redirected to Buzqo

Description of your problems:
After downloading a youtube plugin from cnet, I am sometimes redirected to a site called Buzqo.com. I heard this was a spyware/virus. I ran superantispyware, avast, and malwarebytes, but none of them reported anything. So I am not even sure that there is anything wrong, but just to be on the safe side, I would appreciate you guys checking it out. Thanks.


DDS logs:
.
DDS (Ver_2011-06-23.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_26
Run by [removed] at 19:06:30 on 2011-08-24
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3835.2208 [GMT -7:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
svchost.exe
C:\Windows\Explorer.EXE
svchost.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe
C:\Program Files (x86)\WordWeb\wweb32.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe
C:\Program Files (x86)\Launch Manager\LManager.exe
svchost.exe
C:\Program Files (x86)\Video Web Camera\traybar.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
C:\Program Files (x86)\Launch Manager\LMworker.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
svchost.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
svchost.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Jam Master Nell\AppData\Local\Temp\install_flashplayer10_mssd_aih.exe
C:\Windows\system32\SearchFilterHost.exe
svchost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.com/
uDefault_Page_URL = hxxp://www.bing.com/?pc=MAGW
mDefault_Page_URL = hxxp://www.bing.com/?pc=MAGW
mStart Page = hxxp://www.bing.com/?pc=MAGW
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Best Buy pc app] C:\Users\Jam Master Nell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Best Buy\Best Buy pc app.appref-ms
uRun: [WordWeb] "C:\Program Files (x86)\WordWeb\wweb32.exe" -startup
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" -h -k
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun: [Camera Assistant Software] "C:\Program Files (x86)\Video Web Camera\traybar.exe"
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
StartupFolder: C:\Users\JAMMAS~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Free YouTube Download - C:\Users\Jam Master Nell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - C:\Users\Jam Master Nell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E609B3A7-E5F9-472E-9E5A-5446562C72A8} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E609B3A7-E5F9-472E-9E5A-5446562C72A8}\2375942554931363 : DhcpNameServer = 192.168.1.254
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [PLFSetI] C:\Windows\PLFSetI.exe
mRun-x64: [Acer ePower Management] C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe
Hosts: 127.0.0.1 http://www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Jam Master Nell\AppData\Roaming\Mozilla\Firefox\Profiles\kznwsx1k.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - hxxp://www.buzqo.com/s/?src=addrbar&pro ... x64-SP1&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-7-18 140672]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-7-5 42184]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664]
R2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-2-22 321104]
R2 ePowerSvc;Acer ePower Service;C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe [2011-3-10 867712]
R2 GREGService;GREGService;C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe [2010-1-8 23584]
R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [2010-6-28 255744]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atipmdag.sys --> C:\Windows\system32\DRIVERS\atipmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]
R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]
R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]
R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]
R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
.
=============== Created Last 30 ================
.
2011-08-25 02:03:28 -------- d-----w- C:\Users\Jam Master Nell\AppData\Local\Solid State Networks
2011-08-23 15:41:22 8862544 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{912CB204-010F-4BE4-ADDA-F85A01897C12}\mpengine.dll
2011-08-21 07:31:00 -------- d-----w- C:\Users\Jam Master Nell\AppData\Roaming\SUPERAntiSpyware.com
2011-08-21 07:30:44 -------- d-----w- C:\ProgramData\!SASCORE
2011-08-21 07:30:41 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2011-08-21 07:30:41 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2011-08-12 22:18:43 -------- d-----w- C:\Users\Jam Master Nell\AppData\Local\Microsoft Help
2011-08-11 03:28:39 -------- d-sh--w- C:\Windows\System32\%APPDATA%
2011-08-10 23:28:59 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2011-08-10 23:28:58 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-08-10 23:28:57 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2011-08-10 05:52:29 625736 ----a-w- C:\Program Files (x86)\Common Files\ZugoInstaller.exe
2011-07-31 22:08:55 -------- d-----w- C:\Program Files\iPod
2011-07-31 22:08:54 -------- d-----w- C:\Program Files\iTunes
2011-07-31 22:08:54 -------- d-----w- C:\Program Files (x86)\iTunes
2011-07-31 22:07:27 -------- d-----w- C:\Program Files\Bonjour
2011-07-31 22:07:27 -------- d-----w- C:\Program Files (x86)\Bonjour
.
==================== Find3M ====================
.
2011-08-13 03:15:22 403616 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-22 05:22:26 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-07-22 04:54:18 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-07-16 05:41:50 362496 ----a-w- C:\Windows\System32\wow64win.dll
2011-07-16 05:41:49 243200 ----a-w- C:\Windows\System32\wow64.dll
2011-07-16 05:41:49 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2011-07-16 05:39:10 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
2011-07-16 05:37:12 421888 ----a-w- C:\Windows\System32\KernelBase.dll
2011-07-16 04:29:19 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2011-07-16 04:26:00 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2011-07-16 04:25:37 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2011-07-16 04:24:23 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2011-07-16 04:24:22 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2011-07-16 02:21:44 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2011-07-16 02:21:41 2048 ----a-w- C:\Windows\SysWow64\user.exe
2011-07-16 02:17:19 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:17:19 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:17:19 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:17:19 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2011-07-12 18:34:00 96104 ----a-w- C:\Windows\System32\dns-sd.exe
2011-07-12 18:34:00 85864 ----a-w- C:\Windows\System32\dnssd.dll
2011-07-12 18:34:00 61288 ----a-w- C:\Windows\System32\jdns_sd.dll
2011-07-12 18:34:00 212840 ----a-w- C:\Windows\System32\dnssdX.dll
2011-07-12 18:20:54 83816 ----a-w- C:\Windows\SysWow64\dns-sd.exe
2011-07-12 18:20:54 73064 ----a-w- C:\Windows\SysWow64\dnssd.dll
2011-07-12 18:20:54 50536 ----a-w- C:\Windows\SysWow64\jdns_sd.dll
2011-07-12 18:20:54 178536 ----a-w- C:\Windows\SysWow64\dnssdX.dll
2011-07-09 02:46:28 288768 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2011-07-07 02:52:42 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-07 02:52:42 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-07-04 11:43:53 40112 ----a-w- C:\Windows\avastSS.scr
2011-07-04 11:36:56 600920 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-07-04 11:32:24 64856 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-06-24 05:34:53 214528 ----a-w- C:\Windows\System32\winsrv.dll
2011-06-24 05:25:49 338432 ----a-w- C:\Windows\System32\conhost.exe
2011-06-21 06:34:00 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2011-06-21 06:20:53 1188864 ----a-w- C:\Windows\System32\wininet.dll
2011-06-21 05:28:33 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-06-15 10:02:23 212992 ----a-w- C:\Windows\System32\odbctrac.dll
2011-06-15 10:02:23 163840 ----a-w- C:\Windows\System32\odbccp32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\Windows\System32\odbccu32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\Windows\System32\odbccr32.dll
2011-06-15 08:55:19 86016 ----a-w- C:\Windows\SysWow64\odbccu32.dll
2011-06-15 08:55:19 81920 ----a-w- C:\Windows\SysWow64\odbccr32.dll
2011-06-15 08:55:19 319488 ----a-w- C:\Windows\SysWow64\odbcjt32.dll
2011-06-15 08:55:19 163840 ----a-w- C:\Windows\SysWow64\odbctrac.dll
2011-06-15 08:55:19 122880 ----a-w- C:\Windows\SysWow64\odbccp32.dll
2011-06-11 03:07:25 3137536 ----a-w- C:\Windows\System32\win32k.sys
2011-05-28 20:38:37 0 ----a-w- C:\Windows\SysWow64\sho3E07.tmp
2011-05-28 08:22:03 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-05-28 08:22:03 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
.
============= FINISH: 19:10:53.96 ===============








.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 4/29/2011 6:49:25 PM
System Uptime: 8/24/2011 6:54:19 PM (1 hours ago)
.
Motherboard: Gateway | | SJV51_DN
Processor: AMD Phenom(tm) II N660 Dual-Core Processor | Socket S1G4 | 1500/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 283 GiB total, 226.206 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP54: 7/22/2011 2:46:19 PM - Windows Update
RP55: 7/26/2011 9:42:04 PM - Windows Update
RP56: 8/2/2011 3:26:39 PM - Windows Update
RP57: 8/10/2011 4:23:55 PM - Windows Update
RP58: 8/10/2011 8:27:47 PM - Windows Update
RP59: 8/16/2011 7:04:34 AM - Windows Update
RP60: 8/19/2011 2:53:05 PM - Windows Update
RP61: 8/23/2011 8:40:52 AM - Windows Update
RP62: 8/23/2011 9:23:52 PM - Windows Update
.
==== Installed Programs ======================
.
Acrobat.coma
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Photoshop 7.0
Adobe Reader 9.1 MUI
Advertising Center
AMD USB Filter Driver
Apple Application Support
Apple Software Update
avast! Free Antivirus
Backup Manager Basic
Best Buy pc app
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CyberLink PowerDVD 9
D3DX10
Free Audio CD Burner version 1.4.8
Free Studio version 5.0.9
Free YouTube to MP3 Converter version 3.10.7.804
Galerie de photos Windows Live
Gateway MyBackup
Gateway Power Management
Gateway Recovery Management
Gateway Registration
Gateway ScreenSaver
Gateway Updater
Identity Card
ImagXpress
Java Auto Updater
Java(TM) 6 Update 26
Junk Mail filter update
Launch Manager
Malwarebytes' Anti-Malware version 1.51.1.1800
Mesh Runtime
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 5.0 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 9 Essentials
Nero ControlCenter
Nero DiscSpeed
Nero DiscSpeed Help
Nero DriveSpeed
Nero DriveSpeed Help
Nero Express Help
Nero InfoTool
Nero InfoTool Help
Nero Installer
Nero Online Upgrade
Nero StartSmart
Nero StartSmart Help
Nero StartSmart OEM
NeroExpress
neroxml
OpenOffice.org 3.3
QuickTime
Realtek HDMI Audio Driver for ATI
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Spybot - Search & Destroy
Uninstall 1.0.0.1
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Video Web Camera
Welcome Center
Windows Live
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WordWeb
YouTube Downloader 3.2
.
==== Event Viewer Messages From Past Week ========
.
8/21/2011 5:13:15 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
8/20/2011 2:08:48 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer ADMIN-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{E609B3A7-E5F9-472E-9E5A-5446562C72A8}. The master browser is stopping or an election is being forced.
8/17/2011 11:35:50 PM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.
8/17/2011 1:01:56 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
.
==== End Of File ===========================

Hello litepop,

Welcome to the forum!

