removing infection trojan.win32.generic!bt

Customer

• June 10, 2021 15:24

i used the ad-aware free internet security to scan my computer it found 7 infections that it couldn't remove like couldn't set an action for them. i will list them bellow



Yontoo [1519] pup 2 were found

objects path c:\program file\...\oieclient.ddl



Yontoo pup found 2 infections

objects path HKCR: CLSID\[f\...\BAB4151CAD8}:

HKLM: software\...\BAB4151CAD8}:





win32.trojan.agent which is malware

objects path c:\users\owner\...\olbar4ffx.exe



Yontoo (v) which is adware

objects path c:\users\owner\...\installer.exe



trojan.win32.generic!Bt which is malware

objects path c:\users\owner\...\yer-setup.exe



if the program found the infections why couldn't it remove them. is there a way to remove them with program or manually if their is could you let me on it, that would be great

0

• 

  Customer

  • October 07, 1346 01:00

  Hi xradb22t,
  
  
  
  Can you send me a PM with your Dropbox account name, or the email address associated with it? I can give you access to my Dropbox sample folder.
  
  
  
  Andy
  
  Lavasoft Malware Labs

  0
• 

  Customer

  • June 10, 2021 15:24

  hi all i am a newbie to this forums so help me out a little ok. i found intructions for the removal for the trojan.win32.generic!bt
  
  
  
  [url="http://www.lavasoft.com/mylavasoft/malware-descriptions/blog/nrgbot"]http://www.lavasoft....ns/blog/nrgbot[/url]
  
  
  
  i dont get were to find the
  
  
  
  C:\ recycler\ s-1-5-21-02433556031-8888888379-781863308\ <rnd>.exe
  
  
  
  can someone help me with this pls. i can find all the others but i dont get were to locate this

  0
• 

  Support

  • June 10, 2021 15:24

  Hi xradb22t,
  
  
  
  I have merged your two topics.
  
  
  
  The link in your second post is about the trojan Nrgbot. Even if Ad-Aware reports Trojan.Win32.Generic!BT, it isn't necessary that it is Nrgbot since Trojan.Win32.Generic!BT is a generic name used for several types of malicious programs. In your case, I think that too is a part of Yontoo.
  
  
  
  Please, to get help with cleaning your computer follow the instructions in the topic [url="http://www.lavasoftsupport.com/index.php?showtopic=30823"]Read This Before You Post![/url].

  0
• 

  Customer

  • June 10, 2021 15:24

  i have downloaded the new ad aware free antivirus and im scanning the computer to see if it finds anything but i done as you requested i have gotten dds got 2 files and im going to post them. i just hope the new ad aware free antivirus can find what i wrote in my first post. can you identify if i have any infections.
  
  
  
  
  
  
  
  [attachment=9504:DDS log.txt]
  
  [attachment=9505:Attach.txt]

  0
• 

  Support

  • June 10, 2021 15:24

  Please, answer in this topic by writing in the box called "Reply to this topic".
  
  
  
  Uninstall:
  
  Ask Toolbar, reason: http://www.systemlookup.com/CLSID/56968-GenericAskToolbar_dll_GENERI_1_DLL.html
  
  Conduit Engine, reason: http://www.systemlookup.com/CLSID/70651-ConduitEngin_dll_ConduitEngine_dll_ConduitEngin0_dll_ConduitEngin1_dll_prxConduitEngin_dll_prxConduitEngine_dll_prxConduitEngin0_dll_prxConduitEngin1_dll_prxConduitEngin2_dll_ldrConduitEngine_dll_Local_DLL.html
  
  DVDVideoSoftTB Toolbar http://www.systemlookup.com/CLSID/71740-tbDVDV_dll_tbDVD0_dll_tbDVD1_dll_tbDVD2_dll_prxtbDVDV_dll_prxtbDVD0_dll_prxtbDVD1_dll_prxtbDVD2_dll.html
  
  PCHelpSoft Toolbar, reason: http://www.mywot.com/en/scorecard/pchelpsoft.com
  
  Java(TM) 6 Update 17, reason: Old version with known vulnerabilities which makes it easy to infect your computer from a web page.
  
  
  
  I also recommend you to uninstall uTorrent since a lot of malicious programs are distributed in that way.
  
  
  
  Change your start page in Internet Explorer to something else than funmoods.com, see comments on http://www.mywot.com/en/scorecard/funmoods.com
  
  
  
  When that is done, please restart the computer and run DDS program again. Paste the content of DDS.txt into your answer and I will check what is still in the log.

  0
• 

  Customer

  • June 10, 2021 15:24

  i have removed what you asked
  
  
  
  uninstalled ask toolbar 8/20/12
  
  uninstalled conduit engine 8/20/12
  
  uninstalled dvd video softwaretb 8/19/12 yesterday
  
  uninstalled pchelpsoftwaretb 8/19/12
  
  uninstalled javatm 6 update 17 8/20/12
  
  i also uninstalled aspca reminder by we-care.com my reasons i have no idea what it was and should it have been on this computer
  
  
  
  
  
  you will notice i have not removed utorrent my reason is
  
  i have been using this program as well on my laptop, and i never got an infection on my computer. This one your looking at is my sisters which was infected so im helping her remove these infections. i dont know where she downloads from, but i download movies of kickasstorrents.com, its from the sites where you get the torrent file thats where the infections get in from.
  
  
  
  you will also notice that in internet explorer the start up page is still funmoods.com. but i have already changed that done it after i made the dds logs
  
  
  
  
  
  
  
  [attachment=9506:DDS log.txt]
  
  [attachment=9507:Attach.txt]

  0
• 

  Support

  • June 10, 2021 15:24

  Much better logs now /smile.png' class='bbc_emoticon' alt=':)' /> but Yontoo is still there and some other minor things.
  
  You have switched back to Ad-Aware 9.6 now, haven't you?
  
  That is better to use 9.6 when Avast is installed.
  
  I think OTL will be the easiest way to remove Yontoo.
  
  Save OTL on the Desktop. [url="http://oldtimer.geekstogo.com/OTL.exe/"]http://oldtimer.geekstogo.com/OTL.exe[/url]
  
  Close all programs.
  
  Double-click OTL to run it.
  
  Click on [b]Quick Scan[/b] and do not use the computer while the program runs.
  
  When the program finishes two log files are created on the Desktop, OTL.txt och Extras.txt. Copy the content of the log OTL.txt and paste it directly into your answer but attach Extras.txt.

  0
• 

  Customer

  • June 10, 2021 15:24

  Yontoo is there because i cant remove it, click the uninstall button and this error shows up
  
  
  
  < x c:\progra~3\tarmai~1\ {889df~1\ setup.dat>
  
  error 2 while loading archive
  
  the system cannot find the file specified.
  
  
  
  i switched back to ad-aware 9.6 cause the anti-virus during a scan froze and was not responding besides it even froze the laptop i was running it on.
  
  
  
  i think that the infections are gone because i did another scan with ad-aware 9.6 it did not find anything i will write down what i did
  
  
  
  Path C:\users\owner\app data\local\temp
  
  in the temp folder i scrolled down untill i found the yantoo layers folder opened it and found this item\ yl jscript script file. considered it dangerous sent it to recycle bin\ should i have deleted it or not. clicked out of the folder and scrolled to the bottom and found these:
  
  
  
  zona1.0.0.8 jar
  
  zonainstall
  
  YontooIEclient.dll
  
  i sent these to the recycle bin as well.
  
  found a file for the babylon toolbar opened it found a jscript script file for it and sent it to recycle bin and deleted everything that was assocciated with it.
  
