Advertisement
Advertisement
 Search | |
| |
27-Oct-2012, 11:41 AM
#4 | |||||||
| askey127, First off, please allow me to express my greatest appreciation and sense of gratitude for the help and assistance you've provided on my behalf. As I mentioned in my initial message, I consider myself very fortunate to have discovered this site and come across people like yourself willing to help those in distress like myself. Trying to find information about searchnu.com, let alone specific, detailed strategy on how to have it removed is very scarce, few and far between. Doing a Google search on searchnu.com/421 leaves you rather depressed and discouraged directing you to places, sites that are hardly encouraging about being able to get rid of it, most of which have a sinister sense about them, almost spooky, that while very desperate couldn't get myself to download their "malware remover" and other 100% guaranteed products that seem downright scary. So, finding this site and having you do whatever you can on my behalf is absolutely a godsend. Once again, thanks very much. I did find others with the same problem as listed below and had planned to follow the advice provided at that specific thread but despite all the directions he received from flavallee, Trusted advisor, at the end rusty_2010 writes that he was unable to get it removed. Fortunately, when I went to check my post, you had already given me the means in which to hopefully resolve my problem. I'll get right down to following your directions and you'll be hearing back from me as soon as possible Thanks again very much.   All the Very Best, Marc Savoy rusty_2010 http://forums.techguy.org/virus-othe...rchnu-com.html flavallee's Avatar flavallee flavallee is online now flavallee is a Trusted Advisor with special permissions. flavallee has a Profile Picture Computer Specs Trusted Advisor with 46,225 posts. |
28-Oct-2012, 05:22 PM
#5 | |||||||
| askey127 Here are the results from the OTL log and SystemLook log A few notes for your knowledge base. 1.I've been unable to find the OTL log files on my computer and neither did it seem to save itself in the notepad. Fortunately, I cut and pasted it into a doc. file simply to preserve a back up just in case. C:\_OTL\Moved Files\mmddyyyy_hhmmss.log 2. At one point I had lost hope of ridding the searchnu.com/421 when the fix.txt file wouldn't open up and apppear in the OTL fix field. I tried several times but it wasn't responding getting the same message that it can't be opened or something like that. The fix.txt file menu page was already opened and had to simply click open but as I said it wasn't responding. I simply tried several other approaches using ways to get the file open until I finally succeeded. Here's the information you requested and again want to thank you for your indispensible help. Looking forward to your response and want to discuss making some sort of donation for your efforts. All the Very Best, Marc Savoy All Processes Killed ========== COMMANDS ========== Restore point Set: OTL Restore Point ========== REGISTRY ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page deleted successfully. Registry key HKEY_CURRENT_USER\Software\AppDataLow\Software\searchqutoolbar\ not found. Registry key HKEY_CURRENT_USER\Software\DataMngr\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bandoo\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Searchqu 406 MediaBar\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\menuor der\start menu2\programs\bandoo\ not found. Registry key HKEY_CURRENT_USER\Software\Trolltech\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\DataMngr_Toolbar\ not found. Registry key HKEY_CURRENT_USER\Software\ilivid\ not found. Registry key HKEY_CURRENT_USER\Software\searchqutoolbar\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Bandoo\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\BandooCore.EXE\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1301A8A5-3DFB-4731-A162-B357D00C9644}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1.exe\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.BandooCore.1\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.BandooCore\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.ResourcesMngr.1\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.ResourcesMngr\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.SettingsMngr.1\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.SettingsMngr\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.StatisticMngr.1\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BandooCore.StatisticMngr\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{477F210A-2A86-4666-9C4B-1189634D2C84}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF871E51-2655-4D06-AED5-745962A96B32}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}\1.0\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4e1d-BDD0-1E9C9B7799CC}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{424624F4-C5DD-4e1d-BDD0-1E9C9B7799CC}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7f000001-db8e-f89c-2fec-49bf726f8c12}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7f000001-db8e-f89c-2fec-49bf726f8c12}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4fde-B055-AE7B0F4CF080}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9189560-573A-4fde-B055-AE7B0F4CF080}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFBD6D47-F5E5-49E4-8157-8BCFF11F3CC3}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFBD6D47-F5E5-49E4-8157-8BCFF11F3CC3}\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save video on Savevid.com\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedAppl ications\ilivid.exe\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SetupDataMngr_searchqu_RASAPI 32\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SetupDataMngr_searchqu_RASMAN CS\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASAPI 32\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASMAN CS\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sear chqu 406 MediaBar\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\SearchquMediabarTb\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{27f69c85-64e1-43ce-98b5-3c9f22fb408e}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27f69c85-64e1-43ce-98b5-3c9f22fb408e}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{b543ef05-9758-464e-9f37-4c28525b4a4c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b543ef05-9758-464e-9f37-4c28525b4a4c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{8f5f1cb6-ea9e-40af-a5ca-c7fd63cc1971}\1.0\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\app management\arpcache\searchqu 406 mediabar\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{a40dc6c5-79d0-4ca8-a185-8ff989af1115}\inprocserver32\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{cc1ac828-bb47-4361-afb5-96eee259dd87}\inprocserver32\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clsid\{fefd3af5-a346-4451-aa23-a3ad54915515}\inprocserver32\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{5b4144e1-b61d-495a-9a50-cd1a95d86d15}\1.0\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{6a4bcaba-c437-4c76-a54e-af31b8a76cb9}\1.0\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\typelib\{841d5a49-e48d-413c-9c28-eb3d9081d705}\1.0\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\internet explorer\low rights\elevationpolicy\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\internet explorer\low rights\elevationpolicy\{d0a4be92-2216-42db-ab35-d72efb9f0176}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d0a4be92-2216-42db-ab35-d72efb9f0176}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\shared tools\msconfig\startupreg\datamngr\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\searchqu.com\ not found. Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1E743B1-DFF5-4DCF-8CD5-9AAFD552B290}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\2B1E51D87B2D71A44BB4 2DDD5E894160\ not found. Registry key HKEY_CURRENT_USER\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Nod e\WhiteSmoke\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\CFA942DEC3AFA384B94ECC932BD3DC5A\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\CFE82A48FED40644C984C808A1785C7F\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\EFB5D9F3E46440D4A9C379467CEADEBB\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Products\2B1E51D87B2D71A44BB42DDD5E894160\InstallProperties\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\In staller\Folders not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Fold ers not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toobar not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\Fi rewallPolicy\FirewallRules\\{3B0118C8-8D12-46CD-A083-2116D587A11F} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B0118C8-8D12-46CD-A083-2116D587A11F}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\Fi rewallPolicy\FirewallRules\\{C39DB3DF-7935-4821-9BD7-170D277DA935} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C39DB3DF-7935-4821-9BD7-170D277DA935}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\Fi rewallPolicy\FirewallRules\\{6B2163BE-A595-4E6E-AAF0-E22A29D38262} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B2163BE-A595-4E6E-AAF0-E22A29D38262}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\Fi rewallPolicy\FirewallRules\\{A49227EB-05C7-449A-9BB6-18F653936F32} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49227EB-05C7-449A-9BB6-18F653936F32}\ not found. Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\Fi rewallPolicy\FirewallRules not found. Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\Fi rewallPolicy\FirewallRules not found. Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\Fi rewallPolicy\FirewallRules not found. Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\services\SharedAccess\Parameters\Fi rewallPolicy\FirewallRules not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameter s\FirewallPolicy\FirewallRules\\{3B0118C8-8D12-46CD-A083-2116D587A11F} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B0118C8-8D12-46CD-A083-2116D587A11F}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameter s\FirewallPolicy\FirewallRules\\{C39DB3DF-7935-4821-9BD7-170D277DA935} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C39DB3DF-7935-4821-9BD7-170D277DA935}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameter s\FirewallPolicy\FirewallRules\\{6B2163BE-A595-4E6E-AAF0-E22A29D38262} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B2163BE-A595-4E6E-AAF0-E22A29D38262}\ not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameter s\FirewallPolicy\FirewallRules\\{A49227EB-05C7-449A-9BB6-18F653936F32} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A49227EB-05C7-449A-9BB6-18F653936F32}\ not found. Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E! Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E! Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\\@|"ISearchQueryHelper" /E! Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}\ProxyStubClsid32\\@|"{B056521A-9B10-425E-B616-1FCD828DB3B1}" /E! ========== FILES ========== File/Folder C:\Users\Primary\AppData\Roaming\Mozilla\Firefox\Profiles\SearchquWebSearch .xml not found. File/Folder C:\Users\Primary\AppData\Roaming\Mozilla\Firefox\Profiles\searchqutoolbar not found. File/Folder C:\Users\Primary\AppData\Roaming\Mozilla\Firefox\Profiles\{99079a25-328f-4bd4-be04-00955acaa0a7} not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\*@sweetim[1].txt not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@ilivid[1].txt not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@ilivid[2].txt not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@searchqu[1].txt not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@searchqu[2].txt not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@stats.iliv id[1].txt not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@sweetim[1].txt not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@www.sweeti m[2].txt not found. File/Folder C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Cookies\Low\*@www.sweeti m[3].txt not found. File/Folder C:\Users\Primary\AppData\Local\Ilivid Player not found. File/Folder C:\Users\Primary\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\iLividSetupV1.exe not found. File/Folder C:\Users\Primary\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ilivid[1].7z not found. File/Folder C:\Users\Primary\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SetupDataMngr_Searchqu[1].exe not found. File/Folder C:\Users\Primary\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SweetImSetup.exe not found. File/Folder C:\Users\Primary\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BandooV6[1].exe not found. File/Folder C:\Users\Primary\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\searchqu_net[1].htm not found. File/Folder C:\Users\Primary\AppData\Local\Temp\BandooFiles not found. File/Folder C:\Users\Primary\AppData\Local\Temp\BandooV6.exe not found. File/Folder C:\Users\Primary\AppData\Local\Temp\SetupDataMngr_Searchqu.exe not found. File/Folder C:\Users\Primary\AppData\Local\Temp\SweetIMReinstall not found. File/Folder C:\Users\Primary\AppData\Local\Temp\SweetIMReinstall\SweetImSetup.exe not found. File/Folder C:\Users\Primary\AppData\Local\Temp\ilivid.7z not found. File/Folder C:\Users\Primary\AppData\Local\Temp\searchqu.ini not found. File/Folder C:\Users\Primary\AppData\Local\Temp\searchqutoolbar-manifest.xml not found. File/Folder C:\Users\Primary\AppData\LocalLow\searchquband not found. File/Folder C:\Users\Primary\AppData\LocalLow\searchqutoolbar not found. File/Folder C:\Users\Primary\Downloads\SweetImSetup.exe not found. File/Folder C:\Users\Primary\Downloads\iLividSetupV1.exe not found. File/Folder C:\Users\Primary\AppData\LocalLow\DataMngr not found. File/Folder C:\Users\Primary\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\3AJVC1WF\www.ilivid[1].xml not found. File/Folder C:\Users\Primary\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\TYBUQFS4\www.searchqu[1].xml not found. File\Folder C:\Windows\Prefetch\SEARCHQU TOOLBAR UNINSTALL.EX-4EFDDDEA.pf not found. File\Folder C:\Program Files\Windows iLivid Toolbar not found. File\Folder C:\Program Files\iLivid not found. File\Folder C:\Windows\Prefetch\ILIVID* not found. File\Folder C:\Windows\Prefetch\SEARCHQUMEDIABAR* not found. File\Folder C:\Windows\Prefetch\SETUPDATAMNGR* not found. File\Folder C:\Program Files (x86)\iLivid not found. File\Folder C:\Program Files (x86)\Windows Savevid Toolbar not found. File\Folder C:\Program Files (x86)\Savevid not found. < ipconfig /flushdns /c > Windows IP Configuration Successfully flushed the DNS Resolver Cache. C:\Users\Primary\Favorites\Desktop prime\cmd.bat deleted successfully. C:\Users\Primary\Favorites\Desktop prime\cmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 3059638 bytes ->Temporary Internet Files folder emptied: 10628481 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 598 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 56504 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Mike ->Temp folder emptied: 530359 bytes ->Temporary Internet Files folder emptied: 11927302 bytes ->Flash cache emptied: 1332 bytes User: Primary ->Temp folder emptied: 135012971 bytes ->Temporary Internet Files folder emptied: 350876133 bytes ->Java cache emptied: 2366005 bytes ->FireFox cache emptied: 88174914 bytes ->Flash cache emptied: 15490249 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 113870 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows \Temporary Internet Files folder emptied: 46623132 bytes RecycleBin emptied: 602112 bytes Total Files Cleaned = 635.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 10282012_164111 Files\Folders moved on Reboot... C:\Users\Primary\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot.. SystemsLook.txt SystemLook 30.07.11 by jpshortstuff Log created at 16:56 on 28/10/2012 by Primary Administrator - Elevation successful ========== filefind ========== Searching for "*Fun4IM*" No files found. Searching for "*Bandoo*" No files found. Searching for "*Searchnu*" C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\SystemFiles\Kernel\SystemResources\Windows\Algebra\SearchNumberT heory.mx --a---- 103132 bytes [03:16 21/07/2012] [00:40 04/10/2011] 89EBEEF5D86A5DE0A82E0804DFC37197 C:\Users\Primary\AppData\Roaming\Microsoft\Office\Recent\process to remove searchnu.com.docx.LNK --a---- 1298 bytes [17:46 28/10/2012] [17:46 28/10/2012] 21964AF55F51966372DDF3C9637EF0C5 C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Recent\1process to remove searchnu.com.docx.lnk --a---- 765 bytes [15:07 27/10/2012] [15:07 27/10/2012] 5FFBB0CDFDDF88D679FD03A5D0F3F9D5 C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Recent\process to remove searchnu.com.docx.lnk --a---- 760 bytes [15:02 27/10/2012] [17:46 28/10/2012] A2144B20DAA3FB892873EDD3B363F319 C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Recent\searchnu imposter.txt.lnk --a---- 698 bytes [04:33 27/10/2012] [04:33 27/10/2012] 7B5599BAA65B105111B534372EF224A0 C:\Users\Primary\Favorites\Desktop prime\searchnu imposter.txt --a---- 47 bytes [04:33 27/10/2012] [04:33 27/10/2012] FB1F05083F832BA7D47CC06C6E6B0D9B Searching for "*Searchqu*" No files found. Searching for "*iLivid*" No files found. Searching for "*whitesmoke*" No files found. Searching for "*datamngr*" No files found. Searching for "*trolltech*" No files found. ========== folderfind ========== Searching