My name is pgmigg and I'll be helping you with any malware problems.

Currently I am working under the guidance of the MRU teachers and everything I post to you, must first be approved by them.
This additional review process can add some extra time to my responses, but I will post back with instructions for you as soon as possible.

Before we begin, please read and follow these important guidelines, so things will proceed smoothly.

1. The instructions being given are for YOUR computer and system only!
   Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
2. You must have Administrator rights, permissions for this computer.
3. DO NOT run any other fix or removal tools unless instructed to do so!
4. DO NOT install any other software (or hardware) during the cleaning process. This adds more items to be researched.
5. Only post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
6. Print each set of instructions if possible - your Internet connection will not be available during some fix processes.
7. Only reply to this thread, do not start another one. Please, continue responding, until I give you the "All Clean!"
   Absence of symptoms does not mean that everything is clear.

I am currently reviewing your log and will return, as soon as possible, with additional instructions. In the meantime...
Please take time to read the Malware Removal Forum Guidelines and Rules where the conditions for receiving help at this forum are explained.

Please read all instructions carefully before executing and perform the steps, in the order given.
lf, you have any questions or problems, executing these instructions, <<STOP>> do not proceed, post back with the question or problem.

Okay, thank you very much!

Hello litepop,

Thank you for your patience...

Step 1.
Create a System Restore Point

1. Right-click on Computer ... select Properties.
2. In the left pane under Tasks ... click System protection.
   If UAC prompts for an administrator password or approval, type the password or give your "permission to continue".
3. Select System Protection ...then choose Create.
4. In the System Restore dialog box, type a description for the restore point ... click Create, again.
   A window will pop up with "The Restore Point was created successfully" confirmation message.
5. Click OK ...then close the System Restore dialog.

Unless you use some other method to create system restore points...
Please leave the System Restore function "turned on" until we are finished and I give you the 'all clean' sign.

If you have successfully created a System Restore Point...we can proceed.
If you have NOT successfully created a System Restore Point...do not go any further!
Please post back so we can determine why it was unsuccessful.

Step 2.
Hosts File Corrupted
Download HostsXpert and unzip it to your computer, somewhere where you can find it.

1. Right click on HostsXpert.exe and select "Run As Administrator..." to run it.
2. Click on Restore MS Hosts File to restore your Hosts file to its default condition.
3. Click on Make ReadOnly to secure it against further infection.
4. Exit the program.

Step 3.
Run aswMBR scanner

1. Please download aswMBR and save it to your Desktop.
2. Right click aswMBR.exe and select "Run as administrator..."to run it.
3. Click the Scan button.
4. After a short while when the scan reports "Scan finished successfully", click Save log and save the log to your Desktop.
5. Click OK, then Exit.
6. Note: Do not attempt to fix anything at this stage!
7. Two files will be created, aswMBR.txt and a file named MBR.dat.
8. The MBR.dat is a backup of the MBR (Master Boot Record), do not delete it!
9. I strongly suggest you keep a copy of this backup stored on an external device.
10. Copy and paste the contents of aswMBR.txt into your next reply.

Step 4.
OTL
Please download OTL.exe by Old Timer and save it to your Desktop.
Important! Close all applications and windows so that you have nothing open and are at your Desktop.

1. Right click on OTL.exe select "Run As Administrator..." to run it. If prompted by UAC, please allow it.
2. Under Output, ensure that Minimal Output is selected.
3. Click the Scan All Users checkbox.
   Leave the remaining selections to the default settings.
4. Click on Run Scan at the top left hand corner.
5. When done, two Notepad files will open.
   
   • OTL.txt <-- Will be opened, maximized
   • Extras.txt <-- Will be minimized on task bar.
6. Please post the contents of both OTL.txt and Extras.txt files in your next reply.

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of aswMBR.txt log file
3. Contents of OTL.txt log file
4. Contents of Extras.txt log file
5. Do you see any changes in computer behavior?

If you seem that all logs are too long for one post - make a few.

Thanks,
pgmigg

Thanks for your help. The scans went smoothly. It doesn't seem lik anything has changed, though. When I typed a word in my address bar to search (it would usually do a Google-search) it still took me to Buzqo.

Here are my scan results:

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-01 13:46:50
-----------------------------
13:46:50.979 OS Version: Windows x64 6.1.7601 Service Pack 1
13:46:50.979 Number of processors: 2 586 0x603
13:46:50.980 ComputerName: ILDEPHONSE-IV UserName:
13:46:52.680 Initialize success
13:46:53.692 AVAST engine defs: 11090100
13:46:57.604 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
13:46:57.609 Disk 0 Vendor: WDC_WD3200BPVT-22ZEST0 01.01A01 Size: 305245MB BusType: 11
13:46:59.675 Disk 0 MBR read successfully
13:46:59.682 Disk 0 MBR scan
13:46:59.690 Disk 0 Windows 7 default MBR code
13:46:59.697 Service scanning
13:47:03.485 Modules scanning
13:47:03.493 Disk 0 trace - called modules:
13:47:03.515 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
13:47:03.523 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80042f0060]
13:47:03.532 3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004281060]
13:47:04.752 AVAST engine scan C:\Windows
13:47:07.785 AVAST engine scan C:\Windows\system32
13:48:50.407 AVAST engine scan C:\Windows\system32\drivers
13:49:04.291 AVAST engine scan C:\Users\Jam Master Nell
13:52:05.188 AVAST engine scan C:\ProgramData
13:53:08.101 Scan finished successfully
13:59:28.134 Disk 0 MBR has been saved successfully to "C:\Users\Jam Master Nell\Desktop\MBR.dat"
13:59:28.140 The log file has been saved successfully to "C:\Users\Jam Master Nell\Desktop\aswMBR.txt"


aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-01 14:28:38
-----------------------------
14:28:38.849 OS Version: Windows x64 6.1.7601 Service Pack 1
14:28:38.849 Number of processors: 2 586 0x603
14:28:38.849 ComputerName: ILDEPHONSE-IV UserName:
14:28:40.144 Initialize success
14:28:40.222 AVAST engine defs: 11090100
14:28:41.969 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
14:28:41.969 Disk 0 Vendor: WDC_WD3200BPVT-22ZEST0 01.01A01 Size: 305245MB BusType: 11
14:28:44.028 Disk 0 MBR read successfully
14:28:44.028 Disk 0 MBR scan
14:28:44.044 Disk 0 Windows 7 default MBR code
14:28:44.044 Service scanning
14:28:45.916 Modules scanning
14:28:45.916 Disk 0 trace - called modules:
14:28:45.932 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
14:28:45.932 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80042f0060]
14:28:45.947 3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004281060]
14:28:47.055 AVAST engine scan C:\Windows
14:28:50.300 AVAST engine scan C:\Windows\system32
14:30:06.163 AVAST engine scan C:\Windows\system32\drivers
14:30:15.741 AVAST engine scan C:\Users\Jam Master Nell
14:32:27.452 AVAST engine scan C:\ProgramData
14:33:08.792 Scan finished successfully
14:39:54.564 Disk 0 MBR has been saved successfully to "C:\Users\Jam Master Nell\Desktop\MBR.dat"
14:39:54.564 The log file has been saved successfully to "C:\Users\Jam Master Nell\Desktop\aswMBR.txt"



OTL logfile created on: 9/1/2011 2:41:21 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Jam Master Nell\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.21 Gb Available Physical Memory | 58.90% Memory free
7.49 Gb Paging File | 5.67 Gb Available in Paging File | 75.68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 282.99 Gb Total Space | 226.30 Gb Free Space | 79.97% Space Free | Partition Type: NTFS
Drive D: | 4.38 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive E: | 465.65 Gb Total Space | 253.82 Gb Free Space | 54.51% Space Free | Partition Type: FAT32

