Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: 1 2 [All]   Go Down

Author Topic: Antivir Solution Pro Removal?? Help!  (Read 42302 times)

0 Members and 1 Guest are viewing this topic.

1two3

    Topic Starter


    Beginner
    Antivir Solution Pro Removal?? Help!
    « on: August 06, 2010, 05:31:23 AM »
    I'm moving my post here from the virus and spyware removal section because nobody seems to be replying there.

    My laptop is screwed. I'm on my other computer now that I never use for anything but email etc, so this one is safe. My laptop is Windows 7 Ultimate. Running Avast free (latest version)

    I started having a fake AV (Antivir), getting messages telling me that:

     "Application cannot be executed. The file ("sf.bin" or "wltuser.exe") is infected. Do you want to activate your antivirus software now?"

    It tries to open up www. *censored* .com on IE (I don't watch porn)

    I get, in the bottom right corner, a message telling me that:

    Your computer is being attacked by an internet virus. It could be a password-stealing attack, a trojan - dropper or similar.

    Details:
    Attack from (random ip, random port)
    Attacked port (usually 49593)
    Threat:  ("Bankerfox.A", or "wsqmcons.xe", or "waucult.exe". Sometimes "win32/Nuqel.e" or something.
    (I'm sure it's the fake AV telling me, because it doesn't look like Windows or Avast at all.



    I can't open any webpage from Firefox or IE. Tells me that there is a virus warning and to buy some software. If I try to open Chrome, it tells me it can't. It automatically opens IE every few minutes. I think it's going to some webpage but I don't know what as I close it down before it does.


    Please help, I've no idea what to do. Scanning with Avast buy it doesn't seem to be doing anything. If you can't help, I'll have to take it into a specialist.

    Edit:

    For some reason, when I noted up my laptop today, avast blocked the Trojan so there was no Antivir or alerts. I've removed the proxies that Antivir put on IE and Firefox, but I'm not using the computer for anything yet as I want to know if the Trojan is actually gone. If you could still help it would be great thanks.


    Moderator edit: At the risk of someone clicking the *censored* link, I "broke" the link so as to prevent this.
    - Zylstra555
    « Last Edit: August 14, 2010, 12:01:12 AM by Zylstra »
    Logged

    Kerjifire

    • Guest
    Re: Antivir Solution Pro Removal?? Help!
    « Reply #1 on: August 06, 2010, 06:31:01 AM »
    Logged

    1two3

      Topic Starter


      Beginner
      Re: Antivir Solution Pro Removal?? Help!
      « Reply #2 on: August 06, 2010, 01:39:19 PM »
      Quote from: Kerjifire on August 06, 2010, 06:31:01 AM
      Read this before requesting malware removal help

      At the risk of sounding obnoxious, I did not ask for a wannabe mod to come along and tell me to read the guidelines before requesting help. You think I haven't done that? I don't think the others that you replied to wanted your "advice" either. If you don't have anything helpful to say, don't bother replying to my topic, Kerjifire.
      Logged

      SuperDave

      • Malware Removal Specialist
      • Moderator


        • Genius
        • Thanked: 1020
      • Certifications: List
      • Experience: Expert
      • OS: Windows 10
      Re: Antivir Solution Pro Removal?? Help!
      « Reply #3 on: August 08, 2010, 05:47:27 PM »
      Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

      1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
      2. The fixes are specific to your problem and should only be used for this issue on this machine.
      3. If you don't know or understand something, please don't hesitate to ask.
      4. Please DO NOT run any other tools or scans while I am helping you.
      5. It is important that you reply to this thread. Do not start a new topic.
      6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
      7. Absence of symptoms does not mean that everything is clear.

      Windows 7 severely limits the number of tools I can use to clean your computer but I'll try. Sorry. If you can't access the internet, download and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

      Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
      Save Rkill to your desktop.

      There are 4 different versions. If one of them won't run then download and try to run the other one.
       
      Vista and Win7 users need to right click Rkill and choose Run as Administrator
       

      You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

      * Rkill.exe
      * Rkill.com
      * Rkill.scr
      * Rkill.pif

      Once you've gotten one of them to run then try to immediately run the following.

      ==================================

      SUPERAntiSpyware

      If you already have SUPERAntiSpyware be sure to check for updates before scanning!

      Download SuperAntispyware Free Edition (SAS)
      * Double-click the icon on your desktop to run the installer.
      * When asked to Update the program definitions, click Yes
      * If you encounter any problems while downloading the updates, manually download and unzip them from here
      * Next click the Preferences button.

      •Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
      * Click the Scanning Control tab.
      * Under Scanner Options make sure only the following are checked:

      •Close browsers before scanning
      •Scan for tracking cookies
      •Terminate memory threats before quarantining
      •Please leave the others unchecked

      •Click the Close button to leave the control center screen.

      * On the main screen click Scan your computer
      * On the left check the box for the drive you are scanning.
      * On the right choose Perform Complete Scan
      * Click Next to start the scan. Please be patient while it scans your computer.
      * After the scan is complete a summary box will appear. Click OK
      * Make sure everything in the white box has a check next to it, then click Next
      * It will quarantine what it found and if it asks if you want to reboot, click Yes

      •To retrieve the removal information please do the following:
      •After reboot, double-click the SUPERAntiSpyware icon on your desktop.
      •Click Preferences. Click the Statistics/Logs tab.

      •Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

      •It will open in your default text editor (preferably Notepad).
      •Save the notepad file to your desktop by clicking (in notepad) File > Save As...

      * Save the log somewhere you can easily find it. (normally the desktop)
      * Click close and close again to exit the program.
      *Copy and Paste the log in your post.

      ==============================

      Please download Malwarebytes Anti-Malware from here.

      Double Click mbam-setup.exe to install the application.
      • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
      • If an update is found, it will download and install the latest version.
      • Once the program has loaded, select "Perform Full Scan", then click Scan.
      • The scan may take some time to finish,so please be patient.
      • When the scan is complete, click OK, then Show Results to view the results.
      • Make sure that everything is checked, and click Remove Selected.
      • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
      • Please save the log to a location you will remember.
      • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
      • Copy and paste the entire report in your next reply.
      Extra Note:

      If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

      =================================

      Please download: HiJackThis to your Desktop.
      • Double Click the HijackThis icon, located on your Desktop.
      • By Default, it will install to: C:\Program Files\Trend Micro\HijackThis
      • Accept the license agreement.
      • Click the Open the Misc Tools section button.
      • Place a checkmark beside Calculate MD5 of files if possible. Then, click Back.
      • Click Do a System Scan and Save a Logfile. Or, if you see a white screen, click Scan.
      • Please post the log in your next reply.
      Logged
      Windows 8 and Windows 10 dual boot with two SSD's

      harry 48



        Egghead

      • lay back , relax and chill out
        • Thanked: 129
        • Yes
        • Yes
        • Yes
        • Dribbling Pensioner
      • Certifications: List
      • Experience: Familiar
      • OS: Windows 7
      Re: Antivir Solution Pro Removal?? Help!
      « Reply #4 on: August 09, 2010, 12:10:33 PM »
      Quote from: 1two3 on August 06, 2010, 01:39:19 PM
      At the risk of sounding obnoxious, I did not ask for a wannabe mod to come along and tell me to read the guidelines before requesting help. You think I haven't done that? I don't think the others that you replied to wanted your "advice" either. If you don't have anything helpful to say, don't bother replying to my topic, Kerjifire.


      people are always asked to do what Kerjifire asked you to do , superdave has asked you to do the same with one difference , you will not get help until you do these check's , so i and other's who have read this post will think you are wrong in what you said
      Logged

      1two3

        Topic Starter


        Beginner
        Re: Antivir Solution Pro Removal?? Help!
        « Reply #5 on: August 09, 2010, 03:43:55 PM »
        Quote from: harry 48 on August 09, 2010, 12:10:33 PM

        people are always asked to do what Kerjifire asked you to do , superdave has asked you to do the same with one difference , you will not get help until you do these check's , so i and other's who have read this post will think you are wrong in what you said

        I would have gladly done it had a more established person come along and asked me. Having been in many forums, I have have met this kind of person before. Maybe he had good intent, but I am too stressed at the moment  with this problem to lnot reply so harshly. And superdave, I will get bak to you asap. My Internet has been playing up so tomorrow (it is 11pm) I will get tthe logs.
        Logged

        harry 48



          Egghead

        • lay back , relax and chill out
          • Thanked: 129
          • Yes
          • Yes
          • Yes
          • Dribbling Pensioner
        • Certifications: List
        • Experience: Familiar
        • OS: Windows 7
        Re: Antivir Solution Pro Removal?? Help!
        « Reply #6 on: August 09, 2010, 04:02:09 PM »
        Quote from: 1two3 on August 09, 2010, 03:43:55 PM
        I would have gladly done it had a more established person come along and asked me. Having been in many forums, I have have met this kind of person before. Maybe he had good intent, but I am too stressed at the moment  with this problem to lnot reply so harshly. And superdave, I will get bak to you asap. My Internet has been playing up so tomorrow (it is 11pm) I will get tthe logs.

        read my signature ( just below ) , thats what i have lived by for 50+ years  ;D
        Logged

        patio

        • Moderator


          • Genius
        • Maud' Dib
          • Thanked: 1769
          • Yes
        • Experience: Beginner
        • OS: Windows 7
        Re: Antivir Solution Pro Removal?? Help!
        « Reply #7 on: August 09, 2010, 08:11:53 PM »
        Quote
        I would have gladly done it had a more established person come along and asked me. Having been in many forums, I have have met this kind of person before. Maybe he had good intent, but I am too stressed at the moment  with this problem to lnot reply so harshly. And superdave, I will get bak to you asap. My Internet has been playing up so tomorrow (it is 11pm) I will get tthe logs.

        You need to start realising what Free Help is all about...i could care less how many other Forums you have visited.
        Your stress level and how you are dealing with it have nothing to do with recieving qualified advice.
        Adjust your attitude...things will go smoother after that.

        Just a simple heads up...
        Logged
        " Anyone who goes to a psychiatrist should have his head examined. "

        1two3

          Topic Starter


          Beginner
          Re: Antivir Solution Pro Removal?? Help!
          « Reply #8 on: August 10, 2010, 07:47:33 AM »
          Quote from: patio on August 09, 2010, 08:11:53 PM
          You need to start realising what Free Help is all about...i could care less how many other Forums you have visited.
          Your stress level and how you are dealing with it have nothing to do with recieving qualified advice.
          Adjust your attitude...things will go smoother after that.

