -- C:\Users\paultess\Documents\Big Jay McNeely -- 3D.mp4
    [2013/11/13 13:55:08 | 000,290,239 | ---- | C] () -- C:\Users\paultess\shill-6.jpg
    [2013/10/31 21:59:21 | 001,103,360 | ---- | C] () -- C:\Windows\System32\cidfont.dll
    [2013/10/31 21:59:20 | 001,503,232 | ---- | C] () -- C:\Windows\System32\ptj.exe
    [2013/10/31 21:59:15 | 004,369,408 | ---- | C] () -- C:\Windows\System32\pdftk.exe
    [2013/10/31 21:59:15 | 000,235,008 | ---- | C] () -- C:\Windows\System32\office.exe
    [2013/09/01 14:23:50 | 000,039,904 | ---- | C] () -- C:\Windows\System32\DiscHandler.exe
    [2013/08/29 19:54:26 | 003,915,776 | ---- | C] () -- C:\Windows\System32\ffmpeg.dll
    [2013/08/29 19:53:34 | 000,112,640 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
    [2013/08/29 19:51:58 | 000,099,840 | ---- | C] () -- C:\Windows\System32\ff_wmv9.dll
    [2013/08/29 19:51:54 | 000,157,184 | ---- | C] () -- C:\Windows\System32\ff_unrar.dll
    [2013/08/29 19:51:50 | 000,147,456 | ---- | C] () -- C:\Windows\System32\ff_libmad.dll
    [2013/08/29 19:51:48 | 001,525,760 | ---- | C] () -- C:\Windows\System32\ff_samplerate.dll
    [2013/08/29 19:51:48 | 000,211,968 | ---- | C] () -- C:\Windows\System32\ff_libdts.dll
    [2013/08/29 19:51:48 | 000,114,688 | ---- | C] () -- C:\Windows\System32\ff_liba52.dll
    [2013/08/29 19:51:40 | 000,271,360 | ---- | C] () -- C:\Windows\System32\TomsMoComp_ff.dll
    [2013/08/29 19:51:40 | 000,136,704 | ---- | C] () -- C:\Windows\System32\libmpeg2_ff.dll
    [2013/08/23 20:55:57 | 000,127,605 | ---- | C] () -- C:\Users\paultess\HK - tail_NEW.jpg
    [2013/08/23 20:53:35 | 000,128,134 | ---- | C] () -- C:\Users\paultess\HK - tail.jpg
    [2013/08/19 20:18:54 | 001,175,371 | ---- | C] () -- C:\Windows\System32\unins000.exe
    [2013/08/18 09:04:35 | 000,122,714 | ---- | C] () -- C:\Users\paultess\1923-tl.jpg
    [2013/08/18 08:34:54 | 000,122,606 | ---- | C] () -- C:\Users\paultess\1923-tail.jpg
    [2013/08/18 08:32:13 | 000,109,960 | ---- | C] () -- C:\Users\paultess\1923-head.jpg
    [2013/08/18 08:04:17 | 000,110,506 | ---- | C] () -- C:\Users\paultess\fl-head.jpg
    [2013/08/10 05:23:57 | 000,250,880 | ---- | C] () -- C:\Windows\System32\ff_kernelDeint.dll
    [2013/08/10 05:23:55 | 000,328,704 | ---- | C] () -- C:\Windows\System32\ff_libfaad2.dll
