WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93124 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Computer Auto Shutting Down, Malwarebyte's finding RootKit.0Access

Started by Socram484 , Jun 24 2012 01:59 AM

This topic is locked

27 replies to this topic

#1 Socram484

Authentic Member

Authentic Member
25 posts

Posted 24 June 2012 - 01:59 AM

I've been experiencing frequent auto shutdowns after a dialog box comes up saying "Windows encountered a fatal error". Also getting dialog boxes-ups about a Busy Server and an option to Switch To.. a program or retry. Malwarebyte's has found Rootkit.0Access but can't seem to remove it permanently. Attacks have been occuring frequently as well and Malwarebytes tries to block them.

OTL logfile created on: 6/24/2012 2:36:10 AM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Marcos\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

8.00 Gb Total Physical Memory | 6.02 Gb Available Physical Memory | 75.26% Memory free
16.00 Gb Paging File | 13.78 Gb Available in Paging File | 86.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 139.73 Gb Total Space | 10.43 Gb Free Space | 7.46% Space Free | Partition Type: NTFS
Drive E: | 698.64 Gb Total Space | 321.94 Gb Free Space | 46.08% Space Free | Partition Type: NTFS
Drive F: | 38.57 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: FAT32

Computer Name: MARCOS-PC | User Name: Marcos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Marcos\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\FacebookMessenger.exe (Facebook)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Wondershare\MobileGo for Android\MobileGoService.exe (Wondershare)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Users\Marcos\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\TechSmith\Jing\Jing.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG)
PRC - C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe (WIBU-SYSTEMS AG)
PRC - C:\Program Files (x86)\3d-io plugins\licensing_v2\ActiveLockServerV2.exe (3d-io GmbH)
PRC - C:\Program Files (x86)\M-Audio\Axiom\AudioDevMon.exe (M-Audio)

========== Modules (No Company Name) ==========

MOD - C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\CefSharp.dll ()
MOD - C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\CefSharp.WinForms.dll ()
MOD - C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\libcef.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Users\Marcos\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll ()
MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\a8bd6b91bf16c6727723481b42ea3293\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\16498c46d223310bc8811e193bcf1205\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\5f29a2d3dc6bdadb9751faaa0f230911\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\c21fbb4bf27a7c8705e29f08827c9c7e\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\36b3b787a2942e629e87b1b96fa049d4\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\227927e469cb6b079e4cc7d81e38f8f5\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\1741fc5f7819af118d4de616016a8b2d\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\698b02e36bac06ac74077cc3ec6eced0\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\30740aecd686555cb6800b47cc80fae7\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\5c2eff65e7e457ea372f767c024c04f7\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b4e03b2b9835e9cb4e879c703880fe74\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2d3806670b3c3e4163592b5aca62f8cc\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d4e8a005f4cdd6528f1c7295d833877f\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\TechSmith\Jing\Recorder.dll ()
MOD - C:\Program Files\TortoiseSVN\bin\libsasl32.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\243bd5a8b17896967384745d0c441ab7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a0afd596da13c708d04b0a2dd1490036\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\1d96b1ef408e2b5a2aa8de007b822aa3\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\3675db4c02d762278716f4a32db61e15\System.EnterpriseServices.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\6a5e1084d24d779e937e405672fdfbfe\System.Transactions.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\8bcef9992033319f9c1d470e497437ef\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\0018b6bfd1d96454aa8fb698d0ea51a1\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a9f6cfa4eb1436ff770995822f10e227\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\c8aa11ee6789d0f3f5542747aad7a2e4\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\173e012cca07a9b7151c574585a4ca9e\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\40404dbd013b0ca1e41ab7e57274308b\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c68401de935c813374253d4fc2a18f6a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\acbc57d41499fbc2b99194148786c677\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\338f3c91a0bea33a07a4611d324bf73a\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\16b68fcaff063835ae0ee348a1201f2a\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (ANTS Memory Profiler 7 Service) -- C:\Program Files\Red Gate\ANTS Memory Profiler 7\RedGate.Memory.IISService.exe (Red Gate Software Ltd.)
SRV:64bit: - (ANTS Performance Profiler 6 Service) -- C:\Program Files\Red Gate\ANTS Performance Profiler 6\RedGate.Profiler.IISService.exe (Red Gate Software Ltd.)
SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Flexera Software, Inc.)
SRV:64bit: - (TabletServiceWacom) -- C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (HiPatchService) -- C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (CodeMeter.exe) -- C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe (WIBU-SYSTEMS AG)
SRV - (3d-io License Server v2.0) -- C:\Program Files (x86)\3d-io plugins\licensing_v2\ActiveLockServerV2.exe (3d-io GmbH)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AxiomAudioDevMon) -- C:\Program Files (x86)\M-Audio\Axiom\AudioDevMon.exe (M-Audio)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (balancesvc) -- C:\Windows\SysNative\drivers\balance.sys (Propellerhead Software)
DRV:64bit: - (BalanceWdmService) -- C:\Windows\SysNative\drivers\BalanceWdm.sys (Propellerhead Software)
DRV:64bit: - (SCDEmu) -- C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (ssadmdfl) SAMSUNG Android USB Modem (Filter) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (YMIDUSBW) Yamaha USB-MIDI Driver (WDM) -- C:\Windows\SysNative\drivers\ymidusbx64.sys (Yamaha Corporation)
DRV:64bit: - (sscdmdm) -- C:\Windows\SysNative\drivers\sscdmdm.sys (MCCI Corporation)
DRV:64bit: - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\SysNative\drivers\sscdbus.sys (MCCI Corporation)
DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (sscdmdfl) -- C:\Windows\SysNative\drivers\sscdmdfl.sys (MCCI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (cpuz135) -- C:\Windows\SysNative\drivers\cpuz135_x64.sys (CPUID)
DRV:64bit: - (wacmoumonitor) -- C:\Windows\SysNative\drivers\wacmoumonitor.sys (Wacom Technology)
DRV:64bit: - (wacommousefilter) -- C:\Windows\SysNative\drivers\wacommousefilter.sys (Wacom Technology)
DRV:64bit: - (wacomvhid) -- C:\Windows\SysNative\drivers\wacomvhid.sys (Wacom Technology)
DRV:64bit: - (MAUSBPRODUCER) -- C:\Windows\SysNative\drivers\MAudioProducer.sys (Avid Technology, Inc.)
DRV:64bit: - (AXIOM) -- C:\Windows\SysNative\drivers\MAudioAxiom.sys (M-Audio)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (xnacc) -- C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (rt61x64) -- C:\Windows\SysNative\drivers\netr6164.sys (Ralink Technology, Corp.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (dgderdrv) -- C:\Windows\SysWOW64\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 AD B7 E7 D3 51 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:466...q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.10: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wolfram.com/Mathematica: C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.4.2609412\npmathplugin.dll (Wolfram Research, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@onlive.com/OnLiveGameClientDetector,version=1.0.0: C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll (OnLive)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Marcos\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Marcos\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Marcos\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Marcos\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Marcos\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/06/07 01:00:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/23 12:14:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/06/07 01:00:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/11/09 12:47:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012/02/21 00:00:07 | 000,000,000 | ---D | M]

[2011/07/04 16:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marcos\AppData\Roaming\Mozilla\Extensions
[2012/06/16 15:05:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\extensions
[2012/05/20 01:47:59 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/08/21 01:21:47 | 000,000,000 | ---D | M] (ActiveGS) -- C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\extensions\activegs@freetoolsassociation.com
[2012/05/11 15:11:36 | 000,000,000 | ---D | M] (Nokia Maps 3D browser plugin) -- C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\extensions\maps@ovi.com
[2012/06/23 12:14:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/06/07 01:00:06 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2011/10/22 14:25:15 | 000,015,162 | ---- | M] () (No name found) -- C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\{988DA70D-B78D-44A1-A9C7-ED11832A9E2E}.XPI
[2012/01/12 01:24:18 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011/10/29 14:35:37 | 000,434,392 | ---- | M] () (No name found) -- C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2011/11/19 00:12:04 | 000,018,894 | ---- | M] () (No name found) -- C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\HISTORYBLOCK@KAIN.XPI
[2011/10/15 09:31:38 | 000,025,950 | ---- | M] () (No name found) -- C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\PBUPLOAD@PHOTOBUCKET.COM.XPI
[2012/05/05 03:11:10 | 000,226,493 | ---- | M] () (No name found) -- C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\SCRIPTISH@ERIKVOLD.COM.XPI
[2011/08/26 13:26:19 | 000,011,510 | ---- | M] () (No name found) -- C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI
[2012/06/14 17:20:49 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/06/14 17:19:40 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/14 17:19:40 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Marcos\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Marcos\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Marcos\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U30 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: OnLive Game Client Detector (Enabled) = C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files (x86)\TabletPlugins\npwacom.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Marcos\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Facebook Desktop (Enabled) = C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.0.4447.0\npFbDesktopPlugin.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Marcos\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Adblock Plus (Beta) = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.2_0\
CHR - Extension: imgur = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehoopddfhgaehhmphfcooacjdpmbjlao\1.1.1_0\
CHR - Extension: AirMech = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdahlabpinmfcemhcbcfoijcpoalfgdn\7575_0\
CHR - Extension: Cloud9 = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbdmccoknlfggadpfkmcpnamfnbkmkcp\1.9.7_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