          Just a simple heads up...

          Oh my goodness.



          Anyway, thank you SuperDave for helping. I will post the logs as soon as they are finished.

          Not sure if it's needed, but the Rkill log:

          This log file is located at C:\rkill.log.
          Please post this only if requested to by the person helping you.
          Otherwise you can close this log when you wish.
          Ran as Jimbo on 10/08/2010 at 14:59:40.


          Processes terminated by Rkill or while it was running:


          C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
          C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe
          C:\Users\Jimbo\Desktop\rkill.exe


          Rkill completed on 10/08/2010  at 14:59:46.
          Logged

          1two3

            Topic Starter


            Beginner
            Re: Antivir Solution Pro Removal?? Help!
            « Reply #9 on: August 10, 2010, 10:20:50 AM »
            Here is the SUPERAntiSpyware log. A lot of tracking cookies  :o:

            UPERAntiSpyware Scan Log
            http://www.superantispyware.com

            Generated 08/10/2010 at 05:06 PM

            Application Version : 4.41.1000

            Core Rules Database Version : 5341
            Trace Rules Database Version: 3153

            Scan type       : Complete Scan
            Total Scan Time : 01:57:44

            Memory items scanned      : 737
            Memory threats detected   : 0
            Registry items scanned    : 9945
            Registry threats detected : 0
            File items scanned        : 188318
            File threats detected     : 264

            Adware.Tracking Cookie
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[7].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[9].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][11].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[5].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[9].txt
               atdmt.com [ C:\Users\Guest\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\C4QVHLZP ]
               spe.atdmt.com [ C:\Users\Guest\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\C4QVHLZP ]
               uk.2mdn.net [ C:\Users\Guest\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\C4QVHLZP ]
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\guest@atdmt[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\guest@doubleclick[1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@adrevolver[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@advertising[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@atdmt[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@casalemedia[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@doubleclick[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@fastclick[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@indextools[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][3].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@mediaplex[1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@questionmarket[1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@serving-sys[1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@tacoda[1].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@tradedoubler[2].txt
               C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@tribalfusion[2].txt
               .doubleclick.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .media6degrees.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .media6degrees.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .media6degrees.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .atdmt.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               ad.yieldmanager.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               ad.yieldmanager.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .adviva.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .adviva.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .advertising.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .tribalfusion.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .traveladvertising.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .traveladvertising.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .invitemedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .invitemedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .atdmt.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .invitemedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               advancedsearch.virginmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               advancedsearch.virginmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .atdmt.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .atdmt.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .msnportal.112.2o7.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .lfstmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .lfstmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .lfstmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .statcounter.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .fastclick.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .fastclick.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .fastclick.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .questionmarket.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .2o7.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .2o7.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .apmebf.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .mediaplex.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .mediaplex.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .questionmarket.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .interclick.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .interclick.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .interclick.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .imrworldwide.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .imrworldwide.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .bs.serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .zedo.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .zedo.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .zedo.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               uk.sitestat.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .tacoda.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .tacoda.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .tacoda.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .trvlnet.adbureau.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .advertising.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .at.atwola.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .at.atwola.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .trvlnet.adbureau.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .trvlnet.adbureau.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .mediaplex.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .revsci.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .revsci.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               ad.yieldmanager.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               ad.yieldmanager.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .revsci.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .revsci.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
               .doubleclick.net [ C:\Users\Jimbo\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
               statse.webtrendslive.com [ C:\Users\Jimbo\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
               C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@atdmt[1].txt
               C:\Users\Jimbo\AppData\Local\Temp\Cookies\[email protected][2].txt
               C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@doubleclick[1].txt
               C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@questionmarket[1].txt
               C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@serving-sys[2].txt
               C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@tradedoubler[2].txt
               C:\Users\Jimbo\AppData\Local\Temp\Low\Cookies\jimbo@atdmt[1].txt
               131.memecounter.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               acvs.mediaonenetwork.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               atdmt.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               breakbeatdotca.trackitdown.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               cdn.insights.gravity.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               cdn4.specificclick.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               cdn5.specificclick.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               cloud.video.unrulymedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               core.insightexpressai.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               dennis.cerosmedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               ds.serving-sys.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               ec.atdmt.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               files.adbrite.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               googleads.g.doubleclick.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               ia.media-imdb.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               img-cdn.mediaplex.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               interclick.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               m.uk.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               m1.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               m1.emea.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media.a123.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media.ign.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media.mtvnservices.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media.play.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media.podaddies.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media.scanscout.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media.tattomedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media1.break.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               media1.thegamehomepage.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               mediacloud.whirled.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               mediaplex.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               memecounter.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               msntest.serving-sys.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               objects.tremormedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               oddcast.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               richmedia247.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               s0.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               secure-us.imrworldwide.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               serving-sys.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               spe.atdmt.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               static.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               track.webgains.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               udn.specificclick.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               uk.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               video.unrulymedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               www.soundclick.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               www.trackitdown.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               yo.static.presidiomedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@247realmedia[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@247realmedia[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@adrevolver[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@adtech[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@advertising[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@advertising[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@adviva[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@apmebf[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@apmebf[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@apmebf[3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[5].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[6].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[8].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@bluestreak[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][10].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][5].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][7].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][8].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][9].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@imrworldwide[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@imrworldwide[3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@insightexpressai[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@mediaplex[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@mediaplex[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@mediaplex[4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@myroitracking[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[5].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[6].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pro-market[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@questionmarket[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@questionmarket[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@questionmarket[3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@questionmarket[4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[5].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[6].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[8].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@specificclick[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@tradedoubler[1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@tradedoubler[3].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@tradedoubler[4].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@tradedoubler[5].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@zedo[2].txt
               C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@zedo[3].txt

            Trojan.Agent/Gen-Frauder
               C:\PROGRAM FILES\CHEAT ENGINE\EMPTYPROCESS.EXE
            Logged

            1two3

              Topic Starter


              Beginner
              Re: Antivir Solution Pro Removal?? Help!
              « Reply #10 on: August 10, 2010, 12:00:38 PM »
              Here is the Malwarebyte's Anti-Malware log:

              Internet Explorer 8.0.7600.16385

              10/08/2010 19:11:04
              mbam-log-2010-08-10 (19-11-04).txt

              Scan type: Full scan (C:\|D:\|)
              Objects scanned: 336148
              Time elapsed: 1 hour(s), 22 minute(s), 49 second(s)

              Memory Processes Infected: 0
              Memory Modules Infected: 0
              Registry Keys Infected: 1
              Registry Values Infected: 1
              Registry Data Items Infected: 0
              Folders Infected: 0
              Files Infected: 0

              Memory Processes Infected:
              (No malicious items detected)

              Memory Modules Infected:
              (No malicious items detected)

              Registry Keys Infected:
              HKEY_CURRENT_USER\Software\SolutionAV (Rogue.AntivirSolutionPro) -> Quarantined and deleted successfully.

              Registry Values Infected:
              HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fglfulcn (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

              Registry Data Items Infected:
              (No malicious items detected)

              Folders Infected:
              (No malicious items detected)

              Files Infected:
              (No malicious items detected)
              Logged

              1two3

                Topic Starter


                Beginner
                Re: Antivir Solution Pro Removal?? Help!
                « Reply #11 on: August 10, 2010, 12:11:03 PM »
                Here is the HJT log:

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 19:22:25, on 10/08/2010
                Platform: Unknown Windows (WinNT 6.01.3504)
                MSIE: Internet Explorer v8.00 (8.00.7600.16385)
                Boot mode: Normal

                Running processes:
                C:\Windows\system32\taskhost.exe
                C:\Windows\system32\Dwm.exe
                C:\Windows\Explorer.EXE
                C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                C:\Program Files\Hp\QuickPlay\QPService.exe
                C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
                C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
                C:\Windows\System32\hkcmd.exe
                C:\Windows\System32\igfxpers.exe
                C:\Program Files\Common Files\Java\Java Update\jusched.exe
                C:\Windows\system32\igfxsrvc.exe
                C:\Program Files\Alwil Software\Avast5\AvastUI.exe
                C:\Program Files\iTunes\iTunesHelper.exe
                C:\Program Files\Windows Sidebar\sidebar.exe
                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE
                C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
                C:\Windows\ehome\ehmsas.exe
                C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\Windows\system32\wuauclt.exe
                C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
                C:\Program Files\Mozilla Firefox\plugin-container.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                O1 - Hosts: ::1 localhost
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (filesize 62080 bytes, MD5 C11F6A1F61481E24BE3FDC06EA6F7D2A)
                O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (filesize 137600 bytes, MD5 F655CDD5506FBB4C40C08C9C6A66F7C8)
                O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (filesize 408448 bytes, MD5 B7899C3E21B299D7A3C0DA96CAE340BD)
                O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (filesize 762864 bytes, MD5 927558FA159FED54852692D729039E67)
                O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (filesize 41760 bytes, MD5 385BD69743EA92E76CDF07B3345A25D5)
                O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (filesize 1068904 bytes, MD5 28455424E3C8B81661C5A40E18066BB1)
                O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (filesize 1068904 bytes, MD5 28455424E3C8B81661C5A40E18066BB1)
                O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (filesize 39792 bytes, MD5 8B9145D229D4E89D15ACB820D4A3A90F)
                O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exeC:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
                O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto (filesize 233984 bytes, MD5 93BA58F2CFA194A23A72FE86EABD680D)
                O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" (filesize 176128 bytes, MD5 F1544FC4D25FD26B0CF805BD913D4ECA)
                O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
                O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exeC:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exeC:\Windows\system32\igfxtray.exe
                O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exeC:\Windows\system32\hkcmd.exe
                O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exeC:\Windows\system32\igfxpers.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" (filesize 248040 bytes, MD5 52DB6CDAC5BC7A1FC884E97C41C91213)
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (filesize 421888 bytes, MD5 ED7A6D40B20DC34BE06F4AE196AE7D50)
                O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" (filesize 500208 bytes, MD5 5447AF432CDA61159ADDE218C468FFD9)
                O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exeC:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
                O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin (filesize 406992 bytes, MD5 D5B783DACE1BBDD382A63C894BAB8E1E)
                O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (filesize 141608 bytes, MD5 E840A9AEA5D59A5E9C1C4F1AB24D197A)
                O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
                O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (filesize 1173504 bytes, MD5 EA6EADF6314E43783BA8EEE79F93F73C)
                O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeC:\Windows\ehome\ehTray.exe
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (filesize 3883856 bytes, MD5 D39DA5B7139B4B5147B3C6A94978B5AA)
                O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (filesize 68856 bytes, MD5 E616A6A6E91B0A86F2F6217CDE835FFE)
                O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_S9636.tmp" /EF "HKCU" (filesize 182272 bytes, MD5 9AD31D8018B72E1013CFD012619E0232)
                O4 - HKCU\..\Run: [Google Update] "C:\Users\Jimbo\AppData\Local\Google\Update\GoogleUpdate.exe" /c (filesize 136176 bytes, MD5 F02A533F517EB38333CB12A9E8963773)
                O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (filesize 97680 bytes, MD5 32C26797AB646074A2BB562F9D10ADB5)
                O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (filesize 186192 bytes, MD5 F008B25C34C98E4F207B00852E25E97D)
                O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (filesize 186192 bytes, MD5 F008B25C34C98E4F207B00852E25E97D)
                O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (filesize 603040 bytes, MD5 79F7DB36E67B9E8365FA824AD96DF400)
                O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (filesize 603040 bytes, MD5 79F7DB36E67B9E8365FA824AD96DF400)
                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL (filesize 39464 bytes, MD5 AEF204E782BFA2C8448CB43A58960744)
                O13 - Gopher Prefix:
                O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
                O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-1054b06ff577c5e3.spaces.live.com/PhotoUpload/VistaMsnPUplden-gb.cab
                O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
                O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
                O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exeC:\Program Files\Alwil Software\Avast5\AvastSvc.exe
                O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exeC:\Program Files\Alwil Software\Avast5\AvastSvc.exe
                O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exeC:\Program Files\Alwil Software\Avast5\AvastSvc.exe
                O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Bonjour\mDNSResponder.exe
                O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
                O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXEC:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
                O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exeC:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
                O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeC:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeC:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeC:\Program Files\iPod\bin\iPodService.exe
                O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exe
                O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exeC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeC:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exeC:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
                O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exeC:\Windows\system32\DRIVERS\xaudio.exe