    [2013/08/10 05:23:52 | 000,136,055 | ---- | C] () -- C:\Windows\System32\unins000.dat
    [2013/07/30 17:03:12 | 000,216,064 | ---- | C] () -- C:\Windows\System32\gcapi_dll.dll
    [2013/07/26 05:24:22 | 006,275,760 | ---- | C] () -- C:\Windows\System32\avcodec-lav-55.dll
    [2013/07/26 05:24:22 | 001,239,216 | ---- | C] () -- C:\Windows\System32\avformat-lav-55.dll
    [2013/07/26 05:24:22 | 000,394,416 | ---- | C] () -- C:\Windows\System32\swscale-lav-2.dll
    [2013/07/26 05:24:22 | 000,288,944 | ---- | C] () -- C:\Windows\System32\avutil-lav-52.dll
    [2013/07/26 05:24:22 | 000,235,184 | ---- | C] () -- C:\Windows\System32\avfilter-lav-3.dll
    [2013/07/26 05:24:22 | 000,190,640 | ---- | C] () -- C:\Windows\System32\libbluray.dll
    [2013/07/26 05:24:22 | 000,150,192 | ---- | C] () -- C:\Windows\System32\avresample-lav-1.dll
    [2013/06/24 17:52:11 | 000,123,392 | ---- | C] () -- C:\Users\paultess\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2013/06/24 15:52:08 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
    [2013/06/24 15:27:06 | 000,000,680 | ---- | C] () -- C:\Users\paultess\AppData\Local\d3d9caps.dat
    [2013/04/14 02:00:06 | 000,150,016 | ---- | C] () -- C:\Windows\System32\mkx.dll
    [2013/04/14 02:00:02 | 000,109,568 | ---- | C] () -- C:\Windows\System32\avi.dll
    [2013/04/14 01:59:54 | 000,143,872 | ---- | C] () -- C:\Windows\System32\mp4.dll
    [2013/04/14 01:59:48 | 000,123,392 | ---- | C] () -- C:\Windows\System32\ogm.dll
    [2013/04/14 01:59:36 | 000,113,152 | ---- | C] () -- C:\Windows\System32\dsmux.exe
    [2013/04/14 01:59:32 | 000,154,624 | ---- | C] () -- C:\Windows\System32\ts.dll
    [2013/04/14 01:59:28 | 000,249,856 | ---- | C] () -- C:\Windows\System32\dxr.dll
    [2013/04/14 01:59:12 | 000,097,792 | ---- | C] () -- C:\Windows\System32\avs.dll
    [2013/04/14 01:59:10 | 000,137,728 | ---- | C] () -- C:\Windows\System32\mkv2vfr.exe
    [2013/04/14 01:59:06 | 000,357,376 | ---- | C] () -- C:\Windows\System32\gdsmux.exe
    [2013/04/14 01:59:06 | 000,093,184 | ---- | C] () -- C:\Windows\System32\avss.dll
    [2013/04/14 01:58:12 | 000,080,384 | ---- | C] () -- C:\Windows\System32\mkzlib.dll
    [2013/04/14 01:58:12 | 000,024,576 | ---- | C] () -- C:\Windows\System32\mkunicode.dll
    [2012/09/29 14:47:28 | 000,000,178 | ---- | C] () -- C:\Windows\System32\Formats.ini

