Solved Windows Update not working

dodopie · 2012/09/07

here is the log, the program is still opened it looks like it found one thing, should i use the fix button?

RogueKiller V8.0.2 [08/31/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : jerry [Admin rights]
Mode : Scan -- Date : 09/08/2012 00:08:17

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 1 ¤¤¤
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD16 00BEVT-22ZCT0 SCSI Disk Device +++++
--- User ---
[MBR] 3cc9fe40bde09045362c2c919a02afed
[BSP] 0f071cfbe77f754bc10c577fc5353435 : Acer tatooed MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 10244 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 20981760 | Size: 71192 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 166782976 | Size: 71189 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[1].txt >>
RKreport[1].txt

broni · 2012/09/07

No. You can close it.

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Scan All Users checkbox.

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

dodopie · 2012/09/07

OTL logfile created on: 9/8/2012 12:25:26 AM - Run 1
OTL by OldTimer - Version 3.2.61.2 Folder = C:\Users\jerry\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.57 Gb Available Physical Memory | 57.21% Memory free
5.73 Gb Paging File | 4.23 Gb Available in Paging File | 73.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.52 Gb Total Space | 29.28 Gb Free Space | 42.12% Space Free | Partition Type: NTFS
Drive D: | 69.52 Gb Total Space | 69.42 Gb Free Space | 99.85% Space Free | Partition Type: NTFS
Drive E: | 640.76 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: JERRY-PC | User Name: jerry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/08 00:24:58 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
PRC - [2012/08/29 11:23:10 | 003,039,352 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgui.exe
PRC - [2012/08/27 02:27:10 | 001,108,088 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgnsx.exe
PRC - [2012/08/20 04:53:34 | 000,184,304 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe
PRC - [2012/08/20 04:53:06 | 000,713,848 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgrsx.exe
PRC - [2012/08/20 04:52:42 | 005,751,928 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe
PRC - [2012/08/20 04:52:34 | 000,783,992 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgemcx.exe
PRC - [2012/08/20 04:52:26 | 000,450,168 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2013\avgcsrvx.exe
PRC - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/23 21:16:11 | 004,777,856 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2012/06/27 03:25:06 | 001,326,176 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psia.exe
PRC - [2012/06/27 03:25:04 | 000,681,056 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\sua.exe
PRC - [2012/06/27 03:25:04 | 000,572,000 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psi_tray.exe
PRC - [2012/06/15 06:10:29 | 000,686,280 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe
PRC - [2012/03/16 21:39:58 | 000,476,728 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
PRC - [2012/03/16 21:34:50 | 000,728,120 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe
PRC - [2011/08/11 19:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2010/04/02 10:18:54 | 001,185,112 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2010/03/24 22:50:00 | 002,516,296 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/11/28 14:56:06 | 000,024,576 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
PRC - [2007/12/06 20:15:28 | 000,110,592 | ---- | M] () -- C:\ACER\Mobility Center\MobilityService.exe
PRC - [2007/01/04 23:48:50 | 000,112,152 | ---- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

========== Modules (No Company Name) ==========

MOD - [2012/09/07 22:30:35 | 000,065,024 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2012/09/07 22:30:35 | 000,052,736 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2012/08/08 05:30:40 | 000,117,760 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2012/08/08 05:30:40 | 000,052,224 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2011/11/03 10:39:28 | 001,310,752 | ---- | M] () -- C:\Program Files\WOT\WOT.dll
MOD - [2008/07/03 23:37:36 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll

========== Services (SafeList) ==========

SRV - [2012/08/20 04:53:34 | 000,184,304 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2012/08/20 04:52:42 | 005,751,928 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/06/27 03:25:06 | 001,326,176 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\psia.exe -- (Secunia PSI Agent)
SRV - [2012/06/27 03:25:04 | 000,681,056 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2012/03/16 21:39:58 | 000,476,728 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2011/08/11 19:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2008/11/28 14:56:06 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService)
SRV - [2008/01/20 22:33:00 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/06 20:15:28 | 000,110,592 | ---- | M] () [Auto | Running] -- C:\ACER\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - [2007/01/04 23:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\jerry\AppData\Local\Temp\mbr.sys -- (mbr)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\RTKVHDA.sys -- (IntcAzAudAddService)
DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2012/08/13 16:40:54 | 000,176,096 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2012/08/10 04:52:38 | 000,164,704 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/08/10 04:52:36 | 000,089,440 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2012/08/10 04:52:28 | 000,019,808 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2012/08/10 04:52:18 | 000,035,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2012/08/09 13:56:44 | 000,178,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avglogx.sys -- (Avglogx)
DRV - [2012/08/09 13:56:36 | 000,054,112 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/08/09 13:56:22 | 000,151,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2011/12/16 10:19:54 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/04/11 00:46:08 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb8023.sys -- (USB_RNDIS_XP)
DRV - [2009/01/26 18:17:09 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
DRV - [2009/01/26 18:17:08 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
DRV - [2008/10/01 14:04:16 | 000,012,832 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)
DRV - [2008/08/06 22:40:40 | 000,129,552 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s)
DRV - [2008/07/28 03:53:48 | 000,919,552 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008/07/04 02:35:40 | 003,847,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/06/10 06:54:36 | 000,123,904 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/04/28 09:26:42 | 000,014,352 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie)
DRV - [2007/05/03 11:21:08 | 000,029,056 | ---- | M] (Service & Quality Technology.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Capt905c.sys -- (SQTECH905C)
DRV - [2007/04/18 00:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\regi.sys -- (regi)
DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006/11/02 09:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vb32&d=1208&m=aspire_5515
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=FWV5&o=14193&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=FM&apn_dtid=TES002A7US&apn_uid=29261208-1004-47CA-9C3F-F37F3F6A393C&apn_sauid=3471DD4D-425F-48F4-BF0F-5986A3B3D409
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = http://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=60195
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{3952C606-56D2-4A99-A1F6-4CFFAB45756F}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_en
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{547EEAAC-3665-4e6c-B326-C622D698543A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=SOLTDF&pc=SOLTDF&src=IE-SearchBox
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={853F32EB-E421-44B3-AE14-3D4495532402}&mid=2d550cef69b574666674f3904c4cca9d-926113d46e07c1a10a54c687293e356df434df7e&lang=en&ds=AVG&pr=fr&d=2012-07-22 08:27:39&v=12.2.5.32&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80227language
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://search.avg.com/route/?d=4d147f3d&v=6.103.18.1&i=23&tp=chrome&q={searchTerms}&lng={language}&iy=b&ychte=us
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@realarcade.com/RAClient: C:\ProgramData\RealArcade\npraclient.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\