Computer Name: ILDEPHONSE-IV | User Name: Jam Master Nell | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Jam Master Nell\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\Video Web Camera\traybar.exe (Chicony)
PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\LMworker.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Program Files (x86)\WordWeb\wweb32.exe (WordWeb Software)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\WordWeb\WUCNT.dll ()
MOD - C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\sqlite3.dll ()
MOD - C:\Windows\PLFSetI.exe ()
MOD - C:\Program Files (x86)\Launch Manager\CdDirIo.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (ePowerSvc) -- C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (Updater Service) -- C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe (Acer Group)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (DsiWMIService) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (NTI IScheduleSvc) -- C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (GREGService) -- C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SBSDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (k57nd60a) Broadcom NetLink (TM) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) -- C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com/?pc=MAGW
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=MAGW
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com/?pc=MAGW
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=MAGW



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com/?pc=MAGW
IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.bing.com/?pc=MAGW
IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..keyword.URL: "http://www.buzqo.com/s/?src=addrbar&provider=bing&provider_name=bing&provider_code=Z067&partner_id=232&product_id=687&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.1.0&install_country=US&install_date=20110810&user_guid=6C4EA88A8FC1424A93200C0669BE706E&machine_id=fa25fa4e835a2e7f18eb6431a65a6ad9&browser=FF&os=win&os_version=6.1-x64-SP1&q="
FF - prefs.js..network.proxy.type: 0

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_0_1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/07/05 17:06:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/08/30 19:49:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011/04/29 19:31:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jam Master Nell\AppData\Roaming\Mozilla\Extensions
[2011/08/09 22:54:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jam Master Nell\AppData\Roaming\Mozilla\Firefox\Profiles\kznwsx1k.default\extensions
[2011/05/24 01:27:29 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Jam Master Nell\AppData\Roaming\Mozilla\Firefox\Profiles\kznwsx1k.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/07/14 23:47:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/04/29 20:08:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/04/29 21:48:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/07/14 23:47:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/08/26 00:13:54 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/01/01 01:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml.old

O1 HOSTS File: ([2011/09/01 14:28:13 | 000,000,698 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files (x86)\Video Web Camera\traybar.exe (Chicony)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000..\Run: [Best Buy pc app] File not found
O4 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000..\Run: [WordWeb] C:\Program Files (x86)\WordWeb\wweb32.exe (WordWeb Software)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Jam Master Nell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Jam Master Nell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jam Master Nell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Jam Master Nell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jam Master Nell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E609B3A7-E5F9-472E-9E5A-5446562C72A8}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/12/09 01:44:22 | 000,000,000 | ---D | M] - E:\autorun -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

File not found -- C:\Windows\regedit.exe
File not found -- C:\Windows\PLFSetI.exe
[2011/09/01 14:16:41 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\AppData\Local\Diagnostics
[2011/09/01 13:43:31 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Users\Jam Master Nell\Desktop\OTL.exe
[2011/09/01 13:39:05 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\Desktop\HostsXpert
[2011/09/01 01:42:13 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Users\Jam Master Nell\Desktop\aswMBR.exe
[2011/08/30 21:12:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSECache
[2011/08/30 19:51:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/08/30 19:51:30 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/08/30 19:51:29 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011/08/30 19:51:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2011/08/30 19:49:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/08/30 19:49:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2011/08/26 12:38:07 | 016,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Users\Jam Master Nell\Desktop\spybotsd162(1).exe
[2011/08/24 19:05:40 | 000,607,017 | R--- | C] (Swearware) -- C:\Users\Jam Master Nell\Desktop\dds.scr
[2011/08/24 19:03:28 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\AppData\Local\Solid State Networks
[2011/08/23 21:34:06 | 000,050,688 | ---- | C] (Atribune.org) -- C:\Users\Jam Master Nell\Desktop\ATF-Cleaner.exe
[2011/08/21 00:31:00 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\AppData\Roaming\SUPERAntiSpyware.com
[2011/08/21 00:30:44 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
[2011/08/21 00:30:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011/08/21 00:30:41 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011/08/21 00:30:41 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/08/12 15:18:43 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\AppData\Local\Microsoft Help
[2011/08/12 15:18:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2011/08/10 20:28:39 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2011/08/10 16:29:56 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xmllite.dll
[2011/08/10 16:29:53 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbcjt32.dll
[2011/08/10 16:29:53 | 000,212,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbctrac.dll
[2011/08/10 16:29:53 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccp32.dll
[2011/08/10 16:29:53 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccu32.dll
[2011/08/10 16:29:53 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\odbccr32.dll
[2011/08/10 16:29:53 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccu32.dll
[2011/08/10 16:29:53 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccr32.dll
[2011/08/10 16:29:52 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbctrac.dll
[2011/08/10 16:29:52 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccp32.dll
[2011/08/10 16:29:38 | 001,162,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2011/08/10 16:29:38 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2011/08/10 16:29:37 | 000,214,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2011/08/10 16:29:36 | 000,421,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2011/08/10 16:29:36 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2011/08/10 16:29:35 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2011/08/10 16:29:35 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2011/08/10 16:29:35 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2011/08/10 16:29:35 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2011/08/10 16:29:35 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2011/08/10 16:29:32 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2011/08/10 16:29:32 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2011/08/10 16:29:32 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/10 16:29:32 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/10 16:29:32 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/10 16:29:32 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/10 16:29:32 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/10 16:29:32 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2011/08/10 16:29:32 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2011/08/10 16:29:31 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2011/08/10 16:29:31 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2011/08/10 16:29:31 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2011/08/10 16:29:31 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/10 16:29:31 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/10 16:29:31 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/10 16:29:31 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2011/08/10 16:29:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/10 16:29:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/10 16:29:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/10 16:29:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/10 16:29:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/10 16:29:27 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2011/08/10 16:29:27 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2011/08/10 16:29:27 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/10 16:29:27 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2011/08/10 16:29:27 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2011/08/10 16:29:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2011/08/10 16:29:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2011/08/10 16:29:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2011/08/10 16:29:27 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2011/08/10 16:29:09 | 000,702,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011/08/10 16:29:07 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011/08/10 16:29:07 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011/08/10 16:29:07 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011/08/10 16:29:07 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011/08/10 16:29:07 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011/08/10 16:29:07 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011/08/10 16:28:59 | 003,912,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2011/08/10 16:28:58 | 005,561,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2011/08/10 16:28:57 | 003,967,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2011/08/09 22:52:29 | 000,625,736 | ---- | C] (How Inc.) -- C:\Program Files (x86)\Common Files\ZugoInstaller.exe
[2011/08/02 18:23:54 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\Desktop\LOLI
[2011/08/02 16:33:34 | 000,290,816 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\Jam Master Nell\Desktop\SASUNINST64.EXE
[2011/08/02 15:17:16 | 012,410,448 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\Jam Master Nell\Desktop\SUPERAntiSpyware(1).exe
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/01 14:39:54 | 000,000,512 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\MBR.dat
[2011/09/01 14:28:13 | 000,000,698 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011/09/01 14:06:16 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/01 14:06:16 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/01 13:43:38 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Jam Master Nell\Desktop\OTL.exe
[2011/09/01 01:42:30 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Jam Master Nell\Desktop\aswMBR.exe
[2011/09/01 01:42:05 | 000,357,766 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\HostsXpert.zip
[2011/09/01 01:12:46 | 135,715,518 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\kera - 1109(1).zip
[2011/09/01 00:41:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/08/31 22:55:36 | 3015,884,800 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/31 19:48:23 | 000,122,707 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lqkcssqD9b1qjbd4t.htm
[2011/08/30 22:15:24 | 000,296,400 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/08/30 22:04:06 | 000,000,017 | ---- | M] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2011/08/30 19:51:55 | 000,001,790 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/08/30 19:49:36 | 000,001,852 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/08/26 15:34:40 | 000,436,960 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20110827-000310.backup
[2011/08/26 12:44:06 | 000,001,269 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\Spybot - Search & Destroy.lnk
[2011/08/26 12:40:45 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Users\Jam Master Nell\Desktop\spybotsd162(1).exe
[2011/08/24 23:34:06 | 000,403,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/08/24 19:06:03 | 000,607,017 | R--- | M] (Swearware) -- C:\Users\Jam Master Nell\Desktop\dds.scr
[2011/08/23 21:38:59 | 000,000,829 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011/08/23 21:35:13 | 000,741,240 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/08/23 21:35:13 | 000,624,622 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/08/23 21:35:13 | 000,106,708 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/08/23 21:35:12 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Users\Jam Master Nell\Desktop\ATF-Cleaner.exe
[2011/08/22 17:14:27 | 000,031,558 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\bg.gif
[2011/08/22 17:14:18 | 000,019,853 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\header.gif
[2011/08/21 00:30:43 | 000,001,815 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/08/20 14:52:59 | 000,511,283 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lpkvsji7SC1qc9pino1_500.gif
[2011/08/16 16:05:35 | 000,171,121 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\UC apply online_11-12_transfer_final.pdf
[2011/08/16 15:52:39 | 001,172,565 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\TAG UCSC.pdf
[2011/08/16 15:45:04 | 000,061,388 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\TAG.pdf
[2011/08/12 20:23:19 | 000,001,409 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\Free YouTube to MP3 Converter.lnk
[2011/08/02 16:33:37 | 000,290,816 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\Jam Master Nell\Desktop\SASUNINST64.EXE
[2011/08/02 15:24:01 | 012,410,448 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\Jam Master Nell\Desktop\SUPERAntiSpyware(1).exe
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/01 13:59:28 | 000,000,512 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\MBR.dat
[2011/09/01 01:41:39 | 000,357,766 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\HostsXpert.zip
[2011/09/01 00:58:25 | 135,715,518 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\kera - 1109(1).zip
[2011/08/31 19:48:22 | 000,122,707 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lqkcssqD9b1qjbd4t.htm
[2011/08/30 22:04:06 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2011/08/30 21:13:36 | 000,002,543 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint Viewer .lnk
[2011/08/30 19:51:55 | 000,001,790 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/08/30 19:49:36 | 000,001,852 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/08/22 17:14:26 | 000,031,558 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\bg.gif
[2011/08/22 17:14:17 | 000,019,853 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\header.gif
[2011/08/21 00:30:43 | 000,001,815 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/08/20 14:52:58 | 000,511,283 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lpkvsji7SC1qc9pino1_500.gif
[2011/08/16 16:05:35 | 000,171,121 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\UC apply online_11-12_transfer_final.pdf
[2011/08/16 15:52:39 | 001,172,565 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\TAG UCSC.pdf
[2011/08/16 15:45:04 | 000,061,388 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\TAG.pdf
[2011/05/01 14:05:31 | 000,743,534 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/04/29 19:31:44 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/03/10 09:37:03 | 000,000,321 | ---- | C] () -- C:\Windows\PidList_C.ini
[2011/03/10 09:33:12 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/02/22 04:50:34 | 000,002,093 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009/07/13 22:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 19:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 19:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 17:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 16:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 14:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 14:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