O1 HOSTS File: ([2012/05/21 12:05:08 | 000,001,269 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com
O1 - Hosts: 127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [M-Audio Taskbar Icon] C:\Windows\SysNative\M-AudioTaskBarIcon.exe (Avid Technology, Inc.)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [Facebook Update] C:\Users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [Jing] C:\Program Files (x86)\TechSmith\Jing\Jing.exe (TechSmith Corporation)
O4 - HKCU..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup File not found
O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Marcos\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\FacebookMessenger.exe (Facebook)
O4 - Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mozilla Thunderbird.lnk = C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.3.1)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{59DD3D3F-B7ED-404C-BA1F-84E544261B0D}: DhcpNameServer = 10.254.40.1 128.194.254.1 128.194.254.2 128.194.254.3
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA53C310-0C3C-4C99-B8B5-E2651CEBED41}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBFB7911-C70E-47D2-A6E5-84773522C303}: DhcpNameServer = 10.254.40.1 128.194.254.1 128.194.254.2 128.194.254.3
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/12/20 02:35:27 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: vidc.tscc - C:\Windows\SysWOW64\tsccvid64.dll (TechSmith Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS http://hp.vector.co....hors/VA012897/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.tscc - C:\Windows\SysWOW64\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/24 01:15:15 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\For Emma, Forever Ago
[2012/06/24 01:15:13 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Bon Iver - Bon Iver'
[2012/06/24 00:09:25 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\RoyAwesome-XNA-Voronoi-Diagram-af32ff9
[2012/06/23 14:12:46 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012/06/23 14:12:45 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/06/23 12:14:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012/06/23 12:14:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/06/18 18:13:18 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012/06/18 18:13:18 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012/06/18 18:13:18 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012/06/18 18:13:11 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012/06/18 18:13:11 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012/06/18 18:13:11 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012/06/18 18:12:56 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012/06/18 18:12:56 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012/06/17 23:11:49 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Documents\Propellerhead Logs
[2012/06/17 22:10:02 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\ReasonEssentials1.5
[2012/06/17 18:24:06 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Will'sBud
[2012/06/17 17:38:40 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\RemoteDroidServer
[2012/06/17 17:22:56 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\New folder (2)
[2012/06/15 22:11:33 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/06/14 18:50:29 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Hydorah
[2012/06/14 12:49:35 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Suzuki Method
[2012/06/13 18:48:45 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Local\Macromedia
[2012/06/12 23:57:40 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Creative Development Modeling a Female Character for Animation in Maya with Gene Arvan
[2012/06/12 22:39:23 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\NEX.v1.6.1.83_For_Maya_2011-2013_32_64_Cracked-LCT
[2012/06/12 00:49:31 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Digital-Tutors - Modeling a Female Character for Animation in Maya
[2012/06/12 00:49:31 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Digital Tutors - Object Tracking in MatchMover 2011 and NUKE 6.1
[2012/06/10 14:09:42 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Roaming\Mathematica
[2012/06/10 14:09:42 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Local\Mathematica
[2012/06/10 14:01:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram Mathematica
[2012/06/10 13:59:11 | 000,465,936 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysNative\mltcpip64.mlp
[2012/06/10 13:59:11 | 000,436,240 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysNative\ml64i3.dll
[2012/06/10 13:59:11 | 000,302,608 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysNative\ml64i2.dll
[2012/06/10 13:59:11 | 000,203,792 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysNative\mlmodule64.dll
[2012/06/10 13:59:11 | 000,103,440 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysNative\mltcp64.mlp
[2012/06/10 13:59:11 | 000,099,344 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysNative\mlshm64.mlp
[2012/06/09 13:52:02 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Roaming\MathematicaPlayer
[2012/06/09 13:52:02 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Local\MathematicaPlayer
[2012/06/09 13:52:02 | 000,000,000 | ---D | C] -- C:\ProgramData\MathematicaPlayer
[2012/06/09 13:50:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wolfram Research
[2012/06/09 13:50:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ResearchSoft
[2012/06/09 13:50:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram CDF Player
[2012/06/09 13:47:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wolfram Research
[2012/06/09 13:47:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Mathematica
[2012/06/09 13:47:02 | 000,370,704 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysWow64\ml32i3.dll
[2012/06/09 13:47:02 | 000,334,352 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysWow64\mltcpip32.mlp
[2012/06/09 13:47:02 | 000,260,112 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysWow64\ml32i2.dll
[2012/06/09 13:47:02 | 000,253,968 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysWow64\ml32i1.dll
[2012/06/09 13:47:02 | 000,163,344 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysWow64\mlmodule32.dll
[2012/06/09 13:47:02 | 000,093,712 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysWow64\mltcp32.mlp
[2012/06/09 13:47:02 | 000,088,080 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysWow64\mlshm32.mlp
[2012/06/09 13:47:02 | 000,079,376 | ---- | C] (Wolfram Research, Inc.) -- C:\Windows\SysWow64\mlmap32.mlp
[2012/06/09 13:46:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wolfram Research
[2012/06/07 01:09:45 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Local\DDMSettings
[2012/06/07 01:00:00 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Roaming\DivX
[2012/06/07 00:59:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
[2012/06/07 00:59:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
[2012/06/07 00:59:45 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
[2012/06/07 00:59:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DivX Shared
[2012/06/07 00:58:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DivX
[2012/06/07 00:57:38 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
[2012/06/05 23:06:36 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Documents\Trials 2
[2012/06/05 23:04:06 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Local\Redlynx
[2012/06/05 23:03:28 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RedLynx Trials 2 Second Edition
[2012/06/05 23:03:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RedLynx Trials 2 Second Edition
[2012/06/05 23:03:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trials 2 Second Edition
[2012/06/05 22:53:19 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Mercury Particle Engine 3.1 for XNA 4.0 (Binaries)
[2012/06/05 22:39:57 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Project Zomboid v0.2.0q
[2012/06/02 23:58:38 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Farseer Physics Engine 3.3.1 Samples XNA
[2012/06/02 21:46:25 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt
[2012/06/02 21:02:15 | 004,830,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9d_33.dll
[2012/06/02 21:02:15 | 002,686,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9d_43.dll
[2012/06/02 21:02:15 | 000,964,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudioD2_7.dll
[2012/06/02 21:02:15 | 000,411,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XactEngineA3_7.dll
[2012/06/02 21:02:15 | 000,327,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XactEngineD3_7.dll
[2012/06/02 21:02:15 | 000,139,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFXD1_5.dll
[2012/06/02 21:02:15 | 000,053,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudioD1_7.dll
[2012/06/02 21:02:14 | 002,947,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d9d.dll
[2012/06/02 21:02:14 | 001,931,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCSXd_43.dll
[2012/06/02 21:02:14 | 000,645,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3D11SDKLayers.dll
[2012/06/02 21:02:14 | 000,639,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3D11Ref.dll
[2012/06/02 21:02:14 | 000,608,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3D10SDKLayers.DLL
[2012/06/02 21:02:14 | 000,568,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX10d_43.dll
[2012/06/02 21:02:14 | 000,453,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3D10Ref.DLL
[2012/06/02 21:02:14 | 000,447,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dref9.dll
[2012/06/02 21:02:14 | 000,308,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX11d_43.dll
[2012/06/02 21:02:13 | 003,795,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9d_33.dll
[2012/06/02 21:02:13 | 002,719,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d9d.dll
[2012/06/02 21:02:13 | 002,261,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3dx9d_43.dll
[2012/06/02 21:02:13 | 001,883,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCSXd_43.dll
[2012/06/02 21:02:13 | 000,954,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudioD2_7.dll
[2012/06/02 21:02:13 | 000,525,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3D11Ref.dll
[2012/06/02 21:02:13 | 000,514,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX10d_43.dll
[2012/06/02 21:02:13 | 000,496,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3D11SDKLayers.dll
[2012/06/02 21:02:13 | 000,442,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3D10SDKLayers.DLL
[2012/06/02 21:02:13 | 000,435,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XactEngineA3_7.dll
[2012/06/02 21:02:13 | 000,367,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3D10Ref.DLL
[2012/06/02 21:02:13 | 000,349,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XactEngineD3_7.dll
[2012/06/02 21:02:13 | 000,348,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dref9.dll
[2012/06/02 21:02:13 | 000,268,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX11d_43.dll
[2012/06/02 21:02:13 | 000,131,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFXD1_5.dll
[2012/06/02 21:02:13 | 000,045,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudioD1_7.dll
[2012/06/02 21:02:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft DirectX SDK (June 2010)
[2012/06/02 20:59:12 | 000,111,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\dxsdkuninst.exe
[2012/06/02 20:59:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft DirectX SDK (June 2010)
[2012/06/01 14:42:03 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012/05/31 21:27:22 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\StarForge_V0.1
[2012/05/31 13:08:23 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\Heimdall Suite
[2012/05/31 13:05:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012/05/31 13:05:43 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012/05/31 13:02:38 | 001,721,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WdfCoInstaller01009.dll
[2012/05/31 13:02:38 | 001,002,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WinUSBCoInstaller2.dll
[2012/05/31 13:02:38 | 000,000,000 | ---D | C] -- C:\usb_driver
[2012/05/31 12:52:42 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\BackupContacts
[2012/05/31 12:44:14 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Local\Wondershare
[2012/05/31 12:44:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wondershare
[2012/05/31 12:44:13 | 000,000,000 | ---D | C] -- C:\Users\Marcos\AppData\Roaming\Wondershare
[2012/05/31 12:44:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
[2012/05/31 12:44:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wondershare
[2012/05/31 11:52:39 | 000,177,640 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\ssadmdm.sys
[2012/05/31 11:52:39 | 000,157,672 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\ssadbus.sys
[2012/05/31 11:52:39 | 000,036,328 | ---- | C] (Google Inc) -- C:\Windows\SysNative\drivers\ssadadb.sys
[2012/05/31 11:52:39 | 000,016,872 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\ssadmdfl.sys
[2012/05/31 11:52:39 | 000,013,800 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\ssadwhnt.sys
[2012/05/31 11:52:39 | 000,013,288 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\ssadcmnt.sys
[2012/05/31 11:52:11 | 000,015,944 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscdwhnt.sys
[2012/05/31 11:52:10 | 000,172,104 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscdmdm.sys
[2012/05/31 11:52:10 | 000,136,264 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscdbus.sys
[2012/05/31 11:52:10 | 000,019,016 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscdmdfl.sys
[2012/05/31 11:52:10 | 000,015,432 | ---- | C] (MCCI Corporation) -- C:\Windows\SysNative\drivers\sscdcmnt.sys
[2012/05/31 11:24:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2012/05/31 11:24:30 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2012/05/31 11:06:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/05/31 11:06:09 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/05/31 03:13:05 | 000,000,000 | ---D | C] -- C:\Users\Marcos\Desktop\TowerClimb_betaV1_1
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/24 02:38:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/24 02:30:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/24 02:29:55 | 2146,332,671 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/24 02:27:30 | 000,000,132 | ---- | M] () -- C:\Users\Marcos\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/06/24 02:24:10 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job
[2012/06/24 02:12:06 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job
[2012/06/24 01:49:39 | 000,001,270 | ---- | M] () -- C:\Users\Marcos\Desktop\Cancel Shutdown.lnk
[2012/06/23 22:09:55 | 006,796,125 | ---- | M] () -- C:\Users\Marcos\Desktop\Reflex.mp3
[2012/06/23 22:06:47 | 077,898,364 | ---- | M] () -- C:\Users\Marcos\Desktop\Reflex.wav
[2012/06/23 16:24:00 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job
[2012/06/23 14:12:47 | 000,001,338 | ---- | M] () -- C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012/06/23 14:12:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job
[2012/06/23 12:14:11 | 000,001,053 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/06/23 11:55:04 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/06/23 11:55:04 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/06/23 11:30:39 | 000,001,095 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun23-11-30-39.wbb
[2012/06/22 01:48:43 | 000,001,095 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun22-01-48-43.wbb
[2012/06/21 00:47:32 | 000,001,095 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun21-00-47-32.wbb
[2012/06/20 00:40:18 | 000,001,095 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun20-00-40-18.wbb
[2012/06/19 00:39:32 | 000,001,095 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun19-00-39-32.wbb
[2012/06/18 04:29:16 | 000,014,096 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/18 04:29:16 | 000,014,096 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/17 23:10:56 | 000,001,095 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun17-23-10-56.wbb
[2012/06/17 22:19:42 | 000,002,199 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk
[2012/06/17 22:18:59 | 000,000,988 | ---- | M] () -- C:\Users\Public\Desktop\Reason Essentials.lnk
[2012/06/17 19:34:50 | 025,811,577 | ---- | M] () -- C:\Users\Marcos\Desktop\WillsBud.zip
[2012/06/17 18:15:22 | 000,872,838 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/17 18:15:22 | 000,726,452 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/06/17 18:15:22 | 000,146,470 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/06/17 04:39:43 | 000,235,120 | ---- | M] () -- C:\Users\Marcos\Desktop\filterRape.png
[2012/06/16 22:30:40 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun16-22-30-40.wbb
[2012/06/16 18:59:00 | 000,128,481 | ---- | M] () -- C:\Users\Marcos\Desktop\testCrash.jpg
[2012/06/16 18:53:49 | 000,130,379 | ---- | M] () -- C:\Users\Marcos\Desktop\2012-06-16_1853.png
[2012/06/15 02:02:35 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun15-02-02-35.wbb
[2012/06/14 23:38:33 | 077,898,364 | ---- | M] () -- C:\Users\Marcos\Desktop\Relax.wav
[2012/06/14 01:48:42 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun14-01-48-42.wbb
[2012/06/13 19:26:21 | 000,065,310 | ---- | M] () -- C:\Users\Marcos\Desktop\DITWSolo.png
[2012/06/13 01:21:24 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun13-01-21-24.wbb
[2012/06/12 01:18:26 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun12-01-18-26.wbb
[2012/06/11 00:23:47 | 052,019,073 | ---- | M] () -- C:\Users\Marcos\Desktop\UPDATA_07X024.ZIP
[2012/06/10 20:23:02 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun10-20-23-02.wbb
[2012/06/10 03:46:46 | 004,891,976 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/09 20:10:28 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun09-20-10-28.wbb
[2012/06/07 01:00:08 | 000,002,120 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012/06/07 01:00:07 | 000,001,615 | ---- | M] () -- C:\Users\Marcos\Desktop\DivX Movies.lnk
[2012/06/07 00:59:56 | 000,001,116 | ---- | M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012/06/05 22:40:09 | 000,001,634 | ---- | M] () -- C:\Users\Marcos\Desktop\Project Zomboid v0.2.0q Launcher.lnk
[2012/06/05 19:45:30 | 000,175,674 | ---- | M] () -- C:\Users\Marcos\Desktop\0610957.jpg
[2012/06/03 21:45:25 | 000,158,728 | ---- | M] () -- C:\Users\Marcos\Documents\recpeit.xps
[2012/06/02 23:03:58 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun02-23-03-58.wbb
[2012/06/02 21:47:11 | 000,111,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\dxsdkuninst.exe
[2012/06/02 20:06:45 | 000,001,051 | ---- | M] () -- C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/06/02 17:19:46 | 000,038,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012/06/02 17:19:42 | 000,057,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012/06/02 17:19:42 | 000,044,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012/06/02 17:19:23 | 000,701,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012/06/02 17:15:31 | 002,622,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012/06/02 17:15:08 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012/06/02 15:19:42 | 000,186,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012/06/02 15:15:12 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012/06/01 22:52:03 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun01-22-52-03.wbb
[2012/06/01 20:44:25 | 000,045,994 | ---- | M] () -- C:\Users\Marcos\Desktop\Untitled-1.png
[2012/06/01 14:37:51 | 000,000,398 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2012/06/01 11:29:27 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/05/31 22:47:42 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12May31-22-47-42.wbb
[2012/05/31 22:47:29 | 000,061,228 | ---- | M] () -- C:\Users\Marcos\Desktop\WTCReceipt.png
[2012/05/31 13:02:38 | 001,721,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WdfCoInstaller01009.dll
[2012/05/31 13:02:38 | 001,002,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WinUSBCoInstaller2.dll
[2012/05/31 12:44:14 | 000,002,240 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MobileGo Service.lnk
[2012/05/31 12:44:13 | 000,002,173 | ---- | M] () -- C:\Users\Public\Desktop\Wondershare MobileGo for Android.lnk
[2012/05/31 11:26:19 | 000,001,957 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2012/05/31 11:09:30 | 000,014,230 | ---- | M] () -- C:\Users\Marcos\Documents\RegBackup5-31-12.reg
[2012/05/31 11:06:10 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/05/30 18:25:59 | 000,107,076 | ---- | M] () -- C:\Users\Marcos\Desktop\mock.png
[2012/05/27 21:35:47 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12May27-21-35-47.wbb
[2012/05/26 21:30:49 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12May26-21-30-49.wbb
[2012/05/25 21:05:12 | 000,000,963 | ---- | M] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12May25-21-05-12.wbb
[2012/05/25 15:42:26 | 000,241,210 | ---- | M] () -- C:\Users\Marcos\Desktop\PastryStore.psd
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/24 01:49:13 | 000,001,270 | ---- | C] () -- C:\Users\Marcos\Desktop\Cancel Shutdown.lnk
[2012/06/23 22:08:25 | 006,796,125 | ---- | C] () -- C:\Users\Marcos\Desktop\Reflex.mp3
[2012/06/23 22:06:13 | 077,898,364 | ---- | C] () -- C:\Users\Marcos\Desktop\Reflex.wav
[2012/06/23 12:14:11 | 000,001,053 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/06/23 11:55:05 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/23 11:30:39 | 000,001,095 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun23-11-30-39.wbb
[2012/06/22 01:48:43 | 000,001,095 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun22-01-48-43.wbb
[2012/06/21 00:47:32 | 000,001,095 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun21-00-47-32.wbb
[2012/06/20 00:40:18 | 000,001,095 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun20-00-40-18.wbb
[2012/06/19 00:39:32 | 000,001,095 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun19-00-39-32.wbb
[2012/06/17 23:10:56 | 000,001,095 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun17-23-10-56.wbb
[2012/06/17 22:18:59 | 000,000,988 | ---- | C] () -- C:\Users\Public\Desktop\Reason Essentials.lnk
[2012/06/17 19:34:49 | 025,811,577 | ---- | C] () -- C:\Users\Marcos\Desktop\WillsBud.zip
[2012/06/17 03:14:19 | 000,235,120 | ---- | C] () -- C:\Users\Marcos\Desktop\filterRape.png
[2012/06/16 22:30:40 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun16-22-30-40.wbb
[2012/06/16 18:58:58 | 000,128,481 | ---- | C] () -- C:\Users\Marcos\Desktop\testCrash.jpg
[2012/06/16 18:53:49 | 000,130,379 | ---- | C] () -- C:\Users\Marcos\Desktop\2012-06-16_1853.png
[2012/06/15 02:02:35 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun15-02-02-35.wbb
[2012/06/14 23:38:01 | 077,898,364 | ---- | C] () -- C:\Users\Marcos\Desktop\Relax.wav
[2012/06/14 01:48:42 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun14-01-48-42.wbb
[2012/06/13 19:26:21 | 000,065,310 | ---- | C] () -- C:\Users\Marcos\Desktop\DITWSolo.png
[2012/06/13 01:21:24 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun13-01-21-24.wbb
[2012/06/12 01:18:26 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun12-01-18-26.wbb
[2012/06/11 00:24:45 | 052,006,912 | ---- | C] () -- C:\Users\Marcos\Desktop\BD07-VUD.BIN
[2012/06/11 00:24:45 | 000,000,080 | ---- | C] () -- C:\Users\Marcos\Desktop\SONY_VUP.ID
[2012/06/11 00:22:26 | 052,019,073 | ---- | C] () -- C:\Users\Marcos\Desktop\UPDATA_07X024.ZIP
[2012/06/10 20:23:02 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun10-20-23-02.wbb
[2012/06/09 20:10:28 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun09-20-10-28.wbb
[2012/06/07 01:00:07 | 000,001,615 | ---- | C] () -- C:\Users\Marcos\Desktop\DivX Movies.lnk
[2012/06/07 00:59:56 | 000,001,116 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012/06/07 00:59:49 | 000,002,120 | ---- | C] () -- C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012/06/05 22:30:27 | 000,001,634 | ---- | C] () -- C:\Users\Marcos\Desktop\Project Zomboid v0.2.0q Launcher.lnk
[2012/06/05 19:45:29 | 000,175,674 | ---- | C] () -- C:\Users\Marcos\Desktop\0610957.jpg
[2012/06/03 21:45:24 | 000,158,728 | ---- | C] () -- C:\Users\Marcos\Documents\recpeit.xps
[2012/06/02 23:03:58 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun02-23-03-58.wbb
[2012/06/02 12:23:31 | 000,016,896 | ---- | C] () -- C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@
[2012/06/02 12:23:29 | 000,001,648 | ---- | C] () -- C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@
[2012/06/01 22:52:03 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12Jun01-22-52-03.wbb
[2012/06/01 20:44:23 | 000,045,994 | ---- | C] () -- C:\Users\Marcos\Desktop\Untitled-1.png
[2012/06/01 11:24:53 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@
[2012/06/01 11:24:52 | 000,001,648 | ---- | C] () -- C:\Windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@
[2012/05/31 22:47:42 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12May31-22-47-42.wbb
[2012/05/31 22:47:29 | 000,061,228 | ---- | C] () -- C:\Users\Marcos\Desktop\WTCReceipt.png
[2012/05/31 13:02:39 | 000,000,398 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012/05/31 12:44:14 | 000,002,240 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MobileGo Service.lnk
[2012/05/31 12:44:13 | 000,002,173 | ---- | C] () -- C:\Users\Public\Desktop\Wondershare MobileGo for Android.lnk
[2012/05/31 11:26:19 | 000,001,957 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2012/05/31 11:08:51 | 000,014,230 | ---- | C] () -- C:\Users\Marcos\Documents\RegBackup5-31-12.reg
[2012/05/31 11:06:10 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/05/30 18:25:59 | 000,107,076 | ---- | C] () -- C:\Users\Marcos\Desktop\mock.png
[2012/05/27 21:35:47 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12May27-21-35-47.wbb
[2012/05/26 21:30:49 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12May26-21-30-49.wbb
[2012/05/25 21:05:12 | 000,000,963 | ---- | C] () -- C:\Windows\SysWow64\CM-Backup2-1874032-12May25-21-05-12.wbb
[2012/05/25 15:42:12 | 000,241,210 | ---- | C] () -- C:\Users\Marcos\Desktop\PastryStore.psd
[2012/05/23 18:49:34 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012/04/03 19:16:11 | 000,000,015 | ---- | C] () -- C:\Users\Marcos\AppData\Local\X-Plane_drm.prf
[2012/04/03 19:15:39 | 000,000,080 | ---- | C] () -- C:\Users\Marcos\AppData\Local\X-Plane Installer.prf
[2012/03/07 03:19:32 | 000,135,316 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2012/01/25 14:30:12 | 000,079,360 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011/12/24 18:00:21 | 000,000,132 | ---- | C] () -- C:\Users\Marcos\AppData\Roaming\Adobe Targa Format CS5 Prefs
[2011/12/12 17:47:16 | 000,001,456 | ---- | C] () -- C:\Users\Marcos\AppData\Local\Adobe Save for Web 12.0 Prefs
[2011/12/12 17:41:28 | 000,000,132 | ---- | C] () -- C:\Users\Marcos\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011/11/29 17:38:12 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011/11/29 17:38:12 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011/11/29 17:38:12 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011/11/29 17:38:12 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011/10/15 01:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011/10/04 21:05:52 | 000,000,043 | ---- | C] () -- C:\Users\Marcos\mercurial.ini
[2011/10/03 22:08:00 | 000,000,218 | ---- | C] () -- C:\Users\Marcos\.recently-used.xbel
[2011/09/30 00:23:52 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011/09/30 00:23:51 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011/09/08 22:04:25 | 000,000,132 | ---- | C] () -- C:\Users\Marcos\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011/07/24 23:33:50 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\@
[2011/07/24 23:33:50 | 000,002,048 | -HS- | C] () -- C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\@
[2011/07/24 17:03:55 | 000,007,605 | ---- | C] () -- C:\Users\Marcos\AppData\Local\Resmon.ResmonCfg
[2011/07/13 18:07:35 | 000,000,132 | ---- | C] () -- C:\Users\Marcos\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011/07/07 22:32:43 | 000,866,562 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/07/06 09:58:12 | 000,052,387 | ---- | C] () -- C:\Windows\MaxwellMayaPluginUninstall.exe
[2011/07/04 16:08:40 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/04/09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