  
  
  after i did all of that i rebooted the laptop, noticed that before it started up slowly after it started up quickly. should i have done what i did or it was a unnecessary move? i did a scan with ad-aware 9.6 after restarting it did not find the infections.i will post the olt logs bellow
  
  
  
  
  
  OTL logfile created on: 8/21/2012 11:20:59 GO TO SLEEP! - Run 1
  
  OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\owner\Downloads\Desktop
  
  64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
  
  Internet Explorer (Version = 9.0.8112.16421)
  
  Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
  
  
  
  3.67 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 56.50% Memory free
  
  7.34 Gb Paging File | 5.47 Gb Available in Paging File | 74.56% Paging File free
  
  Paging file location(s): ?:\pagefile.sys [binary data]
  
  
  
  %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
  
  Drive C: | 289.23 Gb Total Space | 64.86 Gb Free Space | 22.42% Space Free | Partition Type: NTFS
  
  Drive D: | 3.77 Gb Total Space | 3.19 Gb Free Space | 84.83% Space Free | Partition Type: FAT32
  
  
  
  Computer Name: OWNER-VAIO | User Name: owner | Logged in as Administrator.
  
  Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
  
  Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
  
  
  
  [color=#E56717]========== Processes (SafeList) ==========[/color]
  
  
  
  PRC - [2012/08/20 14:46:10 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\owner\Downloads\Desktop\OTL.exe
  
  PRC - [2012/08/19 21:42:12 | 002,152,720 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
  
  PRC - [2012/07/03 09:21:30 | 004,273,976 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
  
  PRC - [2012/07/03 09:21:29 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
  
  PRC - [2012/05/28 22:50:30 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
  
  PRC - [2011/11/03 12:06:56 | 001,187,072 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
  
  PRC - [2011/02/14 18:32:52 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
  
  PRC - [2010/08/17 22:45:28 | 000,327,472 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe
  
  PRC - [2009/12/14 13:06:24 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
  
  PRC - [2009/12/14 13:06:08 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
  
  PRC - [2009/11/20 16:25:24 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
  
  PRC - [2009/11/20 16:25:22 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
  
  PRC - [2009/10/24 04:18:54 | 000,360,224 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
  
  PRC - [2009/10/05 14:57:46 | 000,016,384 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
  
  PRC - [2009/10/05 14:42:48 | 000,161,080 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
  
  PRC - [2009/10/05 14:42:48 | 000,033,792 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
  
  PRC - [2009/10/05 14:42:46 | 000,017,920 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
  
  PRC - [2009/08/26 20:24:00 | 000,320,880 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
  
  PRC - [2008/09/18 11:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
  
  
  
  
  
  [color=#E56717]========== Modules (No Company Name) ==========[/color]
  
  
  
  MOD - [2012/06/13 12:10:13 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
  
  MOD - [2012/06/13 12:09:34 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
  
  MOD - [2012/06/13 12:09:25 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
  
  MOD - [2012/05/11 03:42:46 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
  
  MOD - [2012/05/11 03:41:56 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
  
  MOD - [2012/05/11 03:41:49 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
  
  MOD - [2012/05/11 03:41:45 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
  
  MOD - [2012/05/11 03:41:44 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
  
  MOD - [2012/05/11 03:41:37 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
  
  MOD - [2012/04/23 15:35:09 | 000,630,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
  
  MOD - [2012/03/21 15:32:36 | 005,025,792 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
  
  MOD - [2012/01/03 19:51:03 | 003,190,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
  
  MOD - [2011/02/14 18:33:34 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
  
  MOD - [2011/02/14 18:32:52 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
  
  MOD - [2011/02/06 12:32:14 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
  
  MOD - [2010/11/04 18:58:14 | 002,048,000 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
  
  MOD - [2010/11/04 18:58:10 | 000,303,104 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
  
  MOD - [2010/11/04 18:58:09 | 000,385,024 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
  
  MOD - [2009/10/05 14:57:46 | 000,016,384 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
  
  MOD - [2009/10/05 14:42:50 | 000,121,856 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\SonyCommonLib.dll
  
  MOD - [2009/10/05 14:42:50 | 000,015,360 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.NativeWifiThirdPartyApp.dll
  
  MOD - [2009/10/05 14:42:50 | 000,011,264 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.TosBtThirdPartyApp.dll
  
  MOD - [2009/10/05 14:42:50 | 000,007,680 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\DebugMsg.dll
  
  MOD - [2009/10/05 14:42:50 | 000,004,608 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.Power.dll
  
  MOD - [2009/10/05 14:42:48 | 000,161,080 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
  
  MOD - [2009/10/05 14:42:48 | 000,107,008 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\DevicePanel.dll
  
  MOD - [2009/10/05 14:42:48 | 000,033,792 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
  
  MOD - [2009/10/05 14:42:48 | 000,027,648 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.BtPower.dll
  
  MOD - [2009/10/05 14:42:48 | 000,023,040 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.Generic.dll
  
  MOD - [2009/10/05 14:42:48 | 000,018,944 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\DictionaryLookup.dll
  
  MOD - [2009/10/05 14:42:48 | 000,006,656 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.WlanPower.dll
  
  MOD - [2009/10/05 14:42:48 | 000,005,120 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.ThirdPartyApp.dll
  
  MOD - [2009/10/05 14:42:48 | 000,005,120 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.Generic.dll
  
  MOD - [2009/10/05 14:42:46 | 000,017,920 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
  
  MOD - [2009/10/05 14:42:46 | 000,015,360 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\SharedInterfaces.dll
  
  MOD - [2009/10/05 14:42:46 | 000,011,264 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\MessageXML.dll
  
  MOD - [2009/10/05 14:42:46 | 000,009,728 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Resources.dll
  
  
  
  
  
  [color=#E56717]========== Win32 Services (SafeList) ==========[/color]
  
  
  
  SRV:[b]64bit:[/b] - [2012/07/03 09:21:29 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
  
  SRV:[b]64bit:[/b] - [2011/08/11 16:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
  
  SRV:[b]64bit:[/b] - [2009/09/04 14:35:12 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
  
  SRV:[b]64bit:[/b] - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  
  SRV - [2012/08/19 21:42:12 | 002,152,720 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
  
  SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
  
  SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
  
  SRV - [2009/12/14 13:06:24 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
  
  SRV - [2009/12/14 13:06:08 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
  
  SRV - [2009/11/20 16:25:24 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
  
  SRV - [2009/10/24 04:18:54 | 000,360,224 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
  
  SRV - [2009/08/31 02:59:30 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10)
  
  SRV - [2009/08/31 02:59:18 | 000,313,840 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10)
  
  SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  
  SRV - [2008/09/18 11:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor)
  
  
  
  
  
  [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  
  
  
  DRV:[b]64bit:[/b] - [2012/08/19 21:45:48 | 000,055,384 | ---- | M] (Sunbelt Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SBREDrv.sys -- (SBRE)
  
  DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,958,400 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
  
  DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,355,856 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
  
  DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,071,064 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
  
  DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
  
  DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
  
  DRV:[b]64bit:[/b] - [2012/07/03 09:21:51 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
  
  DRV:[b]64bit:[/b] - [2012/02/29 23:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  
  DRV:[b]64bit:[/b] - [2011/11/03 12:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
  
  DRV:[b]64bit:[/b] - [2011/07/22 09:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
  
  DRV:[b]64bit:[/b] - [2011/07/12 14:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
  
  DRV:[b]64bit:[/b] - [2011/03/10 23:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  
  DRV:[b]64bit:[/b] - [2011/03/10 23:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  
  DRV:[b]64bit:[/b] - [2011/02/18 17:36:58 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
  
  DRV:[b]64bit:[/b] - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  
  DRV:[b]64bit:[/b] - [2010/11/20 04:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
  
  DRV:[b]64bit:[/b] - [2010/11/20 02:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
  
  DRV:[b]64bit:[/b] - [2010/07/12 11:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
  
  DRV:[b]64bit:[/b] - [2010/05/26 10:39:08 | 000,006,144 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\ED5B.tmp -- (MEMSWEEP2)
  
  DRV:[b]64bit:[/b] - [2009/12/24 13:06:08 | 006,106,624 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
  
  DRV:[b]64bit:[/b] - [2009/12/16 13:03:59 | 000,244,736 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
  
  DRV:[b]64bit:[/b] - [2009/12/16 13:03:04 | 007,778,176 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
  
  DRV:[b]64bit:[/b] - [2009/12/14 13:06:07 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
  
  DRV:[b]64bit:[/b] - [2009/11/20 16:09:48 | 000,537,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
  
  DRV:[b]64bit:[/b] - [2009/11/17 21:30:44 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
  
  DRV:[b]64bit:[/b] - [2009/11/17 21:30:32 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
  
  DRV:[b]64bit:[/b] - [2009/11/17 21:30:32 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
  
  DRV:[b]64bit:[/b] - [2009/11/17 21:30:21 | 000,052,264 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt)
  
  DRV:[b]64bit:[/b] - [2009/11/17 21:23:46 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
  
  DRV:[b]64bit:[/b] - [2009/11/13 13:08:21 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
  
  DRV:[b]64bit:[/b] - [2009/11/12 13:16:19 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
  
  DRV:[b]64bit:[/b] - [2009/11/12 13:06:44 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
  
  DRV:[b]64bit:[/b] - [2009/11/06 13:27:30 | 000,093,696 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssne64.sys -- (rimspci)
  
  DRV:[b]64bit:[/b] - [2009/11/04 02:59:59 | 000,253,488 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
  
  DRV:[b]64bit:[/b] - [2009/09/15 13:09:08 | 000,075,776 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdsne64.sys -- (risdsnpe)
  
  DRV:[b]64bit:[/b] - [2009/08/19 13:09:21 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
  
  DRV:[b]64bit:[/b] - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  
  DRV:[b]64bit:[/b] - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  
  DRV:[b]64bit:[/b] - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  
  DRV:[b]64bit:[/b] - [2009/07/13 17:00:13 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Dot4Scan.sys -- (Dot4Scan)
  
  DRV:[b]64bit:[/b] - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  
  DRV:[b]64bit:[/b] - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  
  DRV:[b]64bit:[/b] - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  
  DRV:[b]64bit:[/b] - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  
  DRV:[b]64bit:[/b] - [2009/05/26 15:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)
  
  DRV:[b]64bit:[/b] - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
  
  DRV:[b]64bit:[/b] - [2008/06/27 07:51:10 | 000,088,632 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)
  
  DRV:[b]64bit:[/b] - [2008/05/06 16:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
  
  DRV:[b]64bit:[/b] - [2007/05/09 21:50:48 | 000,050,208 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)
  
  DRV:[b]64bit:[/b] - [2007/05/09 21:46:48 | 001,127,328 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI)
  
  DRV:[b]64bit:[/b] - [2007/05/09 21:46:36 | 000,016,032 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64)
  
  DRV - [2012/08/19 21:45:17 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
  
  DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  
  
  
  
  
  [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  
  
  
  
  
  [color=#E56717]========== Internet Explorer ==========[/color]
  
  
  
  IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
  
  IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  
  IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
  
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
  
  IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
  
  IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  
  IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SNNT
  
  IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
  
  IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
  
  
  
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
  
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
  
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.conduit.com?SearchSource=10&ctid=CT2269050
  
  IE - HKCU\..\URLSearchHook: {5c4cae29-c754-4ca3-89e1-90b82459159a} - No CLSID value found
  
  IE - HKCU\..\SearchScopes,DefaultScope = {3C19222F-EFA5-4EA1-A900-8E362B8E09CD}
  
  IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
  
  IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=110788&tt=290312_bexdll&babsrc=SP_ss&mntrId=84bcf95d0000000000002a8158ff39ee
  
  IE - HKCU\..\SearchScopes\{1678DB53-E92D-4508-8025-BE5029078AB5}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1587&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AA9&apn_dtid=^YYYYYY^CL^US&apn_uid=f1c2c0af-a25e-43e6-b521-289f4bd6989e&apn_sauid=50716A05-16FC-4904-8CFF-C3BB284DB926
  
  IE - HKCU\..\SearchScopes\{2BDD4ACF-C260-4080-B312-1669121CCAAF}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3106575
  
  IE - HKCU\..\SearchScopes\{3C19222F-EFA5-4EA1-A900-8E362B8E09CD}: "URL" = http://start.funmoods.com/results.php?f=4&a=ironto&q={searchTerms}
  
  IE - HKCU\..\SearchScopes\{63140ECF-C629-BE59-8F0E-90B4FF340C03}: "URL" = http://www.bing.com/search?q={searchTerms}&pc=Z128&form=ZGAIDF&install_date=20111009&iesrc={referrer:source}
  
  IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SNNT_enUS374US374
  
  IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
  
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
  
  
  
  
  
  [color=#E56717]========== FireFox ==========[/color]
  
  
  
  FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  
  FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
  
  FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
  
  FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
  
  FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
  
  FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
  
  FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
  
  FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  
  FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
  
  FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  
  FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  
  FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
  
  FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
  
  FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
  
  FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
  
  FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
  
  FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
  
  FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
  
  FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
  
  
  
  FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011/03/22 23:56:54 | 000,000,000 | ---D | M]
  
  FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011/03/22 23:56:55 | 000,000,000 | ---D | M]
  
  FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/08/15 14:05:56 | 000,000,000 | ---D | M]
  
  FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{859BC3F0-6A37-4BDF-9801-32B85DA58F70}: C:\Users\owner\AppData\Local\{859BC3F0-6A37-4BDF-9801-32B85DA58F70} [2010/04/17 18:34:50 | 000,000,000 | ---D | M]
  
  
  
  [2012/03/20 11:42:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
  
  
  
  [color=#E56717]========== Chrome ==========[/color]
  
  
  
  CHR - homepage: http://start.funmoods.com/?f=1&a=ironto
  
  CHR - default_search_provider: Search (Enabled)
  
  CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&a=axl&q={searchTerms}
  
  CHR - default_search_provider: suggest_url =
  
  CHR - homepage: http://start.funmoods.com/?f=1&a=ironto
  
  CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
  
  CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.79\ppGoogleNaClPluginChrome.dll
  
  CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.79\pdf.dll
  
  CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.79\gcswf32.dll
  
  CHR - plugin: Shockwave Flash (Disabled) = C:\Users\owner\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
  
  CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
  
  CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
  
  CHR - plugin: Java Deployment Toolkit 6.0.170.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
  
  CHR - plugin: Java(TM) Platform SE 6 U17 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
  
  CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
  
  CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
  
  CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
  
  CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
  
  CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
  
  CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
  
  CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
  
  CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
  
  CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
  
  CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
  
  CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
  
  CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
  
  CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
  
  CHR - plugin: RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
  
  CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
  
  CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
  
  CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
  
  CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
  
  CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
  
  CHR - Extension: YouTube = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
  
  CHR - Extension: Google Search = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
  
  CHR - Extension: DivX HiQ = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0\
  
  CHR - Extension: avast! WebRep = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1456_0\
  
  CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
  
  CHR - Extension: DivX Plus Web Player HTML5 video = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\
  
  CHR - Extension: Gmail = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
  
  CHR - Extension: Yann Arthus-Bertrand = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\plaekpceeonanmjojailaojkconcgofc\3_0\
  
  
  
  O1 HOSTS File: ([2012/08/15 14:21:59 | 000,444,105 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
  
  O1 - Hosts: 127.0.0.1 www.007guard.com
  
  O1 - Hosts: 127.0.0.1 007guard.com
  
  O1 - Hosts: 127.0.0.1 008i.com
  
  O1 - Hosts: 127.0.0.1 www.008k.com
  
  O1 - Hosts: 127.0.0.1 008k.com
  
  O1 - Hosts: 127.0.0.1 www.00hq.com
  
  O1 - Hosts: 127.0.0.1 00hq.com
  
  O1 - Hosts: 127.0.0.1 010402.com
  
  O1 - Hosts: 127.0.0.1 www.032439.com
  
  O1 - Hosts: 127.0.0.1 032439.com
  
  O1 - Hosts: 127.0.0.1 www.0scan.com
  
  O1 - Hosts: 127.0.0.1 0scan.com
  
  O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
  
  O1 - Hosts: 127.0.0.1 1000gratisproben.com
  
  O1 - Hosts: 127.0.0.1 1001namen.com
  
  O1 - Hosts: 127.0.0.1 www.1001namen.com
  
  O1 - Hosts: 127.0.0.1 100888290cs.com
  
  O1 - Hosts: 127.0.0.1 www.100888290cs.com
  
  O1 - Hosts: 127.0.0.1 www.100sexlinks.com
  
  O1 - Hosts: 127.0.0.1 100sexlinks.com
  
  O1 - Hosts: 127.0.0.1 www.10sek.com
  
  O1 - Hosts: 127.0.0.1 10sek.com
  
  O1 - Hosts: 127.0.0.1 www.1-2005-search.com
  
  O1 - Hosts: 127.0.0.1 1-2005-search.com
  
  O1 - Hosts: 127.0.0.1 www.123fporn.info
  
  O1 - Hosts: 15252 more lines...
  
  O2:[b]64bit:[/b] - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
  
  O2:[b]64bit:[/b] - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
  
  O2:[b]64bit:[/b] - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
  
  O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
  
  O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
  
  O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
  
  O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
  
  O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found
  
  O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll File not found
  
  O3:[b]64bit:[/b] - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
  
  O3:[b]64bit:[/b] - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
  
  O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
  
  O3:[b]64bit:[/b] - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
  
  O4:[b]64bit:[/b] - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
  
  O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
  
  O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
  
  O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
  
  O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
  
  O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
  
  O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
  
  O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
  
  O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
  
  O4 - HKLM..\Run: [SmartWiHelper] C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe (Sony Electronics Corporation)
  
  O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
  
  O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
  
  O4 - HKCU..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
  
  O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  
  O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  
  O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
  
  O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
  
  O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  
  O8:[b]64bit:[/b] - Extra context menu item: Free YouTube Download - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
  
  O8:[b]64bit:[/b] - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
  
  O8 - Extra context menu item: Free YouTube Download - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
  
  O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
  
  O9:[b]64bit:[/b] - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
  
  O9:[b]64bit:[/b] - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
  
  O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
  
  O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
  
  O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
  
  O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
  
  O13[b]64bit:[/b] - gopher Prefix: missing
  
  O13 - gopher Prefix: missing
  
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
  
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
  
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DD0B22D-C026-4940-9700-1362E8BA5673}: DhcpNameServer = 192.168.0.1
  
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}: DhcpNameServer = 192.168.0.1
  
  O18:[b]64bit:[/b] - Protocol\Handler\grooveLocalGWS - No CLSID value found
  
  O18:[b]64bit:[/b] - Protocol\Handler\linkscanner - No CLSID value found
  
  O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
  
  O18:[b]64bit:[/b] - Protocol\Handler\ms-itss - No CLSID value found
  
  O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
  
  O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found
  
  O18 - Protocol\Handler\linkscanner - No CLSID value found
  
  O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  
  O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  
  O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not found
  
  O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
  
  O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
  
  O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
  
  O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
  
  O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\SysWow64\VESWinlogon.dll (Sony Corporation)
  
  O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  
  O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  
  O32 - HKLM CDRom: AutoRun - 1
  
  O33 - MountPoints2\{002e4363-4d35-11e0-826b-54424903294d}\Shell - "" = AutoRun
  
  O33 - MountPoints2\{002e4363-4d35-11e0-826b-54424903294d}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
  
  O33 - MountPoints2\{b7c9ae67-4384-11df-b12c-54424903294d}\Shell - "" = AutoRun
  
  O33 - MountPoints2\{b7c9ae67-4384-11df-b12c-54424903294d}\Shell\AutoRun\command - "" = "D:\WD SmartWare.exe" autoplay=true
  
  O33 - MountPoints2\{dcf2eb74-95ea-11e0-ac82-54424903294d}\Shell - "" = AutoRun
  
  O33 - MountPoints2\{dcf2eb74-95ea-11e0-ac82-54424903294d}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
  
  O33 - MountPoints2\D\Shell - "" = AutoRun
  
  O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
  
  O34 - HKLM BootExecute: (autocheck autochk *)
  
  O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  
  O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  
  O35 - HKLM\..comfile [open] -- "%1" %*
  
  O35 - HKLM\..exefile [open] -- "%1" %*
  
  O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  
  O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  
  O37 - HKLM\...com [@ = comfile] -- "%1" %*
  
  O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  
  O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  
  O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  
  O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  
  
  
  [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  
  
  
  [2012/08/21 11:18:57 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\owner\Downloads\Desktop\OTL.exe
  
  [2012/08/19 21:56:50 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
  
  [2012/08/19 21:56:50 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
  
  [2012/08/19 21:50:42 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
  
  [2012/08/19 21:40:35 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Roaming\SUPERAntiSpyware.com
  
  [2012/08/19 21:40:28 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
  
  [2012/08/19 21:37:42 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
  
  [2012/08/19 21:37:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
  
  [2012/08/19 21:37:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
  
  [2012/08/19 21:37:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
  
  [2012/08/19 20:06:32 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Local\Downloaded Installations
  