< End of report >




OTL Extras logfile created on: 9/1/2011 2:41:21 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Jam Master Nell\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.21 Gb Available Physical Memory | 58.90% Memory free
7.49 Gb Paging File | 5.67 Gb Available in Paging File | 75.68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 282.99 Gb Total Space | 226.30 Gb Free Space | 79.97% Space Free | Partition Type: NTFS
Drive D: | 4.38 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive E: | 465.65 Gb Total Space | 253.82 Gb Free Space | 54.51% Space Free | Partition Type: FAT32

Computer Name: ILDEPHONSE-IV | User Name: Jam Master Nell | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{3B20226B-63ED-B863-B224-FE40401B21CA}" = ATI Catalyst Install Manager
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{997C9EC4-B53D-479D-81B7-0AEC8D174BA1}" = iTunes
"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{CA0D2F09-F811-48D4-843E-C87696C6A9D9}" = Bonjour
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EEB06ECB-38F0-68CD-B215-94D50914C0F8}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FBBC4667-2521-4E78-B1BD-8706F774549B}" = Best Buy pc app
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.00 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01868E82-DA4F-BFF8-45CF-9B1CAE8810D9}" = Catalyst Control Center Core Implementation
"{01CC7DB7-909B-E630-A44A-8118036CAF3C}" = CCC Help Korean
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{07367450-E3E6-B4A1-E19C-A07429026680}" = CCC Help Swedish
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{12A1B519-5934-4508-ADBD-335347B0DC87}" = Video Web Camera
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 3.2
"{1C42AA63-B354-56AF-69CA-FA73285368BE}" = CCC Help German
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FFDACFC-898C-FC99-0140-AE2FC18B710E}" = Catalyst Control Center Graphics Full New
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{268E2A87-470B-118B-B3AD-6F2615B86623}" = CCC Help Greek
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 26
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3601754A-C72B-E4B3-CE39-78CCD0B58DC9}" = CCC Help Russian
"{3A69B28B-6E44-E512-C395-EEDCB5BCB485}" = CCC Help Danish
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3BA616F8-F969-4DE7-0C85-35BE954DDB8A}" = CCC Help Hungarian
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Gateway Power Management
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{3EED6569-D845-F8D1-9648-84729711590E}" = CCC Help Italian
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A41156A-0669-F7B5-B24C-5E25C69F1E68}" = CCC Help Turkish
"{4D43D635-6FDA-4FA5-AA9B-23CF73D058EA}" = Nero StartSmart OEM
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{6057E21C-ABE9-4059-AE3E-3BEB9925E660}" = Windows Live Messenger
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{63ADFC07-D92A-670C-3826-BB0C9CC41D8A}" = CCC Help Polish
"{6488561D-83C8-6987-6163-744E60680139}" = CCC Help Japanese
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69CA5A5F-7541-5216-6433-DE69E4245116}" = Catalyst Control Center Graphics Light
"{69F214C9-507D-7EB5-FF08-926CFD0D5EC6}" = Catalyst Control Center Localization All
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{762CB899-DF14-EB84-78F5-888C83AA7DC3}" = Catalyst Control Center Graphics Previews Common
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Gateway Recovery Management
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83E4C065-91B9-20DD-74DA-90A71242CE18}" = CCC Help Norwegian
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AEAE107-B186-4EA8-5F84-3AAA3158FEB1}" = CCC Help Chinese Standard
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{975B24AC-8CB7-B4E1-E666-37964657576E}" = CCC Help Chinese Traditional
"{987B04C4-B5AC-4AD6-A7E9-8D681085B850}" = AMD USB Filter Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{a0aa3cd4-5659-4d37-9c7d-2fc699c395d6}" = Nero 9 Essentials
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A45B7A40-694C-BAB8-EE69-4240ADFEA1FF}" = CCC Help Finnish
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{AD768FF7-E329-886C-D88E-585F26BB8738}" = CCC Help Dutch
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B8F5BACE-194E-0203-023E-2FFEF68EE290}" = CCC Help English
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C450D07C-3914-5481-A068-29975DA5C596}" = CCC Help French
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C9165CF3-A14D-A281-B62E-37312AA9E63D}" = CCC Help Spanish
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4E16961-E6FA-4689-AD09-3DB7E5770167}" = Catalyst Control Center InstallProxy
"{D6B1E149-790E-3B60-07F9-07A40ECAFBA0}" = Catalyst Control Center Graphics Full Existing
"{DBF91CC3-41F6-0D99-3D2D-686C59865652}" = ccc-core-static
"{DD49AC0F-E08A-F77D-AB38-2EE9CD5D8F0B}" = CCC Help Thai
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DECEFADB-0486-6252-C312-49DDAC71DF33}" = CCC Help Portuguese
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5C7D048-F9B4-4219-B323-8BDB01A2563D}" = Nero DriveSpeed Help
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Gateway Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{F7425F93-2071-A946-008A-6ACA60B43FB2}" = CCC Help Czech
"{FBBC4667-2521-4E78-B1BD-8706F774549B}" = Best Buy pc app
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FC635D8E-FFBA-4B2C-BE68-A37D56BDFB74}" = Catalyst Control Center - Branding
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"avast" = avast! Free Antivirus
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.8
"Free Studio_is1" = Free Studio version 5.0.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.7.804
"Gateway Registration" = Gateway Registration
"Gateway Screensaver" = Gateway ScreenSaver
"Gateway Welcome Center" = Welcome Center
"Identity Card" = Identity Card
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Gateway MyBackup
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Mozilla Firefox 6.0 (x86 en-US)" = Mozilla Firefox 6.0 (x86 en-US)
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"Uninstall_is1" = Uninstall 1.0.0.1
"WinLiveSuite" = Windows Live Essentials
"WordWeb" = WordWeb

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/30/2011 7:53:51 PM | Computer Name = Ildephonse-IV | Source = Bonjour Service | ID = 100
Description = mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1)
!= mDNS_reentrancy (0)

Error - 8/30/2011 7:53:59 PM | Computer Name = Ildephonse-IV | Source = Bonjour Service | ID = 100
Description = mDNSCoreMachineSleep: mDNS_Lock: Locking failure! mDNS_busy (1) !=
mDNS_reentrancy (0)

Error - 8/30/2011 7:53:59 PM | Computer Name = Ildephonse-IV | Source = Bonjour Service | ID = 100
Description = mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1)
!= mDNS_reentrancy (0)

Error - 8/31/2011 1:18:27 AM | Computer Name = Ildephonse-IV | Source = Application Error | ID = 1000
Description = Faulting application name: CVHSVC.EXE, version: 14.0.4750.1000, time
stamp: 0x4b8a36d5 Faulting module name: ole32.dll, version: 6.1.7601.17514, time
stamp: 0x4ce7b96f Exception code: 0xc0000005 Fault offset: 0x001483f8 Faulting process
id: 0xb24 Faulting application start time: 0x01cc679d0f079628 Faulting application
path: C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
Faulting
module path: C:\Windows\syswow64\ole32.dll Report Id: a7c94433-d390-11e0-a773-1c7508e1ce31

Error - 8/31/2011 10:40:31 PM | Computer Name = Ildephonse-IV | Source = Bonjour Service | ID = 100
Description = mDNSCoreMachineSleep: mDNS_Lock: Locking failure! mDNS_busy (1) !=
mDNS_reentrancy (0)

Error - 8/31/2011 10:40:31 PM | Computer Name = Ildephonse-IV | Source = Bonjour Service | ID = 100
Description = mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1)
!= mDNS_reentrancy (0)

Error - 8/31/2011 10:40:31 PM | Computer Name = Ildephonse-IV | Source = Bonjour Service | ID = 100
Description = mDNSCoreMachineSleep: mDNS_Lock: Locking failure! mDNS_busy (1) !=
mDNS_reentrancy (0)

Error - 8/31/2011 10:40:31 PM | Computer Name = Ildephonse-IV | Source = Bonjour Service | ID = 100
Description = mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1)
!= mDNS_reentrancy (0)

Error - 9/1/2011 6:01:58 AM | Computer Name = Ildephonse-IV | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 9/1/2011 6:04:36 AM | Computer Name = Ildephonse-IV | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files (x86)\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program
files (x86)\spybot - search & destroy\DelZip179.dll" on line 8. The value "*" of
attribute "language" in element "assemblyIdentity" is invalid.

