Ping.exe virus problems [Solved]

ComboFix 11-12-17.05 - laptop 12/17/2011 22:40:54.7.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3562.2420 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\laptop\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\stories\to cd\cd transfer\games\bigfishgame_dream_day_wedding_married_in_manhattan_-_full_crack_2008[www.btmon.com].torrent"
"c:\stories\to cd\cd transfer\games\dream.day.wedding.v1.0.3.winall.incl.keygen-eclipse.zip"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\stories\to cd\cd transfer\games\bigfishgame_dream_day_wedding_married_in_manhattan_-_full_crack_2008[www.btmon.com].torrent
c:\stories\to cd\cd transfer\games\dream.day.wedding.v1.0.3.winall.incl.keygen-eclipse.zip
.
.
((((((((((((((((((((((((( Files Created from 2011-11-18 to 2011-12-18 )))))))))))))))))))))))))))))))
.
.
2011-12-18 04:35 . 2011-12-18 04:35 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-17 17:17 . 2011-12-17 17:17 ——– d—–w- c:\users\laptop\AppData\Roaming\QuickScan
2011-12-16 16:10 . 2011-12-16 16:10 ——– d—–w- c:\program files (x86)\ESET
2011-12-16 09:11 . 2011-12-16 09:11 ——– d—–w- c:\program files (x86)\SeaMonkey
2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\users\laptop\AppData\Roaming\Disruptive Innovations SARL
2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\users\laptop\AppData\Local\Disruptive Innovations SARL
2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\program files (x86)\BlueGriffon
2011-12-16 07:47 . 2011-12-16 07:47 ——– d—–w- c:\programdata\Blumentals
2011-12-13 23:01 . 2011-12-17 18:34 ——– d—–w- c:\programdata\AVG2012
2011-12-13 23:00 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\AVG
2011-12-13 22:50 . 2011-12-13 22:50 ——– d–h–w- c:\programdata\Common Files
2011-12-13 22:49 . 2011-12-17 18:35 ——– d—–w- c:\programdata\MFAData
2011-12-13 19:45 . 2011-12-13 19:45 ——– d—–w- c:\users\laptop\AppData\Roaming\Malwarebytes
2011-12-13 19:44 . 2011-12-14 05:54 ——– d—–w- c:\programdata\Malwarebytes
2011-12-13 19:44 . 2011-12-14 05:58 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-13 19:44 . 2011-08-31 22:00 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-04 04:36 . 2011-12-04 04:38 ——– d—–w- c:\program files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition
2011-12-03 23:49 . 2011-12-07 16:15 ——– d—–w- c:\programdata\Playrix Entertainment
2011-12-03 22:21 . 2011-12-03 22:21 ——– d—–w- c:\programdata\TERMINAL Studio
2011-12-03 17:45 . 2011-12-03 17:46 ——– d—–w- c:\users\laptop\AppData\Local\Tific
2011-12-03 16:17 . 2011-12-18 01:48 ——– d—–w- c:\program files (x86)\Luxor Adventures
2011-12-03 16:17 . 2009-08-19 01:26 57344 —-a-w- c:\windows\SysWow64\Big Kahuna Reef.scr
2011-12-03 16:17 . 2011-12-12 00:23 ——– d—–w- c:\program files (x86)\Big Kahuna Reef
2011-12-03 16:02 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Double Play Jewel Quest 2 and 3
2011-12-03 15:55 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Royal Envoy
2011-12-03 15:42 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Samantha Swift and the Mystery from Atlantis
2011-12-03 15:26 . 2011-12-04 02:31 ——– d—–w- c:\program files (x86)\Big Kahuna Reef 2
2011-12-03 15:25 . 2011-12-11 23:32 ——– d—–w- c:\program files (x86)\The Rise Of Atlantis
2011-12-03 15:23 . 2011-12-03 22:42 ——– d—–w- c:\program files (x86)\Sky Kingdoms
2011-12-03 15:20 . 2011-12-11 21:22 ——– d—–w- c:\program files (x86)\Heroes Of Hellas
2011-12-03 15:19 . 2011-12-04 02:38 ——– d—–w- c:\program files (x86)\Call Of Atlantis
2011-12-03 15:13 . 2011-12-04 06:42 ——– d—–w- c:\program files (x86)\Atlantis Quest
2011-12-03 15:11 . 2011-12-18 01:00 ——– d—–w- c:\program files (x86)\Luxor HD
2011-12-03 15:10 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Samantha Swift Fountains of Fate
2011-12-03 14:52 . 2011-12-03 14:52 ——– d—–w- c:\programdata\Amazon
2011-12-03 14:52 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Amazon
2011-12-03 04:34 . 2011-12-03 04:34 ——– d—–w- c:\programdata\Fugazo
2011-12-02 21:57 . 2011-12-02 21:57 ——– d—–w- c:\program files (x86)\Mythic Pearls - The Legend of Tirnanog
2011-12-02 21:53 . 2011-12-02 21:53 ——– d—–w- c:\programdata\Intenium
2011-12-02 21:45 . 2011-12-02 21:45 ——– d—–w- c:\program files (x86)\Luxor - 5th Passage
2011-11-30 17:10 . 2011-11-30 17:10 ——– d—–w- c:\users\laptop\AppData\Roaming\OpenOffice.org
2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\OpenOffice.org 3
2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-11-30 17:08 . 2011-11-30 17:08 472808 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Java
2011-11-30 16:31 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Common Files\Adobe
2011-11-28 00:04 . 2011-11-30 05:03 ——– d—–w- c:\users\laptop\AppData\Roaming\Oberon Games
2011-11-20 03:42 . 2011-11-20 03:42 ——– d—–w- c:\users\laptop\AppData\Roaming\Fuzzy Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-30 17:08 . 2011-04-28 03:24 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
2011-10-07 01:29 . 2011-09-13 23:56 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((( SnapShot_2011-12-16_20.38.05 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 05:10 . 2011-12-17 00:23 47222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 02:36 . 2011-12-17 00:54 96834 c:\windows\system32\perfc009.dat
+ 2011-08-24 17:35 . 2011-12-17 18:30 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-08-24 17:35 . 2011-12-16 15:42 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-08-24 17:35 . 2011-12-16 15:42 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-08-24 17:35 . 2011-12-17 18:30 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-12-17 18:30 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-12-16 15:42 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-08-26 10:00 . 2011-12-16 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-08-26 10:00 . 2011-12-18 04:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-08-26 10:00 . 2011-12-18 04:07 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-08-26 10:00 . 2011-12-16 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-08-25 16:47 . 2011-12-17 00:23 7882 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2785432018-3854357188-4169626549-1000_UserData.bin
+ 2011-12-16 15:06 . 2011-12-17 00:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-12-16 15:06 . 2011-12-16 15:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-16 15:06 . 2011-12-17 00:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-12-16 15:06 . 2011-12-16 15:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 04:54 . 2011-12-16 15:07 344064 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-12-17 00:22 344064 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-09-06 05:40 . 2011-12-17 17:04 277494 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2011-12-17 00:54 594760 c:\windows\system32\perfh009.dat
- 2009-07-14 05:12 . 2011-12-16 15:25 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2011-12-17 17:04 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 04:54 . 2011-12-17 00:22 2785280 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-12-16 15:07 2785280 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-12-17 00:22 1884160 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-12-16 15:07 1884160 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-06-08 336384]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...31d8e9975" [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 Norton PC Checkup Application Launcher;Toshiba Laptop Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe [2011-12-03 135608]
R3 Amazon Download Agent;Amazon Download Agent;c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-10-23 401920]
R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2011-04-06 828336]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe [2011-02-03 126392]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-04-07 294328]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768]
S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
S4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
S4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
S4 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x]
S4 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - Avgldx64
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040]
"TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.toshiba.com
uInternet Settings,ProxyOverride =
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Read It Later: [removed] - %profile%\extensions\[removed]
FF - Ext: Webmail Ad Blocker: [removed] - %profile%\extensions\[removed]
FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr]
"ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-12-18 00:00:47
ComboFix-quarantined-files.txt 2011-12-18 05:00
ComboFix2.txt 2011-12-16 21:06
ComboFix3.txt 2011-12-16 04:06
ComboFix4.txt 2011-12-15 20:50
.
Pre-Run: 512,976,494,592 bytes free
Post-Run: 513,280,532,480 bytes free
.
- - End Of File - - 8960434F25A6D30B9AB7C143C7437589


i ended up uninstalling AVG with all the problems it was giving me. i looked at avast on cnet.com but a lot of people said the current version screwed up their computers and the other one i tried but it popped up the same thing about malwarebytes.