  [2012/08/17 13:31:07 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
  
  [2012/08/15 17:31:18 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
  
  [2012/08/15 14:52:25 | 000,000,000 | ---D | C] -- C:\Users\owner\Documents\Zona Downloads
  
  [2012/08/15 14:35:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
  
  [2012/08/15 14:33:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
  
  [2012/08/15 14:33:55 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
  
  [2012/08/15 14:33:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
  
  [2012/08/15 14:20:18 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
  
  [2012/08/15 14:20:18 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
  
  [2012/08/15 14:20:17 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
  
  [2012/08/15 14:20:17 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
  
  [2012/08/15 14:20:17 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
  
  [2012/08/15 14:20:16 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
  
  [2012/08/15 14:20:16 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
  
  [2012/08/15 14:20:16 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
  
  [2012/08/15 14:20:16 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
  
  [2012/08/15 14:20:16 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
  
  [2012/08/15 14:20:16 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
  
  [2012/08/15 14:20:14 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
  
  [2012/08/15 14:20:14 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
  
  [2012/08/15 14:18:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
  
  [2012/08/15 14:17:09 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
  
  [2012/08/15 14:16:57 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
  
  [2012/08/15 14:16:57 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
  
  [2012/08/15 14:16:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
  
  [2012/08/15 14:16:56 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
  
  [2012/08/15 14:16:55 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
  
  [2012/08/15 14:16:55 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
  
  [2012/08/15 14:16:55 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
  
  [2012/08/12 21:51:46 | 000,000,000 | ---D | C] -- C:\ProgramData\GFI Software
  
  [2012/08/12 21:51:04 | 000,000,000 | -HSD | C] -- C:\Config.Msi
  
  [2012/08/12 20:19:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
  
  [2012/08/12 13:08:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
  
  [2012/08/12 13:08:50 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
  
  [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
  
  
  
  [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  
  
  
  [2012/08/21 11:24:09 | 000,014,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  
  [2012/08/21 11:24:09 | 000,014,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  
  [2012/08/21 11:15:15 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
  
  [2012/08/21 11:15:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  
  [2012/08/21 11:14:57 | 2955,485,184 | -HS- | M] () -- C:\hiberfil.sys
  
  [2012/08/20 14:46:10 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\owner\Downloads\Desktop\OTL.exe
  
  [2012/08/20 11:15:42 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
  
  [2012/08/19 23:59:39 | 000,131,072 | ---- | M] () -- C:\Windows\ocsetup_uninstall_OEMHelpCustomization.etl
  
  [2012/08/19 21:45:48 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
  
  [2012/08/19 21:40:32 | 000,001,808 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
  
  [2012/08/19 21:37:43 | 000,001,060 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
  
  [2012/08/19 20:26:26 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\SBRC.dat
  
  [2012/08/17 13:18:20 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
  
  [2012/08/17 13:18:20 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
  
  [2012/08/15 14:33:57 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  
  [2012/08/15 14:25:00 | 003,073,232 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
  
  [2012/08/15 14:22:51 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
  
  [2012/08/15 14:21:59 | 000,444,105 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
  
  [2012/08/10 15:05:42 | 000,726,444 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
  
  [2012/08/10 15:05:42 | 000,624,412 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
  
  [2012/08/10 15:05:42 | 000,106,756 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
  
  [2012/07/26 00:52:38 | 000,116,937 | ---- | M] () -- C:\test.xml
  
  [2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
  
  
  
  [color=#E56717]========== Files Created - No Company Name ==========[/color]
  
  
  
  [2012/08/19 23:58:20 | 000,131,072 | ---- | C] () -- C:\Windows\ocsetup_uninstall_OEMHelpCustomization.etl
  
  [2012/08/19 21:40:32 | 000,001,808 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
  
  [2012/08/19 21:37:43 | 000,001,060 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
  
  [2012/08/19 20:26:26 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\SBRC.dat
  
  [2012/08/17 13:18:20 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
  
  [2012/08/17 13:18:20 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
  
  [2012/08/15 14:33:57 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  
  [2011/10/19 23:52:15 | 000,027,071 | ---- | C] () -- C:\Users\owner\AppData\Roaming\Crescendo.dmp
  
  [2010/12/26 22:03:32 | 000,003,584 | ---- | C] () -- C:\Users\owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  
  [2010/12/15 05:45:51 | 000,004,096 | -H-- | C] () -- C:\Users\owner\AppData\Local\keyfile3.drm
  
  [2010/05/05 19:31:37 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
  
  [2010/04/17 18:34:56 | 000,000,120 | ---- | C] () -- C:\Users\owner\AppData\Local\Qticuca.dat
  
  [2010/04/17 18:34:56 | 000,000,000 | ---- | C] () -- C:\Users\owner\AppData\Local\Vgumipizulufu.bin
  
  
  
  [color=#E56717]========== Files - Unicode (All) ==========[/color]
  
  [2012/06/12 17:07:22 | 003,800,532 | ---- | C] ()(C:\Users\owner\Downloads\Desktop\???? ??????? _????? ??? ?? memory_ ????.mp3) -- C:\Users\owner\Downloads\Desktop\Вика Дайнеко _Сотри его из memory_ клип.mp3
  
  [2012/05/06 13:16:28 | 003,800,532 | ---- | M] ()(C:\Users\owner\Downloads\Desktop\???? ??????? _????? ??? ?? memory_ ????.mp3) -- C:\Users\owner\Downloads\Desktop\Вика Дайнеко _Сотри его из memory_ клип.mp3
  
  [2012/02/09 01:56:09 | 000,023,087 | ---- | M] ()(C:\Users\Public\Documents\????.docx) -- C:\Users\Public\Documents\торт.docx
  
  [2012/02/09 01:56:09 | 000,023,087 | ---- | C] ()(C:\Users\Public\Documents\????.docx) -- C:\Users\Public\Documents\торт.docx
  
  [2012/02/09 01:56:05 | 000,018,218 | ---- | M] ()(C:\Users\Public\Documents\?????.docx) -- C:\Users\Public\Documents\салат.docx
  
  [2012/02/09 01:56:04 | 000,018,218 | ---- | C] ()(C:\Users\Public\Documents\?????.docx) -- C:\Users\Public\Documents\салат.docx
  
  [2011/09/23 19:16:37 | 000,011,090 | ---- | M] ()(C:\Users\Public\Documents\? ?????? ???? ????? ??????.docx) -- C:\Users\Public\Documents\В грубые ясли рукою нежной.docx
  
  [2011/09/23 19:16:37 | 000,011,090 | ---- | C] ()(C:\Users\Public\Documents\? ?????? ???? ????? ??????.docx) -- C:\Users\Public\Documents\В грубые ясли рукою нежной.docx
  
  [2011/09/16 03:02:19 | 000,002,429 | ---- | M] ()(C:\Users\Public\Documents\?????????.crs) -- C:\Users\Public\Documents\обрашайся.crs
  
  [2011/09/16 03:02:19 | 000,002,429 | ---- | C] ()(C:\Users\Public\Documents\?????????.crs) -- C:\Users\Public\Documents\обрашайся.crs
  