[ System Events ]
Error - 7/6/2011 1:19:41 AM | Computer Name = Ildephonse-IV | Source = WMPNetworkSvc | ID = 866333
Description =

Error - 7/6/2011 1:58:15 AM | Computer Name = Ildephonse-IV | Source = Microsoft-Windows-Bits-Client | ID = 16398
Description = A new BITS job could not be created. The current job count for the
user Ildephonse-IV\Jam Master Nell (60) is equal to or greater than the job limit
(60) specified through group policy. To correct the problem, complete or cancel
the BITS jobs that haven't made progress by looking at the error, and restart the
BITS service. If this error recurs, contact your system administrator and increate
the per-user and per-computer Group Policy job limits.

Error - 7/7/2011 4:46:53 AM | Computer Name = Ildephonse-IV | Source = BROWSER | ID = 8032
Description = The browser service has failed to retrieve the backup list too many
times on transport \Device\NetBT_Tcpip_{E609B3A7-E5F9-472E-9E5A-5446562C72A8}. The
backup browser is stopping.

Error - 7/10/2011 6:02:43 AM | Computer Name = Ildephonse-IV | Source = bowser | ID = 8003
Description = The master browser has received a server announcement from the computer
ADMIN-PC that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{E609B3A7-E5F9-472E-9E5A-5446562C72A8}. The master browser is stopping
or an election is being forced.

Error - 7/12/2011 2:50:55 AM | Computer Name = Ildephonse-IV | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 7/12/2011 5:31:06 AM | Computer Name = Ildephonse-IV | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.1.5. The computer with the IP address 192.168.1.6 did not
allow the name to be claimed by this computer.

Error - 7/12/2011 6:18:02 AM | Computer Name = Ildephonse-IV | Source = BROWSER | ID = 8032
Description = The browser service has failed to retrieve the backup list too many
times on transport \Device\NetBT_Tcpip_{E609B3A7-E5F9-472E-9E5A-5446562C72A8}. The
backup browser is stopping.

Error - 7/14/2011 4:37:57 AM | Computer Name = Ildephonse-IV | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 7/14/2011 8:03:54 PM | Computer Name = Ildephonse-IV | Source = DCOM | ID = 10010
Description =

Error - 7/17/2011 5:32:06 AM | Computer Name = Ildephonse-IV | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.


< End of report >

Hello litepop,

Very good job!

It doesn't seem lik anything has changed, though.

I did not start to clean your computer yet. I tried to get more information about your infection. Let start our treatment now.

Step 1.
Create a System Restore Point

1. Right-click on Computer ... select Properties.
2. In the left pane under Tasks ... click System protection.
   If UAC prompts for an administrator password or approval, type the password or give your "permission to continue".
3. Select System Protection ...then choose Create.
4. In the System Restore dialog box, type a description for the restore point ... click Create, again.
   A window will pop up with "The Restore Point was created successfully" confirmation message.
5. Click OK ...then close the System Restore dialog.

Unless you use some other method to create system restore points...
Please leave the System Restore function "turned on" until we are finished and I give you the 'all clean' sign.

If you have successfully created a System Restore Point...we can proceed.
If you have NOT successfully created a System Restore Point...do not go any further!
Please post back so we can determine why it was unsuccessful.

Step 2.
Add/Remove Programs
I need you to uninstall some programs from your computer.

1. Click on Start -> Control Panel and depends on View by selection in upper right corner:
   
   • If Category - click on Uninstall Programs.
   • If Icons - click on Programs and Features.
2. Locate the following program:
   Java Auto Updater
   Java(TM) 6 Update 26
   Spybot - Search & Destroy
   SUPERAntiSpyware
3. Click on the Change/Remove button to uninstall it.
   Repeat steps 2 and 3 for each program listed.
4. When the program(s) have been uninstalled, please close Control Panel.
5. Reboot your computer in Normal Mode.

Step 3.
OTL - Run Fix Script
You should still have this on your desktop, if so, ignore the download instructions.
Please download OTL.exe by Old Timer and save it to your Desktop.
Important! Close all applications and windows so that you have nothing open and are at your Desktop.

1. Right click on OTL.exe select "Run As Administrator..." to run it. If prompted by UAC, please allow it.
2. When the window appears, make sure Include 64bit Scans is CHECKED.
3. Underneath Output at the top, make sure Minimal Output is selected.
4. Under the Standard Registry box change it to All.
5. Check/tick the boxes beside LOP Check and Purity Check.
6. Copy and Paste the following code into the text box. Do not include the word Code
   

   
   
   :OTL
   
   FF - prefs.js..keyword.URL: "http://www.buzqo.com/s/?src=addrbar&provider=bing&provider_name=bing&provider_code=Z067&partner_id=232&product_id=687&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.1.0&install_country=US&install_date=20110810&user_guid=6C4EA88A8FC1424A93200C0669BE706E&machine_id=fa25fa4e835a2e7f18eb6431a65a6ad9&browser=FF&os=win&os_version=6.1-x64-SP1&q="
   
   [2011/04/29 20:08:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
   
   [2011/04/29 21:48:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
   
   [2011/07/14 23:47:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
   
   O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
   
   O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
   
   O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_26)
   
   O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_26)
   
   O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_26)
   
   2011/08/09 22:52:29 | 000,625,736 | ---- | C] (How Inc.) -- C:\Program Files (x86)\Common Files\ZugoInstaller.exe
   
   [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
   
   
   
   :Commands
   
   [PURITY]
   
   [EMPTYTEMP]
   
   [EMPTYFLASH]
   
   [REBOOT]
   
   

7. Click under the Custom Scan/Fixes box and paste the copied text.
8. Click the Run Fix button. If prompted... click OK.
9. OTL may ask to reboot the machine. Please do so if asked.
10. When the scan completes, Notepad will open with the scan results (OTL.txt). The report is saved in the same location as OTL.
11. Please post the contents of report in your next reply.

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of OTL.txt log file
3. Do you see any changes in computer behavior?

Thanks,
pgmigg

Okay, everything went fine. I actually uninstalled Java before I disabled the Automatic Updates (Sorry, I didn't pay a mind to the order that you instructed). But I didn't reinstall it so that I could disable automatic updates-- just went through the OTL fix regardless. If this is a problem, let me know. My apologies if it is!
Just to let you know, when I ran OTL, Avast auto-sandboxed it originally, which resulted in the the Fix not completing anything, but I ran it again outside of the sandbox and it worked fine. And now when I type a search into the address bar, I get a Google search!

Here are my results:

All processes killed
========== OTL ==========
Prefs.js: "http://www.buzqo.com/s/?src=addrbar&provider=bing&provider_name=bing&provider_code=Z067&partner_id=232&product_id=687&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.1.0&install_country=US&install_date=20110810&user_guid=6C4EA88A8FC1424A93200C0669BE706E&machine_id=fa25fa4e835a2e7f18eb6431a65a6ad9&browser=FF&os=win&os_version=6.1-x64-SP1&q=" removed from keyword.URL
Folder C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
Folder C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\ not found.
Folder C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
C:\Windows\SysWow64\sho3E07.tmp deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Anybody Else

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jam Master Nell
->Temp folder emptied: 11790 bytes
->Temporary Internet Files folder emptied: 794037 bytes
->Java cache emptied: 30972 bytes
->FireFox cache emptied: 48690565 bytes
->Flash cache emptied: 890 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 94787 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50467 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 47.00 mb


[EMPTYFLASH]

User: All Users

User: Anybody Else

User: Default

User: Default User

User: Jam Master Nell
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.27.0 log created on 09022011_150604

Files\Folders moved on Reboot...
C:\Users\Jam Master Nell\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Hello litepop,

It is nice to see you happy again!
Let continue out treatment a little bit more and check if there are still left something which should be fixed...

Step 1.
TFC (Temp File Cleaner)

1. Please download TFC.exe...by Old Timer. Save it to your desktop.
   Print these instructions. Save any unsaved work. TFC will close ALL open programs including your browser!
2. Double click on TFC.exe to run it.
   TFC will begin cleaning up the "temp" files. It may take only a few seconds or it could be several minutes, depending on the amount of temp files found.
3. If prompted to reboot, please click Yes.

! Important ! If TFC prompts you to reboot, please do so immediately, before proceeding to any other steps or other use of your computer.

Step 2.
ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

1. Firstly please Disable any Antivirus you have active, as shown in This topic.
2. Note: Don't forget to re-enable it after the scan.
3. Next please click on the following link to open a new window to ESET online scannner
4. Then click on:
   

   Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
   All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

5. Select the option YES, I accept the Terms of Use then click on:
6. When prompted allow the Add-On/Active X to install.
7. Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
8. Now click on Advanced Settings and select the following:
   
   • Scan for potentially unwanted applications
   • Scan for potentially unsafe applications
   • Enable Anti-Stealth Technology
9. Now click on:
10. The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
11. When completed the Online Scan will begin automatically.
12. Do not touch either the mouse or keyboard during the scan otherwise it may stall.
13. When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
14. Now click on:
15. Use notepad to open the log file located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
16. Copy and paste that log as a reply to this topic.