========== LOP Check ==========

[2011/09/14 20:18:21 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\.minecraft
[2012/01/20 13:40:46 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\1837E
[2011/10/17 02:46:31 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Ableton
[2011/12/25 17:00:41 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Astroburn Lite
[2011/07/07 01:30:56 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\AtomZombieData
[2011/07/15 19:58:41 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Audacity
[2011/07/06 10:37:11 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Autodesk
[2011/07/12 12:50:45 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/07/30 02:38:18 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Crayon Physics Deluxe
[2012/04/17 01:55:28 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\David Walters Development
[2011/11/11 23:33:38 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\digipen
[2012/06/24 02:33:48 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Dropbox
[2012/05/31 11:12:55 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\FileZilla
[2011/11/13 14:01:37 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\fotw
[2011/09/01 17:49:34 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Golly
[2011/10/17 19:45:27 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Image-Line
[2011/10/03 21:55:05 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\inkscape
[2012/02/08 15:37:43 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\IrfanView
[2011/09/27 23:47:44 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\JetBrains
[2011/09/21 01:37:52 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\JustDecompile
[2011/07/30 02:23:14 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Lazy 8 Studios
[2012/04/25 23:59:06 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Line 6
[2012/02/27 02:35:19 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\LOVE
[2012/03/19 16:58:22 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\MinerWars
[2012/03/06 21:26:15 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\MonoDevelop-Unity-2.8
[2011/11/13 05:15:49 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Nicalis
[2011/07/04 17:32:16 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Notepad++
[2011/10/04 22:18:17 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\NuGet
[2012/03/01 03:15:37 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\OnLive App
[2011/07/04 17:46:09 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\OpenOffice.org
[2012/03/06 16:15:59 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\PACE Anti-Piracy
[2012/04/14 02:54:27 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Polynomial
[2012/06/17 22:43:21 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Propellerhead Software
[2011/07/27 18:03:40 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\REAPER
[2012/05/21 11:19:03 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\redsn0w
[2012/05/31 11:23:47 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Samsung
[2012/01/26 01:40:27 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Scoregasm
[2012/04/30 00:49:13 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Scribus
[2011/09/19 19:48:35 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/01/18 22:50:32 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Subversion
[2011/12/06 02:01:11 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\superhudeditor
[2011/08/28 11:11:19 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Thunderbird
[2011/11/29 01:19:39 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\UDP Software
[2012/03/06 16:16:10 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Unity
[2012/06/24 01:33:57 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\uTorrent
[2011/09/29 23:28:36 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\VertexDispenser
[2011/11/01 13:29:15 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Voxatron
[2012/05/31 12:44:40 | 000,000,000 | ---D | M] -- C:\Users\Marcos\AppData\Roaming\Wondershare
[2012/06/23 14:12:00 | 000,000,910 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job
[2012/06/24 02:12:06 | 000,000,932 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job
[2012/04/10 11:36:07 | 000,032,652 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/20 07:40:07 | 000,383,786 | RHS- | M] () -- C:\bootmgr
[2011/07/04 16:09:34 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2012/06/24 02:29:55 | 2146,332,671 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/24 02:30:11 | 4293,435,391 | -HS- | M] () -- C:\pagefile.sys
[2011/09/30 16:35:17 | 000,015,104 | ---- | M] () -- C:\shared.log