  [2011/03/06 16:22:23 | 000,011,475 | ---- | M] ()(C:\Users\Public\Documents\?? ????????? ???.docx) -- C:\Users\Public\Documents\Не забывайте тех.docx
  
  [2011/03/06 16:22:22 | 000,011,475 | ---- | C] ()(C:\Users\Public\Documents\?? ????????? ???.docx) -- C:\Users\Public\Documents\Не забывайте тех.docx
  
  [2010/12/27 18:29:48 | 000,013,258 | ---- | M] ()(C:\Users\Public\Documents\??? ?????.docx) -- C:\Users\Public\Documents\квн песня.docx
  
  [2010/12/20 16:35:29 | 000,013,258 | ---- | C] ()(C:\Users\Public\Documents\??? ?????.docx) -- C:\Users\Public\Documents\квн песня.docx
  
  [2010/12/19 21:58:21 | 000,625,152 | ---- | C] ()(C:\Users\Public\Documents\1570 ????????.doc) -- C:\Users\Public\Documents\1570 вопросов.doc
  
  [2010/12/15 06:10:46 | 000,012,094 | ---- | M] ()(C:\Users\Public\Documents\??? ????????.docx) -- C:\Users\Public\Documents\Кто счастлив.docx
  
  [2010/12/15 06:10:45 | 000,012,094 | ---- | C] ()(C:\Users\Public\Documents\??? ????????.docx) -- C:\Users\Public\Documents\Кто счастлив.docx
  
  [2010/12/15 06:10:28 | 000,024,628 | ---- | M] ()(C:\Users\Public\Documents\?????? ?? ?????????1.docx) -- C:\Users\Public\Documents\Сценки на праздники1.docx
  
  [2010/12/15 06:10:27 | 000,024,628 | ---- | C] ()(C:\Users\Public\Documents\?????? ?? ?????????1.docx) -- C:\Users\Public\Documents\Сценки на праздники1.docx
  
  [2010/12/11 16:14:45 | 000,026,163 | ---- | M] ()(C:\Users\Public\Documents\????? ??? ? ?????.docx) -- C:\Users\Public\Documents\Новый Год в клубе.docx
  
  [2010/12/08 23:03:09 | 000,022,494 | ---- | M] ()(C:\Users\Public\Documents\??????? ????.docx) -- C:\Users\Public\Documents\Доверие Богу.docx
  
  [2010/12/08 05:45:47 | 000,019,028 | ---- | M] ()(C:\Users\Public\Documents\??????????? ????.docx) -- C:\Users\Public\Documents\ДЕЙСТВУЮЩИЕ ЛИЦА.docx
  
  [2010/12/08 05:45:47 | 000,019,028 | ---- | C] ()(C:\Users\Public\Documents\??????????? ????.docx) -- C:\Users\Public\Documents\ДЕЙСТВУЮЩИЕ ЛИЦА.docx
  
  [2010/12/08 05:35:01 | 000,014,303 | ---- | M] ()(C:\Users\Public\Documents\?????? ?? ?????????.docx) -- C:\Users\Public\Documents\Сценки на праздники.docx
  
  [2010/12/08 05:35:01 | 000,014,303 | ---- | C] ()(C:\Users\Public\Documents\?????? ?? ?????????.docx) -- C:\Users\Public\Documents\Сценки на праздники.docx
  
  [2010/12/08 05:15:39 | 000,022,494 | ---- | C] ()(C:\Users\Public\Documents\??????? ????.docx) -- C:\Users\Public\Documents\Доверие Богу.docx
  
  [2010/12/08 04:57:54 | 000,026,163 | ---- | C] ()(C:\Users\Public\Documents\????? ??? ? ?????.docx) -- C:\Users\Public\Documents\Новый Год в клубе.docx
  
  [2010/11/26 17:24:12 | 000,011,247 | ---- | M] ()(C:\Users\Public\Documents\?? ??? ?????????.docx) -- C:\Users\Public\Documents\Ты моя жемчужина.docx
  
  [2010/11/26 17:24:12 | 000,011,247 | ---- | C] ()(C:\Users\Public\Documents\?? ??? ?????????.docx) -- C:\Users\Public\Documents\Ты моя жемчужина.docx
  
  [2009/05/26 08:12:10 | 000,625,152 | ---- | M] ()(C:\Users\Public\Documents\1570 ????????.doc) -- C:\Users\Public\Documents\1570 вопросов.doc
  
  
  
  < End of report >
  
  
  
  
  
  [attachment=9508:Extras.Txt]

  0
• 

  Support

  • June 10, 2021 15:24

  Do you find anything with "Java" among the plugins?
  
  Maybe [url="http://superuser.com/questions/201613/disable-java-plugin-in-google-chrome"]http://superuser.com...n-google-chrome[/url] is useful.
  
  
  
  Please, continue with the rest even if you have problems with Java.

  0
• 

  Support

  • June 10, 2021 15:24

  There are some left-overs of funmood, the uninstalled toolbars, Yontoo, that you have to remove.
  
  
  
  1.
  
  CHR - plugin: Java Deployment Toolkit 6.0.170.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
  
  CHR - plugin: Java™ Platform SE 6 U17 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
  
  Those two lines are that old Java version, which is still installed in Google Chrome. Can you find how to remove it from Chrome?
  
  
  
  2.
  
  Save SystemLook on the desktop: http://jpshortstuff.247fixes.com/SystemLook_x64.exe
  
  
  
  Double-click on SystemLook file to run it.
  
  
  
  Copy all lines in the box
  
  [code]
  
  :dir
  
  C:\Users\owner\AppData\Local\{859BC3F0-6A37-4BDF-9801-32B85DA58F70}
  
  [/code]
  
  and paste in the big text field in SýstemLook.
  
  Click on the Look button to start the search.
  
  When finished Notepad will pop-up with the log. Copy the log and paste into your answer. If Notepad doesn't pop-up you can find the log as SystemLook.txt on the Desktop.
  
  
  
  3.
  
  Close all programs including antivirus programs and other similar programs. Otherwise they might stop OTL.
  
  How? See http://www.bleepingcomputer.com/forums/topic114351.html
  
  
  
  Start the program OTL.
  
  
  
  Copy all the lines in the box:
  
  [code]
  
  :OTL
  
  IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.condui...&ctid=CT2269050
  
  IE - HKCU\..\URLSearchHook: {5c4cae29-c754-4ca3-89e1-90b82459159a} - No CLSID value found
  
  IE - HKCU\..\SearchScopes,DefaultScope = {3C19222F-EFA5-4EA1-A900-8E362B8E09CD}
  
  IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylo...0002a8158ff39ee
  
  IE - HKCU\..\SearchScopes\{1678DB53-E92D-4508-8025-BE5029078AB5}: "URL" = http://websearch.ask...FF-C3BB284DB926
  
  IE - HKCU\..\SearchScopes\{2BDD4ACF-C260-4080-B312-1669121CCAAF}: "URL" = http://search.condui...&ctid=CT3106575
  
  IE - HKCU\..\SearchScopes\{3C19222F-EFA5-4EA1-A900-8E362B8E09CD}: "URL" = http://start.funmood...q={searchTerms}
  
  CHR - homepage: http://start.funmood...m/?f=1&a=ironto
  
  CHR - default_search_provider: search_url = http://start.funmood...q={searchTerms}
  
  CHR - homepage: http://start.funmood...m/?f=1&a=ironto
  
  O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
  
  O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found
  
  O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll File not found
  
  :Commands
  
  [CREATERESTOREPOINT]
  
  [REBOOT]
  
  [/code]
  
  Paste them into the field Custom Scans/Fixes.
  