Step 3.
OTL
I need you to run fresh OTL standard scan.
You should still have this on your desktop, if so, ignore the download instructions.
Please download OTL.exe by Old Timer and save it to your Desktop.
Important! Close all applications and windows so that you have nothing open and are at your Desktop.

1. Right click on OTL.exe select "Run As Administrator..." to run it. If prompted by UAC, please allow it.
2. Under Output, ensure that Minimal Output is selected.
3. Click the Scan All Users checkbox.
   Leave the remaining selections to the default settings.
4. Click on Run Scan at the top left hand corner.
5. When done, two Notepad files will open.
   
   • OTL.txt <-- Will be opened, maximized
   • Extras.txt <-- Will be minimized on task bar.
6. Please post the contents of OTL.txt file only in your next reply.

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of ESET log.txt file
3. Contents of OTL.txt log file
4. Do you see any changes in computer behavior?

Thanks,
pgmigg

Thank you! It looks like Zugo is still there (from what I can see from the scans), but here are the results:

ESET:

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=ae0409e7fb54454b8d8d780ab8b21a6b
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-09-03 09:13:51
# local_time=2011-09-03 02:13:51 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=5893 16776574 100 94 0 66623814 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=125461
# found=1
# cleaned=0
# scan_time=4067
C:\Program Files (x86)\Common Files\ZugoInstaller.exe multiple threats (unable to clean) 00000000000000000000000000000000 I



OTL:

OTL logfile created on: 9/3/2011 10:59:55 PM - Run 1
OTL by OldTimer - Version 3.2.27.0 Folder = C:\Users\Jam Master Nell\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.75 Gb Total Physical Memory | 2.23 Gb Available Physical Memory | 59.52% Memory free
7.49 Gb Paging File | 6.04 Gb Available in Paging File | 80.64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 282.99 Gb Total Space | 226.00 Gb Free Space | 79.86% Space Free | Partition Type: NTFS
Drive D: | 4.38 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: ILDEPHONSE-IV | User Name: Jam Master Nell | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Jam Master Nell\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\Video Web Camera\traybar.exe (Chicony)
PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\LMworker.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe (Acer Group)
PRC - C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\WordWeb\wweb32.exe (WordWeb Software)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\WordWeb\WUCNT.dll ()
MOD - C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\sqlite3.dll ()
MOD - C:\Windows\PLFSetI.exe ()
MOD - C:\Program Files (x86)\Launch Manager\CdDirIo.dll ()


========== Win32 Services (SafeList) ==========

SRV - (DsiWMIService) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (NTI IScheduleSvc) -- C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (GREGService) -- C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com/?pc=MAGW
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=MAGW


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com/?pc=MAGW
IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.bing.com/?pc=MAGW
IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/07/05 17:06:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/09/02 01:18:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011/04/29 19:31:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jam Master Nell\AppData\Roaming\Mozilla\Extensions
[2011/08/09 22:54:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jam Master Nell\AppData\Roaming\Mozilla\Firefox\Profiles\kznwsx1k.default\extensions
[2011/05/24 01:27:29 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Jam Master Nell\AppData\Roaming\Mozilla\Firefox\Profiles\kznwsx1k.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/09/02 14:53:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/09/02 01:18:49 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/01/01 01:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml.old

O1 HOSTS File: ([2011/09/01 14:28:13 | 000,000,698 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files (x86)\Video Web Camera\traybar.exe (Chicony)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000..\Run: [Best Buy pc app] File not found
O4 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000..\Run: [WordWeb] C:\Program Files (x86)\WordWeb\wweb32.exe (WordWeb Software)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Jam Master Nell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-2594660682-4069512376-3426154175-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Free YouTube Download - C:\Users\Jam Master Nell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jam Master Nell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E609B3A7-E5F9-472E-9E5A-5446562C72A8}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/09/03 12:50:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011/09/03 12:49:53 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Jam Master Nell\Desktop\esetsmartinstaller_enu.exe
[2011/09/03 12:46:49 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Jam Master Nell\Desktop\TFC.exe
[2011/09/03 00:12:23 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\Desktop\oldiess
[2011/09/02 17:27:15 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\AppData\Local\Adobe
[2011/09/02 14:53:33 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/09/01 21:22:49 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\Desktop\Kuroshitsuji60BA
[2011/09/01 14:16:41 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\AppData\Local\Diagnostics
[2011/09/01 13:43:31 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Users\Jam Master Nell\Desktop\OTL.exe
[2011/09/01 13:39:05 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\Desktop\HostsXpert
[2011/09/01 01:42:13 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Users\Jam Master Nell\Desktop\aswMBR.exe
[2011/08/30 21:12:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSECache
[2011/08/30 19:51:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/08/30 19:51:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2011/08/30 19:49:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011/08/30 19:49:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2011/08/26 12:38:07 | 016,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Users\Jam Master Nell\Desktop\spybotsd162(1).exe
[2011/08/24 19:05:40 | 000,607,017 | R--- | C] (Swearware) -- C:\Users\Jam Master Nell\Desktop\dds.scr
[2011/08/24 19:03:28 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\AppData\Local\Solid State Networks
[2011/08/23 21:34:06 | 000,050,688 | ---- | C] (Atribune.org) -- C:\Users\Jam Master Nell\Desktop\ATF-Cleaner.exe
[2011/08/12 15:18:43 | 000,000,000 | ---D | C] -- C:\Users\Jam Master Nell\AppData\Local\Microsoft Help
[2011/08/12 15:18:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2011/08/10 16:29:53 | 000,319,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbcjt32.dll
[2011/08/10 16:29:53 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccu32.dll
[2011/08/10 16:29:53 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccr32.dll
[2011/08/10 16:29:52 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbctrac.dll
[2011/08/10 16:29:52 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\odbccp32.dll
[2011/08/10 16:29:35 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2011/08/10 16:29:35 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2011/08/10 16:29:32 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2011/08/10 16:29:32 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2011/08/10 16:29:32 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2011/08/10 16:29:32 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/08/10 16:29:32 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2011/08/10 16:29:31 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2011/08/10 16:29:31 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2011/08/10 16:29:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/08/10 16:29:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2011/08/10 16:29:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2011/08/10 16:29:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2011/08/10 16:29:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/08/10 16:29:27 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2011/08/10 16:29:27 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2011/08/10 16:29:27 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2011/08/10 16:29:27 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2011/08/10 16:29:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2011/08/10 16:29:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2011/08/10 16:29:27 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2011/08/10 16:29:07 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011/08/10 16:29:07 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011/08/10 16:29:07 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011/08/10 16:28:59 | 003,912,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2011/08/10 16:28:57 | 003,967,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2011/08/09 22:52:29 | 000,625,736 | ---- | C] (How Inc.) -- C:\Program Files (x86)\Common Files\ZugoInstaller.exe

========== Files - Modified Within 30 Days ==========

[2011/09/03 13:22:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/09/03 12:50:11 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Jam Master Nell\Desktop\esetsmartinstaller_enu.exe
[2011/09/03 12:48:24 | 3015,884,800 | -HS- | M] () -- C:\hiberfil.sys
[2011/09/03 12:46:54 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Jam Master Nell\Desktop\TFC.exe
[2011/09/03 02:44:25 | 000,489,416 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lgf4teYSRL1qanb21o1_400.gif
[2011/09/03 02:42:17 | 000,406,872 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_locmalsjzq1qzi80do1_500.gif
[2011/09/03 02:41:17 | 000,362,884 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lq7chtEJQi1qe0v4d.gif
[2011/09/03 02:12:08 | 000,088,499 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lqq7qeKKPc1qddppz.jpg
[2011/09/03 02:11:46 | 000,086,620 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lqq7pmTpzJ1qddppz.jpg
[2011/09/03 02:07:08 | 000,198,355 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_ln0ucm2TqP1qga2kpo1_500.png
[2011/09/02 00:58:18 | 000,061,598 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\01.jpg
[2011/09/02 00:56:22 | 000,036,897 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\3456.jpg
[2011/09/02 00:55:03 | 000,023,964 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\3517.jpg
[2011/09/02 00:54:43 | 000,044,263 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\08.jpg
[2011/09/02 00:50:31 | 000,016,883 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\3756.jpg
[2011/09/02 00:49:30 | 000,037,620 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\3827.jpg
[2011/09/02 00:47:44 | 000,026,155 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\3933.jpg
[2011/09/02 00:45:27 | 000,034,405 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\4181.jpg
[2011/09/02 00:45:23 | 000,029,036 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\4182.jpg
[2011/09/02 00:45:12 | 000,050,431 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\4212.jpg
[2011/09/02 00:39:53 | 000,035,684 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\4356.jpg
[2011/09/02 00:32:32 | 000,025,129 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\4871.jpg
[2011/09/02 00:32:23 | 000,073,308 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\4853.jpg
[2011/09/02 00:26:05 | 008,773,795 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\Eiffel 65 - Blue (Da Ba Dee) (Original Video with subtitles).mp3
[2011/09/02 00:22:19 | 013,533,422 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\Capsule - Starry Sky.mp3
[2011/09/02 00:02:49 | 000,029,362 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\5030.jpg
[2011/09/02 00:02:35 | 000,044,030 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\5068.jpg
[2011/09/02 00:02:09 | 000,041,420 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\5048.jpg
[2011/09/01 23:58:31 | 000,028,701 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\5092.jpg
[2011/09/01 23:58:16 | 000,032,299 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\5252.jpg
[2011/09/01 23:52:22 | 014,154,759 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\Capsule x Daft Punk x Beastie Boys - Starry Sky YEAH! Remix.mp3
[2011/09/01 21:09:55 | 014,842,989 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\Kuroshitsuji60BA.zip
[2011/09/01 14:39:54 | 000,000,512 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\MBR.dat
[2011/09/01 13:43:38 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Jam Master Nell\Desktop\OTL.exe
[2011/09/01 01:42:30 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Users\Jam Master Nell\Desktop\aswMBR.exe
[2011/09/01 01:42:05 | 000,357,766 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\HostsXpert.zip
[2011/09/01 01:12:46 | 135,715,518 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\kera - 1109(1).zip
[2011/08/31 19:48:23 | 000,122,707 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lqkcssqD9b1qjbd4t.htm
[2011/08/30 22:04:06 | 000,000,017 | ---- | M] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2011/08/30 19:51:55 | 000,001,790 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/08/30 19:49:36 | 000,001,852 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/08/26 12:40:45 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Users\Jam Master Nell\Desktop\spybotsd162(1).exe
[2011/08/24 23:34:06 | 000,403,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/08/24 19:06:03 | 000,607,017 | R--- | M] (Swearware) -- C:\Users\Jam Master Nell\Desktop\dds.scr
[2011/08/23 21:38:59 | 000,000,829 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011/08/23 21:35:12 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Users\Jam Master Nell\Desktop\ATF-Cleaner.exe
[2011/08/22 17:14:27 | 000,031,558 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\bg.gif
[2011/08/22 17:14:18 | 000,019,853 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\header.gif
[2011/08/20 14:52:59 | 000,511,283 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lpkvsji7SC1qc9pino1_500.gif
[2011/08/16 16:05:35 | 000,171,121 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\UC apply online_11-12_transfer_final.pdf
[2011/08/16 15:52:39 | 001,172,565 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\TAG UCSC.pdf
[2011/08/16 15:45:04 | 000,061,388 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\TAG.pdf
[2011/08/12 20:23:19 | 000,001,409 | ---- | M] () -- C:\Users\Jam Master Nell\Desktop\Free YouTube to MP3 Converter.lnk