    ========== ZeroAccess Check ==========
     
    paultess,
    #19
  21. 2013/12/20
    paultess

    paultess Inactive Thread Starter

    Joined:
    2013/12/11
    Messages:
    50
    Likes Received:
    0
    contd.

    [2006/11/02 04:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    " " = %SystemRoot%\system32\shell32.dll -- [2013/06/26 02:22:21 | 011,315,712 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    " " = %systemroot%\system32\wbem\fastprox.dll -- [2013/06/26 02:12:07 | 000,614,912 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
    " " = %systemroot%\system32\wbem\wbemess.dll -- [2006/11/02 01:46:13 | 000,348,672 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both

    ========== LOP Check ==========

    [2013/08/17 14:54:39 | 000,000,000 | ---D | M] -- C:\Users\Guest\AppData\Roaming\FUJIFILM
    [2013/08/13 12:41:38 | 000,000,000 | ---D | M] -- C:\Users\Guest\AppData\Roaming\Snapfish
    [2013/10/09 02:11:33 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\1O1L1I1PtF1F1C1N
    [2013/08/21 09:30:26 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\AbeBooks
    [2013/08/31 21:03:48 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\aignes
    [2013/12/13 14:40:53 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Allmyapps
    [2013/07/25 23:09:44 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Allmyapps(186)
    [2013/12/13 13:16:52 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Audacity
    [2013/07/11 22:47:19 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Auslogics
    [2013/12/08 17:27:33 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\AVAST Software
    [2013/11/13 04:30:07 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Blink
    [2013/10/31 15:51:59 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Canon
    [2013/06/25 18:39:59 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Dropbox
    [2013/07/06 23:42:05 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Foxit Software
    [2013/12/08 15:27:37 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\FreeFileViewer
    [2013/12/03 07:20:44 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\FUJIFILM
    [2013/12/08 15:27:37 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\IrfanView
    [2013/11/12 21:45:30 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\KiTTY
    [2013/06/24 13:48:58 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Snapfish
    [2013/12/03 00:28:10 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Spark
    [2013/06/24 15:59:26 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\TFP
    [2013/06/25 18:36:28 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\Thunderbird
    [2013/12/03 00:28:10 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\uTorrent
    [2013/06/24 16:39:31 | 000,000,000 | ---D | M] -- C:\Users\paultess\AppData\Roaming\WildTangent

    ========== Purity Check ==========



    ========== Files - Unicode (All) ==========
    [2013/11/25 00:47:29 | 019,122,688 | ---- | M] ()(C:\Users\paultess\Documents\Bloodest Saxophone _ Unexpectedly Morocco (???????).mp4) -- C:\Users\paultess\Documents\Bloodest Saxophone _ Unexpectedly Morocco （意外とモロッコ）.mp4
    [2013/11/25 00:47:19 | 019,122,688 | ---- | C] ()(C:\Users\paultess\Documents\Bloodest Saxophone _ Unexpectedly Morocco (???????).mp4) -- C:\Users\paultess\Documents\Bloodest Saxophone _ Unexpectedly Morocco （意外とモロッコ）.mp4

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:07BF512B
    @Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:98181191
    @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:373E1720

    < End of report >



    OTL Extras logfile created on: 19/12/2013 8:54:57 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\paultess\Downloads
    Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
    Internet Explorer (Version = 7.0.6000.16982)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    2.99 Gb Total Physical Memory | 1.68 Gb Available Physical Memory | 56.09% Memory free
    6.18 Gb Paging File | 4.84 Gb Available in Paging File | 78.37% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 456.33 Gb Total Space | 138.89 Gb Free Space | 30.44% Space Free | Partition Type: NTFS
    Drive D: | 9.42 Gb Total Space | 1.22 Gb Free Space | 12.94% Space Free | Partition Type: NTFS
    Drive E: | 9.87 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
    Drive F: | 166.66 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
    Drive K: | 931.10 Gb Total Space | 21.94 Gb Free Space | 2.36% Space Free | Partition Type: NTFS

    Computer Name: PAULTESS-PC | User Name: paultess | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
    .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

    [HKEY_USERS\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Classes\<extension>]
    .html [@ = TorchHTML.ANEDEOQPCH4KXLLZSNHYB46MRQ] -- "C:\Users\paultess\AppData\Local\Torch\Application\torch.exe" -- "%1 "