[2011/09/13 17:18:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/11/06 22:39:51 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/01/13 17:36:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/02/24 10:38:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/21 09:21:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/09/04 18:04:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011/07/19 05:05:25 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/10/25 13:45:18 | 000,036,864 | ---- | M] (Homestead Technologies, Inc.) -- C:\Program Files\mozilla firefox\plugins\nphssb.dll
[2011/03/18 13:33:22 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2009/03/30 17:13:54 | 000,098,304 | ---- | M] (RealNetworks) -- C:\Program Files\mozilla firefox\plugins\npraclient.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.270.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U27 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Chrome NaCl (Disabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\13.0.782.220\pdf.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1777_0\plugins/avgnpss.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
CHR - plugin: Homestead SiteBuilder Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nphssb.dll
CHR - plugin: RealArcade NPAPI Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npraclient.dll
CHR - plugin: Exent\u00AE AOD Gecko Plugin (Enabled) = C:\Program Files\Free Ride Games\npExentCtl.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll
CHR - plugin: WorldWinner Firefox Launcher Plugin (Enabled) = C:\Program Files\WorldWinner.com, Inc\WorldWinner Games\npwwload.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: AVG Safe Search = C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1777_0\

O1 HOSTS File: ([2012/09/07 22:28:40 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {555F1BBC-6EC2-474F-84AF-633EF097FF54} http://www.worldwinner.com/games/v53/wwhearts/wwhearts.cab (WWHearts Control)
O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} http://www.worldwinner.com/games/v56/spidersolitaire/spidersolitaire.cab (SpiderSolitaire Control)
O16 - DPF: {74E4A24D-5224-4F05-8A41-99445E0FC22B} http://aolsvc.aol.com/onlinegames/free-trial-big-island-blends/gamehouseplayer.cab (GameHouse Games Player)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} http://www.worldwinner.com/games/launcher/ie/v2.23.01.0/iewwload.cab (WorldWinner ActiveX Launcher Control)
O16 - DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} http://www.worldwinner.com/games/v45/royal/royal.cab (Royal Control)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)
O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} http://www.worldwinner.com/games/v52/dinerdash/dinerdash.cab (DinerDash Control)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Arctic%20Quest%202/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} http://www.worldwinner.com/games/v54/wwspades/wwspades.cab (WWSpades Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E6644C9-C18A-4664-A766-F3140C986261}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4936F3D3-BDF4-442B-B0A1-A396ACE2AEE6}: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B57DE832-10A4-4AB6-A41E-080FD9154FD3}: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D00B9979-42B9-4910-94EB-250C116767D1}: DhcpNameServer = 192.168.1.254 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\jerry\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2000/07/28 04:50:14 | 000,000,059 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/08 00:24:37 | 000,599,552 | ---- | C] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
[2012/09/08 00:21:08 | 010,652,120 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\jerry\Desktop\mbam-setup-1.62.0.1300.exe
[2012/09/08 00:06:32 | 000,000,000 | ---D | C] -- C:\Users\jerry\Desktop\RK_Quarantine
[2012/09/07 23:08:02 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\AVG2013
[2012/09/07 23:06:53 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\TuneUp Software
[2012/09/07 23:06:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/09/07 23:06:15 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012/09/07 23:06:15 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013
[2012/09/07 23:03:43 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2012/09/07 22:48:33 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Local\MFAData
[2012/09/07 22:48:33 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012/09/07 22:48:33 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Local\Avg2013
[2012/09/07 22:40:25 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Local\temp
[2012/09/07 22:29:00 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012/09/07 22:26:16 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/09/07 21:57:17 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/09/07 21:57:17 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/09/07 21:57:17 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/09/07 21:57:08 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/09/07 21:57:00 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/09/07 21:54:24 | 004,749,820 | R--- | C] (Swearware) -- C:\Users\jerry\Desktop\ComboFix.exe
[2012/09/07 21:05:13 | 010,901,120 | ---- | C] (OPSWAT, Inc.) -- C:\Users\jerry\Desktop\AppRemover.exe
[2012/09/06 22:40:21 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\jerry\Desktop\dds.com
[2012/09/06 22:04:46 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\jerry\Desktop\aswMBR.exe
[2012/09/05 22:17:55 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\ERS Game Studios
[2012/09/05 21:58:12 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\MumboJumbo
[2012/09/05 21:48:02 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\GameDevo
[2012/09/03 19:07:56 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\Floodlight Games
[2012/09/03 19:07:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Floodlight Games
[2012/09/03 17:44:27 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\TOMI3
[2012/09/03 14:54:29 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Local\ElevatedDiagnostics
[2012/09/03 02:31:22 | 000,444,952 | ---- | C] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll
[2012/09/03 02:31:22 | 000,000,000 | ---D | C] -- C:\Program Files\OpenAL
[2012/08/29 22:20:11 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\PlayfulAge
[2012/08/28 08:29:56 | 000,000,000 | ---D | C] -- C:\Users\jerry\Desktop\sales tax con
[2012/08/26 16:33:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Big Fish Games
[2012/08/26 16:33:13 | 000,000,000 | ---D | C] -- C:\Program Files\bfgclient
[2012/08/26 16:24:58 | 000,000,000 | ---D | C] -- C:\BigFishGamesCache
[2012/08/13 16:40:54 | 000,176,096 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\avgidsdriverx.sys
[2012/08/11 20:07:11 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\Freezetag
[2012/08/11 14:50:03 | 000,000,000 | ---D | C] -- C:\Users\jerry\Documents\Legends1
[2012/08/10 20:39:01 | 000,000,000 | ---D | C] -- C:\Users\jerry\AppData\Roaming\V-Games
[2012/08/10 04:52:38 | 000,164,704 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys
[2012/08/10 04:52:36 | 000,089,440 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys
[2012/08/10 04:52:28 | 000,019,808 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\avgidsshimx.sys
[2012/08/10 04:52:18 | 000,035,168 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgrkx86.sys
[2012/08/09 13:56:44 | 000,178,656 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avglogx.sys
[2012/08/09 13:56:36 | 000,054,112 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\avgidshx.sys
[2012/08/09 13:56:22 | 000,151,520 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys

========== Files - Modified Within 30 Days ==========

[2012/09/08 00:27:55 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/08 00:27:55 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/08 00:24:58 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\jerry\Desktop\OTL.exe
[2012/09/08 00:24:17 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\jerry\Desktop\mbam-setup-1.62.0.1300.exe
[2012/09/08 00:03:38 | 001,378,816 | ---- | M] () -- C:\Users\jerry\Desktop\RogueKiller.exe
[2012/09/07 23:06:53 | 000,000,806 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2012/09/07 22:28:40 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/09/07 22:28:17 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2012/09/07 22:27:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/07 21:56:00 | 004,749,820 | R--- | M] (Swearware) -- C:\Users\jerry\Desktop\ComboFix.exe
[2012/09/07 21:09:31 | 010,901,120 | ---- | M] (OPSWAT, Inc.) -- C:\Users\jerry\Desktop\AppRemover.exe
[2012/09/06 22:59:47 | 000,083,148 | ---- | M] () -- C:\Windows\wininit.ini
[2012/09/06 22:58:32 | 000,003,016 | ---- | M] () -- C:\Windows\SA8.ini
[2012/09/06 22:58:32 | 000,001,601 | ---- | M] () -- C:\Users\jerry\Desktop\startup.sa8
[2012/09/06 22:58:32 | 000,000,421 | ---- | M] () -- C:\Windows\SA4_WKSP.INI
[2012/09/06 22:40:21 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\jerry\Desktop\dds.com
[2012/09/06 22:06:20 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\jerry\Desktop\aswMBR.exe
[2012/09/06 11:59:10 | 000,604,502 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/09/06 11:59:10 | 000,104,170 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/09/05 20:27:45 | 000,008,704 | ---- | M] () -- C:\Users\jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/05 07:18:05 | 000,000,002 | ---- | M] () -- C:\Windows\WindowsUpdatelog
[2012/09/03 02:31:22 | 000,444,952 | ---- | M] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll
[2012/08/26 16:34:15 | 000,000,732 | ---- | M] () -- C:\Users\Public\Desktop\Game Manager.lnk
[2012/08/26 16:34:15 | 000,000,225 | ---- | M] () -- C:\Users\Public\Desktop\More Great Games.url
[2012/08/20 10:14:33 | 000,001,062 | ---- | M] () -- C:\Users\jerry\Desktop\Get More Games at PlayFirst.com.lnk
[2012/08/20 10:14:33 | 000,000,860 | ---- | M] () -- C:\Users\jerry\Desktop\Diner Dash 2.lnk
[2012/08/20 10:13:44 | 000,000,850 | ---- | M] () -- C:\Users\jerry\Desktop\Diner Dash.lnk
[2012/08/13 16:40:54 | 000,176,096 | ---- | M] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\avgidsdriverx.sys
[2012/08/10 18:33:11 | 000,000,474 | ---- | M] () -- C:\Users\jerry\AppData\Roaming\wklnhst.dat
[2012/08/10 04:52:38 | 000,164,704 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys
[2012/08/10 04:52:36 | 000,089,440 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys
[2012/08/10 04:52:28 | 000,019,808 | ---- | M] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\avgidsshimx.sys
[2012/08/10 04:52:18 | 000,035,168 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgrkx86.sys
[2012/08/09 20:44:49 | 000,000,045 | ---- | M] () -- C:\Windows\SA4_DRAW.INI
[2012/08/09 13:56:44 | 000,178,656 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avglogx.sys
[2012/08/09 13:56:36 | 000,054,112 | ---- | M] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\avgidshx.sys
[2012/08/09 13:56:22 | 000,151,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys

========== Files Created - No Company Name ==========

[2012/09/08 00:03:27 | 001,378,816 | ---- | C] () -- C:\Users\jerry\Desktop\RogueKiller.exe
[2012/09/07 23:06:53 | 000,000,806 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2012/09/07 21:57:17 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/09/07 21:57:17 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/09/07 21:57:17 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/09/07 21:57:17 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/09/07 21:57:17 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/09/05 07:18:05 | 000,000,002 | ---- | C] () -- C:\Windows\WindowsUpdatelog
[2012/08/26 16:34:15 | 000,000,732 | ---- | C] () -- C:\Users\Public\Desktop\Game Manager.lnk
[2012/08/26 16:34:15 | 000,000,225 | ---- | C] () -- C:\Users\Public\Desktop\More Great Games.url
[2012/08/26 16:33:16 | 000,001,676 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Manager.lnk
[2012/08/26 16:33:16 | 000,001,184 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\More Great Games.lnk
[2012/08/20 10:14:33 | 000,000,860 | ---- | C] () -- C:\Users\jerry\Desktop\Diner Dash 2.lnk
[2012/08/20 10:13:44 | 000,001,062 | ---- | C] () -- C:\Users\jerry\Desktop\Get More Games at PlayFirst.com.lnk
[2012/08/20 10:13:44 | 000,000,850 | ---- | C] () -- C:\Users\jerry\Desktop\Diner Dash.lnk
[2011/10/31 11:28:15 | 000,000,474 | ---- | C] () -- C:\Users\jerry\AppData\Roaming\wklnhst.dat
[2011/06/23 08:41:36 | 000,115,369 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2011/06/23 08:41:36 | 000,097,859 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2011/03/22 22:51:35 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/10/25 13:45:06 | 000,098,136 | ---- | C] () -- C:\Windows\gzip.exe
[2010/02/15 16:27:21 | 000,001,356 | ---- | C] () -- C:\Users\jerry\AppData\Local\d3d9caps.dat
[2009/07/29 11:51:28 | 000,003,762 | ---- | C] () -- C:\Users\jerry\profiles.xml
[2009/06/07 14:52:25 | 000,003,840 | ---- | C] () -- C:\Users\jerry\AppData\Local\slot1.mm1
[2009/02/03 23:44:41 | 000,008,704 | ---- | C] () -- C:\Users\jerry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== LOP Check ==========