for "*Fun4IM*" No folders found. Searching for "*Bandoo*" No folders found. Searching for "*Searchnu*" No folders found. Searching for "*Searchqu*" No folders found. Searching for "*iLivid*" No folders found. Searching for "*whitesmoke*" No folders found. Searching for "*datamngr*" No folders found. Searching for "*trolltech*" No folders found. ========== Regfind ========== Searching for "Fun4IM" No data found. Searching for "Bandoo" No data found. Searching for "Searchnu" [HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Run] "C:\Users\Primary\AppData\Local\Temp\INSTAL~1.DLL,_SetFirefoxHP http://www.searchnu.com/421,"="12" [HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU] "Item 3"="[F00000000][T01CDB534202DED20]*C:\Users\Primary\Favorites\Desktop prime\process to remove searchnu.com.docx" [HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\File MRU] "Item 6"="[F00000000][T01CDB454B77F05A0]*C:\Users\Primary\Favorites\Desktop prime\1process to remove searchnu.com.docx" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\WinPatrol\Run] "C:\Users\Primary\AppData\Local\Temp\INSTAL~1.DLL,_SetFirefoxHP http://www.searchnu.com/421,"="12" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\Microsoft\Office\12.0\Word\File MRU] "Item 3"="[F00000000][T01CDB534202DED20]*C:\Users\Primary\Favorites\Desktop prime\process to remove searchnu.com.docx" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\Microsoft\Office\12.0\Word\File MRU] "Item 6"="[F00000000][T01CDB454B77F05A0]*C:\Users\Primary\Favorites\Desktop prime\1process to remove searchnu.com.docx" Searching for "Searchqu" [HKEY_CURRENT_USER\Software\BillP Studios\Detected\ActiveTasks] "C:\Users\Primary\AppData\Local\Temp\nsxAC.tmp\nsnE73.tmp\SETUPDATAMNGR_SEA RCHQU.EXE"="10/23/2012 6:33 PM" [HKEY_CURRENT_USER\Software\BillP Studios\Detected\ActiveTasks] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe"="10/23/2012 6:41 PM" [HKEY_CURRENT_USER\Software\BillP Studios\Detected\IEHelper] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll"="10/23/2012 6:34 PM" [HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe"="21" [HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll"="255" [HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll"="255" [HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Run] "cmd.exe /c RD /S /Q C:\Program Files (x86)\Searchqu Toolbar"="22" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}] @="ISearchQueryHelper" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}] @="ISearchQueryHelper" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}] "SuggestionsURL_JSON"="http://www.searchqu.com/suggest.php?src=ieb&gct=ds&appid=101&systemid=421&apn_dtid=BND421&apn_ptnrs =AGA&o=APN10649&apn_uid=6434908431664136&qu={searchTerms}&ft=json" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}] "SuggestionsURL_JSON"="http://www.searchqu.com/suggest.php?src=ieb&gct=ds&appid=101&systemid=421&apn_dtid=BND421&apn_ptnrs =AGA&o=APN10649&apn_uid=6434908431664136&qu={searchTerms}&ft=json" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SearchquSRTB] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SearchquSRTB] "Folder"="C:\Program Files (x86)\Searchqu Toolbar\Datamngr\SRToolBar" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}] @="ISearchQueryHelper" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\Detected\ActiveTasks] "C:\Users\Primary\AppData\Local\Temp\nsxAC.tmp\nsnE73.tmp\SETUPDATAMNGR_SEA RCHQU.EXE"="10/23/2012 6:33 PM" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\Detected\ActiveTasks] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe"="10/23/2012 6:41 PM" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\Detected\IEHelper] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll"="10/23/2012 6:34 PM" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe"="21" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll"="255" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll"="255" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\WinPatrol\Run] "cmd.exe /c RD /S /Q C:\Program Files (x86)\Searchqu Toolbar"="22" Searching for "iLivid" No data found. Searching for "whitesmoke" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\B760674538A35F241999134C94EA70A1] "E9EFB8E6C50FF4F4BA4ABF289FFAF289"="C:\Program Files (x86)\Google\Google SketchUp 8\Materials\Colors-Named\0129_WhiteSmoke.skm" Searching for "datamngr" [HKEY_CURRENT_USER\Software\BillP Studios\Detected\ActiveTasks] "C:\Users\Primary\AppData\Local\Temp\nsxAC.tmp\nsnE73.tmp\SETUPDATAMNGR_SEA RCHQU.EXE"="10/23/2012 6:33 PM" [HKEY_CURRENT_USER\Software\BillP Studios\Detected\ActiveTasks] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe"="10/23/2012 6:41 PM" [HKEY_CURRENT_USER\Software\BillP Studios\Detected\IEHelper] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll"="10/23/2012 6:34 PM" [HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe"="21" [HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll"="255" [HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll"="255" [HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3ec1a45c-8bc3-4bfe-b226-4051c5d3d068}] "AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\SRTOOL~1" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SearchquSRTB] "Folder"="C:\Program Files (x86)\Searchqu Toolbar\Datamngr\SRToolBar" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\Detected\ActiveTasks] "C:\Users\Primary\AppData\Local\Temp\nsxAC.tmp\nsnE73.tmp\SETUPDATAMNGR_SEA RCHQU.EXE"="10/23/2012 6:33 PM" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\Detected\ActiveTasks] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe"="10/23/2012 6:41 PM" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\Detected\IEHelper] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll"="10/23/2012 6:34 PM" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe"="21" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll"="255" [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\BillP Studios\WinPatrol\Run] "C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll"="255" Searching for "kelkoopartners" No data found. Searching for "trolltech" [HKEY_CURRENT_USER\Software\Trolltech] [HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:] [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\Trolltech] [HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:] -= EOF =- |
29-Oct-2012, 11:01 PM
#11 | |||||||
 Desperate to Rid My Computer of http://www.searchnu.com/421 > I screwed up a bit. I enabled Winpatrol temporarily forgot to disable it as you directed, did the OTL run but when it rebooted I remembered that winpatrol should have been disabled and performed a second OTL scan where most of the responses were "error" so i did a third scan with winpatrol disabled, the results of which are here below. Hope i didn't mess things up too badly. All processes killed ========== COMMANDS ========== Restore point Set: OTL Restore Point ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\User Data\S-1-5-18\Components\B760674538A35F241999134C94EA70A1 not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr\ not found. Registry key HKEY_CURRENT_USER\Software\Trolltech\ deleted successfully. Registry key HKEY_USERS\S-1-5-21-2310302133-1125941473-504086252-1002\Software\Trolltech\ not found. ========== FILES ========== < ipconfig /flushdns /c > Windows IP Configuration Successfully flushed the DNS Resolver Cache. C:\Users\Primary\Favorites\Desktop prime\searchnu tools\cmd.bat deleted successfully. C:\Users\Primary\Favorites\Desktop prime\searchnu tools\cmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Mike ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Primary ->Temp folder emptied: 542974 bytes ->Temporary Internet Files folder emptied: 61999 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 8580099 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 20322 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows \Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 9.