                --
                End of file - 13196 bytes

                Logged

                SuperDave

                • Malware Removal Specialist
                • Moderator


                  • Genius
                  • Thanked: 1020
                • Certifications: List
                • Experience: Expert
                • OS: Windows 10
                Re: Antivir Solution Pro Removal?? Help!
                « Reply #12 on: August 10, 2010, 01:30:27 PM »
                Windows 7 severely limits the number of tools I can use to clean your computer but I will try my best. Sorry.

                Open HijackThis and select Do a system scan only

                Place a check mark next to the following entries: (if there)

                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

                Important: Close all open windows except for HijackThis and then click Fix checked.

                Once completed, exit HijackThis.

                ==================================

                Download OTL  to your Desktop
                • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
                • Under the Custom Scan box paste this in
                netsvcs
                msconfig
                safebootminimal
                safebootnetwork
                activex
                drivers32
                %SYSTEMDRIVE%\*.exe
                %systemroot%\*. /mp /s
                c:\$recycle.bin\*.* /s
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
                /md5start
                eventlog.dll
                scecli.dll
                netlogon.dll
                cngaudit.dll
                sceclt.dll
                ntelogon.dll
                logevent.dll
                iaStor.sys
                nvstor.sys
                nvstor32.sys
                atapi.sys
                IdeChnDr.sys
                viasraid.sys
                AGP440.sys
                vaxscsi.sys
                nvatabus.sys
                viamraid.sys
                nvata.sys
                nvgts.sys
                iastorv.sys
                ViPrt.sys
                eNetHook.dll
                explorer.exe
                svchost.exe
                userinit.exe
                qmgr.dll
                ws2_32.dll
                proquota.exe
                imm32.dll
                kernel32.dll
                ndis.sys
                autochk.exe
                spoolsv.exe
                xmlprov.dll
                ntmssvc.dll
                mswsock.dll
                Beep.SYS
                ntfs.sys
                termsrv.dll
                sfcfiles.dll
                st3shark.sys
                ahcix86.sys
                srsvc.dll
                nvrd32.sys
                /md5stop
                %systemroot%\system32\*.dll /lockedfiles
                %systemroot%\Tasks\*.job /lockedfiles
                • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
                  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
                  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
                ==================================

                Download Security Check by screen317 from one of the following links and save it to your desktop.

                Link 1
                Link 2

                * Unzip SecurityCheck.zip and a folder named Security Check should appear.
                * Open the Security Check folder and double-click Security Check.bat
                * Follow the on-screen instructions inside of the black box.
                * A Notepad document should open automatically called checkup.txt
                * Post the contents of that document in your next reply.

                Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
                Logged
                Windows 8 and Windows 10 dual boot with two SSD's

                1two3

                  Topic Starter


                  Beginner
                  Re: Antivir Solution Pro Removal?? Help!
                  « Reply #13 on: August 10, 2010, 03:07:32 PM »
                  Quote
                  Windows 7 severely limits the number of tools I can use to clean your computer but I will try my best. Sorry.

                  Don't say sorry. You're doing more than I ever, ever could without paying the £50 to go and get it fixed. Thanks so much.  :)

                  Will do everything tomorrow as it is late again. Best to do these things on a fresh, awake mind, no?

                  Also, is it badly infected? I can't read these to save my life so I wouldn't know if it was clean or overrun with malware.  ;D

                  Thanks again, SuperDave.
                  Logged

                  SuperDave

                  • Malware Removal Specialist
                  • Moderator


                    • Genius
                    • Thanked: 1020
                  • Certifications: List
                  • Experience: Expert
                  • OS: Windows 10
                  Re: Antivir Solution Pro Removal?? Help!
                  « Reply #14 on: August 10, 2010, 04:16:25 PM »
                  Quote
                  Also, is it badly infected? I can't read these to save my life so I wouldn't know if it was clean or overrun with malware
                  No. I don't think so but I'll know more after I've seen more scans.
                  Logged
                  Windows 8 and Windows 10 dual boot with two SSD's

                  1two3

                    Topic Starter


                    Beginner
                    Re: Antivir Solution Pro Removal?? Help!
                    « Reply #15 on: August 11, 2010, 05:53:48 AM »
                    Here is the OTL log:

                    OTL logfile created on: 11/08/2010 12:43:11 - Run 1
                    OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\Jimbo\Desktop
                     Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
                    Internet Explorer (Version = 8.0.7600.16385)
                    Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
                     
                    1,014.00 Mb Total Physical Memory | 440.00 Mb Available Physical Memory | 43.00% Memory free
                    2.00 Gb Paging File | 1.00 Gb Available in Paging File | 56.00% Paging File free
                    Paging file location(s): ?:\pagefile.sys [binary data]
                     
                    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
                    Drive C: | 105.12 Gb Total Space | 41.50 Gb Free Space | 39.47% Space Free | Partition Type: NTFS
                    Drive D: | 6.66 Gb Total Space | 2.29 Gb Free Space | 34.42% Space Free | Partition Type: NTFS
                    Drive E: | 488.58 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
                    F: Drive not present or media not loaded
                    G: Drive not present or media not loaded
                    H: Drive not present or media not loaded
                    I: Drive not present or media not loaded
                     
                    Computer Name: LAPTOP
                    Current User Name: Jimbo
                    Logged in as Administrator.
                     
                    Current Boot Mode: Normal
                    Scan Mode: Current user
                    Company Name Whitelist: On
                    Skip Microsoft Files: On
                    File Age = 90 Days
                    Output = Standard
                    Quick Scan
                     
                    ========== Processes (SafeList) ==========
                     
                    PRC - [2010/08/11 12:41:27 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Jimbo\Desktop\OTL.exe
                    PRC - [2010/06/28 21:57:18 | 002,837,864 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
                    PRC - [2010/06/28 21:57:15 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
                    PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
                    PRC - [2010/03/06 04:04:24 | 000,310,224 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
                    PRC - [2009/10/31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
                    PRC - [2009/07/14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
                    PRC - [2009/07/14 02:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Windows Defender\MpCmdRun.exe
                    PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                    PRC - [2009/02/26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
                    PRC - [2007/12/17 17:05:50 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                    PRC - [2007/04/12 06:00:00 | 000,182,272 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE
                    PRC - [2007/01/11 04:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
                     
                     
                    ========== Modules (SafeList) ==========
                     
                    MOD - [2010/08/11 12:41:27 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Jimbo\Desktop\OTL.exe
                    MOD - [2009/07/14 02:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll
                    MOD - [2009/07/14 02:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll
                    MOD - [2009/07/14 02:16:13 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\samcli.dll
                    MOD - [2009/07/14 02:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll
                    MOD - [2009/07/14 02:16:03 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netutils.dll
                    MOD - [2009/07/14 02:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll
                    MOD - [2009/07/14 02:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll
                    MOD - [2009/07/14 02:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll
                    MOD - [2009/07/14 02:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll
                    MOD - [2009/07/14 02:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll
                    MOD - [2009/07/14 02:14:10 | 000,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
                    MOD - [2009/07/14 02:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll
                     
                     
                    ========== Win32 Services (SafeList) ==========
                     
                    SRV - [2010/06/28 21:57:15 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
                    SRV - [2010/06/28 21:57:15 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
                    SRV - [2010/06/28 21:57:15 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
                    SRV - [2010/06/27 21:43:00 | 002,561,624 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\rswin_3725.dll -- (Akamai)
                    SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
                    SRV - [2010/05/22 22:01:35 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
                    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
                    SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
                    SRV - [2009/07/14 02:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc)
                    SRV - [2009/07/14 02:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc)
                    SRV - [2009/07/14 02:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power)
                    SRV - [2009/07/14 02:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)
                    SRV - [2009/07/14 02:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify)
                    SRV - [2009/07/14 02:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper)
                    SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
                    SRV - [2009/07/14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
                    SRV - [2009/07/14 02:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc)
                    SRV - [2009/07/14 02:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc)
                    SRV - [2009/07/14 02:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider)
                    SRV - [2009/07/14 02:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg)
                    SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
                    SRV - [2009/07/14 02:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener)
                    SRV - [2009/07/14 02:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
                    SRV - [2009/07/14 02:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)
                    SRV - [2009/07/14 02:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc)
                    SRV - [2009/07/14 02:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC)
                    SRV - [2009/07/14 02:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) ActiveX Installer (AxInstSV)
                    SRV - [2009/07/14 02:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc)
                    SRV - [2009/07/14 02:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\sppsvc.exe -- (sppsvc)
                    SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
                    SRV - [2007/03/05 18:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)
                    SRV - [2007/01/11 04:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)
                     