========== Files Created - No Company Name ==========

[2011/09/03 02:44:24 | 000,489,416 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lgf4teYSRL1qanb21o1_400.gif
[2011/09/03 02:42:16 | 000,406,872 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_locmalsjzq1qzi80do1_500.gif
[2011/09/03 02:41:14 | 000,362,884 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lq7chtEJQi1qe0v4d.gif
[2011/09/03 02:12:07 | 000,088,499 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lqq7qeKKPc1qddppz.jpg
[2011/09/03 02:11:45 | 000,086,620 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lqq7pmTpzJ1qddppz.jpg
[2011/09/03 02:07:08 | 000,198,355 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_ln0ucm2TqP1qga2kpo1_500.png
[2011/09/02 00:58:17 | 000,061,598 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\01.jpg
[2011/09/02 00:56:21 | 000,036,897 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\3456.jpg
[2011/09/02 00:55:02 | 000,023,964 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\3517.jpg
[2011/09/02 00:54:42 | 000,044,263 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\08.jpg
[2011/09/02 00:50:30 | 000,016,883 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\3756.jpg
[2011/09/02 00:49:28 | 000,037,620 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\3827.jpg
[2011/09/02 00:47:43 | 000,026,155 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\3933.jpg
[2011/09/02 00:45:26 | 000,034,405 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\4181.jpg
[2011/09/02 00:45:22 | 000,029,036 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\4182.jpg
[2011/09/02 00:45:11 | 000,050,431 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\4212.jpg
[2011/09/02 00:39:52 | 000,035,684 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\4356.jpg
[2011/09/02 00:32:31 | 000,025,129 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\4871.jpg
[2011/09/02 00:32:22 | 000,073,308 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\4853.jpg
[2011/09/02 00:25:55 | 008,773,795 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\Eiffel 65 - Blue (Da Ba Dee) (Original Video with subtitles).mp3
[2011/09/02 00:21:56 | 013,533,422 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\Capsule - Starry Sky.mp3
[2011/09/02 00:02:49 | 000,029,362 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\5030.jpg
[2011/09/02 00:02:35 | 000,044,030 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\5068.jpg
[2011/09/02 00:02:09 | 000,041,420 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\5048.jpg
[2011/09/01 23:58:29 | 000,028,701 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\5092.jpg
[2011/09/01 23:58:15 | 000,032,299 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\5252.jpg
[2011/09/01 23:52:06 | 014,154,759 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\Capsule x Daft Punk x Beastie Boys - Starry Sky YEAH! Remix.mp3
[2011/09/01 21:07:33 | 014,842,989 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\Kuroshitsuji60BA.zip
[2011/09/01 13:59:28 | 000,000,512 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\MBR.dat
[2011/09/01 01:41:39 | 000,357,766 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\HostsXpert.zip
[2011/09/01 00:58:25 | 135,715,518 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\kera - 1109(1).zip
[2011/08/31 19:48:22 | 000,122,707 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lqkcssqD9b1qjbd4t.htm
[2011/08/30 22:04:06 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2011/08/30 21:13:36 | 000,002,543 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint Viewer .lnk
[2011/08/30 19:51:55 | 000,001,790 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/08/30 19:49:36 | 000,001,852 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011/08/22 17:14:26 | 000,031,558 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\bg.gif
[2011/08/22 17:14:17 | 000,019,853 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\header.gif
[2011/08/20 14:52:58 | 000,511,283 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\tumblr_lpkvsji7SC1qc9pino1_500.gif
[2011/08/16 16:05:35 | 000,171,121 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\UC apply online_11-12_transfer_final.pdf
[2011/08/16 15:52:39 | 001,172,565 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\TAG UCSC.pdf
[2011/08/16 15:45:04 | 000,061,388 | ---- | C] () -- C:\Users\Jam Master Nell\Desktop\TAG.pdf
[2011/05/01 14:05:31 | 000,743,534 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/04/29 19:31:44 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/03/10 09:37:03 | 000,206,208 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2011/03/10 09:37:03 | 000,000,321 | ---- | C] () -- C:\Windows\PidList_C.ini
[2011/03/10 09:33:12 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/02/22 04:50:34 | 000,002,093 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009/07/13 22:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 19:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 19:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 17:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 16:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 14:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 14:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== Files - Unicode (All) ==========
[2011/09/03 12:54:38 | 010,562,399 | ---- | M] ()(C:\Users\Jam Master Nell\Desktop\????????? _ Kyary Len Len?PONPONPON Full ver..mp3) -- C:\Users\Jam Master Nell\Desktop\【きゃりーれんれん _ Kyary Len Len】PONPONPON　Full ver..mp3
[2011/09/03 12:54:25 | 010,562,399 | ---- | C] ()(C:\Users\Jam Master Nell\Desktop\????????? _ Kyary Len Len?PONPONPON Full ver..mp3) -- C:\Users\Jam Master Nell\Desktop\【きゃりーれんれん _ Kyary Len Len】PONPONPON　Full ver..mp3
[2011/09/02 00:22:28 | 004,035,962 | ---- | M] ()(C:\Users\Jam Master Nell\Desktop\Vocaloid 3 Korean Demo Song leaked [??? ????? ??? ??].mp3) -- C:\Users\Jam Master Nell\Desktop\Vocaloid 3 Korean Demo Song leaked [한국어 보컬로이드 데모곡 유출].mp3
[2011/09/02 00:22:23 | 004,035,962 | ---- | C] ()(C:\Users\Jam Master Nell\Desktop\Vocaloid 3 Korean Demo Song leaked [??? ????? ??? ??].mp3) -- C:\Users\Jam Master Nell\Desktop\Vocaloid 3 Korean Demo Song leaked [한국어 보컬로이드 데모곡 유출].mp3
[2011/09/01 23:47:42 | 002,200,733 | ---- | M] ()(C:\Users\Jam Master Nell\Desktop\??????????PONPONPON.mp3) -- C:\Users\Jam Master Nell\Desktop\【きゃりーれんれん】PONPONPON.mp3
[2011/09/01 23:47:38 | 002,200,733 | ---- | C] ()(C:\Users\Jam Master Nell\Desktop\??????????PONPONPON.mp3) -- C:\Users\Jam Master Nell\Desktop\【きゃりーれんれん】PONPONPON.mp3

< End of report >

Hello litepop,

It looks like Zugo is still there

Yes, it is so. Let delete it, but find all possible occurrences firstly...

Step 1.
SystemLook
Please download SystemLook_x64.exe by jpshortstuff and save it to your Desktop.
Alternate download site.

1. Double-click SystemLook_x64.exe to run it.
   If you receive an "Open file - security warning"... asking "Do you want to run this file?", press the Run button.
2. Highlight and copy the following entries from Code Box into SystemLook's main text entry window.
   

   
   
   :filefind
   
   *ZugoInstaller*
   
   

3. Press the Look button to start the scan.
   When finished, a Notepad window will open with the results of the scan.
   A file will be created (on your Desktop) with the results of the scan, named SystemLook.txt
4. Please post the contents of the SystemLook.txt file in your next reply.

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of a SystemLook.txt log file
3. Do you see any changes in computer behavior?