[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Acer GameZone Console
[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Acer GameZone Console
[2009/09/20 21:54:38 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Abra Academy2
[2009/02/01 06:49:37 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Acer
[2008/12/04 08:57:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Acer GameZone Console
[2009/09/13 15:11:27 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Aisle 5 Games, Inc
[2009/10/08 20:39:37 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Alawar
[2009/09/01 21:21:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Alterlab
[2009/08/21 15:30:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Amaranth Games
[2012/02/02 23:02:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Anabel
[2012/02/28 11:20:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Artifex Mundi
[2009/09/27 23:26:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Artogon
[2012/09/07 23:08:02 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\AVG2013
[2009/11/11 00:21:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BeachPartyCraze
[2012/08/26 19:20:27 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Big Fish Games
[2009/07/17 22:08:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BlamGames
[2009/07/27 13:06:26 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\blg
[2009/11/18 21:07:20 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Blitware
[2009/09/20 23:13:02 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BloodTies
[2009/07/20 21:12:42 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Boolat Games
[2012/02/12 16:58:26 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Boomzap
[2009/06/18 20:49:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\BrandX Games
[2009/07/17 16:31:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Camel101
[2012/07/23 22:54:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Canneverbe Limited
[2011/11/21 20:55:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Catalina Marketing Corp
[2012/02/13 01:30:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\cerasus.media
[2009/08/11 15:04:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Chicken Chase
[2009/02/22 14:46:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Coyotes Tale
[2011/05/24 15:50:57 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\CupcakeCafe
[2012/08/27 17:12:50 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\EleFun Games
[2012/02/21 22:06:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ElementalsTheMagicKey
[2009/08/02 22:50:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enchanted Katya
[2009/09/10 14:06:28 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enlightenus
[2012/02/28 12:22:41 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Enlightenus_Real
[2012/09/05 22:17:55 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ERS Game Studios
[2009/06/25 15:55:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Fabulous Finds
[2009/07/30 16:07:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Fever Frenzy
[2012/01/26 23:11:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Flood Light Games
[2012/09/03 19:07:56 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Floodlight Games
[2009/03/23 22:20:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FloodLightGames
[2012/01/20 20:39:21 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FlyWheelGames
[2009/04/01 12:11:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ForgottenRiddles2
[2012/08/11 20:07:11 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Freezetag
[2009/04/01 12:42:00 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Friday's games
[2009/07/24 16:04:36 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FrimaStudio
[2011/06/02 12:19:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\FrostWire
[2009/08/12 23:49:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gaijin Ent
[2012/09/05 21:48:02 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameDevo
[2012/02/11 22:01:25 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameHouse
[2012/08/08 21:49:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameHousev1002
[2012/02/21 20:49:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GameInvest
[2009/08/04 15:34:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gamelab
[2009/09/15 15:54:44 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Games
[2009/04/13 19:33:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GamesCafe
[2009/09/02 20:01:10 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Go-Go Gourmet Chef of the Year
[2012/03/04 12:40:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gogii
[2009/07/05 14:36:25 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gogii Games
[2009/06/25 22:17:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Gold Casual Games
[2009/08/15 23:04:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\GraveyardShift
[2009/09/27 13:48:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\HSA
[2009/07/18 22:07:19 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\HuruBeachParty
[2009/12/16 21:14:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\InterVideo
[2009/06/25 20:05:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ITTNord
[2009/10/15 12:21:05 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\iWin
[2012/05/20 21:23:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\iWing
[2009/08/05 15:50:41 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel
[2009/10/06 22:13:13 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel Family Hero
[2011/02/10 21:00:39 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jane s Hotel 3
[2009/03/25 12:01:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Jetsetter
[2010/06/20 22:18:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\KewlBoxPrefs
[2012/02/06 08:18:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\KranX Productions
[2009/02/01 06:49:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Leadertech
[2009/07/17 23:08:47 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ludia
[2009/09/10 15:22:08 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MA
[2009/03/25 14:58:45 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Magic Academy
[2011/07/08 01:38:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\margrave3_full
[2009/07/19 00:52:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Mean Hamster
[2009/07/26 21:46:27 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MegaplexMadnessSummerBlockbuster
[2009/07/18 19:46:04 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Meridian93
[2012/02/12 15:36:04 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Merscom
[2011/06/01 15:25:53 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\mjusbsp
[2012/09/05 21:58:12 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MumboJumbo
[2009/08/06 23:40:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\My Games
[2010/07/24 09:50:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\MysteryStudio
[2010/03/14 21:16:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Mysteryville2
[2010/06/20 23:17:03 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Namco
[2009/09/01 23:38:48 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberon
[2009/08/19 12:29:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberon Games
[2009/03/22 14:31:59 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1001
[2009/06/08 15:44:42 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1002
[2009/06/24 23:21:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Oberonv1005
[2009/10/19 13:06:07 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ohana Games
[2012/01/15 14:06:07 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\OpenCandy
[2011/06/30 06:52:00 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Paige Harper and the Tome of Mystery
[2009/07/02 22:42:07 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\panoramik
[2010/10/18 19:14:22 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PetsFunHouse
[2009/08/06 16:55:59 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PetShowCraze
[2012/02/16 23:24:17 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Ph03nixNewMedia
[2009/08/17 17:15:23 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Pi