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- Reg Error: Key error.
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1 "
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- "C:\Program Files\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS)
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
    Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [FinePix] -- "C:\Program Files\FinePixViewer\FinePixViewer.exe" "%1" (FUJIFILM Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{27470300-8968-40F2-B89F-0574ED2CFE2A}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{293E5A34-0B43-4D12-8FDC-C91D979B3E14}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{2B5676DC-8892-42DC-8624-369108D55596}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{3FC4AFEC-25C0-40DF-B7A6-4DCC112D11D7}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{40C07797-191A-452F-BEEB-25B1E293E1FE}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{4C258559-8AA5-471D-9D91-DB4A60517D6E}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{673BE554-6D97-487D-95AA-C6BF6C40E23F}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{6B95D14B-5685-4868-9593-B5D6377EB11A}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{756A338E-CEA1-428E-B449-B26F0BB9ADB9}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{87BBC709-A228-4894-905C-3B153DFA8B17}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{8C64AADE-D8C8-45E1-B4A2-4590FC8C791E}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{96062BF8-7E4D-4786-B486-BEE4C90D37A4}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{9F8E81CD-FA95-4CF3-A8CA-C818541B6823}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{AF09A69B-DCDA-416A-A52A-A6213B66FBCD}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{B68A3FB7-5255-4F4D-9E1D-B00AADD7D579}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{D55CE53F-F4DB-400C-8983-0B62212C506E}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{D78F8378-6886-46AE-B828-A908DE44DB84}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{D85C7610-3F98-47AA-B9C1-6EFCB59749B7}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{E5AE0365-3F31-4EEE-9F06-936B4C3D3BB8}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |
    "{E70FF1FF-4B1B-440A-AE13-FDCB72499A77}" = lport=4000 | protocol=6 | dir=out | app=c:\program files\dll-files.com fixer\dllfixer.exe |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{06B992D7-A803-4DF2-A599-E4A8FB676328}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{07132333-69C0-4EEB-80B5-745670B8236C}" = dir=in | app=c:\users\paultess\desktop\codecperformersetup.exe |
    "{17E50C92-7641-4414-B63F-19DC3AA37657}" = dir=out | app=c:\users\paultess\appdata\local\temp\install codec pack804274.exe |
    "{22B4F519-7CCB-4F9B-9295-5A7A91A785C5}" = protocol=6 | dir=in | app=c:\program files\unthreat antivirus\utsvc.exe |
    "{26AE8652-9CB3-4C2D-B043-8EF409C44839}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{2A015530-BFC4-4961-9C09-9FCC3282356D}" = protocol=6 | dir=in | app=c:\program files\veetle\player\veetlenet.exe |
    "{30749D4B-C14C-4EA2-AC46-56D08E0A6A23}" = dir=out | app=c:\users\paultess\desktop\codecperformersetup.exe |
    "{348121B8-E0A0-4F48-8CDB-1186EADD53CB}" = protocol=6 | dir=in | app=c:\program files\unthreat antivirus\utsvc.exe |
    "{49E4D13B-A983-40F6-B7C3-98FD98E958E1}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{5BDFFE27-92C1-41BB-8D9C-0224CBD60BBA}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
    "{657C5C87-0FF3-47CC-9C5B-C2F67AB1A57B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{71F5744F-964B-4623-AD35-F26745CE8432}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{8022461C-663D-45C5-B1B7-1EE481F33FCC}" = dir=in | app=c:\users\paultess\appdata\roaming\allmyapps\allmyapps.exe |
    "{8ABDFA8F-7BED-4A33-B342-345B34C7FA1F}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{8D8E7113-F222-46AC-96D2-8A93462311B4}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "{8E317401-A8DA-488A-B5C7-1086414BA3E2}" = protocol=17 | dir=in | app=c:\program files\unthreat antivirus\utsvc.exe |
    "{9098FF5E-8744-4DC0-BE58-5986D464A8A8}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
    "{9F905EBD-3C19-40C6-8E2C-55182BE960D7}" = protocol=17 | dir=in | app=c:\program files\unthreat antivirus\utsvc.exe |