ComboFix 11-12-17.05 - laptop 12/18/2011 11:09:56.8.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3562.2195 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\laptop\Desktop\CFScript.txt SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Service_Norton PC Checkup Application Launcher . . ((((((((((((((((((((((((( Files Created from 2011-11-18 to 2011-12-18 ))))))))))))))))))))))))))))))) . . 2011-12-18 16:24 . 2011-12-18 16:24 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-12-17 17:17 . 2011-12-17 17:17 ——– d—–w- c:\users\laptop\AppData\Roaming\QuickScan 2011-12-16 16:10 . 2011-12-16 16:10 ——– d—–w- c:\program files (x86)\ESET 2011-12-16 09:11 . 2011-12-16 09:11 ——– d—–w- c:\program files (x86)\SeaMonkey 2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\users\laptop\AppData\Roaming\Disruptive Innovations SARL 2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\users\laptop\AppData\Local\Disruptive Innovations SARL 2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\program files (x86)\BlueGriffon 2011-12-16 07:47 . 2011-12-16 07:47 ——– d—–w- c:\programdata\Blumentals 2011-12-13 23:01 . 2011-12-18 16:27 ——– d—–w- c:\programdata\AVG2012 2011-12-13 23:00 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\AVG 2011-12-13 22:50 . 2011-12-13 22:50 ——– d–h–w- c:\programdata\Common Files 2011-12-13 22:49 . 2011-12-17 18:35 ——– d—–w- c:\programdata\MFAData 2011-12-13 19:45 . 2011-12-13 19:45 ——– d—–w- c:\users\laptop\AppData\Roaming\Malwarebytes 2011-12-13 19:44 . 2011-12-14 05:54 ——– d—–w- c:\programdata\Malwarebytes 2011-12-13 19:44 . 2011-12-14 05:58 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-12-13 19:44 . 2011-08-31 22:00 25416 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-12-04 04:36 . 2011-12-04 04:38 ——– d—–w- c:\program files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition 2011-12-03 23:49 . 2011-12-07 16:15 ——– d—–w- c:\programdata\Playrix Entertainment 2011-12-03 22:21 . 2011-12-03 22:21 ——– d—–w- c:\programdata\TERMINAL Studio 2011-12-03 17:45 . 2011-12-03 17:46 ——– d—–w- c:\users\laptop\AppData\Local\Tific 2011-12-03 16:17 . 2011-12-18 01:48 ——– d—–w- c:\program files (x86)\Luxor Adventures 2011-12-03 16:17 . 2009-08-19 01:26 57344 —-a-w- c:\windows\SysWow64\Big Kahuna Reef.scr 2011-12-03 16:17 . 2011-12-12 00:23 ——– d—–w- c:\program files (x86)\Big Kahuna Reef 2011-12-03 16:02 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Double Play Jewel Quest 2 and 3 2011-12-03 15:55 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Royal Envoy 2011-12-03 15:42 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Samantha Swift and the Mystery from Atlantis 2011-12-03 15:26 . 2011-12-04 02:31 ——– d—–w- c:\program files (x86)\Big Kahuna Reef 2 2011-12-03 15:25 . 2011-12-11 23:32 ——– d—–w- c:\program files (x86)\The Rise Of Atlantis 2011-12-03 15:23 . 2011-12-03 22:42 ——– d—–w- c:\program files (x86)\Sky Kingdoms 2011-12-03 15:20 . 2011-12-18 08:33 ——– d—–w- c:\program files (x86)\Heroes Of Hellas 2011-12-03 15:19 . 2011-12-04 02:38 ——– d—–w- c:\program files (x86)\Call Of Atlantis 2011-12-03 15:13 . 2011-12-04 06:42 ——– d—–w- c:\program files (x86)\Atlantis Quest 2011-12-03 15:11 . 2011-12-18 01:00 ——– d—–w- c:\program files (x86)\Luxor HD 2011-12-03 15:10 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Samantha Swift Fountains of Fate 2011-12-03 14:52 . 2011-12-03 14:52 ——– d—–w- c:\programdata\Amazon 2011-12-03 14:52 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Amazon 2011-12-03 04:34 . 2011-12-03 04:34 ——– d—–w- c:\programdata\Fugazo 2011-12-02 21:57 . 2011-12-02 21:57 ——– d—–w- c:\program files (x86)\Mythic Pearls - The Legend of Tirnanog 2011-12-02 21:53 . 2011-12-02 21:53 ——– d—–w- c:\programdata\Intenium 2011-12-02 21:45 . 2011-12-02 21:45 ——– d—–w- c:\program files (x86)\Luxor - 5th Passage 2011-11-30 17:10 . 2011-11-30 17:10 ——– d—–w- c:\users\laptop\AppData\Roaming\OpenOffice.org 2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\OpenOffice.org 3 2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Common Files\Java 2011-11-30 17:08 . 2011-11-30 17:08 472808 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll 2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Java 2011-11-30 16:31 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Common Files\Adobe 2011-11-28 00:04 . 2011-11-30 05:03 ——– d—–w- c:\users\laptop\AppData\Roaming\Oberon Games 2011-11-20 03:42 . 2011-11-20 03:42 ——– d—–w- c:\users\laptop\AppData\Roaming\Fuzzy Games . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-30 17:08 . 2011-04-28 03:24 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2011-10-07 01:29 . 2011-09-13 23:56 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl . . ((((((((((((((((((((((((((((( SnapShot_2011-12-16_20.38.05 ))))))))))))))))))))))))))))))))))))))))) . + 2011-12-18 16:26 . 2011-12-18 16:26 12411 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat - 2011-12-16 15:05 . 2011-12-16 15:05 12411 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat + 2009-07-14 05:10 . 2011-12-17 00:23 47222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2009-07-14 02:36 . 2011-12-18 16:04 96834 c:\windows\system32\perfc009.dat + 2011-08-24 17:35 . 2011-12-17 18:30 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-08-24 17:35 . 2011-12-16 15:42 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-08-24 17:35 . 2011-12-16 15:42 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-08-24 17:35 . 2011-12-17 18:30 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2011-12-16 15:42 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2011-12-17 18:30 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-08-26 10:00 . 2011-12-18 16:06 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-08-26 10:00 . 2011-12-16 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-08-26 10:00 . 2011-12-18 16:06 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-08-26 10:00 . 2011-12-16 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-12-15 20:54 . 2011-12-18 16:26 3630 c:\windows\system32\wdi\ERCQueuedResolutions.dat + 2011-08-25 16:47 . 2011-12-17 00:23 7882 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2785432018-3854357188-4169626549-1000_UserData.bin + 2011-12-18 16:27 . 2011-12-18 16:27 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-12-16 15:06 . 2011-12-16 15:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-12-16 15:06 . 2011-12-16 15:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-12-18 16:27 . 2011-12-18 16:27 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 04:54 . 2011-12-18 16:27 344064 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2011-12-16 15:07 344064 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-09-06 05:40 . 2011-12-18 15:25 278070 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 02:36 . 2011-12-18 16:04 594760 c:\windows\system32\perfh009.dat - 2009-07-14 05:12 . 2011-12-16 15:25 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2009-07-14 05:12 . 2011-12-17 17:04 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat - 2009-07-14 05:01 . 2011-12-16 15:05 320312 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-12-18 16:26 320312 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-10-01 04:08 . 2011-12-18 16:26 593416 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2785432018-3854357188-4169626549-1000-12288.dat + 2009-07-14 04:54 . 2011-12-18 16:27 2785280 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2011-12-16 15:07 2785280 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-12-18 16:27 1884160 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2011-12-16 15:07 1884160 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-09-06 03:27 . 2011-12-16 15:05 1057200 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2011-09-06 03:27 . 2011-12-18 16:26 1057200 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336] "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-06-08 336384] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] R3 Amazon Download Agent;Amazon Download Agent;c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-10-23 401920] R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664] S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688] S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-04-07 294328] S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768] S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632] S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2011-04-06 828336] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU] "HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU] "TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040] "TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU] "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376] "TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU] "combofix"="c:\combofix\CF32674.3XE" [2010-11-21 345088] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://start.toshiba.com uInternet Settings,ProxyOverride = TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Read It Later: [removed] - %profile%\extensions\[removed] FF - Ext: Webmail Ad Blocker: [removed] - %profile%\extensions\[removed] FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Yahoo!\Messenger\YahooMessenger.exe c:\program files (x86)\Corel\WordPerfect Family Pack 4\Programs\wpwin10.exe c:\program files (x86)\Winamp\winamp.exe c:\program files (x86)\Mozilla Firefox\firefox.exe c:\program files (x86)\Mozilla Firefox\plugin-container.exe . ************************************************************************** . Completion time: 2011-12-18 11:48:43 - machine was rebooted ComboFix-quarantined-files.txt 2011-12-18 16:48 ComboFix2.txt 2011-12-18 05:01 ComboFix3.txt 2011-12-16 21:06 ComboFix4.txt 2011-12-16 04:06 ComboFix5.txt 2011-12-18 16:08 . Pre-Run: 513,322,938,368 bytes free Post-Run: 513,080,836,096 bytes free . - - End Of File - - 2DF2C31B157DBD7999D9C0FA4AB23777 next time we have to do this, can you please take out C:\Windows\SysWOW64\ping.exe ? i know it's what started off this very long process and it's still there, won't let me delete it, and i'd like my search function back sometime. please? re: microsoft security essentials. i tried it, it hit on antimalwarebytes as well the first time then ignored it after that but it did hit on other things, like me pulling up my mp3 player. it acted worse than user control settings.

. DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_22 Run by [removed] at 12:43:51 on 2011-12-18 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3562.1268 [GMT -5:00] . SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\windows\system32\wininit.exe C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\system32\atiesrxx.exe C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\atieclxx.exe C:\windows\system32\svchost.exe -k NetworkService C:\Windows\System32\GFNEXSrv.exe C:\windows\system32\WLANExt.exe C:\windows\system32\conhost.exe C:\windows\System32\spoolsv.exe C:\windows\system32\taskhost.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\windows\System32\svchost.exe -k LocalServiceNoNetwork C:\windows\SysWOW64\svchost.exe -k hpdevmgmt C:\windows\System32\svchost.exe -k HPZ12 C:\windows\System32\svchost.exe -k HPZ12 C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\windows\system32\svchost.exe -k imgsvc C:\windows\system32\TODDSrv.exe C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files\TOSHIBA\TECO\TecoService.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\system32\wbem\unsecapp.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\windows\system32\svchost.exe -k HPService C:\Program Files\Toshiba\Power Saver\TPwrMain.exe C:\Program Files\Toshiba\FlashCards\TCrdMain.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Toshiba\TECO\Teco.exe C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\windows\System32\svchost.exe -k LocalServicePeerNet C:\windows\system32\taskmgr.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe C:\Program Files (x86)\Corel\WordPerfect Family Pack 4\Programs\wpwin10.exe C:\windows\splwow64.exe C:\Program Files (x86)\Winamp\winamp.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\windows\system32\notepad.exe C:\windows\SysWOW64\cmd.exe C:\windows\system32\conhost.exe C:\windows\SysWOW64\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://start.toshiba.com uInternet Settings,ProxyOverride = BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: TOSHIBA Media Controller Plug-in: {f3c88694-effa-4d78-b409-54b7b2535b14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll {555d4d79-4bd2-4094-a395-cfc534424a05} uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet mRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{A0273F09-A733-49EC-9049-CD0F840D449E} : DhcpNameServer = 192.168.1.1 TCP: Interfaces\{C3B9C6DE-557E-4619-A4F6-39D3E6ECB09A} : DhcpNameServer = [removed] [removed] BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll FF - plugin: C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Read It Later: [removed] - %profile%\extensions\[removed] FF - Ext: Webmail Ad Blocker: [removed] - %profile%\extensions\[removed] FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} . ============= SERVICES / DRIVERS =============== . R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys –> C:\windows\system32\DRIVERS\vwififlt.sys [?] R2 AMD External Events Utility;AMD External Events Utility;C:\windows\system32\atiesrxx.exe –> C:\windows\system32\atiesrxx.exe [?] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664] R2 GFNEXSrv;GFNEX Service;C:\Windows\System32\GFNEXSrv.exe –> C:\Windows\System32\GFNEXSrv.exe [?] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-13 366152] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-2 483688] R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\Toshiba\TECO\TecoService.exe [2011-4-7 294328] R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\system32\DRIVERS\TVALZFL.sys –> C:\windows\system32\DRIVERS\TVALZFL.sys [?] R3 amdkmdag;amdkmdag;C:\windows\system32\DRIVERS\atikmdag.sys –> C:\windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\windows\system32\DRIVERS\atikmpag.sys –> C:\windows\system32\DRIVERS\atikmpag.sys [?] R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\windows\system32\drivers\AtihdW76.sys –> C:\windows\system32\drivers\AtihdW76.sys [?] R3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys –> C:\windows\system32\drivers\mbam.sys [?] R3 PGEffect;Pangu effect driver;C:\windows\system32\DRIVERS\pgeffect.sys –> C:\windows\system32\DRIVERS\pgeffect.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys –> C:\windows\system32\DRIVERS\Rt64win7.sys [?] R3 Sftfs;Sftfs;C:\windows\system32\DRIVERS\Sftfslh.sys –> C:\windows\system32\DRIVERS\Sftfslh.sys [?] R3 Sftplay;Sftplay;C:\windows\system32\DRIVERS\Sftplaylh.sys –> C:\windows\system32\DRIVERS\Sftplaylh.sys [?] R3 Sftredir;Sftredir;C:\windows\system32\DRIVERS\Sftredirlh.sys –> C:\windows\system32\DRIVERS\Sftredirlh.sys [?] R3 Sftvol;Sftvol;C:\windows\system32\DRIVERS\Sftvollh.sys –> C:\windows\system32\DRIVERS\Sftvollh.sys [?] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-2 209768] R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-8 137632] R3 TPCHSrv;TPCH Service;C:\Program Files\Toshiba\TPHM\TPCHSrv.exe [2011-4-5 828336] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys –> C:\windows\system32\DRIVERS\vwifimp.sys [?] S2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] S3 Amazon Download Agent;Amazon Download Agent;C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2011-12-3 401920] S3 BtFilter;Bluetooth LowerFilter Class Filter Driver;C:\windows\system32\DRIVERS\btfilter.sys –> C:\windows\system32\DRIVERS\btfilter.sys [?] S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUStor.sys –> C:\windows\system32\Drivers\RtsUStor.sys [?] S3 TMachInfo;TMachInfo;C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe [2011-8-24 54136] S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys –> C:\windows\system32\drivers\tsusbflt.sys [?] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys –> C:\windows\system32\drivers\TsUsbGD.sys [?] S3 WSDPrintDevice;WSD Print Support via UMB;C:\windows\system32\DRIVERS\WSDPrint.sys –> C:\windows\system32\DRIVERS\WSDPrint.sys [?] . =============== Created Last 30 ================ . 2011-12-18 16:27:51 ——– d-sh–w- C:\$RECYCLE.BIN 2011-12-17 17:17:09 ——– d—–w- C:\Users\laptop\AppData\Roaming\QuickScan 2011-12-16 16:10:32 ——– d—–w- C:\Program Files (x86)\ESET 2011-12-16 09:11:33 ——– d—–w- C:\Program Files (x86)\SeaMonkey 2011-12-16 08:32:54 ——– d—–w- C:\Users\laptop\AppData\Roaming\Disruptive Innovations SARL 2011-12-16 08:32:54 ——– d—–w- C:\Users\laptop\AppData\Local\Disruptive Innovations SARL 2011-12-16 08:32:46 ——– d—–w- C:\Program Files (x86)\BlueGriffon 2011-12-16 07:47:06 ——– d—–w- C:\ProgramData\Blumentals 2011-12-15 20:12:11 98816 —-a-w- C:\windows\sed.exe 2011-12-15 20:12:11 518144 —-a-w- C:\windows\SWREG.exe 2011-12-15 20:12:11 256000 —-a-w- C:\windows\PEV.exe 2011-12-15 20:12:11 208896 —-a-w- C:\windows\MBR.exe 2011-12-13 23:01:15 ——– d—–w- C:\ProgramData\AVG2012 2011-12-13 23:00:29 ——– d—–w- C:\Program Files (x86)\AVG 2011-12-13 22:50:16 ——– d–h–w- C:\ProgramData\Common Files 2011-12-13 22:49:48 ——– d—–w- C:\ProgramData\MFAData 2011-12-13 19:45:38 ——– d—–w- C:\Users\laptop\AppData\Roaming\Malwarebytes 2011-12-13 19:44:51 ——– d—–w- C:\ProgramData\Malwarebytes 2011-12-13 19:44:48 25416 —-a-w- C:\windows\System32\drivers\mbam.sys 2011-12-13 19:44:48 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-12-04 04:36:47 ——– d—–w- C:\Program Files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition 2011-12-03 23:49:57 ——– d—–w- C:\ProgramData\Playrix Entertainment 2011-12-03 22:21:27 ——– d—–w- C:\ProgramData\TERMINAL Studio 2011-12-03 17:45:35 ——– d—–w- C:\Users\laptop\AppData\Local\Tific 2011-12-03 16:17:22 ——– d—–w- C:\Program Files (x86)\Luxor Adventures 2011-12-03 16:17:05 57344 —-a-w- C:\windows\SysWow64\Big Kahuna Reef.scr 2011-12-03 16:17:03 ——– d—–w- C:\Program Files (x86)\Big Kahuna Reef 2011-12-03 16:02:43 ——– d—–w- C:\Program Files (x86)\Double Play Jewel Quest 2 and 3 2011-12-03 15:55:01 ——– d—–w- C:\Program Files (x86)\Royal Envoy 2011-12-03 15:42:33 ——– d—–w- C:\Program Files (x86)\Samantha Swift and the Mystery from Atlantis 2011-12-03 15:26:52 ——– d—–w- C:\Program Files (x86)\Big Kahuna Reef 2 2011-12-03 15:25:26 ——– d—–w- C:\Program Files (x86)\The Rise Of Atlantis 2011-12-03 15:23:37 ——– d—–w- C:\Program Files (x86)\Sky Kingdoms 2011-12-03 15:20:42 ——– d—–w- C:\Program Files (x86)\Heroes Of Hellas 2011-12-03 15:19:21 ——– d—–w- C:\Program Files (x86)\Call Of Atlantis 2011-12-03 15:13:13 ——– d—–w- C:\Program Files (x86)\Atlantis Quest 2011-12-03 15:11:54 ——– d—–w- C:\Program Files (x86)\Luxor HD 2011-12-03 15:10:00 ——– d—–w- C:\Program Files (x86)\Samantha Swift Fountains of Fate 2011-12-03 14:52:40 ——– d—–w- C:\ProgramData\Amazon 2011-12-03 14:52:33 ——– d—–w- C:\Program Files (x86)\Amazon 2011-12-03 04:34:22 ——– d—–w- C:\ProgramData\Fugazo 2011-12-02 21:57:00 ——– d—–w- C:\Program Files (x86)\Mythic Pearls - The Legend of Tirnanog 2011-12-02 21:53:49 ——– d—–w- C:\ProgramData\Intenium 2011-12-02 21:45:22 ——– d—–w- C:\Program Files (x86)\Luxor - 5th Passage 2011-11-30 17:10:59 ——– d—–w- C:\Users\laptop\AppData\Roaming\OpenOffice.org 2011-11-30 17:08:59 ——– d—–w- C:\Program Files (x86)\OpenOffice.org 3 2011-11-30 17:08:17 472808 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll 2011-11-28 00:04:22 ——– d—–w- C:\Users\laptop\AppData\Roaming\Oberon Games 2011-11-20 03:42:26 ——– d—–w- C:\Users\laptop\AppData\Roaming\Fuzzy Games . ==================== Find3M ==================== . 