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/07/04 13:52:46 | 000,000,221 | -HS- | M] () -- C:\Users\Marcos\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 1183 bytes -> C:\ProgramData\Microsoft:BKXE8W95G1VeCgLp8Rj8
@Alternate Data Stream - 1137 bytes -> C:\Users\Marcos\AppData\Local\0G198sB6Z:kGFmpSgyzcNqO134cWP7K
@Alternate Data Stream - 1115 bytes -> C:\ProgramData\Microsoft:avx58ODF2Ii38Y1ZK2e0Q
@Alternate Data Stream - 1091 bytes -> C:\Users\Marcos\AppData\Local\QZsVxr1ZXB:Q0WmQ85HmO7VowQ0W4oI5c8

< End of report >

OTL Extras logfile created on: 6/24/2012 2:36:10 AM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Marcos\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

8.00 Gb Total Physical Memory | 6.02 Gb Available Physical Memory | 75.26% Memory free
16.00 Gb Paging File | 13.78 Gb Available in Paging File | 86.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 139.73 Gb Total Space | 10.43 Gb Free Space | 7.46% Space Free | Partition Type: NTFS
Drive E: | 698.64 Gb Total Space | 321.94 Gb Free Space | 46.08% Space Free | Partition Type: NTFS
Drive F: | 38.57 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: FAT32

Computer Name: MARCOS-PC | User Name: Marcos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)
"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)
"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{034106B5-54B7-467F-B477-5B7DBB492624}" = Microsoft Sync Framework Services v1.0 SP1 (x64)
"{03AC245F-4C64-425C-89CF-7783C1D3AB2C}" = Microsoft Sync Framework 2.0 Provider Services (x64) ENU
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0826F9E4-787E-481D-83E0-BC6A57B056D5}" = Microsoft SQL Server VSS Writer
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{1111706F-666A-4037-7777-203648764D10}" = JavaFX 2.0.3 (64-bit)
"{1AB7EDC5-D891-34C5-9FF1-BE6A85ACC44B}" = Microsoft Team Foundation Server 2010 Object Model - ENU
"{1B1D83BE-BAB8-4220-A850-036C67590C73}" = TortoiseSVN 1.7.4.22459 (64 bit)
"{1CB6C387-65A7-327F-B4A5-7DDC75A291AF}" = Microsoft Visual Studio 2010 Office Developer Tools (x64)
"{1D1CEEF8-3741-45BD-8E77-963E1DEBDDD3}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64)
"{1D5CE83C-BFDD-4668-8BCB-E8614334A657}" = Adobe Photoshop Lightroom 3.4 64-bit
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{2222706F-666A-4037-7777-203648764D10}" = JavaFX 2.0.3 SDK (64-bit)
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417003FF}" = Java™ 7 Update 3 (64-bit)
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{4529F749-C362-4119-AFA0-0A3F1CA924AB}" = Autodesk MatchMover 2012 64-bit
"{4554DBB6-40D0-43BB-ADB8-75399FF11284}" = ANTS Memory Profiler 7
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{491DF203-7B61-4F0E-BDCB-A1218C4DAFE9}" = Native Instruments Massive
"{4A8CE6D7-4D52-43B9-970B-03FC75FAD667}" = Microsoft SQL Server System CLR Types (x64)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{502EAA3C-5887-4B62-83BC-7FCE593A8A89}" = ANTS Performance Profiler 6
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{5494E6CE-2212-4CE4-8E20-BE8BECF84B4D}" = Reason Essentials Ignition Key Support
"{5D068141-189F-39E2-A052-E40D4B561256}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{64A3A4F4-B792-11D6-A78A-00B0D0170030}" = Java™ SE Development Kit 7 Update 3 (64-bit)
"{6617A518-55F2-42F8-9DED-7A3EBDFA42EE}_is1" = Balance Driver 1.0.17
"{662014D2-0450-37ED-ABAE-157C88127BEB}" = Visual Studio 2010 Prerequisites - English
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7608CF6F-EB13-4E89-A4F0-8732FB6EAF98}" = Maxwell Shell Extension (x64)
"{77BBAFA6-A43D-4FBE-8888-4E397025878C}" = M-Audio Producer Driver 6.0.4 (x64)
"{7A780DF7-359E-42F6-A258-A1AA602024F4}" = .NET Reflector 7
"{7ACE202B-1B01-4B43-B6AE-03D66D621CDE}" = Microsoft SQL Server 2008 RsFx Driver
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8304B583-73E1-452B-8C67-DC7211586C1B}" = Authorizer Ignition Key Support
"{8438EC02-B8A9-462D-AC72-1B521349C001}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64)
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{88DAAF05-5A72-46D2-A7C5-C3759697E943}" = SyncToy 2.1 (x64)
"{893F27E6-D6BE-4B9F-80E6-0ADA694A31A8}" = Microsoft SQL Server 2008 Common Files
"{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}" = Microsoft Sync Framework 2.0 Core Components (x64) ENU
"{8D99210A-25E1-4920-8231-D12490FB8E2C}" = M-Audio Axiom Driver 1.1.1 (x64)
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64
"{918473BA-67C9-498B-BE7A-BC3A3CBC3338}" = TortoiseHg 2.1.3 (x64)
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010 x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{9E6BB4E4-0B20-4922-AA37-260FA5ACFBA5}" = Autodesk Maya 2012 64-bit
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B40EE88B-400A-4266-A17B-E3DE64E94431}" = Microsoft SQL Server 2008 Setup Support Files
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{BBDE8A3D-64A2-43A6-95F3-C27B87DF7AC1}" = Microsoft SQL Server 2008 Native Client
"{BCA26999-EC22-3007-BB79-638913079C9A}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{C9A5048A-26A6-440B-A059-9DF9956C4D44}" = Yamaha USB-MIDI Driver
"{CC7C5BA5-0010-1033-B966-42899C00BD23}" = Autodesk Mudbox 2012 64-bit - English
"{CC7C5BA5-09B5-428E-B966-42899C00BD23}" = Autodesk Mudbox 2012 64-bit - English
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DA67488A-2689-4F10-B90F-D2F6977509D6}" = Microsoft SQL Server 2008 R2 Management Objects (x64)
"{DE0248C8-0701-4132-95A5-9130D22B3A24}" = ANTS Profiler Visual Studio Add-in 1
"{DF167CE3-60E7-44EA-99EC-2507C51F37AE}" = Microsoft SQL Server 2008 Database Engine Shared
"{F5079164-1DB9-3BDA-853B-F78AF67CE071}" = Microsoft Visual C++ 2010 x64 Designtime - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6762963-9AE5-4bc6-A70F-2D749F6AC02F}_is1" = Authorizer 2.0
"{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = Microsoft SQL Server 2008 Database Engine Services
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FC4AD39F-9DCE-4BD0-B7D0-7C81CEB9F04B}" = NVIDIA PhysX Plug-in for Autodesk Maya 2012 64 bit
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Autodesk Maya 2012 64-bit" = Autodesk Maya 2012 64-bit
"Autodesk Mudbox 2012 64-bit - English" = Autodesk Mudbox 2012 64-bit - English
"A-WIN-Extras 8.0.4 2609412_is1" = Mathematica Extras 8.0 (2609412)
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.58
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.18
"Mari 1.3v1_is1" = Mari 1.3v1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Microsoft Team Foundation Server 2010 Object Model - ENU" = Microsoft Team Foundation Server 2010 Object Model - ENU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"M-WIN-L 8.0.1 2063990_is1" = Wolfram Mathematica 8 (M-WIN-L 8.0.1 2063990)
"Nuke 6.2v2_is1" = Nuke 6.2v2
"ReasonEssentials1.5_64_is1" = Reason Essentials 1.5
"V-Ray for Maya 2012 for x64" = V-Ray for Maya 2012 for x64
"Wacom Tablet Driver" = Wacom Tablet
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.44-1 (x64)
"WinRAR archiver" = WinRAR 4.01 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01C79EF3-DE84-4B56-B638-8BEA0D507506}" = Microsoft XNA Game Studio 4.0 (XnaLiveProxy)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0666E46E-A860-4353-BE6D-13AA72FABB57}" = Microsoft XNA Game Studio Platform Tools
"{08C84CC6-E7FD-4B2D-BBF9-B02CC90EE031}" = Microsoft XNA Game Studio 4.0 (Shared Components)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0DDCEC37-369C-484B-B16D-B4413FD42FB9}" = Microsoft SQL Server 2008 R2 Data-Tier Application Framework
"{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}" = Microsoft Sync Framework SDK v1.0 SP1
"{0FDCF6BC-AB79-4CEF-9A7D-01FD838A6C61}" = JetBrains ReSharper 6.0
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1E04C795-7359-4E05-8A0E-5644F777AA08}_is1" = Wondershare MobileGo for Android ( Version 2.0.0 )
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{21AF2C88-A2D7-436D-A261-017865640E84}" = Imgur Uploader
"{265E2F1D-0025-45DF-B83B-8320466108A8}" = Python 3.2 pygame-1.9.2a0
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 30
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2D9FEBEE-F1B7-344F-BFDF-760E18332D96}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{325045C9-F040-3D98-892D-53D5E840266C}" = Google Talk Plugin
"{34b2530c-6349-4292-9dc3-60bda4aed93c}" = Python 3.2.1
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{37542828-0F05-4BAA-BEB7-B633F27D3E7B}" = SlimDX SDK (September 2011)
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend Closed Beta
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{3F4EB5FE-B5BE-4069-A5A8-6D9262E1B379}" = Microsoft XNA Game Studio 4.0 Documentation
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}" = Dotfuscator Software Services - Community Edition
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{59F24743-2EA1-3A45-B8C2-6E0E1E078FA8}" = Microsoft Visual C# 2010 Express - ENU
"{5AFD94F5-CB9F-4CEF-B271-2A636C895451}_is1" = Window On Top version 1.2
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{68BD57D3-D606-411E-A7E0-3EB6EA5660F6}" = Microsoft XNA Game Studio 4.0 (Redists)
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{73BE04D9-BA0E-4BAF-9C9D-677278BDB3DC}" = Microsoft XNA Game Studio 4.0 (ARP entry)
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{78C3657E-742C-40B1-9F53-E5A921D40F17}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{7AB01508-C2B2-43C8-8B44-514801E7CCC9}" = Jing
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{8472BE38-4100-44EB-96D5-6B0D936EE1C6}" = SlimDX SDK (January 2012)
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C496FBF-DB4A-468D-A3A1-15E127382218}" = Microsoft XNA Game Studio 4.0 (Visual Studio)
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B55759D-424F-4CB1-B84E-AAE83CC1D20A}_is1" = Nitronic Rush (2011-11-11) version 20111111.0
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A8AF728F-2EE8-4322-96B3-656CAD1F7805}" = Facebook Messenger 2.1.4554.0
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{C0E8FE43-C35B-451D-B35F-D4BD056D70E7}" = Camtasia Studio 7
"{C28DD992-5B7B-D195-6841-4EC57DF512BD}" = Adobe Story
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{C95443CF-EE78-4CB5-A25E-6CF71C0127C5}" = Telerik JustDecompile Beta
"{ceca424e-2d49-4406-b1ff-b570a1a2933a}" = MinerWars
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.8 Game
"{D6B15AE6-B052-363E-B6BB-C4714CBA6509}" = Microsoft Visual Studio 2010 Professional - ENU
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E14F0598-ACB9-4953-90E0-458B880852CB}" = RockScroll
"{E5AE9031-79A5-4627-9641-BEFA82819B08}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{E82097B9-A3B8-404A-9A92-AC16A8AC9576}" = Adobe After Effects CS5.5
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{FAB1F336-1B7C-4057-A7BC-2922CD82A781}" = Ralink RT6x Wireless LAN Card
"{FD9C31B6-F572-414D-81E3-89368C97A125}_is1" = CamStudio OSS Desktop Recorder
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Android SDK Tools" = Android SDK Tools
"ASIO4ALL" = ASIO4ALL
"Astroburn Lite" = Astroburn Lite
"Audacity_is1" = Audacity 1.2.6
"Authorizer_is1" = Authorizer 1.0.5
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Story
"Contour Storyteller 3.0.8" = Contour Storyteller
"Diablo III" = Diablo III
"DivX Setup" = DivX Setup
"dRasterNEX_is1" = NEX 1.6.1.83
"DROD 4: Gunthro and the Epic Blunder Demo_is1" = DROD 4: Gunthro and the Epic Blunder Demo 4.0.1
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"ffdshow_is1" = ffdshow v1.1.4257 [2012-01-15]
"FileZilla Client" = FileZilla Client 3.5.0
"FoxyTunesForFirefox" = FoxyTunes for Firefox
"Fraps" = Fraps (remove only)
"Google Desktop" = Google Desktop
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"IrfanView" = IrfanView (remove only)
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"Line 6 Uninstaller" = Line 6 Uninstaller
"Live 8.2.6" = Live 8.2.6
"LOVE" = LOVE (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Maxwell 2" = Maxwell 2
"MaxwellMaya" = Maxwell Plugin for Maya
"Microsoft DirectX SDK (June 2010)" = Microsoft DirectX SDK (June 2010)
"Microsoft Visual C# 2010 Express - ENU" = Microsoft Visual C# 2010 Express - ENU
"Microsoft Visual Studio 2010 Professional - ENU" = Microsoft Visual Studio 2010 Professional - ENU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Miro Video Converter" = Miro Video Converter
"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)
"Mozilla Thunderbird 9.0.1 (x86 en-US)" = Mozilla Thunderbird 9.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"M-WIN-D 8.0.4 2609533_is1" = Wolfram CDF Player (M-WIN-D 8.0.4 2609533)
"Native Instruments Massive" = Native Instruments Massive
"Notepad++" = Notepad++
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OnLive" = OnLive
"OpenAL" = OpenAL
"Orcs Must Die!_is1" = Orcs Must Die!
"Outerra Anteworld" = Outerra - Anteworld - Outerra Anteworld Demo
"OVERGROWTH" = Overgrowth (remove only)
"PowerISO" = PowerISO
"Proun" = Proun
"RealFlow 5" = RealFlow 5
"REAPER" = REAPER
"ReCycle_is1" = ReCycle 2.1.2
"Rigs of Rods 0.38.67" = Rigs of Rods 0.38.67
"Scribus 1.4.0" = Scribus 1.4.0
"Steam App 105600" = Terraria
"Steam App 105800" = PixelJunk Eden
"Steam App 107100" = Bastion
"Steam App 107400" = ARMA 2: Free
"Steam App 113200" = The Binding Of Isaac
"Steam App 12210" = Grand Theft Auto IV
"Steam App 202410" = Scoregasm
"Steam App 203850" = Microsoft Flight
"Steam App 204060" = Superbrothers: Sword & Sworcery EP
"Steam App 205730" = Insanely Twisted Shadow Planet
"Steam App 205870" = Auditorium
"Steam App 207170" = Legend of Grimrock
"Steam App 207530" = Noitu Love 2 Devolution
"Steam App 22000" = World of Goo
"Steam App 22350" = Brink
"Steam App 24420" = Aquaria
"Steam App 25010" = Lugaru HD
"Steam App 26500" = Cogs
"Steam App 26800" = Braid
"Steam App 26900" = Crayon Physics Deluxe
"Steam App 29180" = Osmos
"Steam App 37400" = Time Gentlemen, Please!
"Steam App 37420" = Ben There, Dan That!
"Steam App 40700" = Machinarium
"Steam App 40720" = Samorost 2
"Steam App 41100" = Hammerfight
"Steam App 44320" = DiRT 3
"Steam App 50000" = Nimbus
"Steam App 70300" = VVVVVV
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 91600" = Sanctum
"Steam App 93200" = Revenge of the Titans
"Steam App 94200" = Jamestown
"Steam App 9500" = Gish
"Steam App 96200" = Steel Storm: Burning Retribution
"Steam App 98200" = Frozen Synapse
"Steam App 99700" = NightSky
"Steam App 99810" = Bulletstorm
"Super Box Factory_is1" = Super Box Factory
"Trials 2 SE" = Trials 2 Second Edition
"Unity" = Unity
"Unwrella_Maya" = Unwrella_Maya 2.13
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.10
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"XNA Game Studio 4.0" = Microsoft XNA Game Studio 4.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"0ab833f7f99039b3" = RoadWare
"161d74b240b47115" = WindowsFormsApplication1
"Akamai" = Akamai NetSession Interface
"b14223fc30a0843d" = RTS
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"JoinMe" = join.me
"OpenTK" = OpenTK 1.0
"Sweet Volcano- The Game" = Sweet Volcano- The Game
"UnityWebPlayer" = Unity Web Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/23/2012 11:58:57 AM | Computer Name = Marcos-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