  Click on Run Fix.
  
  
  
  If you are asked to restart the computer do that.
  
  
  
  Notepad will pop-up with a log. Copy it and paste it into your answer.
  
  If it is not pop-upped, you can find it in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.
  
  
  
  Be sure that antivirus programs etc. are active before connecting to internet.
  
  
  
  4.
  
  Run OTL as you did the first time and post OTL.txt (Extras.txt will not be created).

  0
• 

  Customer

  • June 10, 2021 15:24

  there is one problem with removing the java deployment toolkit. i opened the chrome browser in the address bar i typed
  
  
  
  chrome://plugins which is how you can access all the installed plugins in google chrome.
  
  i did not find the Java Deployment Toolkit 6.0.170.4 and the Java™ Platform SE 6 U17 among all the plugins in google chrome so i couldn't remove them.
  
  thats the only way i know of removing plugins and disabling in google chrome.

  0
• 

  Customer

  • June 10, 2021 15:24

  i didn't find anything with java among the plugins
  
  
  
  i will past the systemlook log bellow
  
  
  
  
  
  [attachment=9510:SystemLook.txt]
  
  
  
  should i leave the two files that popped up on the desktop
  
  
  
  desktop.ini
  
  desktop.ini
  
  they look like there blanked out gray color
  
  
  
  post the ost log bellow
  
  
  
  
  
  [attachment=9511:OTL.Txt]

  0
• 

  Support

  • June 10, 2021 15:24

  Yes, leave the two desktop.ini. They are marked as hidden but at the moment you can see hidden files even if they have another color.
  
  
  
  Please, see if you can find the log file that were created when you ran OTL to fix something (3.). It should be in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.

  0
• 

  Customer

  • June 10, 2021 15:24

  here is the file
  
  
  
  [attachment=9512:08222012_001449.log]
  
  
  
  is this the one

  0
• 

  Support

  • June 10, 2021 15:24

  Yes, that was the right log /smile.png' class='bbc_emoticon' alt=':)' />
  
  
  
  Close all programs including antivirus programs and other similar programs. Otherwise they might stop OTL.
  
  How? See http://www.bleepingcomputer.com/forums/topic114351.html
  
  
  
  Start the program OTL.
  
  Copy all the lines in the box:
  
  [code]
  
  :OTL
  
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.conduit.com?SearchSource=10&ctid=CT2269050
  
  CHR - homepage: http://start.funmoods.com/?f=1&a=ironto
  
  CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&a=axl&q={searchTerms}
  
  CHR - homepage: http://start.funmoods.com/?f=1&a=ironto
  
  CHR - plugin: Java Deployment Toolkit 6.0.170.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
  
  CHR - plugin: Java(TM) Platform SE 6 U17 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
  
  @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
  
  @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2
  
  :Commands
  
  [CREATERESTOREPOINT]
  
  [REBOOT]
  
  [/code]
  
  Paste them into the field Custom Scans/Fixes.
  
  Click on Run Fix.
  
  
  
  If you are asked to restart the computer do that.
  
  
  
  Check that the start page and default search provider in Google Chrome aren't funmoods.com.
  
  
  
  Notepad will pop-up with a log. Copy it and paste it into your answer.
  
  If it is not pop-upped, you can find it in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.
  
  
  
  Be sure that antivirus programs etc. are active before connecting to internet.

  0
• 

  Customer

  • June 10, 2021 15:24

  sorry that my reply will be a little different from your instructions, i am going to report the following.
  
  
  
  Ad-aware free internet security only found what it could posted in my first topic with all the detection's, i will post what it failed to detect.
  
  
  
  
  
  [attachment=9516:08.22.2012.log]
  
  in this log it shows what ad-aware did not detect, so i had more infections on this computer that what was posted in my first topic.
  
  
  
  another what it did not detect that will not be in the log is backdoor.frauder.
  
  found these with anvi smart defender and what it found it removed.
  
  
  
  ad-aware should have detected them in the first place, even the ad-aware 10 anti-virus that i used will not be able to detect them as well.
  
  
  
  i will reply following your instructions after this report.

  0
• 

  Support

  • June 10, 2021 15:24

  You can NOT trust Anvi Smart Defender. Here is a review of it[quote] In testing, it proved almost wholly unable to cleanup malware threats and also did a very poor job preventing malware attacks on a clean system. Worse, it repeatedly identified perfectly valid Windows files as malware. You've been warned; stay away.[/quote]http://www.pcmag.com/article2/0,2817,2405313,00.asp
  
  
  
  There are of course no viruses inside Adobe Reader, for example. Anvi has also removed something that has to do with Avast.
  
  
  
  I recommend that you do a system restore to a restore point created before you run Anvi:
  
  Start menu - Programs - Accessories - System Tools - System Restore
  
  That will undo most of the damage Anvi did.

  0
• 

  Customer

  • June 10, 2021 15:24

  hey i followed your instructions with the olt. it didn't quite complete when i ran the olt run fix it in the processes it only showed creating restorepoint rebooting and nothing else so it did not work.
  
  
  
  after the reboot the computer always freezes and i cannot do anything on it anymore, it is unresponsive i need help dont know what to do. any help please need to fix this.

  0
• 

  Support

  • June 10, 2021 15:24

  If you no longer can do the system restore in normal mode, please boot the computer to the System Recovery Options and perform the system restore, see http://www.sevenforums.com/tutorials/700-system-restore.html Option Two.

  0
• 

  Customer

  • June 10, 2021 15:24

  why did i use anvi? simple i had no where else to turn to.
  
  
  
  the malware that i posted in one of my replies did not get detected by
  
  Malware-bytes Anti-malware
  
  Superantispyware which is able to detect malware as well
  
  
  
  these two are at the top of malware removers, if they didn't detect them it doesn't mean they weren't present.
  
  those malware i posted were on the computer, i just don't see why they couldn't be detected.
  
  
  
  does this mean that one of those malware hid all of those infections and bypassed them so that they don't get detected.
  
  
  
  what anvi did on this computer i am using to reply in this topic. first off this computer had no internet access because all of those
  
  malware were blocking the computer from communicating with the dns server. i did a network diagnostic troubleshooter and it reported that the dns server is not responding.
  
  
  
  after the scan and if those infections were removed, previously there was a yellow ! mark on the bars where it says if you have
  
  access to the network, you probably know what those bars are, well anyway now i do have access to the internet and it seems those malware were removed, because this computer was running slow on start-up and slow at loading programs in windows,
  
  now its running much faster than before.
  
  
  
  i uninstalled anvi for safety and did a system restore picked one 2 days before i used the program. 2 days ago i had no access to the internet and my computer was running slow, now after the restore i have access and the computer seems to be running much better than before.
  