2011-11-30 17:08:07 472808 —-a-w- C:\windows\SysWow64\deployJava1.dll 2011-10-16 09:05:43 2951 —-a-w- C:\windows\SysWow64\settings.bin 2011-10-07 01:29:46 414368 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl . ============= FINISH: 12:44:16.12 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 8/24/2011 1:37:34 PM System Uptime: 12/18/2011 11:26:49 AM (1 hours ago) . Motherboard: PEGATRON CORPORATION | | TKBSS Processor: AMD A4-3300M APU with Radeon™ HD Graphics | CPU 1 | 1900/mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 581 GiB total, 477.888 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318} Description: Photosmart D110 series Device ID: ROOT\MULTIFUNCTION\0000 Manufacturer: HP Name: Photosmart D110 series PNP Device ID: ROOT\MULTIFUNCTION\0000 Service: . ==== System Restore Points =================== . RP31: 11/23/2011 5:15:50 PM - primary retore point RP32: 11/30/2011 11:19:19 AM - Installed Adobe Reader X (10.1.0). RP33: 11/30/2011 11:30:22 AM - Installed Adobe Reader X (10.1.0). RP34: 11/30/2011 12:07:14 PM - Installed Java™ 6 Update 22 RP35: 11/30/2011 12:08:37 PM - Installed OpenOffice.org 3.3 RP36: 12/13/2011 2:20:43 PM - Removed Microsoft Primary Interoperability Assemblies 2005 RP37: 12/13/2011 5:59:52 PM - Installed AVG 2012 RP38: 12/13/2011 6:00:40 PM - Installed AVG 2012 RP39: 12/15/2011 3:12:24 PM - ComboFix created restore point RP40: 12/15/2011 5:03:29 PM - Installed AVG 2012 RP41: 12/15/2011 10:42:11 PM - Removed AVG 2012 RP42: 12/16/2011 10:49:32 AM - Windows Update RP44: 12/17/2011 1:32:02 PM - Removed AVG 2012 RP45: 12/17/2011 1:34:37 PM - Removed AVG 2012 . ==== Installed Programs ====================== . Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader X (10.1.1) Amazon Games & Software Downloader AMD VISION Engine Control Center Ancient Mysteries Atheros Driver Installation Program Atlantis Bejeweled 3 Big Fish Games: Game Manager Big Kahuna Reef BlueGriffon version 1.3.1 Bricks of Atlantis Bricks of Egypt 2 BufferChm Call Of Atlantis Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center InstallProxy Catalyst Control Center Localization All CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish Chuzzle Deluxe Coffee Rush D110 Dark Parables: Curse of Briar Rose Dark Parables: Rise of the Snow Queen Collector's Edition Dark Parables: The Exiled Prince Destinations DeviceDiscovery Double Play Jewel Quest 2 and 3 Dream Day Honeymoon Dream Day Wedding Dream Day Wedding: Married in Manhattan Dream Day Wedding: Viva Las Vegas Echoes of the Past: Royal House of Stone Echoes of the Past: The Castle of Shadows Echoes of the Past: The Citadels of Time Empress of the Deep 2: Song of the Blue Whale Empress of the Deep: The Darkest Secret ESET Online Scanner v3 Fab Fashion Farm Frenzy – Pizza Party! FATE - The Traitor Soul GPBaseService2 Hallowed Legends: Samhain Heroes Of Hellas Heroes of Hellas 3: Athens Hidden Mysteries - White House HPAppStudio HPPhotoGadget HPProductAssistant Ipswitch WS_FTP LE Java Auto Updater Java™ 6 Update 22 Jewel Quest: The Sleepless Star - Collector's Edition Jigs@w Puzzle 2 Jigsaw World Jojo's Fashion Show Legends of Dreams Love Chronicles: The Sword and The Rose Luxor Adventures Luxor HD Luxor: 5th Passage Macabre Mysteries: Curse of the Nightingale Mahjong Journey of Enlightenment Mahjong World Malwarebytes' Anti-Malware version 1.51.2.1300 MarketResearch Microsoft Office 2010 Microsoft Office Click-to-Run 2010 Microsoft Office Starter 2010 - English Microsoft Primary Interoperability Assemblies 2005 Microsoft Silverlight Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Mozilla Firefox (3.6.24) My Kingdom for the Princess My Kingdom for the Princess II My Kingdom for the Princess III Mythic Pearls: The Legend of Tirnanog OpenOffice.org 3.3 Opera Penguins! Plants vs. Zombies - Game of the Year PlayReady PC Runtime x86 Polar Bowler Potion Bar Princess Isabella: Return of the Curse PS_AIO_07_D110_SW_Min QuickTransfer Ranch Rush Realtek Ethernet Controller Driver Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Royal Envoy Samantha Swift - Adventure Bundle Samantha Swift and the Mystery from Atlantis Samantha Swift Fountains of Fate Scan Scepter of Ra SeaMonkey (2.5) Secrets of the Dark: Temple of Night SolutionCenter Sparkle Spirits of Mystery: Amber Maiden Status Super GameHouse Solitaire The Curse Of Montezuma The Rise Of Atlantis The Sultan's Labyrinth The Sultan's Labyrinth: A Royal Sacrifice Tom Clancy's Splinter Cell Toolbox TOSHIBA Assist Toshiba Book Place TOSHIBA Hardware Setup Toshiba Laptop Checkup TOSHIBA Media Controller TOSHIBA Media Controller Plug-in TOSHIBA Recovery Media Creator TOSHIBA ReelTime TOSHIBA Resolution+ Plug-in for Windows Media Player TOSHIBA Service Station TOSHIBA Sleep Utility TOSHIBA Supervisor Password TOSHIBA Value Added Package TOSHIBA Web Camera Application TOSHIBA Wireless LAN Indicator TrayApp Treasure Masters, Inc. Trial of the Gods: Ariadne's Fate Turbo Fiesta Turbo Pizza Turbo Subs Update Installer for WildTangent Games App Vampire Brides: Love Over Death VideoLAN VLC media player 0.8.6f Visual Studio 2008 x64 Redistributables VIVA MEDIA GAME CENTER WebReg WildTangent Games WildTangent Games App (Toshiba Games) Winamp Winamp Detector Plug-in Windows Live Mesh ActiveX Control for Remote Connections Word Search Deluxe WordPerfect Family Pack 4 World Mosaics Yahoo! Messenger Zuma's Revenge Zuma's Revenge - Adventure . ==== Event Viewer Messages From Past Week ======== . 12/18/2011 4:20:03 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WdiSystemHost service. 12/18/2011 4:20:03 AM, Error: Service Control Manager [7000] - The Diagnostic System Host service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 12/18/2011 11:29:54 AM, Error: Service Control Manager [7034] - The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s). 12/18/2011 11:28:21 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 12/18/2011 11:28:13 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143. 12/18/2011 11:27:21 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. 12/18/2011 11:27:21 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed. 12/18/2011 11:27:21 AM, Error: Service Control Manager [7003] - The Internet Connection Sharing (ICS) service depends the following service: BFE. This service might not be installed. 12/18/2011 11:27:21 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. 12/18/2011 11:26:27 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service. 12/18/2011 11:25:57 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service. 12/18/2011 11:25:29 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 12/18/2011 11:25:27 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service. 12/18/2011 11:19:27 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wudfsvc service. 12/18/2011 11:18:57 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AudioEndpointBuilder service. 12/18/2011 11:17:54 AM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. 12/18/2011 11:17:27 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the UxSms service. 12/18/2011 11:16:27 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service. 12/18/2011 11:15:27 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service. 12/18/2011 11:14:27 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the PcaSvc service. 12/17/2011 10:38:12 PM, Error: Service Control Manager [7034] - The hpqcxs08 service terminated unexpectedly. It has done this 1 time(s). 12/17/2011 10:38:12 PM, Error: Service Control Manager [7034] - The HP CUE DeviceDiscovery Service service terminated unexpectedly. It has done this 1 time(s). 12/17/2011 1:35:02 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Installer service, but this action failed with the following error: An instance of the service is already running. 12/17/2011 1:32:02 PM, Error: Service Control Manager [7034] - The Volume Shadow Copy service terminated unexpectedly. It has done this 1 time(s). 12/17/2011 1:30:02 PM, Error: Service Control Manager [7031] - The Windows Installer service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service. 12/17/2011 1:24:36 PM, Error: Service Control Manager [7031] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/16/2011 7:56:05 PM, Error: Service Control Manager [7034] - The TPCH Service service terminated unexpectedly. It has done this 1 time(s). 12/16/2011 7:54:47 PM, Error: Service Control Manager [7034] - The Toshiba Laptop Checkup Application Launcher service terminated unexpectedly. It has done this 1 time(s). 12/16/2011 7:53:16 PM, Error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service. 12/16/2011 7:52:55 PM, Error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service. 12/16/2011 7:52:27 PM, Error: Service Control Manager [7031] - The Common Client Job Manager Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 12/16/2011 7:22:30 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1. 12/16/2011 10:50:44 AM, Error: Microsoft Antimalware [3002] - 12/15/2011 1:43:16 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file. 12/14/2011 2:24:07 PM, Error: Service Control Manager [7034] - The TPCH Service service terminated unexpectedly. It has done this 2 time(s). 12/13/2011 8:51:46 PM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start. 12/13/2011 8:50:13 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start. 12/13/2011 8:50:05 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 12/13/2011 8:50:03 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\windows\system32\athihvs.dll Error Code: 21 12/13/2011 8:49:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 12/13/2011 8:49:46 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx64 Avgmfx64 discache spldr Wanarpv6 12/13/2011 8:49:44 PM, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start. 12/13/2011 8:49:43 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 12/13/2011 8:29:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 12/13/2011 2:32:48 PM, Error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 3 time(s). 12/12/2011 12:39:09 AM, Error: Service Control Manager [7034] - The TPCH Service service terminated unexpectedly. It has done this 7 time(s). 12/12/2011 12:38:40 AM, Error: Service Control Manager [7034] - The Amazon Download Agent service terminated unexpectedly. It has done this 2 time(s). . ==== End Of File ===========================