    "{BFBA6370-E86C-4C48-A877-749D7571BBC6}" = dir=in | app=c:\users\paultess\appdata\local\temp\install codec pack804274.exe |
    "{C746443D-819C-477A-A6B5-581483F03C3B}" = dir=in | app=c:\program files\itunes\itunes.exe |
    "{D850EA38-900A-4775-AEDE-CA953E353A64}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
    "{E0BBFFFB-F1D0-4D82-AF75-C59081F59F5C}" = dir=in | app=c:\program files\file type assistant\tsassist.exe |
    "{E2820318-6D50-4F3B-8852-E614238B33C8}" = dir=in | app=c:\users\paultess\appdata\local\torch\plugins\torrent\torchtorrent.exe |
    "{E3BC5210-0E80-465B-9EB4-E0D0789993CD}" = dir=in | app=c:\program files\freefileviewer\ffvcheckforupdates.exe |
    "{E869B64D-527F-4902-8BB3-5BA12BA64A04}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
    "{F980DE0B-E111-4B96-AC0B-AD2409A07690}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
    "TCP Query User{600B7BE9-8970-434F-9510-5A610D039DC0}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe |
    "TCP Query User{8A160FB8-A4A7-4BD0-97ED-A067DD9B0199}C:\program files\spark\spark.exe" = protocol=6 | dir=in | app=c:\program files\spark\spark.exe |
    "TCP Query User{9D57FA82-73BA-49E7-A0CA-415393DE80B3}C:\program files\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\java.exe |
    "TCP Query User{E403FF0B-35E7-42C8-820A-16189A74F5E5}C:\users\paultess\desktop\utorrent.exe" = protocol=6 | dir=in | app=c:\users\paultess\desktop\utorrent.exe |
    "TCP Query User{EBEBFEF8-4412-4E61-97FC-A69495D611BB}C:\program files\blink\blink.exe" = protocol=6 | dir=in | app=c:\program files\blink\blink.exe |
    "UDP Query User{0844A551-CD85-488D-8816-8D7DDB47CE1A}C:\program files\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\java.exe |
    "UDP Query User{182A8E77-0F4E-4618-838B-9912541D5483}C:\program files\spark\spark.exe" = protocol=17 | dir=in | app=c:\program files\spark\spark.exe |
    "UDP Query User{96F41BF3-E572-48D0-A625-5A5165698302}C:\program files\blink\blink.exe" = protocol=17 | dir=in | app=c:\program files\blink\blink.exe |
    "UDP Query User{F19BA59B-ADFD-4EC9-825F-DE9314F65A50}C:\users\paultess\desktop\utorrent.exe" = protocol=17 | dir=in | app=c:\users\paultess\desktop\utorrent.exe |
    "UDP Query User{FC4163D0-0DE9-4299-8E8C-CA47494A37A5}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{029B5901-1F27-4347-9923-E8ACC8F54E15}" = Snapfish Picture Mover
    "{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}" = Apple Mobile Device Support
    "{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
    "{0CD47142-BA4F-46B0-AA92-2675864928B8}" = Microsoft Security Client
    "{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
    "{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
    "{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
    "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
    "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
    "{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
    "{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YTD Video Downloader 4.6
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
    "{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.5.5
    "{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
    "{26A24AE4-039D-4CA4-87B4-2F83217040FF}" = Java 7 Update 45
    "{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
    "{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
    "{3577E42B-3347-4EB8-BFDA-D36E8ED3C519}" = Windows 7 USB/DVD Download Tool
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3D599ADA-65D9-4B51-898F-CE718DEC5DBB}" = Microsoft Image Composite Editor
    "{3EBA6E7C-3DF6-48AE-B87B-4CAFB2C1C3F7}" = LightScribe Template Labeler
    "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
    "{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
    "{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
    "{654977DB-0001-0002-0001-EABD228DDE8B}" = Microsoft Download Manager
    "{65EB09A3-993B-401E-8936-C9708CBFAB26}" = FinePixViewer YTUPL
    "{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
    "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
    "{83F40BA0-C14D-4EC7-9751-044CC0283A08}" = YTD Toolbar v8.3
    "{8444F175-4F29-4F4F-81C1-8E624C9BD858}_is1" = Free FLV to MP3 Converter version 1.0