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 10292012_220343 Files\Folders moved on Reboot... C:\Users\Primary\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... OTL logfile created on: 10/29/2012 10:50:48 PM - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Primary\Favorites\Desktop prime\searchnu tools 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 4.00 Gb Total Physical Memory | 2.38 Gb Available Physical Memory | 59.62% Memory free 8.00 Gb Paging File | 6.34 Gb Available in Paging File | 79.30% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 698.54 Gb Total Space | 214.50 Gb Free Space | 30.71% Space Free | Partition Type: NTFS Drive E: | 465.76 Gb Total Space | 335.70 Gb Free Space | 72.08% Space Free | Partition Type: NTFS Drive L: | 1862.98 Gb Total Space | 1228.84 Gb Free Space | 65.96% Space Free | Partition Type: NTFS Computer Name: MIKE-PC | User Name: Primary | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/10/28 16:32:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Primary\Favorites\Desktop prime\searchnu tools\OTL.exe PRC - [2012/10/20 22:14:34 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012/06/14 11:04:26 | 001,177,536 | R--- | M] (Western Digital ) -- C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe PRC - [2012/06/14 11:04:24 | 001,151,424 | R--- | M] (Western Digital ) -- C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe PRC - [2012/06/14 10:58:24 | 005,235,128 | R--- | M] (Western Digital Technologies, Inc.) -- C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe PRC - [2012/06/14 10:57:20 | 000,248,248 | R--- | M] (Western Digital) -- C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe PRC - [2011/06/30 14:48:46 | 000,395,152 | ---- | M] (Seagate) -- C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe PRC - [2011/06/30 14:47:14 | 002,638,152 | ---- | M] (Seagate) -- C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe PRC - [2010/07/04 15:51:26 | 000,017,408 | ---- | M] () -- C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe PRC - [2010/06/16 17:42:58 | 000,839,680 | ---- | M] () -- C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe PRC - [2010/05/18 15:13:58 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009/03/12 21:18:48 | 000,602,624 | ---- | M] () -- C:\Program Files (x86)\Everything\Everything.exe ========== Modules (No Company Name) ========== MOD - [2012/10/20 22:13:50 | 002,294,240 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2012/02/20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012/02/20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2010/07/04 17:32:36 | 000,004,608 | ---- | M] () -- C:\Program Files (x86)\Unlocker\UnlockerHook.dll MOD - [2010/07/04 15:51:26 | 000,017,408 | ---- | M] () -- C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe MOD - [2010/06/16 17:42:58 | 000,839,680 | ---- | M] () -- C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe MOD - [2009/03/12 21:18:48 | 000,602,624 | ---- | M] () -- C:\Program Files (x86)\Everything\Everything.exe ========== Services (SafeList) ========== SRV:64bit: - [2012/09/12 21:21:48 | 000,368,896 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV:64bit: - [2012/09/12 21:21:48 | 000,022,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV:64bit: - [2011/11/10 03:11:34 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009/07/13 21:41:19 | 000,045,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lpdsvc.dll -- (LPDSVC) SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012/10/20 22:14:33 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012/10/09 22:42:22 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012/06/14 11:04:26 | 001,177,536 | R--- | M] (Western Digital ) [Auto | Running] -- C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe -- (WDRulesService) SRV - [2012/06/14 11:04:24 | 001,151,424 | R--- | M] (Western Digital ) [Auto | Running] -- C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe -- (WDBackup) SRV - [2012/06/14 10:57:20 | 000,248,248 | R--- | M] (Western Digital) [Auto | Running] -- C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe -- (WDDriveService) SRV - [2012/03/08 02:50:22 | 000,115,520 | ---- | M] (Cloud Engines) [Auto | Running] -- C:\Program Files (x86)\PogoplugBackup\dokanmnt.exe -- (DokanCEMounter) SRV - [2011/06/30 14:50:10 | 001,191,408 | ---- | M] (Seagate) [Auto | Running] -- C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe -- (SgtSch2Svc) SRV - [2010/11/20 08:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS) SRV - [2010/11/20 08:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc) SRV - [2010/05/18 15:13:58 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012/10/15 23:48:53 | 000,971,360 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\timntr.sys -- (timounter) DRV:64bit: - [2012/10/15 23:48:31 | 000,210,016 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vididr.sys -- (vididr) DRV:64bit: - [2012/10/15 23:48:27 | 000,141,920 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vsflt53.sys -- (vidsflt53) DRV:64bit: - [2012/10/15 23:48:20 | 000,275,552 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\snapman.sys -- (snapman) DRV:64bit: - [2012/10/12 16:35:26 | 000,050,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2012/10/09 20:31:14 | 000,075,928 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) DRV:64bit: - [2012/09/22 17:45:22 | 000,031,080 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp) DRV:64bit: - [2012/08/30 22:03:48 | 000,128,456 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012/07/09 13:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011/11/10 03:45:32 | 010,567,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2011/11/10 02:12:46 | 000,325,632 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010/11/20 09:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010/11/20 07:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2009/07/31 00:12:56 | 000,339,744 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET) DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/07/13 20:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009/06/10 16:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD) DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008/05/06 16:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM) DRV - [2012/03/08 02:50:22 | 000,066,880 | ---- | M] (Cloud Engines) [File_System | Auto | Running] -- C:\Program Files (x86)\PogoplugBackup\dokance.sys -- (DokanCEDriver) DRV - [2010/07/04 15:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5) DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://searchfunmoods.com/?f=1&a=nv1...&cr=1127200979 IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDtBtAy DyEtB0EtA0EtBtAyC0E0DzytN0D0Tzu0CtBtDtAtN1L2XzutBtFtCtFtDtFtAtDtC&cr=197120 3690 IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={ inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}: "URL" = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=101&systemid=421&apn_dtid=BND421&apn_ptnrs=AGA&o=AP N10649&apn_uid=6434908431664136&q={searchTerms} IE:64bit: - HKLM\..\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtBtAy DyEtB0EtA0EtBtAyC0E0DzytN0D0Tzu0CtBzyyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=112720 0979 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKLM\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDtBtAy DyEtB0EtA0EtBtAyC0E0DzytN0D0Tzu0CtBtDtAtN1L2XzutBtFtCtFtDtFtAtDtC&cr=197120 3690 IE - HKLM\..\SearchScopes\{2ACC9101-D1A6-0CE1-84C5-022FD22F899F}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={ inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtBtAy DyEtB0EtA0EtBtAyC0E0DzytN0D0Tzu0CtBzyyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=112720 0979 IE - HKLM\..\SearchScopes\{c1d89ae7-449d-4929-b24b-fded04adbe06}: "URL" = http://isearch.glarysoft.com/?q={searchTerms}&src=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = http://msn.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.conduit.com?SearchSour...ctid=CT3227980 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?ocid=OIE9MSE&PC=UP09 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://search.autocompletepro.com/?si=7981&bi=400 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?ocid=OIE9MSE&PC=UP09 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 C4 EA 89 84 50 CD 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://search.autocompletepro.com/?si=7981&bi=400 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\..\URLSearchHook: {0cc09160-108c-4759-bab1-5c12c216e005} - No CLSID value found IE - HKCU\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found IE - HKCU\..\URLSearchHook: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - No CLSID value found IE - HKCU\..\URLSearchHook: {b97ed18c-1a8a-4acc-884f-b4fe7415adf2} - No CLSID value found IE - HKCU\..\SearchScopes,Backup.Old.DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} IE - HKCU\..\SearchScopes,DefaultScope = {2F5B3A35-D8AD-439C-B006-5F52D9734059} IE - HKCU\..\SearchScopes\{2F5B3A35-D8AD-439C-B006-5F52D9734059}: "URL" = http://www.bing.com/search?FORM=UP09DF&PC=UP09&q={searchTerms}&src=IE-SearchBox IE - HKCU\..