Error - 6/23/2012 12:16:57 PM | Computer Name = Marcos-PC | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe, version: 6.1.7600.16385, time
stamp: 0x4a5bc3c1 Faulting module name: Flash64_11_2_202_235.ocx, version: 11.2.202.235,
time stamp: 0x4f9af802 Exception code: 0xc0000005 Fault offset: 0x00000000005fce65
Faulting
process id: 0x14ec Faulting application start time: 0x01cd515b2116a390 Faulting application
path: C:\Windows\system32\svchost.exe Faulting module path: C:\Windows\system32\Macromed\Flash\Flash64_11_2_202_235.ocx
Report
Id: da2fc500-bd4e-11e1-aa1f-00044b15890c

Error - 6/24/2012 2:33:10 AM | Computer Name = Marcos-PC | Source = Application Error | ID = 1000
Description = Faulting application name: services.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bc10e Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c8f9 Exception code: 0xc0000005 Fault offset: 0x000000000004e4b4
Faulting
process id: 0x280 Faulting application start time: 0x01cd51590ee22020 Faulting application
path: C:\Windows\system32\services.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 76d06a50-bdc6-11e1-aa1f-00044b15890c

Error - 6/24/2012 2:35:11 AM | Computer Name = MARCOS-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

Error - 6/24/2012 2:45:38 AM | Computer Name = Marcos-PC | Source = Application Error | ID = 1000
Description = Faulting application name: services.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bc10e Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c8f9 Exception code: 0xc0000005 Fault offset: 0x000000000004e4b4
Faulting
process id: 0x264 Faulting application start time: 0x01cd51d37ff079e0 Faulting application
path: C:\Windows\system32\services.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 34cf76d0-bdc8-11e1-bb12-00044b15890c

Error - 6/24/2012 2:47:54 AM | Computer Name = Marcos-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

Error - 6/24/2012 2:59:11 AM | Computer Name = Marcos-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

Error - 6/24/2012 3:12:05 AM | Computer Name = Marcos-PC | Source = Google Update | ID = 20
Description =

Error - 6/24/2012 3:28:18 AM | Computer Name = Marcos-PC | Source = Application Error | ID = 1000
Description = Faulting application name: services.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bc10e Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c8f9 Exception code: 0xc0000005 Fault offset: 0x000000000004e4b4
Faulting
process id: 0x2a4 Faulting application start time: 0x01cd51d6d11f19e0 Faulting application
path: C:\Windows\system32\services.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 2ab623f0-bdce-11e1-8b43-00044b15890c

Error - 6/24/2012 3:30:33 AM | Computer Name = Marcos-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

[ System Events ]
Error - 6/24/2012 2:59:49 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7003
Description = The IKE and AuthIP IPsec Keying Modules service depends the following
service: BFE. This service might not be installed.

Error - 6/24/2012 3:00:26 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the SQL
Server (SQLEXPRESS) service to connect.

Error - 6/24/2012 3:00:26 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7000
Description = The SQL Server (SQLEXPRESS) service failed to start due to the following
error: %%1053

Error - 6/24/2012 3:00:28 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7003
Description = The IPsec Policy Agent service depends the following service: BFE.
This service might not be installed.

Error - 6/24/2012 3:30:19 AM | Computer Name = Marcos-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 2:23:34 AM on ?6/?24/?2012 was unexpected.

Error - 6/24/2012 3:30:38 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1060

Error - 6/24/2012 3:31:25 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7003
Description = The IKE and AuthIP IPsec Keying Modules service depends the following
service: BFE. This service might not be installed.

Error - 6/24/2012 3:31:41 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7003
Description = The IPsec Policy Agent service depends the following service: BFE.
This service might not be installed.

Error - 6/24/2012 3:33:27 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7023
Description = The Function Discovery Resource Publication service terminated with
the following error: %%-2147024891

Error - 6/24/2012 3:33:27 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Resource
Publication service which failed to start because of the following error: %%-2147024891

< End of report >

Advertisements

Register to Remove

#2 jeffce

Malware Guy

Authentic Member
8,693 posts

Posted 24 June 2012 - 09:25 AM

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view
Choose to "show hidden files and folders,"
Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
Close the window with OK

---------

Please download aswMBR to your desktop.

Right click and Run as Administrator the aswMBR icon to run it.
Click the Scan button to start scan.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

Click the image to enlarge it
----------

#3 Socram484

Authentic Member

Authentic Member
25 posts

Posted 24 June 2012 - 11:50 AM

It asked me about scanning with Avast or downloading their virus list when I ran the program but I canceled that since you didn't mention it. aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-06-24 12:47:30 ----------------------------- 12:47:30.059 OS Version: Windows x64 6.1.7601 Service Pack 1 12:47:30.059 Number of processors: 4 586 0x1706 12:47:30.059 ComputerName: MARCOS-PC UserName: Marcos 12:47:34.802 Initialize success 12:48:00.424 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005d 12:48:00.440 Disk 0 Vendor: WDC_WD15 21.0 Size: 143089MB BusType: 3 12:48:00.440 Disk 1 \Device\Harddisk1\DR1 -> \Device\0000005e 12:48:00.440 Disk 1 Vendor: WDC_WD75 30.0 Size: 715404MB BusType: 3 12:48:00.440 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000071 12:48:00.440 Disk 2 Vendor: Size: 715404MB BusType: 0 12:48:00.455 Disk 0 MBR read successfully 12:48:00.455 Disk 0 MBR scan 12:48:00.455 Disk 0 Windows 7 default MBR code 12:48:00.455 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 143088 MB offset 63 12:48:00.471 Disk 0 scanning C:\Windows\system32\drivers 12:48:06.415 Service scanning 12:48:22.155 Modules scanning 12:48:22.155 Disk 0 trace - called modules: 12:48:22.654 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor.sys 12:48:22.670 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80080e6060] 12:48:22.670 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8007d2e530] 12:48:22.670 5 ACPI.sys[fffff88000f777a1] -> nt!IofCallDriver -> \Device\0000005d[0xfffffa800702b9c0] 12:48:22.670 Scan finished successfully 12:48:57.598 Disk 0 MBR has been saved successfully to "C:\Users\Marcos\Desktop\MBR.dat" 12:48:57.614 The log file has been saved successfully to "C:\Users\Marcos\Desktop\aswMBR.txt"

#4 jeffce

Malware Guy

Authentic Member
8,693 posts

Posted 24 June 2012 - 12:20 PM

Hi,

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

Unfortunately I have found what is known as the ZeroAccess rootkit on your system. It is an especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end we may need to reinstall the operating system anyway depending on the extent of the infection.