OTL logfile created on: 12/18/2011 9:06:34 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\laptop\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.48 Gb Total Physical Memory | 1.46 Gb Available Physical Memory | 41.97% Memory free
6.96 Gb Paging File | 4.29 Gb Available in Paging File | 61.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 581.37 Gb Total Space | 477.49 Gb Free Space | 82.13% Space Free | Partition Type: NTFS

Computer Name: LAPTOP-PC | User Name: laptop | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\laptop\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft, Inc.)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Corel\WordPerfect Family Pack 4\Programs\wpwin10.exe (Corel Corporation Limited)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\Winamp\System\aacdec.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\jnetlib.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\auth.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_ipod.dll ()
MOD - C:\Program Files (x86)\Winamp\System\jpeg.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_p4s.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_wifi.dll ()
MOD - C:\Program Files (x86)\Winamp\System\png.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\xml.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\playlist.w5s ()
MOD - C:\Program Files (x86)\Winamp\tataki.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_android.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_usb.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_ds.dll ()
MOD - C:\Program Files (x86)\Winamp\zlib.dll ()
MOD - C:\Program Files (x86)\Winamp\System\devices.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\timer.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\albumart.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_disk.dll ()
MOD - C:\Program Files (x86)\Winamp\System\tagz.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_njb.dll ()
MOD - C:\Program Files (x86)\Winamp\System\gif.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\bmp.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\System\dlmgr.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gracenote.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\filereader.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\primo.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ff.dll ()
MOD - C:\Program Files (x86)\Winamp\nsutil.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wm.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ml.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_local.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp3.dll ()
MOD - C:\Program Files (x86)\Winamp\libsndfile.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_devices.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_pmp.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_disc.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_jumpex.dll ()
MOD - C:\Program Files (x86)\Winamp\libmp4v2.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_online.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_midi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_cdda.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_plg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_playlists.dll ()
MOD - C:\Program Files (x86)\Winamp\nde.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_nsv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_dshow.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_avi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flac.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_impex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_orgler.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_history.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp4.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mkv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_rg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_transcode.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_autotag.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_bookmarks.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_hotkeys.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_tray.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_swf.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_linein.dll ()
MOD - C:\Program Files (x86)\Yahoo!\Messenger\yui.dll ()
MOD - C:\Program Files (x86)\Yahoo!\Messenger\pcre.dll ()
MOD - C:\Program Files (x86)\Corel\WordPerfect Family Pack 4\Programs\axcntrls.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (TOSHIBA eco Utility Service) – C:\Program Files\TOSHIBA\TECO\TecoService.exe (TOSHIBA Corporation)
SRV:64bit: - (TPCHSrv) – C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TODDSrv) – C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (GFNEXSrv) – C:\Windows\SysNative\GFNEXSrv.exe ()
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (TMachInfo) – C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (Amazon Download Agent) – C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe (Amazon.com)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (PGEffect) – C:\Windows\SysNative\drivers\PGEffect.sys (TOSHIBA Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Tosrfusb) – C:\Windows\SysNative\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (BtFilter) – C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (tosrfec) – C:\Windows\SysNative\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (tdcmdpst) – C:\Windows\SysNative\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (TVALZFL) – C:\Windows\SysNative\drivers\TVALZFL.sys (TOSHIBA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.toshiba.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_0_1.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/17 12:12:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/11/30 12:08:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.5\extensions\\Components: C:\Program Files (x86)\SeaMonkey\components [2011/12/16 04:11:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.5\extensions\\Plugins: C:\Program Files (x86)\SeaMonkey\plugins

[2011/08/26 05:01:46 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\Extensions
[2011/12/18 18:16:15 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions
[2011/08/27 16:43:38 | 000,000,000 | —D | M] (Ad blocker) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
[2011/12/17 12:12:30 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/09/30 18:30:33 | 000,000,000 | —D | M] (Webmail Ad Blocker) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\[removed]
[2011/10/07 21:02:14 | 000,000,000 | —D | M] (Read It Later) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\[removed]
[2011/12/16 04:11:40 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\SeaMonkey\Profiles\bvn00hqz.default\extensions
[2011/12/18 18:16:15 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/12/14 00:54:27 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
[2011/11/30 12:08:07 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/07/11 16:48:12 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}