  
  
  is there a way to see if it did remove them or not or did it do any damage, can one of the logs by dds or otl show if anything was done. if there is i will make it and post it

  0
• 

  Customer

  • June 10, 2021 15:24

  yes i meant what anvi detected
  
  
  
  [font="helvetica, arial, sans-serif"][color="#282828"]When did i loose my internet connection, i lost my internet connection when this computer got infected. i did not make any changes. here is the otl log i created. [/color][/font]
  
  
  
  
  
  [attachment=9517:OTL.Txt]
  
  
  
  
  
  
  
  [font="helvetica, arial, sans-serif"][color="#282828"]is there a possible chance to report what you find to malware-bytes so they could improve their program at detecting malicious software and hard to detect malware. i don't want to open a user account with them to report it myself, to much of a hassle and i wouldn't even know what to report.[/color][/font]

  0
• 

  Support

  • June 10, 2021 15:24

  [quote]the malware that i posted in one of my replies[/quote]Do you mean those in your first post? They have been removed.
  
  Or do you mean those that Anvi claimed you had? Anvi didn't detect any active malware. Anvi claimed that files belonging to your WinRAR, Adobe Reader, DVDVideoSoft Free Audio CD to MP3 Converter and Avast were malware, for example pretending that Adobe Reader contains a password stealer for online games. If you didn't have cracked versions of those programs it is nonsense (and since Adobe Reader is free it makes no sense to have a cracked version of it). I suggest that you reinstall those four programs to be sure that they aren't damaged by Anvi.
  
  
  
  If you want me to help you, please don't run other programs. If you get any problems, as a lost internet connection, please tell me.
  
  When did you loose your internet connection, after doing what?
  
  
  
  Please, run OTL and paste OTL.txt.

  0
• 

  Support

  • June 10, 2021 15:24

  Sorry, I don't report anything to Malwarebytes, only to Lavasoft.
  
  
  
  Repeat step 3 and 4 in post#9, since the system restore undid those changes.

  0
• 

  Customer

  • June 10, 2021 15:24

  is it to late to try and use hijack this, like you posted in Please help fight malware! submitting files is easy, or i should not do that?
  
  
  
  here is the olt log i created
  
  
  
  [attachment=9518:OTL.Txt]

  0
• 

  Support

  • June 10, 2021 15:24

  We don't use the HijackThis program any more, nowadays it is DDS, OTL and other programs instead. All these programs moves the malware files to a quarantine and when everything is fine with the computer, I will tell you how to collect the quarantined files and send them to Lavasoft.
  
  
  
  1. Change your home page in Google Chrome. At the moment it is a search page provided by Conduit, which is spying on you (more than Google).
  
  
  
  2. Close all programs including antivirus programs and other similar programs as Comodo. Otherwise they might stop OTL.
  
  How? See http://www.bleepingcomputer.com/forums/topic114351.html
  
  
  
  Start the program OTL.
  
  Copy all the lines in the box:
  
  [code]
  
  :OTL
  
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.conduit.com?SearchSource=10&ctid=CT2269050
  
  :Commands
  
  [CREATERESTOREPOINT]
  
  [REBOOT]
  
  [/code]
  
  Paste them into the field Custom Scans/Fixes.
  
  Click on Run Fix.
  
  
  
  If you are asked to restart the computer do that.
  
  
  
  Notepad will pop-up with a log. Copy it and paste it into your answer.
  
  If it is not pop-upped, you can find it in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.
  
  
  
  Be sure that antivirus programs etc. are active before connecting to internet.
  
  
  
  Run a Quick Scan in OTL and post OTL.txt.
  
  
  
  3. Run an online scan with Eset http://www.eset.com/onlinescan/
  
  To shorten the scanning time disable your antivirus program while scanning.
  
  
  
  Un-check "Remove found threats"
  
  Check "Scan Archives"
  
  
  
  Click "Advanced Settings"
  
  Check:
  
  Scan for potentially unwanted applications
  
  Scan for potentially unsafe applications
  
  Enable Anti-Stealth Technology
  
  
  
  Click Scan
  
  
  
  When the scan completes copy the result of the scan and paste it into your answer.

  0
• 

  Customer

  • June 10, 2021 15:24

  this is the second half to my previous reply i did the scan with eset online scanner and this is what it found.
  
  
  
  
  
  [attachment=9521:eset scan.txt]
  
  
  
  what is the next step after detection, how am i going to move the infected files to lavasoft.

  0
• 

  Customer

  • June 10, 2021 15:24

  i will post the 1 log i did with the instructions
  
  
  
  [attachment=9519:08252012_031838.log]
  
  
  
  my home page is still conduit because i set home page to Google default and it does not want to make Google the default home page. the fix with otl did not work.
  
  
  
  i will post the quick scan log bellow
  
  
  
  [attachment=9520:OTL.Txt]
  
  
  
  the rest i will post in the next reply don't have time gotta run have to do something else.

  0
• 

  Support

  • June 10, 2021 15:24

  Are you sure that you included the line:
  
  :OTL
  
  when you tried to fix with OTL?
  
  Please, try again.

  0
• 

  Customer

  • June 10, 2021 15:24

  i have redone the fix and i will post the log
  
  
  
  [attachment=9522:08262012_001909.log]
  
  
  
  i downloaded Avira-Antivir because different antiviruses find different things just to check if i dont have anything else that is infected. although i will not keep 2 anti viruses installed ran the scan with avira saved the log i made and i will post it bellow, have already uninstalled it.
  
  
  
  [attachment=9523:AVSCAN-20120825-232137-BB8540BD.LOG]
  
  it did find an infection, its almost at the bottom where it says, starting to scan executable file (registry).
  
  it found a file, that contains virus patterns of Adware Adware/installcore.gen.
  
  should i remove the program its associated with/ Foxtab video to mp3

  0
• 

  Support

  • June 10, 2021 15:24

  Good! OTL fix worked.
  
  
  
  You shouldn't install more antivirus programs, it is possible that Windows will crash during startup due to conflicting drivers. You should use online scanners to get a second opinion.
  
  
  
  It is possible that FoxTab Video To MP3 is responsible for installing one of the toolbars or settings in the browser you have removed. You can uninstall it. Eset also complained on the same file.
  
  
  
  1.
  
  Close all programs including antivirus programs and other similar programs. Otherwise they might stop OTL.
  
  How? See http://www.bleepingcomputer.com/forums/topic114351.html
  
  
  
  Start the program OTL.
  
  Copy all the lines in the box:
  
  [code]
  
  :Files
  
  C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
  
  C:\Users\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
  
  C:\Users\owner\AppData\Local\Temp\is135653842\MyBabylonTB.exe
  
  C:\Users\owner\AppData\Local\Temp\is135653842\setup.exe
  
  C:\Users\owner\AppData\Local\Temp\is1438683437\zgInstaller.exe
  
  C:\Users\owner\Downloads\4shared_Desktop_3.3.5.exe
  
  C:\Users\owner\Downloads\FreeStudio.exe
  
  :Commands
  
  [REBOOT]
  
  [/code]
  
  Paste them into the field Custom Scans/Fixes.
  
  Click on Run Fix.
  
  
  
  If you are asked to restart the computer do that.
  
  
  
  Notepad will pop-up with a log. Copy it and paste it into your answer.
  
  If it is not pop-upped, you can find it in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.
  
  
  
  Be sure that antivirus programs etc. are active before connecting to internet.
  
  
  
  2.
  
  Run a Quick Scan and paste that log, too.

  0

Please sign in to leave a comment.