                     
                    ========== Driver Services (SafeList) ==========
                     
                    DRV - [2010/06/28 21:37:52 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
                    DRV - [2010/06/28 21:37:30 | 000,165,456 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
                    DRV - [2010/06/28 21:33:13 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
                    DRV - [2010/06/28 21:32:56 | 000,050,256 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
                    DRV - [2010/06/28 21:32:33 | 000,017,744 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
                    DRV - [2010/05/10 19:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
                    DRV - [2010/02/17 19:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
                    DRV - [2010/01/21 01:59:58 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
                    DRV - [2010/01/21 01:59:56 | 000,024,960 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
                    DRV - [2010/01/21 01:59:56 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
                    DRV - [2009/12/11 08:44:02 | 000,133,720 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\ksecpkg.sys -- (KSecPkg)
                    DRV - [2009/09/23 13:18:14 | 004,808,192 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
                    DRV - [2009/07/14 02:26:21 | 000,015,952 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\cmdide.sys -- (cmdide)
                    DRV - [2009/07/14 02:26:17 | 000,297,552 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpahci.sys -- (adpahci)
                    DRV - [2009/07/14 02:26:15 | 000,422,976 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adp94xx.sys -- (adp94xx)
                    DRV - [2009/07/14 02:26:15 | 000,159,312 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsbs.sys -- (amdsbs)
                    DRV - [2009/07/14 02:26:15 | 000,146,512 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpu320.sys -- (adpu320)
                    DRV - [2009/07/14 02:26:15 | 000,086,608 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arcsas.sys -- (arcsas)
                    DRV - [2009/07/14 02:26:15 | 000,079,952 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsata.sys -- (amdsata)
                    DRV - [2009/07/14 02:26:15 | 000,076,368 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arc.sys -- (arc)
                    DRV - [2009/07/14 02:26:15 | 000,023,616 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\amdxata.sys -- (amdxata)
                    DRV - [2009/07/14 02:26:15 | 000,014,400 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\aliide.sys -- (aliide)
                    DRV - [2009/07/14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvstor.sys -- (nvstor)
                    DRV - [2009/07/14 02:20:44 | 000,117,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvraid.sys -- (nvraid)
                    DRV - [2009/07/14 02:20:44 | 000,044,624 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nfrd960.sys -- (nfrd960)
                    DRV - [2009/07/14 02:20:37 | 000,089,168 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas.sys -- (LSI_SAS)
                    DRV - [2009/07/14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iaStorV.sys -- (iaStorV)
                    DRV - [2009/07/14 02:20:36 | 000,235,584 | ---- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MegaSR.sys -- (MegaSR)
                    DRV - [2009/07/14 02:20:36 | 000,096,848 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_scsi.sys -- (LSI_SCSI)
                    DRV - [2009/07/14 02:20:36 | 000,095,824 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_fc.sys -- (LSI_FC)
                    DRV - [2009/07/14 02:20:36 | 000,054,864 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas2.sys -- (LSI_SAS2)
                    DRV - [2009/07/14 02:20:36 | 000,041,040 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iirsp.sys -- (iirsp)
                    DRV - [2009/07/14 02:20:36 | 000,030,800 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\megasas.sys -- (megasas)
                    DRV - [2009/07/14 02:20:36 | 000,013,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hwpolicy.sys -- (hwpolicy)
                    DRV - [2009/07/14 02:20:28 | 000,453,712 | ---- | M] (Emulex) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\elxstor.sys -- (elxstor)
                    DRV - [2009/07/14 02:20:28 | 000,070,720 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\djsvs.sys -- (aic78xx)
                    DRV - [2009/07/14 02:20:28 | 000,067,152 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HpSAMD.sys -- (HpSAMD)
                    DRV - [2009/07/14 02:20:28 | 000,046,160 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fsdepends.sys -- (FsDepends)
                    DRV - [2009/07/14 02:19:11 | 000,141,904 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vsmraid.sys -- (vsmraid)
                    DRV - [2009/07/14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
                    DRV - [2009/07/14 02:19:10 | 000,159,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vhdmp.sys -- (vhdmp)
                    DRV - [2009/07/14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
                    DRV - [2009/07/14 02:19:10 | 000,032,832 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vdrvroot.sys -- (vdrvroot)
                    DRV - [2009/07/14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
                    DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\wimmount.sys -- (WIMMount)
                    DRV - [2009/07/14 02:19:10 | 000,016,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\viaide.sys -- (viaide)
                    DRV - [2009/07/14 02:19:04 | 001,383,488 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql2300.sys -- (ql2300)
                    DRV - [2009/07/14 02:19:04 | 000,173,648 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\rdyboost.sys -- (rdyboost)
                    DRV - [2009/07/14 02:19:04 | 000,106,064 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql40xx.sys -- (ql40xx)
                    DRV - [2009/07/14 02:19:04 | 000,077,888 | ---- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\sisraid4.sys -- (SiSRaid4)
                    DRV - [2009/07/14 02:19:04 | 000,043,088 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pcw.sys -- (pcw)
                    DRV - [2009/07/14 02:19:04 | 000,040,016 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\SiSRaid2.sys -- (SiSRaid2)
                    DRV - [2009/07/14 02:19:04 | 000,021,072 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\stexstor.sys -- (stexstor)
                    DRV - [2009/07/14 02:17:54 | 000,369,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\cng.sys -- (CNG)
                    DRV - [2009/07/14 01:57:25 | 000,272,128 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\Brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
                    DRV - [2009/07/14 01:02:41 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rdpbus.sys -- (rdpbus)
                    DRV - [2009/07/14 01:01:41 | 000,007,168 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPREFMP.sys -- (RDPREFMP)
                    DRV - [2009/07/14 00:55:00 | 000,049,152 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\agilevpn.sys -- (RasAgileVpn) WAN Miniport (IKEv2)
                    DRV - [2009/07/14 00:53:51 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wfplwf.sys -- (WfpLwf)
                    DRV - [2009/07/14 00:52:44 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ndiscap.sys -- (NdisCap)
                    DRV - [2009/07/14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
                    DRV - [2009/07/14 00:52:04 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\vwififlt.sys -- (vwififlt)
                    DRV - [2009/07/14 00:52:02 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifibus.sys -- (vwifibus)
                    DRV - [2009/07/14 00:52:00 | 000,163,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\1394ohci.sys -- (1394ohci)
                    DRV - [2009/07/14 00:51:35 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\umpass.sys -- (UmPass)
                    DRV - [2009/07/14 00:51:23 | 000,080,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
                    DRV - [2009/07/14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
                    DRV - [2009/07/14 00:51:08 | 000,004,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mshidkmdf.sys -- (mshidkmdf)
                    DRV - [2009/07/14 00:46:55 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MTConfig.sys -- (MTConfig)
                    DRV - [2009/07/14 00:45:26 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CompositeBus.sys -- (CompositeBus)
                    DRV - [2009/07/14 00:36:52 | 000,050,176 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\appid.sys -- (AppID)
                    DRV - [2009/07/14 00:33:50 | 000,026,624 | ---- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] -- C:\Windows\System32\drivers\scfilter.sys -- (scfilter)
                    DRV - [2009/07/14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
                    DRV - [2009/07/14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
                    DRV - [2009/07/14 00:24:05 | 000,032,256 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\discache.sys -- (discache)
                    DRV - [2009/07/14 00:19:21 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HidBatt.sys -- (HidBatt)
                    DRV - [2009/07/14 00:16:36 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\acpipmi.sys -- (AcpiPmi)
                    DRV - [2009/07/14 00:11:04 | 000,052,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdppm.sys -- (AmdPPM)
                    DRV - [2009/07/13 23:54:14 | 000,026,624 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\hcw85cir.sys -- (hcw85cir)
                    DRV - [2009/07/13 23:53:33 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbMdm.sys -- (BrUsbMdm)
                    DRV - [2009/07/13 23:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbSer.sys -- (BrUsbSer)
                    DRV - [2009/07/13 23:53:32 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrSerWdm.sys -- (BrSerWdm)
                    DRV - [2009/07/13 23:53:28 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltLo.sys -- (BrFiltLo)
                    DRV - [2009/07/13 23:53:28 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltUp.sys -- (BrFiltUp)
                    DRV - [2009/07/13 23:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
                    DRV - [2009/07/13 23:02:48 | 003,100,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\evbdx.sys -- (ebdrv)
                    DRV - [2009/07/13 23:02:48 | 001,131,008 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
                    DRV - [2009/07/13 23:02:48 | 000,430,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\bxvbdx.sys -- (b06bdrv)
                    DRV - [2008/04/02 10:13:43 | 000,278,728 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
                    DRV - [2008/04/02 10:13:42 | 000,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
                    DRV - [2007/11/28 14:00:44 | 000,174,530 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ov519vid.sys -- (ovt519)
                    DRV - [2007/02/22 17:24:48 | 000,159,232 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)
                    DRV - [2007/02/16 16:17:52 | 000,050,176 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
                    DRV - [2007/01/13 04:59:02 | 000,181,432 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
                    DRV - [2006/12/07 16:05:58 | 000,985,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
                    DRV - [2006/12/07 16:04:36 | 000,207,360 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
                    DRV - [2006/12/07 16:04:26 | 000,659,968 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
                    DRV - [2006/11/28 17:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
                     
                     
                    ========== Standard Registry (SafeList) ==========
                     
                     
                    ========== Internet Explorer ==========
                     
                    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
                    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
                    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
                     
                    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
                    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
                    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
                    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
                    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
                     
                    ========== FireFox ==========
                     
                    FF - prefs.js..browser.search.defaultenginen ame: "Google"
                    FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/firefox?client=firefox-a&rlz=1R0GGGL_en-GB"
                    FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16
                    FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.8
                    FF - prefs.js..extensions.enabledItems: [email protected]:1.5.3
                    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
                    FF - prefs.js..network.proxy.type: 0
                     
                    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/24 22:41:14 | 000,000,000 | ---D | M]
                    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/24 22:41:14 | 000,000,000 | ---D | M]
                     