O1 HOSTS File: ([2011/12/18 11:27:32 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\Toshiba\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe (Amazon.com)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - %SystemRoot%\System32\winrnr.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A0273F09-A733-49EC-9049-CD0F840D449E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C3B9C6DE-557E-4619-A4F6-39D3E6ECB09A}: DhcpNameServer = [removed] [removed]
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/18 21:05:38 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\laptop\Desktop\OTL.exe
[2011/12/18 17:52:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Security Client
[2011/12/18 17:52:37 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/12/18 11:27:51 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/12/18 11:05:51 | 001,163,104 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Users\laptop\Desktop\avg_remover_stf_x86_2011_1322.exe
[2011/12/17 12:17:09 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\QuickScan
[2011/12/16 11:10:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2011/12/16 11:10:04 | 002,322,184 | —- | C] (ESET) – C:\Users\laptop\Desktop\esetsmartinstaller_enu.exe
[2011/12/16 04:11:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SeaMonkey
[2011/12/16 04:11:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\SeaMonkey
[2011/12/16 03:32:54 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Disruptive Innovations SARL
[2011/12/16 03:32:54 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Local\Disruptive Innovations SARL
[2011/12/16 03:32:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueGriffon
[2011/12/16 03:32:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\BlueGriffon
[2011/12/16 02:47:06 | 000,000,000 | —D | C] – C:\ProgramData\Blumentals
[2011/12/16 00:44:42 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/15 20:57:00 | 004,342,882 | R— | C] (Swearware) – C:\Users\laptop\Desktop\ComboFix.exe
[2011/12/15 15:12:11 | 000,518,144 | —- | C] (SteelWerX) – C:\windows\SWREG.exe
[2011/12/15 15:12:11 | 000,406,528 | —- | C] (SteelWerX) – C:\windows\SWSC.exe
[2011/12/15 15:12:11 | 000,060,416 | —- | C] (NirSoft) – C:\windows\NIRCMD.exe
[2011/12/15 15:11:45 | 000,000,000 | —D | C] – C:\windows\ERDNT
[2011/12/15 15:11:39 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/15 13:54:48 | 000,000,000 | —D | C] – C:\Users\laptop\Desktop\tdsskiller
[2011/12/15 13:47:31 | 000,000,000 | —D | C] – C:\Users\laptop\Desktop\gmer
[2011/12/13 22:46:39 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/13 22:46:07 | 000,607,260 | R— | C] (Swearware) – C:\Users\laptop\Desktop\dds.scr
[2011/12/13 18:01:15 | 000,000,000 | —D | C] – C:\ProgramData\AVG2012
[2011/12/13 18:00:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVG
[2011/12/13 17:50:16 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2011/12/13 17:49:48 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2011/12/13 14:45:38 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Malwarebytes
[2011/12/13 14:44:51 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/12/13 14:44:48 | 000,025,416 | —- | C] (Malwarebytes Corporation) – C:\windows\SysNative\drivers\mbam.sys
[2011/12/13 14:44:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/12/03 23:36:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition
[2011/12/03 18:49:57 | 000,000,000 | —D | C] – C:\ProgramData\Playrix Entertainment
[2011/12/03 18:33:20 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\My Games
[2011/12/03 17:42:59 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\MumboJumbo
[2011/12/03 17:21:27 | 000,000,000 | —D | C] – C:\ProgramData\TERMINAL Studio
[2011/12/03 12:45:35 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Local\Tific
[2011/12/03 11:17:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor Adventures
[2011/12/03 11:17:05 | 000,057,344 | —- | C] (Reflexive) – C:\windows\SysWow64\Big Kahuna Reef.scr
[2011/12/03 11:17:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Big Kahuna Reef
[2011/12/03 11:02:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\Double Play Jewel Quest 2 and 3
[2011/12/03 10:55:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Royal Envoy
[2011/12/03 10:42:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Samantha Swift and the Mystery from Atlantis
[2011/12/03 10:26:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Big Kahuna Reef 2
[2011/12/03 10:25:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\The Rise Of Atlantis
[2011/12/03 10:23:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Sky Kingdoms
[2011/12/03 10:20:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\Heroes Of Hellas
[2011/12/03 10:19:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Call Of Atlantis
[2011/12/03 10:13:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Atlantis Quest
[2011/12/03 10:11:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor HD
[2011/12/03 10:10:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Samantha Swift Fountains of Fate
[2011/12/03 09:52:45 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\Amazon Downloads
[2011/12/03 09:52:40 | 000,000,000 | —D | C] – C:\ProgramData\Amazon
[2011/12/03 09:52:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2011/12/03 09:52:33 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Amazon Games & Software
[2011/12/03 09:52:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Amazon
[2011/12/02 23:34:22 | 000,000,000 | —D | C] – C:\ProgramData\Fugazo
[2011/12/02 16:57:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mythic Pearls - The Legend of Tirnanog
[2011/12/02 16:53:49 | 000,000,000 | —D | C] – C:\ProgramData\Intenium
[2011/12/02 16:45:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor - 5th Passage
[2011/11/30 12:10:59 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\OpenOffice.org
[2011/11/30 12:09:48 | 000,000,000 | –SD | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011/11/30 12:08:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\OpenOffice.org 3
[2011/11/30 12:08:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2011/11/30 12:08:17 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\windows\SysWow64\javaws.exe
[2011/11/30 12:08:17 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\SysWow64\javaw.exe
[2011/11/30 12:08:17 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\SysWow64\java.exe
[2011/11/30 12:08:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2011/11/30 11:31:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe
[2011/11/27 19:04:22 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Oberon Games
[2011/11/19 22:42:26 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Fuzzy Games
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/18 21:05:43 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\laptop\Desktop\OTL.exe
[2011/12/18 19:24:01 | 000,095,744 | —- | M] () – C:\Users\laptop\Desktop\SystemLook_x64.exe
[2011/12/18 18:23:17 | 000,024,400 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/18 18:23:17 | 000,024,400 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/18 18:20:40 | 000,688,904 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2011/12/18 18:20:40 | 000,596,860 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2011/12/18 18:20:40 | 000,097,834 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2011/12/18 18:15:06 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2011/12/18 18:15:01 | 2801,418,240 | -HS- | M] () – C:\hiberfil.sys
[2011/12/18 17:52:58 | 000,001,945 | —- | M] () – C:\windows\epplauncher.mif
[2011/12/18 17:52:47 | 000,702,750 | —- | M] () – C:\windows\SysWow64\PerfStringBackup.INI
[2011/12/18 11:27:32 | 000,000,027 | —- | M] () – C:\windows\SysNative\drivers\etc\hosts
[2011/12/18 11:05:52 | 001,163,104 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Users\laptop\Desktop\avg_remover_stf_x86_2011_1322.exe
[2011/12/18 04:21:40 | 000,007,609 | —- | M] () – C:\Users\laptop\AppData\Local\Resmon.ResmonCfg
[2011/12/17 22:39:02 | 004,342,882 | R— | M] (Swearware) – C:\Users\laptop\Desktop\ComboFix.exe
[2011/12/16 15:10:58 | 000,458,240 | —- | M] () – C:\Users\laptop\Desktop\CKScanner.exe
[2011/12/16 15:10:36 | 000,458,240 | —- | M] () – C:\Users\laptop\Desktop\CKScanner.exe.part
[2011/12/16 14:43:19 | 000,004,540 | —- | M] () – C:\Users\laptop\Desktop\avg scan.csv
[2011/12/16 11:10:24 | 002,322,184 | —- | M] (ESET) – C:\Users\laptop\Desktop\esetsmartinstaller_enu.exe
[2011/12/15 16:06:50 | 000,139,264 | —- | M] () – C:\Users\laptop\Desktop\SystemLook.exe
[2011/12/13 22:46:10 | 000,607,260 | R— | M] (Swearware) – C:\Users\laptop\Desktop\dds.scr
[2011/12/13 15:38:56 | 000,458,752 | —- | M] () – C:\windows\SysNative\Ikeext.etl
[2011/12/13 14:31:42 | 000,005,770 | -HS- | M] () – C:\Users\laptop\AppData\Local\222620n4p360q763c457a6gir7g0
[2011/12/13 14:31:42 | 000,005,770 | -HS- | M] () – C:\ProgramData\222620n4p360q763c457a6gir7g0
[2011/12/05 18:49:43 | 000,000,000 | -H– | M] () – C:\windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/12/03 00:10:11 | 000,372,016 | —- | M] () – C:\windows\SysNative\FNTCACHE.DAT
[2011/11/30 12:08:07 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\windows\SysWow64\deployJava1.dll
[2011/11/30 12:08:07 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\windows\SysWow64\javaws.exe
[2011/11/30 12:08:07 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\windows\SysWow64\javaw.exe
[2011/11/30 12:08:07 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\windows\SysWow64\java.exe
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/18 19:24:00 | 000,095,744 | —- | C] () – C:\Users\laptop\Desktop\SystemLook_x64.exe
[2011/12/18 17:52:40 | 000,001,908 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/12/16 15:10:34 | 000,458,240 | —- | C] () – C:\Users\laptop\Desktop\CKScanner.exe
[2011/12/16 15:10:31 | 000,458,240 | —- | C] () – C:\Users\laptop\Desktop\CKScanner.exe.part
[2011/12/16 14:43:19 | 000,004,540 | —- | C] () – C:\Users\laptop\Desktop\avg scan.csv
[2011/12/16 10:42:34 | 000,001,945 | —- | C] () – C:\windows\epplauncher.mif
[2011/12/15 16:06:49 | 000,139,264 | —- | C] () – C:\Users\laptop\Desktop\SystemLook.exe
[2011/12/15 15:12:11 | 000,256,000 | —- | C] () – C:\windows\PEV.exe
[2011/12/15 15:12:11 | 000,208,896 | —- | C] () – C:\windows\MBR.exe
[2011/12/15 15:12:11 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2011/12/15 15:12:11 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2011/12/15 15:12:11 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2011/12/13 17:39:17 | 000,007,609 | —- | C] () – C:\Users\laptop\AppData\Local\Resmon.ResmonCfg
[2011/12/13 13:28:37 | 000,005,770 | -HS- | C] () – C:\Users\laptop\AppData\Local\222620n4p360q763c457a6gir7g0
[2011/12/13 13:28:37 | 000,005,770 | -HS- | C] () – C:\ProgramData\222620n4p360q763c457a6gir7g0