If you would like to format and reinstall your Operating System please let me know and we can assist you with that.

If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help.

----------

Please run aswMBR again and allow it to download the Avast database and post the newly made log.

#5 Socram484

Authentic Member

Authentic Member
25 posts

Posted 24 June 2012 - 12:52 PM

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-06-24 13:33:25 ----------------------------- 13:33:25.255 OS Version: Windows x64 6.1.7601 Service Pack 1 13:33:25.255 Number of processors: 4 586 0x1706 13:33:25.255 ComputerName: MARCOS-PC UserName: Marcos 13:33:25.723 Initialize success 13:35:05.867 AVAST engine defs: 12062400 13:35:25.741 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005d 13:35:25.741 Disk 0 Vendor: WDC_WD15 21.0 Size: 143089MB BusType: 3 13:35:25.741 Disk 1 \Device\Harddisk1\DR1 -> \Device\0000005e 13:35:25.741 Disk 1 Vendor: WDC_WD75 30.0 Size: 715404MB BusType: 3 13:35:25.741 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000071 13:35:25.757 Disk 2 Vendor: Size: 715404MB BusType: 0 13:35:25.772 Disk 0 MBR read successfully 13:35:25.772 Disk 0 MBR scan 13:35:25.788 Disk 0 Windows 7 default MBR code 13:35:25.788 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 143088 MB offset 63 13:35:25.850 Disk 0 scanning C:\Windows\system32\drivers 13:35:39.890 Service scanning 13:36:08.563 Modules scanning 13:36:09.062 Disk 0 trace - called modules: 13:36:09.062 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor.sys 13:36:09.078 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80080e6060] 13:36:09.078 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8007d2e530] 13:36:09.078 5 ACPI.sys[fffff88000f777a1] -> nt!IofCallDriver -> \Device\0000005d[0xfffffa800702b9c0] 13:36:16.270 AVAST engine scan C:\Windows 13:36:18.532 AVAST engine scan C:\Windows\system32 13:39:50.120 AVAST engine scan C:\Windows\system32\drivers 13:39:59.309 AVAST engine scan C:\Users\Marcos 13:41:43.689 File: C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\n **INFECTED** Win64:Sirefef-F [Rtk] 13:41:43.736 File: C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@ **INFECTED** Win32:Malware-gen 13:41:43.783 File: C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@ **INFECTED** Win32:Malware-gen 13:41:43.845 File: C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\800000cb.@ **INFECTED** Win32:Malware-gen 13:51:13.332 AVAST engine scan C:\ProgramData 13:52:09.550 Scan finished successfully 13:52:16.736 Disk 0 MBR has been saved successfully to "C:\Users\Marcos\Desktop\MBR.dat" 13:52:16.736 The log file has been saved successfully to "C:\Users\Marcos\Desktop\aswMBR.txt"

#6 jeffce

Malware Guy

Authentic Member
8,693 posts

Posted 24 June 2012 - 01:32 PM

Hi,

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**
** If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer. **

--------------------------------------------------------------------

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

--------------------------------------------------------------------

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

#7 Socram484

Authentic Member

Authentic Member
25 posts

Posted 24 June 2012 - 02:53 PM

Running ComboFix doesn't seem to work, I am running it as administrator and it seems to load/install itself then when it finishes the dialog box dissapears and nothing happens.

#8 jeffce

Malware Guy

Authentic Member
8,693 posts

Posted 24 June 2012 - 03:42 PM

Hi,

Go ahead and delete your copy of ComboFix from your Desktop.

Download Combofix from any of the links below but rename it to vageta.com before saving it to your desktop.

Link 1
Link 2

==================================

Right-click and Run as Administrator on the renamed ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt so we can continue cleaning the system.

#9 Socram484

Authentic Member

Authentic Member
25 posts

Posted 24 June 2012 - 05:48 PM

ComboFix 12-06-24.03 - Marcos 06/24/2012 18:29:49.5.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8191.6560 [GMT -5:00] Running from: c:\users\Marcos\Desktop\vageta.com.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Propellerhead Software\ReCycle c:\programdata\Propellerhead Software\ReCycle\ReCycle212.dat c:\users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\@ c:\users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\n c:\users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@ c:\users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@ c:\users\Marcos\AppData\Local\assembly\tmp c:\users\Marcos\AppData\Roaming\Love c:\users\Marcos\AppData\Roaming\Love\BR2\cache\2acdfefc6e33a4c1bbbd327dd02441f7.brc c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\logic\maps\intro.lua c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\logic\maps\mainmenu.lua c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\maps\intro.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\maps\mainmenu.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\maps\sandbox.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\maps\test.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\styles.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\tilesets\menu.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\tilesets\outside_n.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\fonts\trebuc.ttf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\fonts\trebucbd.ttf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\fonts\trebucbi.ttf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\fonts\trebucit.ttf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\bg\menu.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\bg\test.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\bg\test.psd c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\bg\test2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player.biq c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player.psd c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player2.pdn c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\bar_l.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\bar_m.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\bar_r.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\btm.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\btm_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\btm_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\hud.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\icons\coins.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\icons\star.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\icons\troll.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\icons\user.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\bg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\btn.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\btn_d.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\btn_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\btn_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but.biq c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but_a.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but_d.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_a.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_a_c.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_d.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_d_c.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_h_c.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_n.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_n_c.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\chk_0.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\chk_0_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\chk_1.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\chk_1_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dialog.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_bg.old.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_bg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_close.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_close_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_close_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_item.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_item_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_item_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\inp.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\inp_a.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\inp_d.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\inp_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\panel.biq c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\panel.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\sb_thumb.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\userbg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\props\table.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\set.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\bg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\buts_1.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\buts_1h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\buts_2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\buts_2h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\collide.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\grid.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\handle.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item_a.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item_fs.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\splash.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\3.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\4.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\5.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\control_room\computer 1.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\control_room\computer 2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\menu\metal.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\brick.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\brickwall.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\concrete.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\dirt.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\grass.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\stonepath.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\bg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\brick.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\brickwall.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\concrete.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\dirt.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\grass.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\stonepath.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\void.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\white.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\info.txt c:\users\Marcos\AppData\Roaming\Love\BR2\reg.sav c:\users\Marcos\AppData\Roaming\Love\not_tetris_2\highscoresA.txt c:\users\Marcos\AppData\Roaming\Love\not_tetris_2\highscoresB.txt c:\users\Marcos\AppData\Roaming\Love\not_tetris_2\options.txt c:\users\Marcos\AppData\Roaming\Propellerhead Software\ReCycle c:\users\Marcos\AppData\Roaming\Propellerhead Software\ReCycle\ReCycle Preferences File.prf c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\@ c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\n c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@ c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@ c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\800000cb.@ c:\windows\SysWow64\DEBUG.log c:\windows\SysWow64\muzapp.exe . Infected copy of c:\windows\system32\services.exe was found and disinfected Restored copy from - c:\windows\ERDNT\cache64\services.exe . . ((((((((((((((((((((((((( Files Created from 2012-05-24 to 2012-06-24 ))))))))))))))))))))))))))))))) . . 2012-06-24 23:36 . 2012-06-24 23:36 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-06-24 23:36 . 2012-06-24 23:36 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-06-23 17:14 . 2012-06-23 17:14 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service 2012-06-23 17:14 . 2012-06-14 22:20 85472 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2012-06-23 17:14 . 2012-06-14 22:20 157608 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe 2012-06-23 17:14 . 2012-06-14 22:20 113120 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe 2012-06-23 17:14 . 2012-06-14 22:19 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll 2012-06-23 17:14 . 2012-06-14 22:19 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll 2012-06-18 23:13 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-18 23:13 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-18 23:13 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll 2012-06-18 23:13 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll 2012-06-18 23:13 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll 2012-06-18 23:13 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll 2012-06-18 23:13 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll 2012-06-18 23:12 . 2012-06-02 20:19 186752 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-18 23:12 . 2012-06-02 20:15 36864 ----a-w- c:\windows\system32\wuapp.exe 2012-06-13 23:48 . 2012-06-13 23:48 -------- d-----w- c:\users\Marcos\AppData\Local\Macromedia 2012-06-10 19:09 . 2012-06-10 21:38 -------- d-----w- c:\users\Marcos\AppData\Roaming\Mathematica 2012-06-10 19:09 . 2012-06-10 19:24 -------- d-----w- c:\users\Marcos\AppData\Local\Mathematica 2012-06-10 18:59 . 2011-02-24 00:40 465936 ----a-w- c:\windows\system32\mltcpip64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 103440 ----a-w- c:\windows\system32\mltcp64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 99344 ----a-w- c:\windows\system32\mlshm64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 203792 ----a-w- c:\windows\system32\mlmodule64.dll 2012-06-10 18:59 . 2011-02-24 00:40 436240 ----a-w- c:\windows\system32\ml64i3.dll 2012-06-10 18:59 . 2011-02-24 00:40 302608 ----a-w- c:\windows\system32\ml64i2.dll 2012-06-09 18:50 . 2012-06-09 18:50 -------- d-----w- c:\program files\Common Files\Wolfram Research 2012-06-09 18:50 . 2012-06-09 18:50 -------- d-----w- c:\program files (x86)\Common Files\ResearchSoft 2012-06-09 18:47 . 2012-06-09 18:50 -------- d-----w- c:\program files (x86)\Common Files\Wolfram Research 2012-06-09 18:47 . 2012-06-10 19:25 -------- d-----w- c:\programdata\Mathematica 2012-06-09 18:47 . 2011-10-03 23:45 334352 ----a-w- c:\windows\SysWow64\mltcpip32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 93712 ----a-w- c:\windows\SysWow64\mltcp32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 88080 ----a-w- c:\windows\SysWow64\mlshm32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 163344 ----a-w- c:\windows\SysWow64\mlmodule32.dll 2012-06-09 18:47 . 2011-10-03 23:45 79376 ----a-w- c:\windows\SysWow64\mlmap32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 370704 ----a-w- c:\windows\SysWow64\ml32i3.dll 2012-06-09 18:47 . 2011-10-03 23:45 260112 ----a-w- c:\windows\SysWow64\ml32i2.dll 2012-06-09 18:47 . 2011-10-03 23:45 253968 ----a-w- c:\windows\SysWow64\ml32i1.dll 2012-06-09 18:46 . 2012-06-09 18:46 -------- d-----w- c:\program files (x86)\Wolfram Research 2012-06-07 06:09 . 2012-06-07 06:09 -------- d-----w- c:\users\Marcos\AppData\Local\DDMSettings 2012-06-07 06:00 . 2012-06-07 06:00 -------- d-----w- c:\users\Marcos\AppData\Roaming\DivX 2012-06-07 05:59 . 2012-06-07 05:59 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine 2012-06-07 05:59 . 2012-06-07 05:59 -------- d-----w- c:\program files\DivX 2012-06-07 05:59 . 2012-06-07 05:59 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared 2012-06-07 05:58 . 2012-06-07 06:00 -------- d-----w- c:\program files (x86)\DivX 2012-06-07 05:57 . 2012-06-07 06:08 -------- d-----w- c:\programdata\DivX 2012-06-06 04:04 . 2012-06-06 04:04 -------- d-----w- c:\users\Marcos\AppData\Local\Redlynx 2012-06-06 04:03 . 2012-06-06 04:05 -------- d-----w- c:\program files (x86)\Trials 2 Second Edition 2012-06-03 02:46 . 2012-06-03 02:46 -------- d-----w- c:\windows\system32\appmgmt 2012-06-03 01:59 . 2012-06-03 02:47 111960 ----a-w- c:\windows\dxsdkuninst.exe 2012-06-03 01:59 . 2012-06-03 02:02 -------- d-----w- c:\program files (x86)\Microsoft DirectX SDK (June 2010) 2012-06-01 19:42 . 2012-06-01 19:42 -------- d-sh--w- c:\windows\system32\%APPDATA% 2012-05-31 18:05 . 2012-05-31 18:05 -------- d-----w- c:\program files\7-Zip 2012-05-31 18:02 . 2012-05-31 18:02 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll 2012-05-31 18:02 . 2012-05-31 18:02 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll 2012-05-31 18:02 . 2012-05-31 18:02 -------- d-----w- C:\usb_driver 2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\users\Marcos\AppData\Local\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\program files (x86)\Common Files\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\users\Marcos\AppData\Roaming\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\program files (x86)\Wondershare 2012-05-31 16:52 . 2011-06-02 05:47 177640 ----a-w- c:\windows\system32\drivers\ssadmdm.sys 2012-05-31 16:52 . 2011-06-02 05:47 16872 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys 2012-05-31 16:52 . 2011-06-02 05:47 157672 ----a-w- c:\windows\system32\drivers\ssadbus.sys 2012-05-31 16:52 . 2011-06-02 05:47 13800 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys 2012-05-31 16:52 . 2011-06-02 05:47 13288 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 36328 ----a-w- c:\windows\system32\drivers\ssadadb.sys 2012-05-31 16:52 . 2010-12-21 05:55 15944 ----a-w- c:\windows\system32\drivers\sscdwhnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 19016 ----a-w- c:\windows\system32\drivers\sscdmdfl.sys 2012-05-31 16:52 . 2010-12-21 05:55 172104 ----a-w- c:\windows\system32\drivers\sscdmdm.sys 2012-05-31 16:52 . 2010-12-21 05:55 15432 ----a-w- c:\windows\system32\drivers\sscdcmnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 136264 ----a-w- c:\windows\system32\drivers\sscdbus.sys 2012-05-31 16:24 . 2012-05-23 23:49 821824 ----a-w- c:\windows\SysWow64\dgderapi.dll 2012-05-31 16:06 . 2012-05-31 16:06 -------- d-----w- c:\program files\CCleaner . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 16:55 . 2012-04-26 01:11 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 16:55 . 2011-07-04 21:29 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-23 23:50 . 2011-08-27 18:51 4659712 ----a-w- c:\windows\SysWow64\Redemption.dll 2012-05-23 23:49 . 2012-05-23 23:49 90112 ----a-w- c:\windows\MAMCityDownload.ocx 2012-05-23 23:49 . 2012-05-23 23:49 325552 ----a-w- c:\windows\MASetupCaller.dll 2012-05-23 23:49 . 2012-05-23 23:49 30568 ----a-w- c:\windows\MusiccityDownload.exe 2012-05-23 23:49 . 2012-05-23 23:49 45320 ----a-w- c:\windows\SysWow64\MAMACExtract.dll 2012-05-15 06:17 . 2011-07-07 06:17 466456 ----a-w- c:\windows\system32\wrap_oal.dll 2012-05-15 06:17 . 2011-07-07 06:17 122904 ----a-w- c:\windows\system32\OpenAL32.dll 2012-05-15 06:17 . 2011-07-07 06:17 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll 2012-05-15 06:17 . 2011-07-07 06:17 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll 2012-05-05 05:18 . 2012-04-26 01:18 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-04-04 20:56 . 2012-01-20 18:32 24904 ----a-w- c:\windows\system32\drivers\mbam.sys . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2012-02-06 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll . [-] 2012-02-06 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll [7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "HideSCAHealth"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer8"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-06-19 8704] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x] R3 ANTS Memory Profiler 7 Service;ANTS Memory Profiler 7 Service;c:\program files\Red Gate\ANTS Memory Profiler 7\RedGate.Memory.IISService.exe [2012-01-16 164792] R3 ANTS Performance Profiler 6 Service;ANTS Performance Profiler 6 Service;c:\program files\Red Gate\ANTS Performance Profiler 6\RedGate.Profiler.IISService.exe [2012-01-16 145408] R3 AXIOM;Service for M-Audio Axiom;c:\windows\system32\DRIVERS\MAudioAxiom.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-07-04 1431888] R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-07-14 30192] R3 MAUSBPRODUCER;Service for M-Audio Producer;c:\windows\system32\DRIVERS\MAudioProducer.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-14 113120] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 YMIDUSBW;Yamaha USB-MIDI Driver (WDM);c:\windows\system32\drivers\ymidusbx64.sys [x] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-22 61976] R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [x] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 427880] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 3d-io License Server v2.0;3d-io License Server v2.0;c:\program files (x86)\3d-io plugins\licensing_v2\ActiveLockServerV2.exe [2011-03-31 34816] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AxiomAudioDevMon;Axiom Audio Device Monitor;c:\program files (x86)\M-Audio\Axiom\AudioDevMon.exe [2010-02-19 1632776] S2 CodeMeter.exe;CodeMeter Runtime Server;c:\program files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe [2011-07-06 2304912] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 381248] S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2010-11-15 5716848] S3 balancesvc;Propellerhead Balance Driver;c:\windows\system32\DRIVERS\balance.sys [x] S3 BalanceWdmService;Balance Wdm Audio;c:\windows\system32\DRIVERS\BalanceWdm.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-06-24 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26 16:55] . 2012-06-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job - c:\users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-07 20:07] . 2012-06-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job - c:\users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-07 20:07] . 2012-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job - c:\users\Marcos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-29 18:04] . 2012-06-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job - c:\users\Marcos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-29 18:04] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs AtiPcie . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-AdobeBridge - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-UnityWebPlayer - c:\users\Marcos\AppData\Local\Unity\WebPlayer\Uninstall.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1943473726-2824459890-2441723098-1000\Software\SecuROM\License information*] "datasecu"=hex:48,3d,44,b1,2b,cd,bd,b0,f5,3a,d9,c8,ec,44,6a,ec,b4,58,2a,16,52, db,68,43,df,c5,d4,88,4d,46,b1,0d,90,06,67,81,a3,09,55,a5,f7,ab,53,66,40,b0,\ "rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Completion time: 2012-06-24 18:46:31 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-24 23:46 . Pre-Run: 10,773,049,344 bytes free Post-Run: 11,723,886,592 bytes free . - - End Of File - - 5396CCB8083F50A78F913EE47EECB4E8