    "{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
    "{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
    "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
    "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
    "{97486FBE-A3FC-4783-8D55-EA37E9D171CC}" = HP Update
    "{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AA4328C3-006F-49F0-94F4-0BA659FCB6A5}_is1" = Blink version 0.2.7
    "{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.04)
    "{AFAD41A9-9687-48A3-848F-693C11451433}" = HP Customer Experience Enhancements
    "{B44529FF-501E-47CD-A06D-223C161BE058}" = FinePixViewer Resource
    "{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
    "{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
    "{C197BC08-3D82-4651-8886-E68C21578A38}" = iTunes
    "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
    "{C67F5282-3EB4-4FE2-A5C7-ABEE4BE42F6D}" = DriverUpdate
    "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{DBDD570E-0952-475F-9453-AB88F3DD5659}" = Python 2.7.5
    "{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
    "{E6CFBFB5-9232-410C-B353-AF6E614B2681}" = LightScribe System Software 1.10.16.1
    "{E8C2622C-9FF1-4F60-8008-A0208154F9F3}" = muvee autoProducer 6.1
    "{e96b3d28-47d6-43cc-98fd-7069eeab6b11}" = HP Total Care Advisor
    "{ECF43B43-F239-496F-9792-AEEEBF999C6C}" = HomeBase 3
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "7-Zip" = 7-Zip 9.22beta
    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
    "aignesamdeadlink_is1" = AM-DeadLink 4.6
    "Amazon Kindle" = Amazon Kindle
    "AU11_is1" = Advanced Uninstaller PRO - Version 11
    "Audacity_is1" = Audacity 2.0.5
    "AVS4YOU Video Converter 7_is1" = AVS Video Converter 8
    "Awesome Duplicate Photo Finder_is1" = Awesome Duplicate Photo Finder v. 1.0
    "CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
    "CanonMyPrinter" = Canon Utilities My Printer
    "CanonSolutionMenu" = Canon Utilities Solution Menu
    "CCleaner" = CCleaner
    "Clickfree Easy Image" = Clickfree Easy Image
    "Dll-Files Fixer_is1" = Dll-Files Fixer
    "Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
    "Easy-WebPrint EX" = Canon Easy-WebPrint EX
    "ffdshow_is1" = ffdshow v1.2.4422 [2012-04-09]
    "Foxit Reader_is1" = Foxit Reader
    "FreeFileViewer_is1" = Free File Viewer 2012
    "GIMP-2_is1" = GIMP 2.8.6
    "Google Chrome" = Google Chrome
    "Greatis Reanimator_is1" = RegRun Reanimator
    "HaaliMkx" = Haali Media Splitter
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "HP Photosmart Essential" = HP Photosmart Essential 2.5
    "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
    "IrfanView" = IrfanView (remove only)
    "Kobo" = Kobo
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
    "Media Player - Codec Pack" = Media Player Codec Pack 4.2.9
    "metaCrawler" = metaCrawler
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft Security Client" = Microsoft Security Essentials
    "MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
    "office Convert Pdf to Jpg Jpeg Tiff Free_is1" = office Convert Pdf to Jpg Jpeg Tiff Free 6.5
    "OfficeTrial" = Microsoft Office Home and Student 60 day trial
    "OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
    "PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
    "Picasa 3" = Picasa 3
    "Spark 2.6.3.12555" = Spark 2.6.3.12555
    "Trusted Software Assistant_is1" = File Type Assistant
    "Veetle TV" = Veetle TV
    "VLC media player" = VLC media player 2.1.2
    "WildTangent hp Master Uninstall" = My HP Games
    "Yahoo! Companion" = Yahoo! Toolbar
    "Yahoo! Toolbar" = Yahoo! Toolbar

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-2410994966-3734587764-1746882321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Adobe Reader Free Download Packages" = Adobe Reader Free Download Packages
    "Allmyapps" = Allmyapps
    "CCleaner Free Download Packages" = CCleaner Free Download Packages
    "iTunes Free Download Packages" = iTunes Free Download Packages
    "uTorrent" = µTorrent
    "VLC media player Free Download Packages" = VLC media player Free Download Packages

    < End of report >
     
    paultess,
    #20
Page 1 of 5

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...