\SearchScopes\{7468ABCE-9808-46BD-99A7-4BA3A0514603}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&rlz= IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://searchfunmoods.com/?f=1&a=nv1&chnl=nv1&cd=2XzuyEtN2Y1L1QzutDtDtBtAyDyEtB0EtA0EtBtAyC0E0DzytN0D 0Tzu0CtBzyyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=1127200979" FF - prefs.js..keyword.URL: "Google" FF - prefs.js..browser.search.selectedEngine: "Funmoods" FF - prefs.js..browser.search.defaultenginename: "Funmoods" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\\npsitesafety.dll File not found FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@parallelgraphics.com/Cortona: C:\Program Files (x86)\Common Files\ParallelGraphics\Cortona\npcortona.dll (ParallelGraphics) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\@virtools.com/3DviaPlayer: C:\Program Files (x86)\Virtools\3D Life Player\npvirtools.dll (Dassault Systèmes) FF - HKLM\Software\MozillaPlugins\@wolfram.com/Mathematica: C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.4.2609412\npmathplugin.dll (Wolfram Research, Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Primary\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Primary\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll () FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Primary\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Primary\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Primary\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/20 22:14:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012/10/13 22:42:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012/10/13 22:42:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012/10/23 18:53:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\Extensions [2012/10/29 21:15:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\Firefox\Profiles\extensions [2012/10/20 15:34:08 | 000,000,000 | ---D | M] (Toolbar Buttons) -- C:\Users\Primary\AppData\Roaming\mozilla\Firefox\Profiles\extensions\{03B08 592-E5B4-45ff-A0BE-C1D975458688} [2012/10/20 15:34:00 | 000,000,000 | ---D | M] (Remove It Permanently) -- C:\Users\Primary\AppData\Roaming\mozilla\Firefox\Profiles\extensions\{1dbc4 a33-ea62-4330-966c-7bdad3455322} [2012/10/20 15:34:01 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\Primary\AppData\Roaming\mozilla\Firefox\Profiles\extensions\{6AC85 730-7D0F-4de0-B3FA-21142DD85326} [2012/10/29 02:25:07 | 000,000,000 | ---D | M] (BlockSite Plus) -- C:\Users\Primary\AppData\Roaming\mozilla\Firefox\Profiles\extensions\{6d43f ee4-72e7-4290-b75a-b898e4f4676d} [2012/10/20 13:21:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\Firefox\Profiles\y8w4ggb9.default\ extensions [2012/10/25 21:35:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\Firefox\Profiles\y8w4ggb9.default\ extensions\staged [2012/10/20 15:33:58 | 000,025,781 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\add-to-searchbox@maltekraus.de.xpi [2012/10/20 15:34:00 | 000,020,387 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\chrome view@systemantics.net.xpi [2012/10/20 15:34:00 | 000,018,310 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\colori nspector3d@davidfichtmueller.de.xpi [2012/10/26 18:14:17 | 000,052,154 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\gmailt his@lazyrussian.com.xpi [2012/10/20 15:34:00 | 000,128,599 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\itsall text@docwhat.gerf.org.xpi [2012/10/21 20:05:02 | 000,154,926 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\Noia4O ptions@ArisT2.xpi [2012/10/20 14:46:39 | 000,013,094 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\noinst alldelay@trlkly.drivehq.com.xpi [2012/10/20 15:34:00 | 000,013,168 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\oldAdd BookmarkBehavior@alice.xpi [2012/10/20 15:34:00 | 000,108,792 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\pcln@c ycledlm.gmail.com.xpi [2012/10/20 15:34:00 | 000,030,669 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\redire ctcleaner@example.net.xpi [2012/10/20 15:34:00 | 000,139,801 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\savefi leto@mozdev.org.xpi [2012/10/20 15:34:00 | 000,258,434 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\scrapb ookplus@addons.mozilla.org.xpi [2012/10/29 18:47:36 | 000,001,469 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\skip_c ompatibility_check@sdrocking.com.xpi [2012/10/20 15:34:00 | 000,079,135 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{1A2D0 EC4-75F5-4c91-89C4-3656F6E44B68}.xpi [2012/10/20 15:34:00 | 000,018,589 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{1ced4 832-f06e-413f-aa14-9eb63ad40ace}.xpi [2012/10/20 15:34:00 | 000,077,698 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{1feca 320-6b4d-11df-a08a-0800200c9a66}.xpi [2012/10/20 14:47:39 | 000,318,456 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{28197 867-b1ef-4140-8e3b-55c45b9c8460}.xpi [2012/10/25 13:56:13 | 000,049,303 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{4c709 7f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2012/10/25 20:22:08 | 000,013,331 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{4DC70 064-89E2-4a55-8FC6-E8CDEAE3612C}.xpi [2012/10/25 19:59:28 | 000,013,345 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{4DC70 064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi [2012/10/20 15:34:01 | 000,372,140 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{5C46D 283-ABDE-4dce-B83C-08881401921C}.xpi [2012/10/20 15:34:01 | 000,017,971 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{c1970 c0d-dbe6-4d91-804f-c9c0de643a57}.xpi [2012/10/20 15:34:01 | 000,061,700 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{cd617 375-6743-4ee8-bac4-fbf10f35729e}.xpi [2012/10/20 15:27:29 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{d10d0 bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012/10/20 15:34:01 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{d40f5 e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2012/10/20 15:34:01 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{D4DD6 3FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2012/10/20 15:34:01 | 000,038,787 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{d93e6 838-8272-4382-a0fb-36a56db176c5}.xpi [2012/10/20 15:34:01 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{dc572 301-7619-498c-a57d-39143191b318}.xpi [2012/10/29 02:22:14 | 000,016,192 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{dd3d7 613-0246-469d-bc65-2a3cc1668adc}.xpi [2012/10/20 15:34:01 | 000,252,340 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{e4a8a 97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012/10/20 15:34:01 | 000,004,139 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{ec268 e28-22c6-4a6c-ac22-635cabee283c}.xpi [2012/10/20 15:34:01 | 000,091,556 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{EDA7B 1D7-F793-4e03-B074-E6F303317FB0}.xpi [2012/10/21 20:05:02 | 001,556,566 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{faf13 420-5e24-11e0-80e3-0800200c9a66}.xpi [2012/10/27 01:01:39 | 000,057,702 | ---- | M] () (No name found) -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\extensions\{fe025 8ab-4f74-43a1-8781-bcdf340f9ee9}.xpi [2012/10/20 13:21:40 | 000,000,775 | ---- | M] () -- C:\Users\Primary\AppData\Roaming\mozilla\firefox\profiles\y8w4ggb9.default\ searchplugins\Funmoods.xml [2012/10/23 18:53:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012/10/20 22:14:34 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012/09/05 21:26:22 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012/10/23 18:41:02 | 000,002,687 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml [2012/10/20 22:13:49 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml O1 HOSTS File: ([2012/10/02 21:36:14 | 000,001,115 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.ambit.com O1 - Hosts: 127.0.0.1 search.babylon.com/?affID=14335&tt=3512_6&babsrc=HP_ss&mntrId=d8f66ed90000000000000023542e3e23 O1 - Hosts: 127.0.0.1 www.comodo.com/secure-dns/*/ O1 - Hosts: 127.0.0.1 www.comodo.com/*/*/*/*/ O1 - Hosts: 127.0.0.1 http://www.comodo.com/.../internet-s...et-security/*/ O1 - Hosts: 127.0.0.1 O2:64bit: - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll File not found O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll File not found O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll File not found O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [IntelliType Pro] C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [Seagate Scheduler2 Service] C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [DiscWizardMonitor.exe] C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe (Seagate) O4 - HKLM..\Run: [Everything] C:\Program Files (x86)\Everything\Everything.exe () O4 - HKLM..\Run: [STARTPAGE] C:\NOSPY.ORG\start1.exe File not found O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe () O4 - HKLM..\Run: [WD Quick View] C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe (Western Digital Technologies, Inc.) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" File not found O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe File not found O4 - HKCU..\Run: [OpenDNS Updater] C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe () O4 - HKCU..\Run: [SkyDrive] C:\Users\Primary\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll File not found O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll File not found O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanage...ex-2.2.6.2.cab (DLM Control) O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd...pdetect118.cab (GMNRev Class) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/ge...sh/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{703EEC82-4BE4-4A8A-9EFE-FB3FDFD9C47E}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{703EEC82-4BE4-4A8A-9EFE-FB3FDFD9C47E}: NameServer = 208.67.222.222,208.67.220.220 O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll File not found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\linkscanner - No CLSID value found O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{2d667252-cbb1-11e1-b8e4-0023542e3e23}\Shell - "" = AutoRun O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012/10/29 18:52:21 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\Firefox [2012/10/29 00:49:47 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\final reagan [2012/10/29 00:48:17 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\searchnu tools [2012/10/28 16:41:11 | 000,000,000 | ---D | C] -- C:\_OTL [2012/10/28 15:41:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client [2012/10/28 15:41:45 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client [2012/10/28 13:38:32 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\rkill [2012/10/28 13:22:31 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\ProcessMonitor [2012/10/28 13:11:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Softland [2012/10/28 13:11:34 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2012/10/28 13:11:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FBackup 4 [2012/10/28 13:11:03 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Roaming\Softland [2012/10/28 13:11:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Softland [2012/10/28 13:07:14 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Local\NeoSmart_Technologies [2012/10/28 13:06:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NeoSmart Technologies [2012/10/28 13:05:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NeoSmart Technologies [2012/10/27 05:06:23 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\photos [2012/10/27 01:23:28 | 009,330,176 | ---- | C] (Irfan Skiljan) -- C:\Users\Primary\Favorites\Desktop prime\irfanview_plugins_433_setup.exe [2012/10/26 23:48:36 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\Spyware [2012/10/26 12:18:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012/10/25 22:22:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TrendMicro [2012/10/24 11:15:27 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\NeroVision [2012/10/24 10:39:46 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\main [2012/10/23 19:41:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSECache [2012/10/23 18:33:14 | 000,040,960 | ---- | C] (vbAccelerator) -- C:\Windows\SysWow64\SSubTmr6.dll [2012/10/23 18:33:13 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Roaming\FreeBurner [2012/10/23 18:33:13 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess [2012/10/23 17:54:20 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\neo burn [2012/10/22 19:07:56 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Roaming\Nero [2012/10/22 18:56:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero [2012/10/22 18:55:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero [2012/10/22 18:55:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nero [2012/10/22 18:53:54 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling [2012/10/22 18:53:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\LightScribe [2012/10/22 18:26:32 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Local\{4DB50C1E-93CF-43C6-8D5C-125DF30B8374} [2012/10/22 16:40:29 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\BM [2012/10/22 16:35:53 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\RRCA [2012/10/20 22:13:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012/10/20 00:24:15 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\raw-hdr [2012/10/19 18:48:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Applian Technologies [2012/10/18 07:26:44 | 000,000,000 | ---D | C] -- C:\Users\Primary\.gimp-2.8 [2012/10/17 19:58:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center [2012/10/17 19:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Mouse and Keyboard Center [2012/10/17 13:09:26 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain [2012/10/17 12:53:33 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\Bit Torrent Transferred [2012/10/17 12:38:21 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\Extra Step [2012/10/17 12:22:12 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Hacks [2012/10/17 12:22:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google Hacks [2012/10/16 22:01:48 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\My Documents [2012/10/16 21:50:03 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\New ISOs [2012/10/16 19:37:40 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee [2012/10/16 13:52:52 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\Beatles Search [2012/10/16 13:35:21 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\mp3 1 [2012/10/15 23:49:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Seagate [2012/10/15 23:48:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Acronis [2012/10/15 23:47:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Seagate [2012/10/15 23:34:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate [2012/10/15 23:34:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Seagate [2012/10/15 23:32:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard [2012/10/14 13:04:41 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\Step Folder 2 [2012/10/14 07:13:00 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Roaming\GoforFiles [2012/10/14 07:01:22 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Roaming\Audacity [2012/10/14 06:58:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity [2012/10/14 06:28:24 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView [2012/10/13 23:21:23 | 000,000,000 | ---D | C] -- C:\Users\Primary\Favorites\Desktop prime\undeletable [2012/10/13 01:30:27 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx [2012/10/13 01:26:52 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Local\Western_Digital [2012/10/12 21:51:01 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Everything [2012/10/11 05:02:57 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Local\{68BC8EE9-C571-40EC-BC49-679770AD920A} [2012/10/10 01:25:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenDNS Updater [2012/10/09 20:07:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FirefoxPreloader [2012/10/08 07:27:59 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Local\{04F45F3E-68C5-467F-9CC6-77FBAEEDE8CF} [2012/10/07 18:55:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip [2012/10/06 20:36:10 | 000,000,000 | ---D | C] -- C:\Wow Gospel - CD 1 [2012/10/05 14:57:40 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Local\{87C8B400-0B14-4529-837D-8E3B67D60B52} [2012/10/04 23:48:54 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Local\{C073A1FD-46E4-482D-B718-4D9A84808FF0} [2012/10/04 18:08:31 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler [2012/10/03 15:57:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012/10/01 13:09:23 | 000,000,000 | ---D | C] -- C:\Windows\CheckSur [2012/10/01 03:34:31 | 000,000,000 | ---D | C] -- C:\Users\Primary\AppData\Local\{07EB5B35-93B9-4B58-BF46-E614B919C961} [1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ] [1 C:\Program Files (x86)\Common Files\*.tmp files -> C:\Program Files (x86)\Common Files\*.tmp -> ] [1 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/10/29 22:42:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012/10/29 22:18:00 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/10/29 22:14:54 | 000,017,168 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/10/29 22:14:54 | 000,017,168 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/10/29 22:07:44 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/10/29 22:07:44 | 000,000,328 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job [2012/10/29 