[2011/12/05 18:49:43 | 000,000,000 | -H– | C] () – C:\windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/11/30 11:32:03 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/10/16 04:05:33 | 000,002,951 | —- | C] () – C:\windows\SysWow64\settings.bin
[2011/10/16 02:05:51 | 000,702,750 | —- | C] () – C:\windows\SysWow64\PerfStringBackup.INI
[2011/10/15 22:24:50 | 000,007,112 | —- | C] () – C:\windows\mozver.dat
[2011/10/15 00:29:35 | 000,000,335 | —- | C] () – C:\windows\nsreg.dat
[2011/10/11 22:54:25 | 000,004,096 | —- | C] () – C:\windows\d3dx.dat
[2011/10/10 20:35:44 | 000,000,574 | —- | C] () – C:\windows\hpomdl46.dat.temp
[2011/09/14 11:06:40 | 000,207,034 | —- | C] () – C:\windows\hpoins46.dat
[2011/09/05 22:44:51 | 000,000,000 | —- | C] () – C:\windows\ativpsrm.bin
[2011/09/05 22:37:34 | 000,003,929 | —- | C] () – C:\windows\SysWow64\atipblag.dat
[2011/08/25 12:38:12 | 000,061,678 | —- | C] () – C:\Users\laptop\AppData\Roaming\PFP100JPR.{PB
[2011/08/25 12:38:12 | 000,012,358 | —- | C] () – C:\Users\laptop\AppData\Roaming\PFP100JCM.{PB
[2011/08/25 11:57:18 | 000,000,420 | —- | C] () – C:\windows\PowerReg.dat
[2011/08/24 11:58:34 | 000,128,312 | —- | C] () – C:\windows\SysWow64\GFNEX.dll
[2011/02/03 21:56:58 | 000,066,856 | —- | C] () – C:\windows\SysWow64\SynTPEnhPS.dll
[2010/03/31 19:34:36 | 000,000,574 | —- | C] () – C:\windows\hpomdl46.dat
[2009/07/14 00:38:36 | 000,067,584 | –S- | C] () – C:\windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | —- | C] () – C:\windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | —- | C] () – C:\windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | —- | C] () – C:\windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | —- | C] () – C:\windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/10/09 16:56:41 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Anabel
[2011/11/02 08:26:46 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Big Fish Games
[2011/12/02 22:27:16 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Blue Tea Games
[2011/11/09 22:08:51 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Boomzap
[2011/11/10 06:39:07 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Casual Box
[2011/11/03 21:35:25 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\ChaYoWo Games
[2011/10/14 19:43:25 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\CursedOnboard
[2011/10/22 02:44:49 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\DarkParablesBriarRoseSE_BFG
[2011/12/16 03:32:54 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Disruptive Innovations SARL
[2011/11/10 02:54:51 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\EleFun Games
[2011/11/16 15:33:10 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Elephant Games
[2011/11/09 21:55:50 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Enki Games
[2011/11/07 23:04:21 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Enlightenus
[2011/11/10 02:10:22 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\ERS Game Studios
[2011/11/08 14:36:08 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\FirstColony
[2011/11/10 00:53:14 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\ForgottenRiddles
[2011/10/30 03:55:31 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Friday's games
[2011/11/19 22:42:26 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Fuzzy Games
[2011/08/27 16:47:04 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Gamelab
[2011/08/27 15:25:54 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\GameMill
[2011/11/10 07:53:33 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Gamers Digital
[2011/11/09 21:29:35 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\GAMGO
[2011/11/07 03:36:45 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Genimo
[2011/10/12 01:46:52 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Gogii
[2011/11/16 15:23:16 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\HdO Adventure
[2011/11/10 04:49:45 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\In search of the Lost Temple
[2011/11/03 01:26:45 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\JaiboGames
[2011/11/06 08:55:47 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\MumboJumbo
[2011/10/15 22:20:26 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Netscape
[2011/11/30 00:03:28 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Oberon Games
[2011/11/30 12:10:59 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\OpenOffice.org
[2011/11/03 18:08:42 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Orneon
[2011/10/09 20:32:29 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Peace Craft
[2011/10/23 19:36:27 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\PeaceCraft2
[2011/10/30 21:47:22 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\PeaceCraft3
[2011/11/10 01:01:17 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\PlayFirst
[2011/12/17 12:17:18 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\QuickScan
[2011/11/03 20:09:15 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Silverback Productions
[2011/12/08 13:21:49 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\SoftGrid Client
[2011/11/10 23:07:26 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\SultansLabyrinth
[2011/09/05 22:17:06 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Tific
[2011/11/23 17:21:32 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Toshiba
[2011/10/16 02:06:48 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\TP
[2011/11/09 06:32:19 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\UClick
[2011/11/08 22:40:04 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\VendelGAMES
[2011/10/14 17:20:36 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\ViquaSoft
[2011/08/24 12:38:07 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\WinBatch
[2009/07/14 00:08:49 | 000,016,194 | —- | M] () – C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:11E79CC9
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:4AA2F6A9
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:0C988F7D
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:58A2C544
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:1A5207FA
@Alternate Data Stream - 241 bytes -> C:\ProgramData\TEMP:AAA06E15
@Alternate Data Stream - 241 bytes -> C:\ProgramData\TEMP:8AE92FD3
@Alternate Data Stream - 239 bytes -> C:\ProgramData\TEMP:E5BA9ADD
@Alternate Data Stream - 238 bytes -> C:\ProgramData\TEMP:689E7F7D
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:D667795F
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:38FF076E
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:D6D084A5
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:BEE39E9B
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:7A032A04
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP:6F0B6A5A
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:9033BDFB
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:D8134D8F
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:3BF63E4A
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:D2397415
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:BCFEA004
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:E87AB4E3
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:A9056F42
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:1ECED34B
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:4F96D8E6
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:F072AFAF
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:6677D85A
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:E5D4F1EB
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:96AFAB10
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:102394C6
@Alternate Data Stream - 205 bytes -> C:\ProgramData\TEMP:6B50A605
@Alternate Data Stream - 205 bytes -> C:\ProgramData\TEMP:51F17BB8
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:50636E35
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:8F4E260C
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:10D98D98
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:B0B6888E
@Alternate Data Stream - 173 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 164 bytes -> C:\ProgramData\TEMP:FD7016C1
@Alternate Data Stream - 155 bytes -> C:\ProgramData\TEMP:402839DE
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:AECF4772
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:4A8EB1C4
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:4C35C064
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:678C1866
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:9812B773
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:378824DE
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0E67073E
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5E73E1C2
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:895A78C5
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:9F3CEEE6
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:2AE74FF9
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:5E9B629B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:56C66609
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0A74923C
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:41289DF0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:2211E7A0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:18A6D2CC
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:E6708F08
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:996104FC
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:D5BF78B4
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:1297FF3C
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:F81E7082
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:ED194880
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:D4D38596
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:943E8182
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:68B61847
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:C0A9B815
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:8836A712
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:8DD20B4A
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:F422F8F1
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:ECC979BD
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:6C5EC3CD
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:F0A06891
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:E0888117
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:DD6F157A
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:D507AEDA
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:B42826C8
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:6017A808
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:331B76C7
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:3313A48D
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:969C0C96
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:6BF0805F
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:4A1628E5