dodopie · 2012/09/07

here is the rest of the first log, it said it was to big
Eye Games
[2012/09/02 21:14:36 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PlayFirst
[2009/06/17 15:52:57 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Playrix Entertainment
[2012/02/13 00:16:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PoBros
[2009/08/10 22:15:08 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Pogo Games
[2012/04/15 13:28:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\PokerCreations
[2009/09/10 22:33:30 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Princess Isabella
[2012/02/20 15:11:43 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\QB9
[2009/04/04 20:59:46 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Reflexivev1001
[2009/03/21 13:29:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoe
[2009/06/06 23:52:37 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoeOM
[2012/01/30 12:42:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\RobinsonCrusoeRA
[2009/07/26 19:34:56 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Sandlot Games
[2009/03/30 14:27:32 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SecretIslandEng
[2009/08/15 23:10:29 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Shape games
[2012/02/20 11:35:05 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ShinyTales
[2009/10/07 19:08:51 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Shockwave_DressUpRush
[2012/02/27 13:56:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Silverback Productions
[2009/09/23 10:45:58 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Skunk Studios
[2009/02/21 16:15:02 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SpinTop
[2012/02/21 11:08:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SpinTop Games
[2012/02/19 16:54:09 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\SulusGames
[2012/01/31 20:40:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TeleportGamesLtd
[2011/10/31 11:30:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Template
[2009/03/30 06:38:49 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TheScruffs
[2012/01/19 18:00:51 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TitanicMystery
[2012/09/03 17:45:18 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TOMI3
[2012/02/20 16:39:35 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Total Eclipse
[2012/09/07 23:06:53 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\TuneUp Software
[2009/07/23 09:04:33 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\UClick
[2009/03/29 14:43:24 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\URSE Games
[2012/08/10 20:39:01 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\V-Games
[2012/02/26 13:27:15 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Valusoft
[2011/07/03 02:36:41 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\VampireSaga
[2011/05/19 21:53:06 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Vasilek Games
[2009/07/31 19:38:40 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ViquaSoft
[2009/06/09 21:56:26 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\VisualShape
[2009/11/09 22:30:28 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Wild Tangent
[2012/07/25 21:41:19 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\WildTangent
[2009/07/30 09:16:34 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\World-LooM
[2009/06/18 07:42:52 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\Yatec Games
[2009/07/24 15:58:40 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\YoudaGames
[2011/01/12 22:55:47 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ZEN
[2012/05/28 21:54:31 | 000,000,000 | ---D | M] -- C:\Users\jerry\AppData\Roaming\ZEN Entertainment
[2012/09/07 22:26:38 | 000,032,618 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP507B5A8
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:961B84C5
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:A6F30843
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:27A88EF2
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:F5B51004
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:1316EAD4
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:2E3F04BC
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:A02025CE
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:4B244549
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:6247E766
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:C43C957E
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:AE2EA3C2
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:96646EC1
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:FBD274CF
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:93226FE3
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:439E3411
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:7B52659E
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:A774141A
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:80B291A7
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:BBF60A29
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:B722BCE5
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:1F67CD26
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:177313FB
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:067F588D
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:554C6431
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:386B39C3
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:5FA4CB99
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:56C17A93
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:61AF2B29
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:E32966C0
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:6FDE1666