22:07:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/10/29 22:06:56 | 3220,037,632 | -HS- | M] () -- C:\hiberfil.sys [2012/10/29 22:01:00 | 000,000,916 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2310302133-1125941473-504086252-1002UA.job [2012/10/29 21:14:12 | 000,001,028 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Continue Best Codec Pack installation.lnk [2012/10/29 20:50:20 | 000,152,392 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Word 2010 Return.png [2012/10/29 19:01:00 | 000,000,864 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2310302133-1125941473-504086252-1002Core.job [2012/10/29 18:11:01 | 000,419,734 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\1 extensions.png [2012/10/29 13:59:56 | 000,466,275 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\googlemap.png [2012/10/28 16:25:14 | 000,339,430 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\clean reagan.png1.png [2012/10/28 15:42:29 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif [2012/10/28 14:15:46 | 000,900,708 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\flying main.png [2012/10/28 14:09:00 | 000,013,685 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\ProcessMonitor.lnk [2012/10/28 14:07:11 | 000,001,797 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\ProcessMonitor.lnk [2012/10/28 13:11:17 | 000,001,056 | ---- | M] () -- C:\Users\Public\Desktop\FBackup 4.lnk [2012/10/28 13:06:58 | 000,024,576 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\EasyBCD Backup (2012-10-28).bcd [2012/10/28 13:06:14 | 000,001,215 | ---- | M] () -- C:\Users\Public\Desktop\EasyBCD 2.2.lnk [2012/10/27 14:10:51 | 000,065,576 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\flag Untitled.png [2012/10/27 14:10:32 | 000,152,264 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Untitled.pdn [2012/10/27 14:05:49 | 000,888,967 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\flying flags.png [2012/10/27 04:16:26 | 239,698,070 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\GoFlex_Slim_ProSW.zip [2012/10/27 00:04:22 | 000,876,595 | ---- | M] () -- C:\Users\Primary\AppData\Local\census.cache [2012/10/27 00:00:43 | 000,127,705 | ---- | M] () -- C:\Users\Primary\AppData\Local\ars.cache [2012/10/26 17:25:09 | 000,000,036 | ---- | M] () -- C:\Users\Primary\AppData\Local\housecall.guid.cache [2012/10/25 21:42:12 | 000,005,677 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\bm search ms.search-ms [2012/10/24 10:57:10 | 000,000,227 | ---- | M] () -- C:\Users\Primary\AppData\Roaming\default.rss [2012/10/24 10:56:55 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2012/10/24 10:49:49 | 000,001,319 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\CDC Label.ncd [2012/10/24 01:43:05 | 000,001,661 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Jobs News, Videos, Reviews and Gossip - Lifehacker.htm - Shortcut.lnk [2012/10/22 18:56:54 | 000,002,710 | ---- | M] () -- C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk [2012/10/22 18:53:59 | 000,002,039 | ---- | M] () -- C:\Users\Public\Desktop\LightScribe.lnk [2012/10/22 18:38:28 | 000,001,300 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Revo Uninstaller.lnk [2012/10/22 18:37:12 | 000,000,526 | ---- | M] () -- C:\Users\Primary\AppData\Roaming\burnaware.ini [2012/10/22 10:42:31 | 000,830,650 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012/10/22 10:42:31 | 000,687,146 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012/10/22 10:42:31 | 000,131,926 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012/10/21 23:16:44 | 000,023,084 | ---- | M] () -- C:\Users\Primary\png.png [2012/10/20 22:06:40 | 000,497,064 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Warp_Velocity_by_Mxyzptlk246.jpg [2012/10/20 18:51:16 | 000,440,720 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012/10/20 14:44:34 | 000,813,556 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012/10/20 07:26:01 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2012/10/20 04:39:37 | 000,012,792 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\images.jpg [2012/10/19 23:41:58 | 000,000,622 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\TakeOwnership.zip [2012/10/19 21:06:27 | 003,077,634 | ---- | M] () -- C:\Users\Primary\best supreeem.png [2012/10/17 19:59:37 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf [2012/10/17 19:05:47 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf [2012/10/17 19:05:46 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Coinstaller_Critical.Wdf [2012/10/16 15:35:29 | 000,093,394 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\LeviathanWallHanging.gif [2012/10/15 23:48:59 | 000,001,141 | ---- | M] () -- C:\Users\Public\Desktop\Seagate DiscWizard.lnk [2012/10/15 23:34:36 | 000,002,453 | ---- | M] () -- C:\Users\Public\Desktop\SeaTools for Windows.lnk [2012/10/15 23:32:35 | 021,476,536 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\SeaToolsforWindowsSetup-1206.exe [2012/10/14 13:28:02 | 000,126,844 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Going_into_warp_by_Balsavor.jpg [2012/10/14 07:34:04 | 006,619,729 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\preview.mp3 [2012/10/14 07:31:31 | 003,727,360 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\60379.mp3 [2012/10/14 07:22:42 | 004,866,587 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\10 I'd Rather Be Dead.mp3 [2012/10/14 06:58:55 | 000,001,015 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Audacity.lnk [2012/10/14 06:28:24 | 000,001,898 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\IrfanView Thumbnails.lnk [2012/10/14 06:28:24 | 000,001,006 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\IrfanView.lnk [2012/10/14 06:24:30 | 009,330,176 | ---- | M] (Irfan Skiljan) -- C:\Users\Primary\Favorites\Desktop prime\irfanview_plugins_433_setup.exe [2012/10/14 06:11:40 | 000,002,842 | ---- | M] () -- C:\Users\Primary\AppData\Local\recently-used.xbel [2012/10/14 01:59:54 | 000,001,074 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Glary Utilities.lnk [2012/10/13 22:35:43 | 000,000,448 | ---- | M] () -- C:\OS (C) - Shortcut.lnk [2012/10/11 04:04:24 | 000,003,478 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\25 The Name's Bond... James Bond.m4a - Shortcut.lnk [2012/10/10 01:28:47 | 000,001,411 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Internet Explorer (64-bit).lnk [2012/10/10 01:24:52 | 000,225,336 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\OpenDNS-Updater-2.2.1.exe [2012/10/09 22:43:17 | 000,001,304 | ---- | M] () -- C:\Users\Primary\Favorites\Desktop prime\Notepad.lnk [2012/10/04 23:23:03 | 000,001,879 | ---- | M] () -- C:\Users\Public\Desktop\Defraggler.lnk [2012/10/04 23:18:20 | 000,002,088 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk [2012/10/04 22:54:28 | 000,000,151 | ---- | M] () -- C:\Windows\PhotoSnapViewer.INI [2012/10/03 15:57:05 | 000,001,132 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012/10/02 21:36:14 | 000,001,115 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ] [1 C:\Program Files (x86)\Common Files\*.tmp files -> C:\Program Files (x86)\Common Files\*.tmp -> ] [1 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/10/29 20:50:15 | 000,152,392 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Word 2010 Return.png [2012/10/29 18:11:00 | 000,419,734 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\1 extensions.png [2012/10/29 13:59:55 | 000,466,275 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\googlemap.png [2012/10/28 16:25:13 | 000,339,430 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\clean reagan.png1.png [2012/10/28 15:41:57 | 000,002,119 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk [2012/10/28 14:12:50 | 000,900,708 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\flying main.png [2012/10/28 14:09:00 | 000,013,685 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\ProcessMonitor.lnk [2012/10/28 14:07:11 | 000,001,797 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\ProcessMonitor.lnk [2012/10/28 13:11:17 | 000,001,056 | ---- | C] () -- C:\Users\Public\Desktop\FBackup 4.lnk [2012/10/28 13:06:57 | 000,024,576 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\EasyBCD Backup (2012-10-28).bcd [2012/10/28 13:05:40 | 000,001,215 | ---- | C] () -- C:\Users\Public\Desktop\EasyBCD 2.2.lnk [2012/10/27 14:10:47 | 000,065,576 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\flag Untitled.png [2012/10/27 14:10:31 | 000,152,264 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Untitled.pdn [2012/10/27 14:05:44 | 000,888,967 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\flying flags.png [2012/10/27 04:38:42 | 002,828,466 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\ubble.png [2012/10/27 