                    [2009/11/15 23:07:29 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Mozilla\Extensions
                    [2010/08/10 19:47:07 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Mozilla\Firefox\Profiles\iao1yho0.default\extensions
                    [2010/04/28 17:22:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jimbo\AppData\Roaming\Mozilla\Firefox\Profiles\iao1yho0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
                    [2010/07/11 09:42:14 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Jimbo\AppData\Roaming\Mozilla\Firefox\Profiles\iao1yho0.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
                    [2010/04/28 17:22:15 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Jimbo\AppData\Roaming\Mozilla\Firefox\Profiles\iao1yho0.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
                    [2010/04/28 17:21:09 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\Jimbo\AppData\Roaming\Mozilla\Firefox\Profiles\iao1yho0.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
                    [2010/04/28 17:21:06 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Jimbo\AppData\Roaming\Mozilla\Firefox\Profiles\iao1yho0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
                    [2010/04/09 23:17:39 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Mozilla\Firefox\Profiles\iao1yho0.default\extensions\[email protected]
                    [2010/06/16 09:13:19 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
                    [2010/06/16 09:13:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
                    [2008/09/04 01:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
                    [2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
                    [2010/03/14 22:41:27 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
                    [2010/03/14 22:41:27 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
                    [2010/03/14 22:41:27 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
                    [2010/03/14 22:41:27 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml
                     
                    O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
                    O1 - Hosts: 127.0.0.1       localhost
                    O1 - Hosts: ::1             localhost
                    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
                    O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
                    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
                    O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
                    O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
                    O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
                    O4 - HKLM..\Run: []  File not found
                    O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
                    O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
                    O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
                    O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
                    O4 - HKLM..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
                    O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation)
                    O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
                    O4 - HKCU..\Run: [AdobeBridge]  File not found
                    O4 - HKCU..\Run: [EPSON Stylus DX7400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE (SEIKO EPSON CORPORATION)
                    O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
                    O4 - Startup: C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
                    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
                    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
                    O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
                    O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
                    O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
                    O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
                    O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
                    O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
                    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
                    O13 - gopher Prefix: missing
                    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
                    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
                    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
                    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab (Solitaire Showdown Class)
                    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
                    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} http://cid-1054b06ff577c5e3.spaces.live.com/PhotoUpload/VistaMsnPUplden-gb.cab (Windows Live Photo Upload Control)
                    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
                    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
                    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
                    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
                    O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
                    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
                    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
                    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
                    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
                    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
                    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
                    O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab (GoPetsWeb Control)
                    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
                    O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
                    O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
                    O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
                    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
                    O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
                    O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
                    O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
                    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
                    O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img32.jpg
                    O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img32.jpg
                    O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
                    O32 - HKLM CDRom: AutoRun - 1
                    O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
                    O32 - AutoRun File - [2005/09/11 16:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
                    O32 - AutoRun File - [2000/01/07 13:26:10 | 000,000,044 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
                    O33 - MountPoints2\{a8583309-d22c-11de-a526-806e6f6e6963}\Shell - "" = AutoRun
                    O33 - MountPoints2\{a8583309-d22c-11de-a526-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2000/01/07 13:26:10 | 006,152,192 | R--- | M] ()
                    O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
                    O35 - HKLM\..comfile [open] -- "%1" %*
                    O35 - HKLM\..exefile [open] -- "%1" %*
                    O37 - HKLM\...com [@ = comfile] -- "%1" %*
                    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
                     
                    NetSvcs: FastUserSwitchingCompatibility -  File not found
                    NetSvcs: Ias -  File not found
                    NetSvcs: Nla -  File not found
                    NetSvcs: Ntmssvc -  File not found
                    NetSvcs: NWCWorkstation -  File not found
                    NetSvcs: Nwsapagent -  File not found
                    NetSvcs: SRService -  File not found
                    NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
                    NetSvcs: WmdmPmSp -  File not found
                    NetSvcs: LogonHours -  File not found
                    NetSvcs: PCAudit -  File not found
                    NetSvcs: helpsvc -  File not found
                    NetSvcs: uploadmgr -  File not found
                    NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
                    NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
                     
                    MsConfig - State: "services" - 2
                     
                    SafeBootMin: Base - Driver Group
                    SafeBootMin: Boot Bus Extender - Driver Group
                    SafeBootMin: Boot file system - Driver Group
                    SafeBootMin: File system - Driver Group
                    SafeBootMin: Filter - Driver Group
                    SafeBootMin: HelpSvc - Service
                    SafeBootMin: NTDS -  File not found
                    SafeBootMin: PCI Configuration - Driver Group
                    SafeBootMin: PNP Filter - Driver Group
                    SafeBootMin: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation)
                    SafeBootMin: Primary disk - Driver Group
                    SafeBootMin: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
                    SafeBootMin: sacsvr - Service
                    SafeBootMin: SCSI Class - Driver Group
                    SafeBootMin: System Bus Extender - Driver Group
                    SafeBootMin: vmms - Service
                    SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
                    SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
                    SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
                    SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
                    SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
                    SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
                    SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
                    SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
                    SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
                    SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
                    SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
                    SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
                    SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
                    SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
                    SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
                    SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
                    SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
                    SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
                     
                    SafeBootNet: Base - Driver Group
                    SafeBootNet: Boot Bus Extender - Driver Group
                    SafeBootNet: Boot file system - Driver Group
                    SafeBootNet: Dhcp - C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
                    SafeBootNet: File system - Driver Group
                    SafeBootNet: Filter - Driver Group
                    SafeBootNet: HelpSvc - Service
                    SafeBootNet: Messenger - Service
                    SafeBootNet: NDIS Wrapper - Driver Group
                    SafeBootNet: ndiscap - C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
                    SafeBootNet: NetBIOSGroup - Driver Group
                    SafeBootNet: NetDDEGroup - Driver Group
                    SafeBootNet: Network - Driver Group
                    SafeBootNet: NetworkProvider - Driver Group
                    SafeBootNet: NTDS -  File not found
                    SafeBootNet: PCI Configuration - Driver Group
                    SafeBootNet: PNP Filter - Driver Group
                    SafeBootNet: PNP_TDI - Driver Group
                    SafeBootNet: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation)
                    SafeBootNet: Primary disk - Driver Group
                    SafeBootNet: rdsessmgr - Service
                    SafeBootNet: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
                    SafeBootNet: sacsvr - Service
                    SafeBootNet: SCSI Class - Driver Group
                    SafeBootNet: Streams Drivers - Driver Group
                    SafeBootNet: System Bus Extender - Driver Group
                    SafeBootNet: TDI - Driver Group
                    SafeBootNet: vmms - Service
                    SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
                    SafeBootNet: WudfUsbccidDriver - Driver
                    SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
                    SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
                    SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
                    SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
                    SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
                    SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
                    SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
                    SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
                    SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
                    SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
                    SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
                    SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
                    SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
                    SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
                    SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
                    SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
                    SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
                    SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
                    SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
                    SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
                    SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
                    SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
                     
                    ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
                    ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
                    ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
                    ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
                    ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
                    ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
                    ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
                    ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
                    ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
                    ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
                    ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
                    ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
                    ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
                    ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
                    ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
                    ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
                    ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
                    ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
                    ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
                    ActiveX: {9C5F4549-D51C-B164-8D1E-375801720FF9} - Microsoft Windows Media Player
                    ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
                    ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6
                    ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
                    ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
                    ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
                    ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
                    ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
                    ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
                     
                    Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
                    Drivers32: msacm.lameacm - C:\Windows\System32\LameACM.acm (http://www.mp3dev.org/)
                    Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
                    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
                    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
                    Drivers32: VIDC.IV41 - C:\Windows\System32\ir41_32.dll (Intel Corporation)
                    Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
                     
                    ========== Files/Folders - Created Within 90 Days ==========
                     
                    [2010/08/11 12:41:16 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Jimbo\Desktop\OTL.exe
                    [2010/08/10 19:12:51 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
                    [2010/08/10 17:38:30 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\AppData\Roaming\Malwarebytes
                    [2010/08/10 17:38:11 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
                    [2010/08/10 17:38:09 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
                    [2010/08/10 17:38:09 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
                    [2010/08/10 17:38:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
                    [2010/08/10 15:02:02 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\AppData\Roaming\SUPERAntiSpyware.com
                    [2010/08/10 15:02:02 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
                    [2010/08/10 15:01:33 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
                    [2010/08/08 19:51:03 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\AppData\Roaming\Sony Creative Software
                    [2010/08/04 14:33:46 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\AppData\Local\lltumscdq
                    [2010/07/28 18:48:55 | 000,000,000 | ---D | C] -- C:\Program Files\Easy GIF Animator
                    [2010/07/21 12:24:12 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
                    [2010/07/21 12:24:00 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
                    [2010/07/12 19:08:46 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\Documents\My Webcam Recordings
                    [2010/06/30 15:58:51 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\Windows\avastSS.scr
                    [2010/06/20 21:38:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software
                    [2010/06/19 12:56:59 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
                    [2010/06/19 12:53:01 | 000,000,000 | ---D | C] -- C:\Program Files\Safari
                    [2010/06/04 15:20:01 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\Desktop\Brushes
                    [2010/06/03 13:41:41 | 000,098,304 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll
                    [2010/06/03 13:06:03 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
                    [2010/06/03 13:06:03 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\AppData\Roaming\Adobe Mini Bridge CS5
                    [2010/05/27 20:23:17 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
                    [2010/05/27 20:14:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
                    [2010/05/27 20:01:31 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\Documents\CS5
                    [2010/05/23 18:36:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Akamai
                    [2010/05/22 22:01:37 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
                    [2010/05/17 20:56:55 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
                    [2010/05/15 14:23:52 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\AppData\Local\TechSmith
                    [2010/05/15 14:12:29 | 000,000,000 | ---D | C] -- C:\Users\Jimbo\Documents\Camtasia Studio
                    [2010/05/15 14:11:52 | 000,000,000 | ---D | C] -- C:\Windows\System32\QuickTime
                    [2010/05/15 14:10:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\TechSmith Shared
                    [2010/05/15 14:10:12 | 000,000,000 | ---D | C] -- C:\ProgramData\TechSmith
                    [2010/05/15 14:10:12 | 000,000,000 | ---D | C] -- C:\Program Files\TechSmith
                    [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
                    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
                    [1 C:\Users\Jimbo\Documents\*.tmp files -> C:\Users\Jimbo\Documents\*.tmp -> ]
                     