< End of report >

dodopie · 2012/09/07

OTL Extras logfile created on: 9/8/2012 12:25:26 AM - Run 1
OTL by OldTimer - Version 3.2.61.2 Folder = C:\Users\jerry\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.57 Gb Available Physical Memory | 57.21% Memory free
5.73 Gb Paging File | 4.23 Gb Available in Paging File | 73.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.52 Gb Total Space | 29.28 Gb Free Space | 42.12% Space Free | Partition Type: NTFS
Drive D: | 69.52 Gb Total Space | 69.42 Gb Free Space | 99.85% Space Free | Partition Type: NTFS
Drive E: | 640.76 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: JERRY-PC | User Name: jerry | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{0D724243-6AAA-499C-ACFE-9C47B6BFE628}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{497D9907-71E2-4134-B7AD-53E2C1938F0B}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{4D785AA1-5056-4B04-B6D4-FA58339BD01F}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{64A4029B-363A-4DB7-8037-94C78F918292}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6A6C4174-71B2-4C6B-892E-BBB868487611}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8F532E8F-51EB-49C2-85DE-CCB092126219}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B11C1288-D447-44BF-8A8C-7FB70D0D03C5}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E4D05488-8F18-42C1-B68D-4144DBA54E5F}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{5B2566AC-5798-4054-9000-0ED41E363F2D}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{DBDC1E2C-EDDC-43EA-A3A4-3F88DFD26B36}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00030409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Small Business
"{071EA6A1-4189-3D9C-6B3F-0BE15495CE80}" = Catalyst Control Center Core Implementation
"{08137BF5-9879-EBDA-6462-79D3C6D113B2}" = Catalyst Control Center Localization Portuguese
"{09621381-D4B0-2D6A-AB14-E8CE4CD424D9}" = Catalyst Control Center Graphics Previews Vista
"{09D3675D-E1BB-1B3D-3F35-0338F7AAB0FD}" = Catalyst Control Center Localization Czech
"{0AD63C23-3DE8-82FF-4DF2-BDD0784F3348}" = Diamond Detective
"{0EC7C406-B592-4686-BAC1-AD29A85EAE6A}" = HP Driver Diagnostics
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series" = Canon MP280 series MP Drivers
"{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1DE63D16-8A5E-74AB-1A5F-6E1834234229}" = CCC Help Chinese Standard
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"{23697393-E392-4FFA-B8EF-193B5569C0B2}" = AVG 2013
"{254C0471-5FDF-D591-1219-112ABECED882}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{285432CE-2033-7317-27FC-DFB027E24F33}" = Catalyst Control Center Localization French
"{29E1DB75-A926-D7A5-6773-E24477526D49}" = CCC Help Chinese Traditional
"{2B82EEF1-A86E-CE6A-E7E6-ED114131E383}" = Catalyst Control Center Graphics Full New
"{2F3FC1A5-37B4-7685-7295-37FD1B3FE806}" = CCC Help Danish
"{32EBA2B9-23F8-82A8-E229-0F283EE902B0}" = CCC Help Portuguese
"{3A2536D9-53FF-CD79-F46C-9E3902D2EEBA}" = CCC Help English
"{3A6CE5E6-7416-37A1-1DA2-2BCB0A9CF444}" = Catalyst Control Center Localization Japanese
"{3A7D9B34-E8A9-A352-20C1-0607B1D5F8B6}" = Catalyst Control Center Localization Chinese Traditional
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F9544A3-63B0-E523-D212-5C010368E492}" = Catalyst Control Center Localization Spanish
"{41802C9A-1BF6-9A4E-D903-C6587560D758}" = Catalyst Control Center Localization Chinese Standard
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5339885F-4597-4343-BD3B-74280CC79424}" = ArcSoft VideoImpression 2
"{553C904F-57A2-4113-888E-BA0C3D1C69C0}" = Microsoft VC9 runtime libraries
"{58D9BD9C-C96F-F308-5D72-371A9D3CC939}" = CCC Help Dutch
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6165BE73-8AC5-A2B6-8910-963387FE5B9B}" = Catalyst Control Center Localization Russian
"{6190B8CA-366D-A8E1-9976-7EE50B7DC39E}" = Aloha Solitaire
"{67A8747E-0517-75EF-244F-9E219C440107}" = ATI Catalyst Install Manager
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6A25BA91-82D1-0841-FC65-57CE27540922}" = Catalyst Control Center Localization Danish
"{6A41CE62-8379-2A4D-E690-AA5D4DA8A279}" = ccc-core-static
"{6BB99DE2-D79C-B223-8D4F-E3D80A478D0F}" = CCC Help Polish
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6E52D2FB-5FB5-334E-86F9-4316EEDC2926}" = ccc-utility
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72BBB36F-D323-0746-4F92-083E4C5EAC52}" = CCC Help Czech
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7DDF474C-2AF9-4A3B-57E0-FBF31ED2C913}" = Catalyst Control Center Localization Polish
"{7DE2E198-17B2-4E2D-A884-1603CD32FD38}" = AVG 2013
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E992D2F-5D9F-0A2A-302E-E4AC8FB79F47}" = Catalyst Control Center Graphics Full Existing
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{822B325F-9CDD-4E78-87A2-35E6F0DDEEA2}" = HP Deskjet 1000 J110 series Product Improvement Study
"{83d96ed0-98aa-4515-8ddc-816f3efdd104}" = MyDSC2
"{84DB8DAE-531B-FDA4-E683-8C82F0F81F26}" = Catalyst Control Center Localization Turkish
"{865A7423-1322-E68E-4604-BEB0EEBFB624}" = Catalyst Control Center Localization Norwegian
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9B35344F-7FA4-B6BA-E64B-930A5BDB9585}" = Catalyst Control Center InstallProxy
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FFC6670-6711-387B-3566-7D0DA1808531}" = CCC Help Swedish
"{A8176277-4272-EA16-CDAE-1E37C62E14B2}" = CCC Help Italian
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A9E38025-D8D8-FB5E-0DDB-12691243EF1F}" = CCC Help Norwegian
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.4)
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AFE52E73-FADF-7AEC-9F2E-9C490C77AB61}" = Catalyst Control Center Localization German
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B16469A5-D2FA-A0C8-D371-2F4C8D5707D4}" = CCC Help Finnish
"{B463846D-85B8-5B31-59BD-AA68307ECC69}" = CCC Help Spanish
"{B483D67F-8223-F1C5-1CBD-59B13676019E}" = CCC Help Greek
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7BA5747-159E-B1E7-B73D-E3B7575D783A}" = CCC Help Thai
"{BC4FBC02-B2B7-ACCA-C983-FFF31FC3C1C9}" = CCC Help Japanese
"{C08B098D-E9A6-649F-120D-9263C0527C2E}" = Catalyst Control Center Localization Swedish
"{C0DA129B-1E45-494D-A362-5CD0109C306B}" = WOT for Internet Explorer
"{C22EDAB3-B9C3-3189-6FE5-8DC4CFADED81}" = CCC Help Hungarian
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C4FA4F86-63E8-9CD5-8CD3-25E4AC0E8861}" = Catalyst Control Center Localization Finnish
"{C63225DD-4956-D968-E563-30371AA23FD8}" = Skins
"{C7D5F833-4603-B3A3-4DB7-178022D73CC6}" = Catalyst Control Center Localization Dutch
"{CC4AD2ED-C8C8-6548-BAB0-59058B3FA658}" = Catalyst Control Center Localization Greek
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{D04DA284-0680-277B-832E-B795D9302F8D}" = CCC Help Turkish
"{D5B90069-DC5F-E482-D86A-B0CBBBD0E50E}" = CCC Help Russian
"{D9029DA7-CFA1-AC76-018D-AE0E596374D5}" = Cradle of Persia
"{DABF43D9-1104-4764-927B-5BED1274A3B0}" = Runtime
"{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}" = HP Deskjet 1000 J110 series Help
"{DF7A3C71-08FD-9154-BF1C-81BC491F4C2C}" = CCC Help French
"{E03CD71A-F595-49DF-9ADC-0CFC93B1B211}" = PlayMemories Home
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{EA78289C-35D1-10D4-CA0D-7C653B2E212A}" = Catalyst Control Center Localization Hungarian
"{EAE06CC6-8838-CA77-347C-BD3E9DEC6C93}" = Catalyst Control Center Localization Italian
"{EB18E9CE-A633-1192-BDF6-4EA15DA97785}" = Catalyst Control Center Graphics Light
"{ECA47E2A-51B0-2F2F-67D3-A2A0639092B1}" = Catalyst Control Center Localization Korean
"{ED5085E1-BA8E-1464-2E3D-400086526EDE}" = Catalyst Control Center Localization Thai
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F4B1B985-F308-4DBA-BFD7-CCCB8839234B}" = HP Deskjet 1000 J110 series Basic Device Software
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFA58E6D-8053-18D7-C9BB-C76312C1E12C}" = CCC Help Korean
"1902fd36d1b6378187f66cc6d404038c" = The Conjurer
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ATT-PRT22" = ATT-PRT22
"AVG" = AVG 2013
"BellSouth" = BellSouth FastAccess DSL Help Center
"BFGC" = Big Fish Games: Game Manager
"Canon MP280 series User Registration" = Canon MP280 series User Registration
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"Diner Dash" = Diner Dash
"Diner Dash 2" = Diner Dash 2
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"ESET Online Scanner" = ESET Online Scanner v3
"HP Photo Creations" = HP Photo Creations
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"Intuit SiteBuilder" = Intuit SiteBuilder
"LManager" = Launch Manager
"Micro Innovations Optical Scroll Mouse" = Micro Innovations Optical Scroll Mouse
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"Mystery P.I. - The Vegas Heist" = Mystery P.I. - The Vegas Heist (remove only)
"OpenAL" = OpenAL
"Secunia PSI" = Secunia PSI (3.0.0.2004)
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SoftwareUpdUtility" = Download Updater (AOL Inc.)
"Street Atlas USA 8.0" = Street Atlas USA 8.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1182583647-3259410284-1344731716-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ZEN Entertainment" = ZEN Entertainment