00:04:22 | 000,876,595 | ---- | C] () -- C:\Users\Primary\AppData\Local\census.cache [2012/10/27 00:00:43 | 000,127,705 | ---- | C] () -- C:\Users\Primary\AppData\Local\ars.cache [2012/10/26 17:25:09 | 000,000,036 | ---- | C] () -- C:\Users\Primary\AppData\Local\housecall.guid.cache [2012/10/25 21:42:12 | 000,005,677 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\bm search ms.search-ms [2012/10/24 10:49:49 | 000,001,319 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\PrimarytoPain\Documents\CDC Label.ncd [2012/10/22 21:03:24 | 000,001,028 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Continue Best Codec Pack installation.lnk [2012/10/22 19:16:03 | 000,000,227 | ---- | C] () -- C:\Users\Primary\AppData\Roaming\default.rss [2012/10/22 19:11:44 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2012/10/22 18:56:54 | 000,002,710 | ---- | C] () -- C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk [2012/10/22 18:53:59 | 000,002,039 | ---- | C] () -- C:\Users\Public\Desktop\LightScribe.lnk [2012/10/22 18:38:28 | 000,001,300 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Revo Uninstaller.lnk [2012/10/21 23:16:39 | 000,023,084 | ---- | C] () -- C:\Users\Primary\png.png [2012/10/20 04:39:35 | 000,012,792 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\images.jpg [2012/10/19 23:41:56 | 000,000,622 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\TakeOwnership.zip [2012/10/19 21:06:21 | 003,077,634 | ---- | C] () -- C:\Users\Primary\best supreeem.png [2012/10/18 03:24:05 | 000,001,661 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Jobs News, Videos, Reviews and Gossip - Lifehacker.htm - Shortcut.lnk [2012/10/18 03:13:27 | 000,003,478 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\25 The Name's Bond... James Bond.m4a - Shortcut.lnk [2012/10/17 19:59:37 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf [2012/10/17 19:05:47 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf [2012/10/17 19:05:46 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Coinstaller_Critical.Wdf [2012/10/17 19:05:22 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012/10/16 15:35:27 | 000,093,394 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\LeviathanWallHanging.gif [2012/10/16 00:01:05 | 239,698,070 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\GoFlex_Slim_ProSW.zip [2012/10/15 23:48:59 | 000,001,141 | ---- | C] () -- C:\Users\Public\Desktop\Seagate DiscWizard.lnk [2012/10/15 23:34:36 | 000,002,453 | ---- | C] () -- C:\Users\Public\Desktop\SeaTools for Windows.lnk [2012/10/15 23:32:27 | 021,476,536 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\SeaToolsforWindowsSetup-1206.exe [2012/10/14 07:33:43 | 006,619,729 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\preview.mp3 [2012/10/14 07:29:54 | 003,727,360 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\60379.mp3 [2012/10/14 07:21:12 | 004,866,587 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\10 I'd Rather Be Dead.mp3 [2012/10/14 06:58:55 | 000,001,021 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk [2012/10/14 06:58:55 | 000,001,015 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Audacity.lnk [2012/10/14 06:28:24 | 000,001,898 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\IrfanView Thumbnails.lnk [2012/10/14 06:28:24 | 000,001,006 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\IrfanView.lnk [2012/10/14 06:11:40 | 000,002,842 | ---- | C] () -- C:\Users\Primary\AppData\Local\recently-used.xbel [2012/10/14 01:59:54 | 000,001,074 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Glary Utilities.lnk [2012/10/14 01:59:54 | 000,000,328 | ---- | C] () -- C:\Windows\tasks\GlaryInitialize.job [2012/10/13 22:35:43 | 000,000,448 | ---- | C] () -- C:\OS (C) - Shortcut.lnk [2012/10/13 22:33:51 | 000,000,526 | ---- | C] () -- C:\Users\Primary\AppData\Roaming\burnaware.ini [2012/10/10 01:28:47 | 000,001,411 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Internet Explorer (64-bit).lnk [2012/10/10 01:25:06 | 000,002,022 | ---- | C] () -- C:\Users\Primary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenDNS Updater.lnk [2012/10/10 01:24:47 | 000,225,336 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\OpenDNS-Updater-2.2.1.exe [2012/10/09 22:43:17 | 000,001,304 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Notepad.lnk [2012/10/05 23:44:13 | 000,459,873 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\926 12.html [2012/10/05 15:36:05 | 000,497,064 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Warp_Velocity_by_Mxyzptlk246.jpg [2012/10/05 15:33:29 | 000,126,844 | ---- | C] () -- C:\Users\Primary\Favorites\Desktop prime\Going_into_warp_by_Balsavor.jpg [2012/10/04 23:18:20 | 000,002,088 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk [2012/10/04 18:08:33 | 000,001,879 | ---- | C] () -- C:\Users\Public\Desktop\Defraggler.lnk [2012/10/03 15:57:05 | 000,001,132 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012/10/03 15:57:04 | 000,001,144 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012/09/23 03:32:39 | 000,830,650 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012/09/19 14:49:02 | 000,000,151 | ---- | C] () -- C:\Windows\PhotoSnapViewer.INI [2012/09/04 13:29:16 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012/08/18 20:36:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2012/05/24 13:31:21 | 000,031,786 | ---- | C] () -- C:\Users\Primary\AppData\Local\Saturn-5-6-121-580x580.jpg [2012/03/02 16:34:34 | 002,345,378 | ---- | C] () -- C:\Windows\Windows 7 Loader.exe [2011/11/10 02:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2011/11/10 02:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2011/09/12 23:06:18 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011/07/25 07:02:32 | 000,602,112 | ---- | C] () -- C:\Windows\SysWow64\xvid.dll ========== ZeroAccess Check ========== [2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 01:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 00:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 08:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012/07/25 18:10:32 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\100 Greatest Classics Disc 5 [2012/10/20 03:09:41 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Audacity [2012/03/10 16:50:19 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\AVG2012 [2012/07/21 21:01:12 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Blurity [2012/10/07 18:47:56 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\com.earthbrowser.air.E6AAAE80A01B412778887 6406C965C3EDE131099.1 [2012/09/01 20:11:27 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\CrystalSpace [2012/10/23 18:41:54 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\FreeBurner [2012/10/14 01:59:47 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\GlarySoft [2012/05/06 20:39:49 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Gmail Backup [2012/10/15 17:44:55 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\GoforFiles [2012/10/14 06:28:24 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\IrfanView [2012/09/14 23:53:50 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Leadertech [2012/07/26 18:45:27 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\LockHunter [2012/09/19 05:08:18 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Memeo [2012/09/02 09:20:30 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\mjusbsp [2012/09/25 02:56:56 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\OpenDNS Updater [2012/07/22 06:43:50 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\OutWit [2012/06/28 02:26:34 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\ParallelGraphics [2012/07/07 06:16:26 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Pictures Videos [2012/07/15 16:27:14 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\qBittorrent [2012/07/26 18:06:11 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\QuickScan [2012/09/02 09:19:05 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\RCP 6 [2012/09/02 09:20:30 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Skyscraper [2012/10/28 13:11:03 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Softland [2012/07/26 19:44:51 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Thunderbird [2012/07/10 08:14:12 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\Windows Live Writer [2012/07/10 08:24:53 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\WinPatrol [2012/07/12 01:03:00 | 000,000,000 | ---D | M] -- C:\Users\Primary\AppData\Roaming\WinZip ========== Purity Check ========== < End of report > |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| Tags |
| desperate, searchnu.com/421, thanks very much |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