                    ========== Files - Modified Within 90 Days ==========
                     
                    [2010/08/11 12:44:43 | 006,553,600 | -HS- | M] () -- C:\Users\Jimbo\NTUSER.DAT
                    [2010/08/11 12:41:27 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Jimbo\Desktop\OTL.exe
                    [2010/08/11 12:33:00 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2684566189-1366576568-2552115098-1000UA.job
                    [2010/08/11 11:00:45 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
                    [2010/08/11 11:00:45 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
                    [2010/08/11 10:55:48 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
                    [2010/08/11 10:53:52 | 000,000,150 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
                    [2010/08/11 10:53:34 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
                    [2010/08/11 10:53:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
                    [2010/08/11 10:53:17 | 797,532,160 | -HS- | M] () -- C:\hiberfil.sys
                    [2010/08/10 22:25:10 | 001,454,574 | -H-- | M] () -- C:\Users\Jimbo\AppData\Local\IconCache.db
                    [2010/08/10 19:12:51 | 000,002,043 | ---- | M] () -- C:\Users\Jimbo\Desktop\HijackThis.lnk
                    [2010/08/10 17:38:13 | 000,000,983 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
                    [2010/08/10 17:32:00 | 000,000,854 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2684566189-1366576568-2552115098-1000Core.job
                    [2010/08/10 15:01:35 | 000,001,965 | ---- | M] () -- C:\Users\Jimbo\Desktop\SUPERAntiSpyware Free Edition.lnk
                    [2010/08/06 14:30:57 | 000,000,146 | ---- | M] () -- C:\Users\Jimbo\Desktop\Windows Defender - Shortcut.lnk
                    [2010/08/03 17:28:48 | 000,002,314 | ---- | M] () -- C:\Users\Jimbo\Desktop\Google Chrome.lnk
                    [2010/08/02 21:40:57 | 000,720,488 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
                    [2010/08/02 21:40:57 | 000,623,784 | ---- | M] () -- C:\Windows\System32\perfh009.dat
                    [2010/08/02 21:40:57 | 000,109,736 | ---- | M] () -- C:\Windows\System32\perfc009.dat
                    [2010/07/29 12:06:46 | 000,000,132 | ---- | M] () -- C:\Users\Jimbo\AppData\Roaming\Adobe PNG Format CS5 Prefs
                    [2010/07/28 18:48:57 | 000,000,943 | ---- | M] () -- C:\Users\Jimbo\Desktop\Easy GIF Animator.lnk
                    [2010/07/27 19:29:52 | 000,001,284 | ---- | M] () -- C:\Users\Jimbo\Documents\[email protected] Sharing Folders Archive.lnk
                    [2010/07/21 12:25:05 | 000,002,429 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
                    [2010/07/07 21:50:22 | 000,203,998 | ---- | M] () -- C:\Users\Jimbo\Documents\The Battle of Britain.docx
                    [2010/06/30 15:58:53 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
                    [2010/06/28 21:57:33 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\Windows\avastSS.scr
                    [2010/06/28 21:57:12 | 000,165,032 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
                    [2010/06/28 21:37:52 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswTdi.sys
                    [2010/06/28 21:37:30 | 000,165,456 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswSP.sys
                    [2010/06/28 21:33:13 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswRdr.sys
                    [2010/06/28 21:32:56 | 000,050,256 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
                    [2010/06/28 21:32:33 | 000,017,744 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
                    [2010/06/28 21:30:19 | 000,000,162 | -H-- | M] () -- C:\Users\Jimbo\Documents\~$e Battle of Britain.docx
                    [2010/06/23 15:49:38 | 003,769,080 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
                    [2010/06/22 21:22:16 | 000,112,056 | ---- | M] () -- C:\Users\Jimbo\AppData\Local\GDIPFONTCACHEV1.DAT
                    [2010/06/20 21:40:20 | 000,002,009 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
                    [2010/06/19 12:53:31 | 000,002,503 | ---- | M] () -- C:\Users\Jimbo\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
                    [2010/06/16 18:59:27 | 000,008,192 | ---- | M] () -- C:\Users\Jimbo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
                    [2010/06/03 13:41:41 | 000,098,304 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll
                    [2010/05/27 20:20:05 | 000,001,169 | ---- | M] () -- C:\Users\Jimbo\Desktop\Adobe Photoshop CS5.lnk
                    [2010/05/17 21:07:41 | 000,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Vegas Pro 9.0.lnk
                    [2010/05/15 14:10:54 | 000,001,126 | ---- | M] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk
                    [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
                    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
                    [1 C:\Users\Jimbo\Documents\*.tmp files -> C:\Users\Jimbo\Documents\*.tmp -> ]
                     
                    ========== Files Created - No Company Name ==========
                     
                    [2010/08/10 19:12:51 | 000,002,043 | ---- | C] () -- C:\Users\Jimbo\Desktop\HijackThis.lnk
                    [2010/08/10 17:38:13 | 000,000,983 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
                    [2010/08/10 15:01:35 | 000,001,965 | ---- | C] () -- C:\Users\Jimbo\Desktop\SUPERAntiSpyware Free Edition.lnk
                    [2010/08/06 14:30:57 | 000,000,146 | ---- | C] () -- C:\Users\Jimbo\Desktop\Windows Defender - Shortcut.lnk
                    [2010/08/03 17:28:48 | 000,002,314 | ---- | C] () -- C:\Users\Jimbo\Desktop\Google Chrome.lnk
                    [2010/08/03 17:28:00 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2684566189-1366576568-2552115098-1000UA.job
                    [2010/08/03 17:27:58 | 000,000,854 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2684566189-1366576568-2552115098-1000Core.job
                    [2010/07/28 18:48:57 | 000,000,943 | ---- | C] () -- C:\Users\Jimbo\Desktop\Easy GIF Animator.lnk
                    [2010/07/21 12:25:05 | 000,002,429 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
                    [2010/07/18 12:23:03 | 000,001,284 | ---- | C] () -- C:\Users\Jimbo\Documents\[email protected] Sharing Folders Archive.lnk
                    [2010/06/28 21:30:19 | 000,000,162 | -H-- | C] () -- C:\Users\Jimbo\Documents\~$e Battle of Britain.docx
                    [2010/06/28 21:30:17 | 000,203,998 | ---- | C] () -- C:\Users\Jimbo\Documents\The Battle of Britain.docx
                    [2010/06/20 21:40:20 | 000,002,009 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
                    [2010/06/19 12:53:31 | 000,002,503 | ---- | C] () -- C:\Users\Jimbo\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
                    [2010/05/31 16:37:56 | 000,000,132 | ---- | C] () -- C:\Users\Jimbo\AppData\Roaming\Adobe PNG Format CS5 Prefs
                    [2010/05/27 20:20:05 | 000,001,169 | ---- | C] () -- C:\Users\Jimbo\Desktop\Adobe Photoshop CS5.lnk
                    [2010/05/17 21:07:41 | 000,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Vegas Pro 9.0.lnk
                    [2010/05/15 14:10:54 | 000,001,126 | ---- | C] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk
                    [2010/01/01 14:19:21 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
                    [2009/10/05 19:04:14 | 000,129,024 | ---- | C] () -- C:\Windows\System32\AVERM.dll
                    [2009/10/05 19:04:14 | 000,028,672 | ---- | C] () -- C:\Windows\System32\AVEQT.dll
                    [2009/08/09 14:25:12 | 000,688,128 | ---- | C] () -- C:\Windows\System32\libeay32.dll
                    [2009/08/09 14:25:12 | 000,155,648 | ---- | C] () -- C:\Windows\System32\ssleay32.dll
                    [2009/08/03 16:31:15 | 000,000,064 | ---- | C] () -- C:\Windows\CIV.INI
                    [2009/07/14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
                    [2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
                    [2008/04/03 19:21:40 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
                    [2008/04/03 19:21:40 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
                    [2008/04/03 19:21:40 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
                    [2008/04/03 12:18:30 | 000,000,553 | ---- | C] () -- C:\Windows\SIERRA.INI
                    [2008/04/02 10:13:43 | 000,278,728 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
                    [2008/04/02 10:13:42 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
                    [2007/02/27 21:43:02 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
                    [2006/12/14 07:01:36 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
                    [2006/12/14 07:01:36 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
                    [2006/03/10 01:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
                    [2000/01/28 00:00:00 | 000,012,288 | ---- | C] () -- C:\Windows\System32\HLINKPRX.DLL
                    [1997/11/17 17:13:16 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
                     
                    ========== LOP Check ==========
                     
                    [2009/11/15 23:05:59 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Acoustica
                    [2009/04/20 17:29:50 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\AVG7
                    [2009/11/15 23:06:30 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Cool Record Edit Pro
                    [2009/11/15 23:06:30 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Football Superstars
                    [2009/10/05 19:03:45 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\GetRightToGo
                    [2010/04/12 10:47:05 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Publish Providers
                    [2010/04/15 19:01:30 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Sony
                    [2010/08/08 19:51:03 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Sony Creative Software
                    [2010/06/03 13:06:03 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
                    [2010/03/21 00:13:17 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\SWiSH miniMax3
                    [2009/11/15 23:07:33 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\SystemRequirementsLab
                    [2009/11/15 23:07:33 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Template
                    [2009/11/15 14:10:08 | 000,000,000 | ---D | M] -- C:\Users\Jimbo\AppData\Roaming\Three Rings Design
                    [2010/06/10 18:54:58 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
                     
                    ========== Purity Check ==========
                     
                     
                     
                    ========== Custom Scans ==========
                     
                     
                    < %SYSTEMDRIVE%\*.exe >
                     
                    < %systemroot%\*. /mp /s >
                     
                    < c:\$recycle.bin\*.* /s >
                    [2009/09/23 19:14:07 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-20\desktop.ini
                    [2007/04/24 19:20:00 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-21-1934124124-1746683133-3662634294-500\desktop.ini
                    [2010/08/08 17:33:59 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-2684566189-1366576568-2552115098-1000\$I17IGO3.MSWMM
                    [2010/08/10 20:45:27 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-2684566189-1366576568-2552115098-1000\$I33XV8Q.exe
                    [2010/08/08 17:34:07 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-2684566189-1366576568-2552115098-1000\$I40NAA1.wmv
                    [2010/08/10
                    Logged

                    1two3

                      Topic Starter


                      Beginner
                      Re: Antivir Solution Pro Removal?? Help!
                      « Reply #16 on: August 11, 2010, 05:55:01 AM »
                      Here is the extras log:

                      OTL Extras logfile created on: 11/08/2010 12:43:11 - Run 1
                      OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\Jimbo\Desktop
                       Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
                      Internet Explorer (Version = 8.0.7600.16385)
                      Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
                       
                      1,014.00 Mb Total Physical Memory | 440.00 Mb Available Physical Memory | 43.00% Memory free
                      2.00 Gb Paging File | 1.00 Gb Available in Paging File | 56.00% Paging File free
                      Paging file location(s): ?:\pagefile.sys [binary data]
                       
                      %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
                      Drive C: | 105.12 Gb Total Space | 41.50 Gb Free Space | 39.47% Space Free | Partition Type: NTFS
                      Drive D: | 6.66 Gb Total Space | 2.29 Gb Free Space | 34.42% Space Free | Partition Type: NTFS
                      Drive E: | 488.58 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
                      F: Drive not present or media not loaded
                      G: Drive not present or media not loaded
                      H: Drive not present or media not loaded
                      I: Drive not present or media not loaded
                       
                      Computer Name: LAPTOP
                      Current User Name: Jimbo
                      Logged in as Administrator.
                       