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 11/18/2011 10:07:53 AM | Computer Name = jerry-PC | Source = Application Hang | ID = 1002
Description = The program Ribbons.scr version 6.0.6001.18000 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 14a0 Start Time: 01cca5fb4fb77820 Termination Time: 11071

Error - 11/18/2011 11:20:57 PM | Computer Name = jerry-PC | Source = WinMgmt | ID = 10
Description =

Error - 11/21/2011 2:32:36 PM | Computer Name = jerry-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 9.0.8112.16421, time stamp
0x4d76255d, faulting module ntdll.dll, version 6.0.6002.18327, time stamp 0x4cb73436,
exception code 0xc0000005, fault offset 0x00065f4f, process id 0x17f8, application
start time 0x01cca8457f84d010.

Error - 11/26/2011 10:01:20 PM | Computer Name = jerry-PC | Source = WinMgmt | ID = 10
Description =

Error - 11/30/2011 3:09:54 AM | Computer Name = jerry-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16421 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 178c Start Time: 01ccaeeef18ee8d0 Termination Time: 297

Error - 11/30/2011 6:43:47 AM | Computer Name = jerry-PC | Source = EventSystem | ID = 4621
Description =

Error - 11/30/2011 6:45:52 AM | Computer Name = jerry-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/2/2011 3:19:21 PM | Computer Name = jerry-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/5/2011 4:45:25 PM | Computer Name = jerry-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16421 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 15ec Start Time: 01ccb38461f3b3f0 Termination Time: 94

Error - 12/15/2011 12:10:05 AM | Computer Name = jerry-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/15/2011 4:24:54 AM | Computer Name = jerry-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 2/1/2009 7:36:19 AM | Computer Name = jerry-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

< End of report >

broni · 2012/09/07

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:D507B5A8
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:961B84C5
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:A6F30843
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:27A88EF2
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:F5B51004
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:1316EAD4
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:2E3F04BC
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:A02025CE
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:4B244549
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:6247E766
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:C43C957E
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:AE2EA3C2
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:96646EC1
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:FBD274CF
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:93226FE3
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:439E3411
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:7B52659E
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:A774141A
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:80B291A7
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:BBF60A29
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:B722BCE5
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:1F67CD26
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:177313FB
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:067F588D
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:554C6431
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:386B39C3
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:5FA4CB99
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:56C17A93
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:61AF2B29
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:E32966C0
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:6FDE1666

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

=================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services

Windows Firewall

System Restore

Security Center

Windows Update

Windows Defender

Press "Scan ".

It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

3. Please download AdwCleaner by Xplode onto your desktop.

Double click on AdwCleaner.exe to run the tool.

Click on Search.

A logfile will automatically open after the scan has finished.

Please post the contents of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[R1].txt as well.

4. Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

5. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, click on List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

dodopie · 2012/09/08

All processes killed
========== OTL ==========
ADS C:\ProgramData\TEMP507B5A8 deleted successfully.
ADS C:\ProgramData\TEMP:961B84C5 deleted successfully.
ADS C:\ProgramData\TEMP:A6F30843 deleted successfully.
ADS C:\ProgramData\TEMP:27A88EF2 deleted successfully.
ADS C:\ProgramData\TEMP:F5B51004 deleted successfully.
ADS C:\ProgramData\TEMP:1316EAD4 deleted successfully.
ADS C:\ProgramData\TEMP:2E3F04BC deleted successfully.
ADS C:\ProgramData\TEMP:A02025CE deleted successfully.
ADS C:\ProgramData\TEMP:4B244549 deleted successfully.
ADS C:\ProgramData\TEMP:6247E766 deleted successfully.
ADS C:\ProgramData\TEMP:C43C957E deleted successfully.
ADS C:\ProgramData\TEMP:AE2EA3C2 deleted successfully.
ADS C:\ProgramData\TEMP:96646EC1 deleted successfully.
ADS C:\ProgramData\TEMP:FBD274CF deleted successfully.
ADS C:\ProgramData\TEMP:93226FE3 deleted successfully.
ADS C:\ProgramData\TEMP:439E3411 deleted successfully.
ADS C:\ProgramData\TEMP:7B52659E deleted successfully.
ADS C:\ProgramData\TEMP:A774141A deleted successfully.
ADS C:\ProgramData\TEMP:80B291A7 deleted successfully.
ADS C:\ProgramData\TEMP:BBF60A29 deleted successfully.
ADS C:\ProgramData\TEMP:B722BCE5 deleted successfully.
ADS C:\ProgramData\TEMP:1F67CD26 deleted successfully.
ADS C:\ProgramData\TEMP:177313FB deleted successfully.
ADS C:\ProgramData\TEMP:067F588D deleted successfully.
ADS C:\ProgramData\TEMP:554C6431 deleted successfully.
ADS C:\ProgramData\TEMP:386B39C3 deleted successfully.
ADS C:\ProgramData\TEMP:5FA4CB99 deleted successfully.
ADS C:\ProgramData\TEMP:56C17A93 deleted successfully.
ADS C:\ProgramData\TEMP:61AF2B29 deleted successfully.
ADS C:\ProgramData\TEMP:E32966C0 deleted successfully.
ADS C:\ProgramData\TEMP:6FDE1666 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56468 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: jerry
->Temp folder emptied: 1771705 bytes
->Temporary Internet Files folder emptied: 284073048 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 536 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 96 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 273.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: jerry
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: jerry
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.61.2 log created on 09082012_060901