Thanks,
pgmigg

Here you go:

SystemLook 30.07.11 by jpshortstuff
Log created at 13:18 on 05/09/2011 by Jam Master Nell
Administrator - Elevation successful

========== filefind ==========

Searching for "*ZugoInstaller*"
C:\Program Files (x86)\Common Files\ZugoInstaller.exe --a---- 625736 bytes [05:52 10/08/2011] [14:14 22/07/2011] 34453C061BD17BA60CE98DE0BD653BA4

-= EOF =-


Thank youuuu!

Hello litepop,

Step 1.
OTL - Run Fix Script
You should still have this on your desktop, if so, ignore the download instructions.
Please download OTL.exe by Old Timer and save it to your Desktop.
Important! Close all applications and windows so that you have nothing open and are at your Desktop.

1. Right click on OTL.exe select "Run As Administrator..." to run it. If prompted by UAC, please allow it.
2. When the window appears, make sure Include 64bit Scans is CHECKED.
3. Underneath Output at the top, make sure Minimal Output is selected.
4. Under the Standard Registry box change it to All.
5. Check/tick the boxes beside LOP Check and Purity Check.
6. Copy and Paste the following code into the text box. Do not include the word Code
   

   
   
   :Files
   
   C:\Program Files (x86)\Common Files\ZugoInstaller.exe
   
   
   
   :Commands
   
   [PURITY]
   
   [EMPTYTEMP]
   
   [EMPTYFLASH]
   
   [REBOOT]
   
   

7. Click under the Custom Scan/Fixes box and paste the copied text.
8. Click the Run Fix button. If prompted... click OK.
9. OTL may ask to reboot the machine. Please do so if asked.
10. When the scan completes, Notepad will open with the scan results (OTL.txt). The report is saved in the same location as OTL.
11. Please post the contents of report in your next reply.

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of OTL.txt log file
3. Do you see any changes in computer behavior?

Thanks,
pgmigg

Hello!
When my computer rebooted I had a white screen for a while, so I rebooted again. Nothing was wrong, but I didn't realise it had just taken a bit for my computer to warm-up post-scan, I guess. So, I don't have the original OTL.txt, but I ran the scan again just to make sure and these were the results (Sorry, man, so many mistakes on my part :B). Thanks!

All processes killed
========== FILES ==========
File\Folder C:\Program Files (x86)\Common Files\ZugoInstaller.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Anybody Else

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jam Master Nell
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 6925643 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 608 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 7.00 mb


[EMPTYFLASH]

User: All Users

User: Anybody Else

User: Default

User: Default User

User: Jam Master Nell
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.27.0 log created on 09062011_145611

Files\Folders moved on Reboot...
C:\Users\Jam Master Nell\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
File\Folder C:\Windows\temp\_asw_aisI.tm~a03892\setup.lok not found!
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Hello litepop,

Your latest set of logs appear to be clean and hopefully I can say 'All Clean'!
Before I give you instructions how to keep your computer clean and secure, you need to make a few additional steps.

Step 1.
Update Adobe Reader
Your version of Adobe Reader is out-of-date. There are serious security issues with older versions of Adobe Reader.
I'm not asking you to update any Adobe Acrobat installation... this can be quite costly. I am going to insist that you update your Adobe Reader software.
Then use the Reader for viewing PDF files - you can use the Acrobat software for your other needs.

Firstly, I need you to uninstall old Adobe Reader from your computer.

1. Click on Start -> Control Panel and depends on View by selection in upper right corner:
   
   • If Category - click on Uninstall Programs.
   • If Icons - click on Programs and Features.
2. Locate the following program:
   Adobe Reader 9.1 MUI
3. Click on the Change/Remove button to uninstall it.
4. When the program(s) have been uninstalled, please close Control Panel.
5. Reboot your computer in Normal Mode.

Now, please download the current version of Adobe Reader...Copyright © Adobe Systems Inc.
Please UNCHECK the box for the: Free McAfee® Security Scan Plus.

1. Click the yellow Download now button. If you don't already have Adobe DLM... you may receive a prompt.
   Adobe DLM software removal instructions available here, if wanted.
2. The Adobe installer will check your system and begin the installation process. Use the default installation parameters.
3. When the installation is complete, please Close and re-open your Internet browser.

Adobe Reader X - recommended (safety) program settings
When the program is open, click on Edit and select Preferences. In the categories below, use these settings:

• Javascript - Uncheck Enable Acrobat Javascript.
• Security (Enhanced) - Uncheck Automatically trust sites from my Win OS security zones.
• Secure Trust Manager- Uncheck Allow opening of non-PDF file attachments with external applications.

Step 2.
Java Update Needed!
Your Java is out of date.
Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
Please follow these steps to remove older versions of Java components and update:

Attention: Print these instructions or copy them. You will be closing your browser!!

DOWNLOAD UPDATED VERSION

1. Get the latest version (7) of Java Runtime Environment (JRE)... © Sun Microsystems, Inc.
2. Click the "Download JRE" button to the right.
3. Check "Accept License Agreement "
4. Locate the entry for Windows x86 Offline and click on the associated file name, save the file to your desktop.

<STOP> Do not install the new version of Java yet. We need to do some cleanup first!

DELETE OLD JAVA FOLDER

1. Right click on the Start button.
2. Using the Start Search box on the Start Menu.
3. Navigate to and find the following folder: if found, delete it.
   It's possible it may have been removed by the uninstall steps
   C:\Program Files\Java\ <=== delete this entire folder
4. When finished, exit Search.

INSTALL UPDATED VERSION

1. Close all open applications (standard), especially your browser.
2. From Desktop please right-click on jre-7-windows-x64.exe select "Run As Administrator..." to install the newest version.
3. Follow the on-screen directions. When installation is completed successfully, reboot your computer normally.
4. Once the computer has been restarted, you can delete the "downloaded" installation file from your desktop.

OPTIONAL:
To prevent some unnecessary JAVA components from running when you boot your computer each time...

1. Go to Control Panel and click on the JAVA icon.
2. Press the Update tab and UNCHECK "Check for Updates Automatically". (You can check for updates manually.)
   
   Reply "Never Check" to the warning prompt.
3. Now press the Advanced tab. Press the [+] to expand the "Miscellaneous" options.
4. UNCHECK "Java Quick Starter".
5. Press Apply and OK, then close the Java Control Panel and exit Control Panel.

Step 3.
OTL-Cleanup
You should still have this on your desktop, if so, ignore the download instructions.
Please download OTL.exe by Old Timer and save it to your Desktop.

Right click on OTL.exe and select "Run As Administrator..." to run it. If prompted by UAC, please allow it.
Press the CleanUp button.
When done, you will be prompted to reboot your system to finish file removal, please select OK to reboot your computer.

If you did not reboot your computer normally, please do so now, before continuing.

Step 4.
Create a new, clean System Restore Point

Click Start, right click on Computer and select Properties.
In the left pane, click System Protection -> Create.
Give this restore point a descriptive name and click Create.
Click Apply and OK.

Step 5.
Deleting all but the most recent System Restore Points

Click on Start and type cleanmgr.exe in the opened box. Then press Enter.
Select the drive-letter from the list (usually System (C:)) and click OK. Wait for a while until Disk Cleanup is calculating how much space you will be able to free.
Select the More Options tab.
Select the Clean up… button under System Restore and Shadow Copies.
Click on Delete button at the opened question window and then click OK.
Click on Delete Files button at the next opened question window to confirm that action.

Please follow these simple guidelines in order to help keep your computer more secure:

Update your Antivirus programs and other programs regularly.
Secunia Personal Software Inspector - Copyright © Secunia. F-secure Health Check - Copyright © F-Secure Corporation.

Visit Microsoft often.
Keep on top of critical updates , as well as other updates for your computer.
What is Windows Update?
Microsoft Update Home

Install additional (free) programs, that can help improve security.
Many feel that having a "layered" protection scheme is beneficial, you'll have to decide what works best for your situation.
Here are a few you can look into, if you want.

Malwarebytes' Anti-Malware
You have this installed already, run scans weekly (at least)... make sure you check for updates before running scans.
Download it from Malewarebytes © Malwarebytes Corporation.
Tutorials are available for installing and running, Malwarebytes' Anti-Malware.
Powerful, easy to use and free. For real-time protection you will have to purchase the product.

WinPatrol
Do not install if you have installed Spybot Search & Destroy and enabled Teatimer protection. System conflicts can occur.
Download it from Copyright © BillP Studios
Information about how WinPatrol works, is available Here
(The free version of WinPatrol... provides limited real-time protection)

Read, stay informed.
To help minimize the chances of becoming re-infected, please read.
Computer Security - a short guide to staying safer online

If your computer is running slowly after your clean up, please read.
What to do if your Computer is running slowly

Please let me know that you completed the cleanup steps, the create/purge System Restore point steps and reviewed the rest of the post. Once I receive your reply, unless there are other malware questions or concerns, I will have this topic closed as resolved.

Stay Safe!
pgmigg

Yay! Thank you so much! I read through everything and completed all the steps, including downloading Secunia.
I was wondering, however, if I could reinstall Search & Destroy, and SuperAntiSpyware. Or do they conflict with the other things I have got installed? And also, would you recommend installing another firewall from this page viewtopic.php?p=557962#p557962 ? I know Avast has one, and I do have the Windows one, but you are the professional!

Again, thank you so much for all the help