                      Current Boot Mode: Normal
                      Scan Mode: Current user
                      Company Name Whitelist: On
                      Skip Microsoft Files: On
                      File Age = 90 Days
                      Output = Standard
                      Quick Scan
                       
                      ========== Extra Registry (SafeList) ==========
                       
                       
                      ========== File Associations ==========
                       
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
                      .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
                      .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
                       
                      [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
                      .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
                       
                      ========== Shell Spawning ==========
                       
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
                      batfile [open] -- "%1" %*
                      cmdfile [open] -- "%1" %*
                      comfile [open] -- "%1" %*
                      cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
                      exefile [open] -- "%1" %*
                      helpfile [open] -- Reg Error: Key error.
                      hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
                      htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
                      htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
                      inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
                      piffile [open] -- "%1" %*
                      regfile [merge] -- Reg Error: Key error.
                      scrfile [config] -- "%1"
                      scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
                      scrfile [open] -- "%1" /S
                      txtfile [edit] -- Reg Error: Key error.
                      Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
                      Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
                      Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
                      Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
                      Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
                      Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
                      Folder [explore] -- Reg Error: Value error.
                      Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
                       
                      ========== Security Center Settings ==========
                       
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
                      "cval" = 1
                       
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
                       
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
                      "VistaSp1" = Reg Error: Unknown registry data type -- File not found
                      "AntiVirusOverride" = 0
                      "AntiSpywareOverride" = 0
                      "FirewallOverride" = 0
                       
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
                       
                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
                      "DisableNotifications" = 0
                      "EnableFirewall" = 1
                       
                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
                      "DisableNotifications" = 0
                      "EnableFirewall" = 1
                       
                      ========== Authorized Applications List ==========
                       
                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
                      "C:\Users\Jimbo\Documents\BitTorrent\bittorrent.exe" = C:\Users\Jimbo\Documents\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- File not found
                       
                       
                      ========== HKEY_LOCAL_MACHINE Uninstall List ==========
                       
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
                      "{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
                      "{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
                      "{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
                      "{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
                      "{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
                      "{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
                      "{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
                      "{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}" = PSSWCORE
                      "{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
                      "{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
                      "{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
                      "{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
                      "{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
                      "{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
                      "{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
                      "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
                      "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
                      "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
                      "{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
                      "{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
                      "{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 20
                      "{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
                      "{290B83AA-093A-45BF-A917-D1C4A1E8D917}" = HP Active Support Library
                      "{2BD5C305-1B27-4D41-B690-7A61172D2FEB}" = Macromedia Flash 8
                      "{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
                      "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
                      "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
                      "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
                      "{32A3A4F4-B792-11D6-A78A-00B0D0160180}" = Java(TM) SE Development Kit 6 Update 18
                      "{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}" = Roxio MyDVD Basic v9
                      "{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.20 D3
                      "{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
                      "{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
                      "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
                      "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
                      "{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
                      "{3FFB3B34-D639-4384-9AE9-DDE58430D86F}" = MSCU for Microsoft Vista
                      "{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
                      "{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
                      "{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 3.2
                      "{49CFD5D9-0556-4037-B7D6-E13ED4BEA4C5}" = Football Manager 2006
                      "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
                      "{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
                      "{53FA9A9F-3C19-4D43-AD6B-DEF365D469BA}" = Camtasia Studio 7
                      "{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager
                      "{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
                      "{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
                      "{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
                      "{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
                      "{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
                      "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
                      "{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent
                      "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
                      "{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
                      "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
                      "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
                      "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
                      "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
                      "{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
                      "{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
                      "{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
                      "{88A548E6-4B09-43E7-AD55-3C7D1B37706D}" = ESU for Microsoft Vista
                      "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
                      "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
                      "{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}" = Macromedia Flash 8 Video Encoder
                      "{8CEA85DE-955B-4BF4-87F2-0BAA62821633}" = HP Photosmart Essential2.5
                      "{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
                      "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
                      "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                      "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
                      "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                      "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
                      "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                      "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
                      "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
                      "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
                      "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
                      "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
                      "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
                      "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
                      "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
                      "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                      "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
                      "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                      "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
                      "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                      "{9061CEF2-51F5-42C9-8A70-9ED351C6597A}" = HP Help and Support
                      "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
                      "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
                      "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
                      "{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
                      "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
                      "{97E038E1-41AD-4C93-BCDC-6A2394AEE352}" = Vegas Movie Studio Platinum 9.0
                      "{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
                      "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
                      "{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
                      "{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
                      "{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe  1.4.136.1
                      "{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
                      "{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
                      "{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
                      "{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
                      "{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
                      "{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
                      "{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
                      "{B6335C5F-0064-4F90-8447-52614F8F0CE0}" = HP User Guides 0079
                      "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
                      "{C1E11C46-E6EB-4BD2-9ADF-2A98ACBEB216}" = iTunes
                      "{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
                      "{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
                      "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
                      "{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
                      "{D32067CD-7409-4792-BFA0-1469BCD8F0C8}" = HP Wireless Assistant
                      "{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
                      "{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
                      "{D9D1A2FD-56B2-4F21-B959-745FE43CAB8C}" = Vegas Pro 9.0
                      "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
                      "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
                      "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
                      "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
                      "{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}" = HP Active Support Library 32 bit components
                      "Acoustica Effects Pack" = Acoustica Effects Pack
                      "Acoustica Mixcraft 4.5" = Acoustica Mixcraft 4.5
                      "Adobe AIR" = Adobe AIR
                      "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
                      "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
                      "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
                      "Akamai" = Akamai NetSession Interface
                      "Audacity_is1" = Audacity 1.2.6
                      "avast5" = avast! Free Antivirus
                      "Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
                      "chc.4875E02D9FB21EE389F73B8D1702B320485 DF8CE.1" = Adobe Community Help
                      "Cheat Engine 5.5_is1" = Cheat Engine 5.5
                      "Cheat Engine 5.6_is1" = Cheat Engine 5.6
                      "CNXT_HDAUDIO" = Conexant HD Audio
                      "CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5045&SUBSYS_103C30B7" = HDAUDIO Soft Data Fax Modem with SmartCP
                      "com.adobe.amp.4875E02D9FB21EE389F73B8D1 702B320485DF8CE.1" = Adobe Media Player
                      "Easy GIF Animator_is1" = Easy GIF Animator 5.1
                      "EPSON Printer and Utilities" = EPSON Printer Software
                      "Google Updater" = Google Updater
                      "Guild Wars" = Guild Wars
                      "HDMI" = Intel(R) Graphics Media Accelerator Driver
                      "HijackThis" = HijackThis 2.0.2
                      "HOMESTUDENTR" = Microsoft Office Home and Student 2007
                      "Hospital" = Theme Hospital
                      "HP Photosmart Essential" = HP Photosmart Essential 2.0
                      "LAME for Audacity_is1" = LAME v3.98.2 for Audacity
                      "LameACM" = Lame ACM MP3 Codec
                      "Logitech Eyetoy Webcam" = Logitech Eyetoy Webcam
                      "Magic DVD Ripper_is1" = Magic DVD Ripper V5.4.2
                      "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
                      "Messenger Plus! Live" = Messenger Plus! Live
                      "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
                      "Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
                      "MS Access 97 SP2" = MS Access 97 SP2
                      "Network Play System (Patching)" = Network Play System (Patching)
                      "Pharaoh" = Pharaoh
                      "Prism" = Prism Video Converter
                      "Shockwave" = Shockwave
                      "SimCity 3000 UK Edition" = SimCity 3000 UK Edition
                      "SynTPDeinstKey" = Synaptics Pointing Device Driver
                      "SystemRequirementsLab" = System Requirements Lab
                      "Test Of Time" = Civ II : Test Of Time
                      "The Sims" = The Sims
                      "Tunatic" = Tunatic
                      "Ultra Mobile 3GP Video Converter_is1" = Ultra Mobile 3GP Video Converter 5.2.0603
                      "WinLiveSuite_Wave3" = Windows Live Essentials
                      "WinRAR archiver" = WinRAR archiver
                       
                      ========== HKEY_CURRENT_USER Uninstall List ==========
                       
                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
                      "Google Chrome" = Google Chrome
                      "UnityWebPlayer" = Unity Web Player
                       
                      ========== Last 10 Event Log Errors ==========
                       
                      [ Antivirus Events ]
                      Error - 21/08/2009 04:48:21 | Computer Name = Laptop | Source = avast! | ID = 33554522
                      Description =
                       
                      Error - 21/08/2009 04:57:07 | Computer Name = Laptop | Source = avast! | ID = 33554522
                      Description =
                       
                      Error - 13/11/2009 14:51:56 | Computer Name = Laptop | Source = avast! | ID = 33554522
                      Description =
                       
                       
                      ========== Last 10 Event Log Errors ==========
                       
                      Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
                       
                      < End of report >
                      Logged

                      1two3

                        Topic Starter


                        Beginner
                        Re: Antivir Solution Pro Removal?? Help!
                        « Reply #17 on: August 11, 2010, 06:00:07 AM »
                        Here is the Security Check log:

                         Results of screen317's Security Check version 0.99.5 
                         Windows 7  (UAC is enabled)
                         Internet Explorer 8 
                        ``````````````````````````````
                        Antivirus/Firewall Check:
                         Windows Firewall Enabled! 
                         avast! Free Antivirus   
                         Antivirus up to date! 
                        ```````````````````````````````
                        Anti-malware/Other Utilities Check:
                         Malwarebytes' Anti-Malware   
                         HijackThis 2.0.2   
                         Java DB 10.5.3.0   
                         Java(TM) 6 Update 20 
                         Java(TM) SE Runtime Environment 6
                         Java(TM) 6 Update 3 
                         Java(TM) 6 Update 5 
                         Java(TM) 6 Update 7 
                         Java(TM) SE Development Kit 6 Update 18
                         Out of date Java installed!
                         Adobe Flash Player 10.1.53.64 
                        Adobe Reader 8.1.2
                        Adobe Reader 8.1.2 Security Update 1 (KB403742)
                        Out of date Adobe Reader installed!
                         Mozilla Firefox (3.6.8)
                        ````````````````````````````````
                        Process Check: 
                        objlist.exe by Laurent
                         Alwil Software Avast5 AvastSvc.exe 
                         Alwil Software Avast5 AvastUI.exe 
                        ````````````````````````````````
                        DNS Vulnerability Check:
                         GREAT! (Not vulnerable to DNS cache poisoning)

                        ``````````End of Log````````````
                        Logged

                        SuperDave

                        • Malware Removal Specialist
                        • Moderator


                          • Genius
                          • Thanked: 1020
                        • Certifications: List
                        • Experience: Expert
                        • OS: Windows 10
                        Re: Antivir Solution Pro Removal?? Help!
                        « Reply #18 on: August 11, 2010, 05:06:00 PM »
                        Update Your Java (JRE)

                        Old versions of Java have vulnerabilities that malware can use to infect your system.

                        First Verify your Java Version

                        If there are any other version(s) installed then update now.

                        Get the new version (if needed)

                        If your version is out of date install the newest version of the Sun Java Runtime Environment.

                        Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

                        Be sure to close ALL open web browsers before starting the installation.

                        Remove any old versions

                        1. Download JavaRa and unzip the file to your Desktop.
                        2. Open JavaRA.exe and choose Remove Older Versions
                        3. Once complete exit JavaRA.
                        4. Run CCleaner.

                        Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.

                        ================================

                        Please download the newest version of Adobe Acrobat Reader from Adobe.com

                        Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
                        Go to the Control Panel and enter Add or Remove Programs.
                        Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

                        Once old versions are gone, please install the newest version.

                        ===============================

                        I'd like to scan your machine with ESET OnlineScan

                        •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
                        ESET OnlineScan
                        •Click the button.
                        •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
                        • Click on to download the ESET Smart Installer. Save it to your desktop.
                        • Double click on the icon on your desktop.
                        •Check
                        •Click the button.
                        •Accept any security warnings from your browser.
                        •Check
                        •Push the Start button.
                        •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
                        •When the scan completes, push
                        •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
                        •Push the button.
                        •Push
                        A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

                        Logged
                        Windows 8 and Windows 10 dual boot with two SSD's

                        1two3

                          Topic Starter


                          Beginner
                          Re: Antivir Solution Pro Removal?? Help!
                          « Reply #19 on: August 12, 2010, 07:53:13 AM »
                          I've done all the updating and removing. But for the online scan, there was no log button. I just had the option to press "finish". Then it just reccomended AV programs. It didn't find any threats anyway. Do you need me to run it again or something?
                          Logged

                          harry 48



                            Egghead

                          • lay back , relax and chill out
                            • Thanked: 129
                            • Yes
                            • Yes
                            • Yes
                            • Dribbling Pensioner
                          • Certifications: List
                          • Experience: Familiar
                          • OS: Windows 7
                          Re: Antivir Solution Pro Removal?? Help!
                          « Reply #20 on: August 12, 2010, 08:14:32 AM »
                          quote from superdave; A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt


                          did you look in your files etc
                          Logged

                          1two3

                            Topic Starter


                            Beginner
                            Re: Antivir Solution Pro Removal?? Help!
                            « Reply #21 on: August 12, 2010, 01:02:59 PM »
                             ;D Yep. Was looking in the wrong place.

                            ESETSmartInstaller@High as downloader log:
                            all ok
                            # version=7
                            # OnlineScannerApp.exe=1.0.0.1
                            # OnlineScanner.ocx=1.0.0.6211
                            # api_version=3.0.2
                            # EOSSerial=2f59ad21ef48884ea88a0348469b1c0c
                            # end=stopped
                            # remove_checked=true
                            # archives_checked=true
                            # unwanted_checked=true
                            # unsafe_checked=false
                            # antistealth_checked=true
                            # utc_time=2010-08-12 10:52:58
                            # local_time=2010-08-12 11:52:58 (+0000, GMT Daylight Time)
                            # country="United Kingdom"
                            # lang=1033
                            # osver=6.1.7600 NT
                            # compatibility_mode=512 16777215 100 0 146374 146374 0 0
                            # compatibility_mode=768 16777175 100 0 4478066 4478066 0 0
                            # compatibility_mode=5893 16776573 100 94 244225 34076736 0 0
                            # compatibility_mode=8192 67108863 100 0 178 178 0 0
                            # scanned=950
                            # found=0
                            # cleaned=0
                            # scan_time=33
                            ESETSmartInstaller@High as downloader log:
                            all ok
                            esets_scanner_update returned -1 esets_gle=53251
                            # version=7
                            # OnlineScannerApp.exe=1.0.0.1
                            # OnlineScanner.ocx=1.0.0.6211
                            # api_version=3.0.2
                            # EOSSerial=2f59ad21ef48884ea88a0348469b1c0c
                            # end=finished
                            # remove_checked=false
                            # archives_checked=true
                            # unwanted_checked=true
                            # unsafe_checked=false
                            # antistealth_checked=true
                            # utc_time=2010-08-12 01:37:51
                            # local_time=2010-08-12 02:37:51 (+0000, GMT Daylight Time)
                            # country="United Kingdom"
                            # lang=1033
                            # osver=6.1.7600 NT
                            # compatibility_mode=512 16777215 100 0 146481 146481 0 0
                            # compatibility_mode=768 16777175 100 0 4478173 4478173 0 0
                            # compatibility_mode=5893 16776573 100 94 244332 34076843 0 0
                            # compatibility_mode=8192 67108863 100 0 285 285 0 0
                            # scanned=200550
                            # found=0
                            # cleaned=0
                            # scan_time=9818
                            Logged

                            harry 48



                              Egghead

                            • lay back , relax and chill out
                              • Thanked: 129
                              • Yes
                              • Yes
                              • Yes
                              • Dribbling Pensioner
                            • Certifications: List
                            • Experience: Familiar
                            • OS: Windows 7
                            Re: Antivir Solution Pro Removal?? Help!
                            « Reply #22 on: August 12, 2010, 01:12:50 PM »
                             :||x
                            Logged

                            SuperDave

                            • Malware Removal Specialist
                            • Moderator


                              • Genius
                              • Thanked: 1020
                            • Certifications: List
                            • Experience: Expert
                            • OS: Windows 10
                            Re: Antivir Solution Pro Removal?? Help!
                            « Reply #23 on: August 12, 2010, 01:22:27 PM »
                            Well, that looks good. If there are no other issues, it's time for some cleanup.

                            To remove all of the tools we used and the files and folders they created do the following:
                            Double click OTL.exe.
                            • Click the CleanUp button.
                            • Select Yes when the "Begin cleanup Process?" prompt appears.
                            • If you are prompted to Reboot during the cleanup, select Yes.
                            • The tool will delete itself once it finishes.
                            Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

                            ****************************************

                            Clean out your temporary internet files and temp files.

                            Download TFC by OldTimer to your desktop.

                            Double-click TFC.exe to run it.

                            Note: If you are running on Vista, right-click on the file and choose Run As Administrator

                            TFC will close all programs when run, so make sure you have saved all your work before you begin.

                            * Click the Start button to begin the cleaning process.
                            * Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
                            * Please let TFC run uninterrupted until it is finished.

                            Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

                            ********************************************

                            Looking over your log it seems you don't have any evidence of a third party firewall.

                            Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

                            Remember only install ONE firewall

                            1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
                            2) Online Armor
                            3) Agnitum Outpost
                            4) PC Tools Firewall Plus

                            If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

                            *********************************************
                            Some of these may not run on Windows 7
                            Use the Secunia Software Inspector to check for out of date software.

                            •Click Start Now

                            •Check the box next to Enable thorough system inspection.

                            •Click Start

                            •Allow the scan to finish and scroll down to see if any updates are needed.
                            •Update anything listed.
                            .
                            ----------

                            Go to Microsoft Windows Update and get all critical updates.

                            ----------

                            I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

                            SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
                            * Using SpywareBlaster to protect your computer from Spyware and Malware
                            * If you don't know what ActiveX controls are, see here

                            Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

                            Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

                            Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
                            Safe Surfing!
                            Logged
                            Windows 8 and Windows 10 dual boot with two SSD's

                            1two3

                              Topic Starter


                              Beginner
                              Re: Antivir Solution Pro Removal?? Help!
                              « Reply #24 on: August 13, 2010, 02:00:09 PM »
                              SuperDave, thank you so much. You've been great. I just have a few questions:

                              1. What programs should have been removed, because some of them weren't removed. Should all of them have been?

                              2. Also, if I use Spybot Search and Destroy, do I disable Windows Defender?

                              Stupid questions, I know, but I just want to make sure.

                              Thanks again, SuperDave.
                              Logged

                              SuperDave

                              • Malware Removal Specialist
                              • Moderator


                                • Genius
                                • Thanked: 1020
                              • Certifications: List
                              • Experience: Expert
                              • OS: Windows 10
                              Re: Antivir Solution Pro Removal?? Help!
                              « Reply #25 on: August 13, 2010, 04:56:01 PM »
                              Quote
                              What programs should have been removed, because some of them weren't removed. Should all of them have been?
                              No. OTC will only remove certain ones. Uninstall or delete the ones that are left.

                              Quote
                              2. Also, if I use Spybot Search and Destroy, do I disable Windows Defender?
                              I have Spybot and Windows Defender running on my computer with no problems.
                              Logged
                              Windows 8 and Windows 10 dual boot with two SSD's

                              1two3

                                Topic Starter


                                Beginner
                                Re: Antivir Solution Pro Removal?? Help!
                                « Reply #26 on: August 14, 2010, 03:03:50 AM »
                                Ok. Thanks once more. You've been such a great help.  :)
                                Logged
                                Pages: 1 2 [All]   Go Up
                                « previous next »