#10 jeffce

Malware Guy

Authentic Member
8,693 posts

Posted 24 June 2012 - 06:03 PM

Hi,

While I am looking over your ComboFix log please do the following...

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Right-click and Run as Administrator SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
user32.dll
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Advertisements

Register to Remove

#11 Socram484

Authentic Member

Authentic Member
25 posts

Posted 24 June 2012 - 10:13 PM

SystemLook 30.07.11 by jpshortstuff Log created at 22:56 on 24/06/2012 by Marcos Administrator - Elevation successful WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. ========== filefind ========== Searching for "user32.dll" C:\Windows\System32\user32.dll --a---- 833024 bytes [04:32 25/07/2011] [03:09 06/02/2012] 861C4346F9281DC0380DE72C8D55D6BE C:\Windows\SysWOW64\user32.dll --a---- 833024 bytes [04:32 25/07/2011] [03:09 06/02/2012] 861C4346F9281DC0380DE72C8D55D6BE C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll --a---- 1008128 bytes [04:33 25/07/2011] [13:27 20/11/2010] FE70103391A64039A921DBFFF9C7AB1B C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll --a---- 833024 bytes [04:32 25/07/2011] [12:08 20/11/2010] 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -= EOF =-

#12 jeffce

Malware Guy

Authentic Member
8,693 posts

Posted 25 June 2012 - 05:38 AM

Hi,

Could you run SystemLook again but instead of using the copy you have now, please delete that and download a fresh copy from either...
Link 1 or
Link 2

Use the same set of instructions as before and then post the new log.

#13 Socram484

Authentic Member

Authentic Member
25 posts

Posted 25 June 2012 - 07:30 AM

SystemLook 30.07.11 by jpshortstuff Log created at 08:20 on 25/06/2012 by Marcos Administrator - Elevation successful ========== filefind ========== Searching for "user32.dll" C:\Windows\System32\user32.dll --a---- 1008640 bytes [04:33 25/07/2011] [03:09 06/02/2012] 2C353B6CE0C8D03225CAA2AF33B68D79 C:\Windows\SysWOW64\user32.dll --a---- 833024 bytes [04:32 25/07/2011] [03:09 06/02/2012] 861C4346F9281DC0380DE72C8D55D6BE C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll --a---- 1008128 bytes [04:33 25/07/2011] [13:27 20/11/2010] FE70103391A64039A921DBFFF9C7AB1B C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll --a---- 833024 bytes [04:32 25/07/2011] [12:08 20/11/2010] 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -= EOF =-

#14 jeffce

Malware Guy

Authentic Member
8,693 posts

Posted 25 June 2012 - 05:39 PM

Hi,

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

ClearJavaCache::