Files\Folders moved on Reboot...
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KUDOZAZY\ddc[2].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KUDOZAZY\visitormatch[1].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IYBDDCAB\xd_arbiter[2].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CZRXN0K2\context_sync[2].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CZRXN0K2\cse[2].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8GU53D8V\ddc[1].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8GU53D8V\pixel[2].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6HTZPLMJ\audmeasure[1].gif moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6HTZPLMJ\fastbutton[5].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6HTZPLMJ\p-01-0VIaSjnOLg[3].gif moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4QCWDJEA\like[9].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4QCWDJEA\xd_arbiter[1].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\14DAEJZX\103548-active-windows-update-not-working-2[1].htm moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2PML818P\i[1] moved successfully.
C:\Users\jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2PML818P\welcome-screen[1].htm moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

dodopie · 2012/09/08

Results of screen317's Security Check version 0.99.50
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG Anti-Virus Free Edition 2013
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
SUPERAntiSpyware
Secunia PSI (3.0.0.2004)
Java(TM) 6 Update 31
Java version out of Date!
Adobe Flash Player 9 Flash Player out of Date!
Adobe Flash Player 11.2.202.235
Adobe Reader 9 Adobe Reader out of Date!
Adobe Reader X (10.1.4)
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1 %
````````````````````End of Log``````````````````````

dodopie · 2012/09/08

Farbar Service Scanner Version: 06-08-2012
Ran by jerry (administrator) on 08-09-2012 at 06:52:19
Running from "C:\Users\jerry\Desktop "
Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware "=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

dodopie · 2012/09/08

i cant download adwcleaner, it says its unsafe

broni · 2012/09/08

Ignore that warning or disable AVG momentarily.

dodopie · 2012/09/08

it says this download was blocked by smartscreen filter, it wont download

dodopie · 2012/09/08

ok got it done

# AdwCleaner v2.000 - Logfile created 09/08/2012 at 13:33:10
# Updated 30/08/2012 by Xplode
# Operating system : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# User : jerry - JERRY-PC
# Boot Mode : Normal
# Running from : C:\Users\jerry\Desktop\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Found : C:\Program Files\Common Files\Software Update Utility
Folder Found : C:\Program Files\Trymedia
Folder Found : C:\ProgramData\GamesBar
Folder Found : C:\ProgramData\Trymedia
Folder Found : C:\ProgramData\WeCareReminder
Folder Found : C:\Users\jerry\AppData\Local\OpenCandy
Folder Found : C:\Users\jerry\AppData\LocalLow\FunWebProducts
Folder Found : C:\Users\jerry\AppData\LocalLow\MyWebSearch
Folder Found : C:\Users\jerry\AppData\Roaming\OpenCandy

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}
Key Found : HKCU\Software\AppDataLow\Software\Fun Web Products
Key Found : HKCU\Software\AppDataLow\Software\FunWebProducts
Key Found : HKCU\Software\AppDataLow\Software\Media Access Startup
Key Found : HKCU\Software\AppDataLow\Software\MyWebSearch
Key Found : HKCU\Software\IGearSettings
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\mywebsearch bar uninstall
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Found : HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKU\S-1-5-21-1182583647-3259410284-1344731716-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - SearchAssistant] = hxxp://toolbar.inbox.com/search/ie.aspx?tbid=80227
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - CustomizeSearch] = hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80227

-\\ Google Chrome v [Unable to get version]

File : C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [4654 octets] - [08/09/2012 13:33:10]

########## EOF - C:\AdwCleaner[R1].txt - [4714 octets] ##########

broni · 2012/09/08

One of the reasons I really dislike AVG. It wants to block everything...grrrrrrrrrrr

Uploaded the file for you here: http://www.filedropper.com/adwcleaner

broni · 2012/09/08

OK. Go on...

dodopie · 2012/09/08

is it ok to surf around while this scan is running?

broni · 2012/09/08

Yes..

dodopie · 2012/09/08

so what would be the best free antivirus to use instead of avg? the eset scan is still running and it looks like its found 8 trojan so far...........i guess avg didnt stop or block or find them?

broni · 2012/09/08

I can't comment before seeing Eset's log.
Most likely it'll find some leftovers.

AVG alternatives:
- Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
- free Microsoft Security Essentials: http://windows.microsoft.com/en-GB/windows/products/security-essentials
- free Comodo Antivirus: http://www.comodo.com/home/internet-security/antivirus.php

dodopie · 2012/09/08

C:\TDSSKiller_Quarantine\19.07.2012_05.35.20\rtkt0000\zafs0000\tsk0006.dta Win32/Conedex.D trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\19.07.2012_05.35.20\rtkt0000\zafs0000\tsk0008.dta Win32/Conedex.E trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\24.07.2012_18.49.15\rtkt0000\svc0000\tsk0000.dta Win32/Sirefef.DA trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\24.07.2012_18.49.15\rtkt0000\zafs0000\tsk0001.dta Win32/Sirefef.EZ trojan deleted - quarantined
C:\TDSSKiller_Quarantine\24.07.2012_18.49.15\rtkt0000\zafs0000\tsk0005.dta Win32/Conedex.D trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\24.07.2012_18.49.15\rtkt0000\zafs0000\tsk0007.dta Win32/Conedex.E trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\24.07.2012_18.49.15\rtkt0000\zafs0000\tsk0008.dta a variant of Win32/Sirefef.FA trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\24.07.2012_18.49.15\rtkt0000\zafs0000\tsk0009.dta Win32/Sirefef.FD trojan cleaned by deleting - quarantined

Log in or Sign up

Solved Windows Update not working

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

Share This Page

Log in or Sign up

Solved Windows Update not working

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

broni Moderator Malware Analyst

dodopie Well-Known Member Thread Starter

Share This Page

Useful Searches