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
----------

#15 Socram484

Authentic Member

Authentic Member
25 posts

Posted 25 June 2012 - 09:31 PM

ComboFix 12-06-24.03 - Marcos 06/25/2012 20:39:28.6.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8191.6520 [GMT -5:00] Running from: c:\users\Marcos\Desktop\vageta.com.exe Command switches used :: c:\users\Marcos\Desktop\CFScript.txt SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-05-26 to 2012-06-26 ))))))))))))))))))))))))))))))) . . 2012-06-26 01:44 . 2012-06-26 01:44 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-06-26 01:44 . 2012-06-26 01:44 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-06-25 22:36 . 2012-06-25 22:36 9310 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS 2012-06-25 22:36 . 2012-06-25 22:36 8646 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS 2012-06-25 22:36 . 2012-06-25 22:36 6429 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS 2012-06-25 22:36 . 2012-06-25 22:36 63115 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS 2012-06-25 22:36 . 2012-06-25 22:36 4599 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS 2012-06-25 22:35 . 2012-06-25 22:35 8782 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS 2012-06-25 22:35 . 2012-06-25 22:35 8613 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS 2012-06-25 22:35 . 2012-06-25 22:35 8288 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS 2012-06-25 22:35 . 2012-06-25 22:35 7271 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS 2012-06-25 22:35 . 2012-06-25 22:35 6910 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS 2012-06-25 22:35 . 2012-06-25 22:35 6208 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS 2012-06-25 22:35 . 2012-06-25 22:35 5927 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS 2012-06-25 22:35 . 2012-06-25 22:35 51852 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS 2012-06-25 22:35 . 2012-06-25 22:35 23327 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS 2012-06-25 22:35 . 2012-06-25 22:35 20719 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS 2012-06-25 22:35 . 2012-06-25 22:35 18541 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS 2012-06-25 22:35 . 2012-06-25 22:35 1651 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS 2012-06-25 06:45 . 2012-06-25 06:45 -------- d-----w- c:\program files (x86)\MagicalTimeBean 2012-06-25 06:09 . 2012-06-25 06:09 -------- d-----w- c:\program files (x86)\ExamDiff 2012-06-23 17:14 . 2012-06-23 17:14 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service 2012-06-23 17:14 . 2012-06-14 22:20 85472 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2012-06-23 17:14 . 2012-06-14 22:20 157608 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe 2012-06-23 17:14 . 2012-06-14 22:20 113120 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe 2012-06-23 17:14 . 2012-06-14 22:19 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll 2012-06-23 17:14 . 2012-06-14 22:19 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll 2012-06-18 23:13 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-18 23:13 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-18 23:13 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll 2012-06-18 23:13 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll 2012-06-18 23:13 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll 2012-06-18 23:13 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll 2012-06-18 23:13 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll 2012-06-18 23:12 . 2012-06-02 20:19 186752 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-18 23:12 . 2012-06-02 20:15 36864 ----a-w- c:\windows\system32\wuapp.exe 2012-06-13 23:48 . 2012-06-13 23:48 -------- d-----w- c:\users\Marcos\AppData\Local\Macromedia 2012-06-10 19:09 . 2012-06-10 21:38 -------- d-----w- c:\users\Marcos\AppData\Roaming\Mathematica 2012-06-10 19:09 . 2012-06-10 19:24 -------- d-----w- c:\users\Marcos\AppData\Local\Mathematica 2012-06-10 18:59 . 2011-02-24 00:40 465936 ----a-w- c:\windows\system32\mltcpip64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 103440 ----a-w- c:\windows\system32\mltcp64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 99344 ----a-w- c:\windows\system32\mlshm64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 203792 ----a-w- c:\windows\system32\mlmodule64.dll 2012-06-10 18:59 . 2011-02-24 00:40 436240 ----a-w- c:\windows\system32\ml64i3.dll 2012-06-10 18:59 . 2011-02-24 00:40 302608 ----a-w- c:\windows\system32\ml64i2.dll 2012-06-09 18:50 . 2012-06-09 18:50 -------- d-----w- c:\program files\Common Files\Wolfram Research 2012-06-09 18:50 . 2012-06-09 18:50 -------- d-----w- c:\program files (x86)\Common Files\ResearchSoft 2012-06-09 18:47 . 2012-06-09 18:50 -------- d-----w- c:\program files (x86)\Common Files\Wolfram Research 2012-06-09 18:47 . 2012-06-10 19:25 -------- d-----w- c:\programdata\Mathematica 2012-06-09 18:47 . 2011-10-03 23:45 334352 ----a-w- c:\windows\SysWow64\mltcpip32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 93712 ----a-w- c:\windows\SysWow64\mltcp32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 88080 ----a-w- c:\windows\SysWow64\mlshm32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 163344 ----a-w- c:\windows\SysWow64\mlmodule32.dll 2012-06-09 18:47 . 2011-10-03 23:45 79376 ----a-w- c:\windows\SysWow64\mlmap32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 370704 ----a-w- c:\windows\SysWow64\ml32i3.dll 2012-06-09 18:47 . 2011-10-03 23:45 260112 ----a-w- c:\windows\SysWow64\ml32i2.dll 2012-06-09 18:47 . 2011-10-03 23:45 253968 ----a-w- c:\windows\SysWow64\ml32i1.dll 2012-06-09 18:46 . 2012-06-09 18:46 -------- d-----w- c:\program files (x86)\Wolfram Research 2012-06-07 06:09 . 2012-06-07 06:09 -------- d-----w- c:\users\Marcos\AppData\Local\DDMSettings 2012-06-07 06:00 . 2012-06-07 06:00 -------- d-----w- c:\users\Marcos\AppData\Roaming\DivX 2012-06-07 05:59 . 2012-06-07 05:59 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine 2012-06-07 05:59 . 2012-06-07 05:59 -------- d-----w- c:\program files\DivX 2012-06-07 05:59 . 2012-06-07 05:59 -------- d-----w- c:\program files (x86)\Common Files\DivX Shared 2012-06-07 05:58 . 2012-06-07 06:00 -------- d-----w- c:\program files (x86)\DivX 2012-06-07 05:57 . 2012-06-07 06:08 -------- d-----w- c:\programdata\DivX 2012-06-06 04:04 . 2012-06-06 04:04 -------- d-----w- c:\users\Marcos\AppData\Local\Redlynx 2012-06-06 04:03 . 2012-06-06 04:05 -------- d-----w- c:\program files (x86)\Trials 2 Second Edition 2012-06-03 02:46 . 2012-06-03 02:46 -------- d-----w- c:\windows\system32\appmgmt 2012-06-03 01:59 . 2012-06-03 02:47 111960 ----a-w- c:\windows\dxsdkuninst.exe 2012-06-03 01:59 . 2012-06-03 02:02 -------- d-----w- c:\program files (x86)\Microsoft DirectX SDK (June 2010) 2012-06-01 19:42 . 2012-06-01 19:42 -------- d-sh--w- c:\windows\system32\%APPDATA% 2012-05-31 18:05 . 2012-05-31 18:05 -------- d-----w- c:\program files\7-Zip 2012-05-31 18:02 . 2012-05-31 18:02 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll 2012-05-31 18:02 . 2012-05-31 18:02 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll 2012-05-31 18:02 . 2012-05-31 18:02 -------- d-----w- C:\usb_driver 2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\users\Marcos\AppData\Local\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\program files (x86)\Common Files\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\users\Marcos\AppData\Roaming\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\program files (x86)\Wondershare 2012-05-31 16:52 . 2011-06-02 05:47 177640 ----a-w- c:\windows\system32\drivers\ssadmdm.sys 2012-05-31 16:52 . 2011-06-02 05:47 16872 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys 2012-05-31 16:52 . 2011-06-02 05:47 157672 ----a-w- c:\windows\system32\drivers\ssadbus.sys 2012-05-31 16:52 . 2011-06-02 05:47 13800 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys 2012-05-31 16:52 . 2011-06-02 05:47 13288 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 36328 ----a-w- c:\windows\system32\drivers\ssadadb.sys 2012-05-31 16:52 . 2010-12-21 05:55 15944 ----a-w- c:\windows\system32\drivers\sscdwhnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 19016 ----a-w- c:\windows\system32\drivers\sscdmdfl.sys 2012-05-31 16:52 . 2010-12-21 05:55 172104 ----a-w- c:\windows\system32\drivers\sscdmdm.sys 2012-05-31 16:52 . 2010-12-21 05:55 15432 ----a-w- c:\windows\system32\drivers\sscdcmnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 136264 ----a-w- c:\windows\system32\drivers\sscdbus.sys 2012-05-31 16:24 . 2012-05-23 23:49 821824 ----a-w- c:\windows\SysWow64\dgderapi.dll 2012-05-31 16:06 . 2012-05-31 16:06 -------- d-----w- c:\program files\CCleaner . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 16:55 . 2012-04-26 01:11 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 16:55 . 2011-07-04 21:29 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-23 23:50 . 2011-08-27 18:51 4659712 ----a-w- c:\windows\SysWow64\Redemption.dll 2012-05-23 23:49 . 2012-05-23 23:49 90112 ----a-w- c:\windows\MAMCityDownload.ocx 2012-05-23 23:49 . 2012-05-23 23:49 325552 ----a-w- c:\windows\MASetupCaller.dll 2012-05-23 23:49 . 2012-05-23 23:49 30568 ----a-w- c:\windows\MusiccityDownload.exe 2012-05-23 23:49 . 2012-05-23 23:49 45320 ----a-w- c:\windows\SysWow64\MAMACExtract.dll 2012-05-15 06:17 . 2011-07-07 06:17 466456 ----a-w- c:\windows\system32\wrap_oal.dll 2012-05-15 06:17 . 2011-07-07 06:17 122904 ----a-w- c:\windows\system32\OpenAL32.dll 2012-05-15 06:17 . 2011-07-07 06:17 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll 2012-05-15 06:17 . 2011-07-07 06:17 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll 2012-05-05 05:18 . 2012-04-26 01:18 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-04-04 20:56 . 2012-01-20 18:32 24904 ----a-w- c:\windows\system32\drivers\mbam.sys . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2012-02-06 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll . [-] 2012-02-06 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll [7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll . ((((((((((((((((((((((((((((( SnapShot@2012-06-24_23.38.54 ))))))))))))))))))))))))))))))))))))))))) . + 2011-07-04 20:48 . 2012-06-26 01:48 61114 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-07-14 05:10 . 2012-06-24 23:41 28460 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-06-26 01:49 28460 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-07-04 19:57 . 2012-06-26 01:49 20722 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1943473726-2824459890-2441723098-1000_UserData.bin - 2011-07-04 21:08 . 2012-06-24 23:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-07-04 21:08 . 2012-06-26 01:47 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:46 . 2012-06-25 13:22 90152 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat + 2011-07-04 21:08 . 2012-06-26 01:47 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-07-04 21:08 . 2012-06-24 23:39 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-07-04 21:08 . 2012-06-24 23:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-07-04 21:08 . 2012-06-26 01:47 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-07-04 21:08 . 2012-06-24 23:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-07-04 21:08 . 2012-06-26 01:47 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-07-04 21:08 . 2012-06-26 01:47 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-07-04 21:08 . 2012-06-24 23:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2012-06-24 23:38 . 2012-06-24 23:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-06-26 01:45 . 2012-06-26 01:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-06-26 01:45 . 2012-06-26 01:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-06-24 23:38 . 2012-06-24 23:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-07-04 20:37 . 2012-06-26 01:45 901120 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-07-04 20:37 . 2012-06-24 23:38 901120 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 05:01 . 2012-06-24 23:37 397868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-06-26 01:44 397868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-06-15 19:18 . 2012-06-15 19:18 664576 c:\windows\Installer\9c9b6a.msi + 2012-06-25 06:45 . 2012-06-25 06:45 112303 c:\windows\Installer\{B7417088-3CD3-49E9-990A-6E84C04BC800}\EscapeGoatIcon.exe - 2012-02-21 16:56 . 2012-06-24 23:38 9928704 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-02-21 16:56 . 2012-06-26 01:45 9928704 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-06-24 23:38 7389184 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2012-06-26 01:45 7389184 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:45 . 2012-06-02 17:26 5976658 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2009-07-14 04:45 . 2012-06-25 13:21 5976658 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2011-07-04 20:40 . 2012-06-26 01:44 13652452 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1943473726-2824459890-2441723098-1000-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "HideSCAHealth"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer8"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x] R3 ANTS Memory Profiler 7 Service;ANTS Memory Profiler 7 Service;c:\program files\Red Gate\ANTS Memory Profiler 7\RedGate.Memory.IISService.exe [2012-01-16 164792] R3 ANTS Performance Profiler 6 Service;ANTS Performance Profiler 6 Service;c:\program files\Red Gate\ANTS Performance Profiler 6\RedGate.Profiler.IISService.exe [2012-01-16 145408] R3 AXIOM;Service for M-Audio Axiom;c:\windows\system32\DRIVERS\MAudioAxiom.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-07-04 1431888] R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-07-14 30192] R3 MAUSBPRODUCER;Service for M-Audio Producer;c:\windows\system32\DRIVERS\MAudioProducer.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-14 113120] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 YMIDUSBW;Yamaha USB-MIDI Driver (WDM);c:\windows\system32\drivers\ymidusbx64.sys [x] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-22 61976] R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [x] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 427880] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 3d-io License Server v2.0;3d-io License Server v2.0;c:\program files (x86)\3d-io plugins\licensing_v2\ActiveLockServerV2.exe [2011-03-31 34816] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AxiomAudioDevMon;Axiom Audio Device Monitor;c:\program files (x86)\M-Audio\Axiom\AudioDevMon.exe [2010-02-19 1632776] S2 CodeMeter.exe;CodeMeter Runtime Server;c:\program files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe [2011-07-06 2304912] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-06-19 8704] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 381248] S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2010-11-15 5716848] S3 balancesvc;Propellerhead Balance Driver;c:\windows\system32\DRIVERS\balance.sys [x] S3 BalanceWdmService;Balance Wdm Audio;c:\windows\system32\DRIVERS\BalanceWdm.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26 16:55] . 2012-06-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job - c:\users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-07 20:07] . 2012-06-26 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job - c:\users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-07 20:07] . 2012-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job - c:\users\Marcos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-29 18:04] . 2012-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job - c:\users\Marcos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-29 18:04] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 ----a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs AtiPcie . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1943473726-2824459890-2441723098-1000\Software\SecuROM\License information*] "datasecu"=hex:48,3d,44,b1,2b,cd,bd,b0,f5,3a,d9,c8,ec,44,6a,ec,b4,58,2a,16,52, db,68,43,df,c5,d4,88,4d,46,b1,0d,90,06,67,81,a3,09,55,a5,f7,ab,53,66,40,b0,\ "rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Completion time: 2012-06-25 20:53:31 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-26 01:53 ComboFix2.txt 2012-06-24 23:46 . Pre-Run: 11,788,591,104 bytes free Post-Run: 11,344,064,512 bytes free . - - End Of File - - F705FC6911B0F1952F18C72F83EEFF15

Body Background

skin color theme