< End of report >

OTL Extras logfile created on: 12/18/2011 9:06:34 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\laptop\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.48 Gb Total Physical Memory | 1.46 Gb Available Physical Memory | 41.97% Memory free
6.96 Gb Paging File | 4.29 Gb Available in Paging File | 61.65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 581.37 Gb Total Space | 477.49 Gb Free Space | 82.13% Space Free | Partition Type: NTFS

Computer Name: LAPTOP-PC | User Name: laptop | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
.url[@ = InternetShortcut] – C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Key error.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1
http [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files (x86)\Internet Explorer\iexplore.exe" %1
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Key error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{48C0866E-57EB-444C-8371-8E4321066BC3}" = Network64
"{4ACA5AE7-E68C-5A48-F8E6-D67946267506}" = ATI Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{6316805C-2485-2FF5-974C-750E3BE1DF65}" = AMD Media Foundation Decoders
"{65486209-5C54-439C-8383-8AC9BBE25932}" = Atheros Bluetooth Filter Driver Package
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6FF9A012-0254-41E9-81E2-F538C4B53611}" = TOSHIBA eco Utility
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}" = TOSHIBA PC Health Monitor
"{9F455BA4-BAFB-AE04-2537-1CFC94FE400A}" = ATI Catalyst Install Manager
"{A34D9B7F-8453-DA02-DC98-EEEE085411C6}" = ccc-utility64
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{C788B026-20BD-4E96-B698-533F1D6C5013}" = 64 Bit HP CIO Components Installer
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DBC1DE57-B55A-4D57-9769-1DB9BE506AF7}" = HP Photosmart D110 All-In-One Driver Software 14.0 Rel. 7
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"Microsoft Security Client" = Microsoft Security Essentials
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0146E330-EEE7-B924-B347-B399460893ED}" = CCC Help Czech
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{09927C92-A652-057A-3A7B-153F23175C58}" = CCC Help Dutch
"{109CBCC5-7151-1CC6-DAD6-6F7DD3162A8A}" = Catalyst Control Center InstallProxy
"{119826A8-4EF6-4BE5-A88B-D2D81FA7CEE2}" = TOSHIBA Supervisor Password
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{15A160C8-124E-481F-BBBB-66218A95F6E1}" = Ancient Mysteries
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19E40731-8E1A-07FB-DA7D-8A54603F6408}" = CCC Help English
"{1B97813D-74A7-25EB-4837-792413507E82}" = CCC Help Danish
"{1CF94211-A7BB-8151-44B8-6618C5A162F8}" = CCC Help Portuguese
"{1D7FEEAC-6CEE-5B5F-A8B0-9BE7A6BCB7FB}" = CCC Help Chinese Traditional
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{247E03D2-485B-7A70-BF5C-AB9BDF6AFB44}" = CCC Help Polish
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2C303EE0-A595-3543-A71A-931C7AC40EDE}" = Microsoft Primary Interoperability Assemblies 2005
"{2EEFB3C4-4706-C2B5-DF69-CF914D87BCE4}" = CCC Help Swedish
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{2FD5D2C5-A7A1-4065-89BA-90542BF7CCD3}" = TOSHIBA Hardware Setup
"{337FDED7-D27B-E476-E888-3674E1C01C69}" = CCC Help Spanish
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{42BBA4CC-EFB6-4653-A2CC-F305D4B399C3}" = PS_AIO_07_D110_SW_Min
"{4485C9D0-A742-F1BB-C0B0-58FC61960D99}" = CCC Help Korean
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}" = Status
"{5BA99779-6E12-49EF-BE49-F35B1EDB4DF9}" = TOSHIBA Wireless LAN Indicator
"{654F7484-88C5-46DC-AB32-C66BCB0E2102}" = TOSHIBA Sleep Utility
"{666E35A7-A224-E3E9-48C2-C641837535D9}" = Catalyst Control Center Localization All
"{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}" = TOSHIBA Resolution+ Plug-in for Windows Media Player
"{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}" = TOSHIBA Web Camera Application
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-toshiba" = WildTangent Games App (Toshiba Games)
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{8064A378-46F4-4A4E-8AF5-153D0D4018DD}" = Catalyst Control Center - Branding
"{83601916-2E71-F1C7-EE5F-A1C985BC9217}" = CCC Help German
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A34A135-D405-DD03-9B2E-0EB99238A312}" = CCC Help Finnish
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{91D3AD6F-09CD-4695-9FA3-8FB15429BE97}" = D110
"{92C7DC44-DAD3-49FE-B89B-F92C6BA9A331}" = Toshiba Book Place
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9550EA6C-4CBE-C1F3-1E1C-5E87F2C645ED}" = CCC Help French
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{97F67013-3076-4261-DC10-808409655042}" = AMD VISION Engine Control Center
"{986BB897-C295-2FED-8DCA-4ADE3AFCEF84}" = CCC Help Russian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A4FF8F4E-D665-712B-07EE-F03ED360E9BE}" = CCC Help Italian
"{A9015334-10BE-4D64-A776-203336EFE806}_is1" = BlueGriffon version 1.3.1
"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{ADB50F70-98FF-067F-DF39-47DD83E32D58}" = CCC Help Chinese Standard
"{B3A31EEE-7C65-4EE6-BB0D-5549FD2D67B9}" = Ipswitch WS_FTP LE
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
"{B83FCE14-53D5-CBF8-87E9-59B8968ADB4C}" = CCC Help Norwegian
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BC5DD87B-0143-4D14-AAE6-97109614DC6B}" = SolutionCenter
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}" = TOSHIBA Assist
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C78E3449-4F24-839B-5F7A-6911C67A5BE9}" = Catalyst Control Center Graphics Previews Common
"{C7A4F26F-F9B0-41B2-8659-99181108CDE3}" = TOSHIBA Media Controller
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CCF100B8-A2FB-41AE-BB9C-86EEF3699114}" = WordPerfect Family Pack 4
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D6E90970-BA9C-51AA-EFA2-9F80A7AE0956}" = CCC Help Thai
"{D826A52E-0AC9-5A55-61B8-0E088477A1B0}" = CCC Help Greek
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E69540AC-FFC3-5519-F925-5ACC8D20DED5}" = CCC Help Hungarian
"{E9D96BD5-7D33-7ED3-0A8E-229FA2524487}" = CCC Help Turkish
"{F0C8BC0A-B0E7-4F39-848C-C5B06021B702}" = Hidden Mysteries - White House
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}" = TOSHIBA Media Controller Plug-in
"{F931F27F-A967-982A-9226-494787D5FBBB}" = CCC Help Japanese
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon Games & Software Downloader_is1" = Amazon Games & Software Downloader
"am-samanthaswiftadventurebundle" = Samantha Swift - Adventure Bundle
"am-supergamehousesolitaire" = Super GameHouse Solitaire
"BFG-Atlantis" = Atlantis
"BFG-Bricks of Atlantis" = Bricks of Atlantis
"BFG-Bricks of Egypt 2" = Bricks of Egypt 2
"BFGC" = Big Fish Games: Game Manager
"BFG-Coffee Rush" = Coffee Rush
"BFG-Dark Parables - Curse of Briar Rose" = Dark Parables: Curse of Briar Rose
"BFG-Dark Parables - Rise of the Snow Queen Collector's Edition" = Dark Parables: Rise of the Snow Queen Collector's Edition
"BFG-Dark Parables - The Exiled Prince" = Dark Parables: The Exiled Prince
"BFG-Dream Day Honeymoon" = Dream Day Honeymoon
"BFG-Dream Day Wedding" = Dream Day Wedding
"BFG-Dream Day Wedding - Married in Manhattan" = Dream Day Wedding: Married in Manhattan
"BFG-Dream Day Wedding - Viva Las Vegas" = Dream Day Wedding: Viva Las Vegas
"BFG-Echoes of the Past - Royal House of Stone" = Echoes of the Past: Royal House of Stone
"BFG-Echoes of the Past - The Castle of Shadows" = Echoes of the Past: The Castle of Shadows
"BFG-Echoes of the Past - The Citadels of Time" = Echoes of the Past: The Citadels of Time
"BFG-Empress of the Deep - The Darkest Secret" = Empress of the Deep: The Darkest Secret
"BFG-Empress of the Deep 2 - Song of the Blue Whale" = Empress of the Deep 2: Song of the Blue Whale
"BFG-Fab Fashion" = Fab Fashion
"BFG-Hallowed Legends - Samhain" = Hallowed Legends: Samhain
"BFG-Heroes of Hellas 3 - Athens" = Heroes of Hellas 3: Athens
"BFG-Jigs@w Puzzle 2" = Jigs@w Puzzle 2
"BFG-Jigsaw World" = Jigsaw World
"BFG-Jojo's Fashion Show" = Jojo's Fashion Show
"BFG-Love Chronicles - The Sword and The Rose" = Love Chronicles: The Sword and The Rose
"BFG-Luxor - 5th Passage" = Luxor: 5th Passage
"BFG-Macabre Mysteries - Curse of the Nightingale" = Macabre Mysteries: Curse of the Nightingale
"BFG-My Kingdom for the Princess" = My Kingdom for the Princess
"BFG-My Kingdom for the Princess II" = My Kingdom for the Princess II
"BFG-My Kingdom for the Princess III" = My Kingdom for the Princess III
"BFG-Mythic Pearls - The Legend of Tirnanog" = Mythic Pearls: The Legend of Tirnanog
"BFG-Potion Bar" = Potion Bar
"BFG-Princess Isabella - Return of the Curse" = Princess Isabella: Return of the Curse
"BFG-Ranch Rush" = Ranch Rush
"BFG-Secrets of the Dark - Temple of Night" = Secrets of the Dark: Temple of Night
"BFG-Sparkle" = Sparkle
"BFG-Spirits of Mystery - Amber Maiden" = Spirits of Mystery: Amber Maiden
"BFG-Sultan's Labyrinth - A Royal Sacrifice" = The Sultan's Labyrinth: A Royal Sacrifice
"BFG-The Sultans Labyrinth" = The Sultan's Labyrinth
"BFG-Trial of the Gods - Ariadnes Fate" = Trial of the Gods: Ariadne's Fate
"BFG-Turbo Fiesta" = Turbo Fiesta
"BFG-Turbo Pizza" = Turbo Pizza
"BFG-Turbo Subs" = Turbo Subs
"BFG-Vampire Brides - Love Over Death" = Vampire Brides: Love Over Death
"BFG-Word Search Deluxe" = Word Search Deluxe
"BFG-World Mosaics" = World Mosaics
"BFG-Zumas Revenge - Adventure" = Zuma's Revenge - Adventure
"Big Kahuna Reef_is1" = Big Kahuna Reef
"Call of Atlantis" = Call of Atlantis
"Call Of Atlantis_is1" = Call Of Atlantis
"Double Play Jewel Quest 2 and 3_is1" = Double Play Jewel Quest 2 and 3
"ESET Online Scanner" = ESET Online Scanner v3
"Farm Frenzy – Pizza Party!" = Farm Frenzy – Pizza Party!
"Heroes Of Hellas_is1" = Heroes Of Hellas
"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}" = TOSHIBA Web Camera Application
"Legends_0" = Legends of Dreams
"Luxor Adventures_is1" = Luxor Adventures
"Luxor HD_is1" = Luxor HD
"Mahjong Journey of Enlightenment" = Mahjong Journey of Enlightenment
"Mahjong World" = Mahjong World
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Mozilla Firefox (3.6.24)" = Mozilla Firefox (3.6.24)
"NortonPCCheckup" = Toshiba Laptop Checkup
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"Opera" = Opera
"Royal Envoy_is1" = Royal Envoy
"Samantha Swift and the Mystery from Atlantis_is1" = Samantha Swift and the Mystery from Atlantis
"Samantha Swift Fountains of Fate_is1" = Samantha Swift Fountains of Fate
"Scepter of Ra" = Scepter of Ra
"SeaMonkey (2.5)" = SeaMonkey (2.5)
"The Curse Of Montezuma" = The Curse Of Montezuma
"The Rise Of Atlantis_is1" = The Rise Of Atlantis
"Treasure Masters, Inc." = Treasure Masters, Inc.
"VIVAGplayer" = VIVA MEDIA GAME CENTER
"VLC media player" = VideoLAN VLC media player 0.8.6f
"WildTangent toshiba Master Uninstall" = WildTangent Games
"Winamp" = Winamp
"WordPerfect Family Pack 4" = WordPerfect Family Pack 4
"WTA-2021335a-271f-4fbe-abb6-bb806b601301" = Zuma's Revenge
"WTA-2573a631-119c-4ed0-b4ee-fb071cb49ba2" = Chuzzle Deluxe
"WTA-33b8377f-08d0-4464-960d-82ab810bc22a" = Plants vs. Zombies - Game of the Year
"WTA-4fcb0a17-8d53-42bb-b689-cba8128c5208" = Polar Bowler
"WTA-6485e948-ea8b-4dd4-aa07-4bfb08572d72" = Bejeweled 3
"WTA-664b636d-5f53-4a7f-8c77-b5b73c6e9aa6" = Jewel Quest: The Sleepless Star - Collector's Edition
"WTA-6db97751-b22c-4ea3-b405-bab7585df9c9" = Penguins!
"WTA-cda86c59-3c0c-4ad4-bfcb-04cea4ff112e" = FATE - The Traitor Soul
"WTA-d5fdc205-f333-4bba-a13a-50c30832a358" = Tom Clancy's Splinter Cell
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/13/2011 3:04:47 PM | Computer Name = laptop-PC | Source = Application Error | ID = 1000
Description = Faulting application name: plugin-container.exe, version: 1.9.2.4324,
time stamp: 0x4eb2a578 Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000222c2 Faulting
process id: 0x74c Faulting application start time: 0x01ccb9c5914bcdba Faulting application
path: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe Faulting module
path: C:\windows\SysWOW64\ntdll.dll Report Id: 52ec29b9-25bd-11e1-8b1b-e06995c52ae1

Error - 12/13/2011 3:29:11 PM | Computer Name = laptop-PC | Source = Application Error | ID = 1000
Description = Faulting application name: plugin-container.exe, version: 1.9.2.4324,
time stamp: 0x4eb2a578 Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000222c2 Faulting
process id: 0x1b50 Faulting application start time: 0x01ccb9ca291b29c0 Faulting application
path: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe Faulting module
path: C:\windows\SysWOW64\ntdll.dll Report Id: bb6b30da-25c0-11e1-8b1b-e06995c52ae1

Error - 12/13/2011 3:46:50 PM | Computer Name = laptop-PC | Source = Application Error | ID = 1000
Description = Faulting application name: plugin-container.exe, version: 1.9.2.4324,
time stamp: 0x4eb2a578 Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000222c2 Faulting
process id: 0x1710 Faulting application start time: 0x01ccb9ce0e07aaba Faulting application
path: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe Faulting module
path: C:\windows\SysWOW64\ntdll.dll Report Id: 32922301-25c3-11e1-8b1b-e06995c52ae1

Error - 12/13/2011 4:39:56 PM | Computer Name = laptop-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/13/2011 5:14:01 PM | Computer Name = laptop-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/13/2011 9:23:38 PM | Computer Name = laptop-PC | Source = Application Error | ID = 1000
Description = Faulting application name: plugin-container.exe, version: 1.9.2.4324,
time stamp: 0x4eb2a578 Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x000222c2 Faulting
process id: 0x9d0 Faulting application start time: 0x01ccb9dc9b2b8073 Faulting application
path: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe Faulting module
path: C:\windows\SysWOW64\ntdll.dll Report Id: 3fc09aa2-25f2-11e1-9e41-e06995c52ae1

Error - 12/13/2011 9:27:42 PM | Computer Name = laptop-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/13/2011 9:49:56 PM | Computer Name = laptop-PC | Source = System Restore | ID = 8210
Description =

Error - 12/13/2011 9:51:24 PM | Computer Name = laptop-PC | Source = WinMgmt | ID = 10
Description =

Error - 12/13/2011 11:32:20 PM | Computer Name = laptop-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 12/16/2011 11:05:22 AM | Computer Name = laptop-PC | Source = DCOM | ID = 10010
Description =

Error - 12/16/2011 11:05:22 AM | Computer Name = laptop-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

Error - 12/16/2011 11:06:42 AM | Computer Name = laptop-PC | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1060

Error - 12/16/2011 11:06:44 AM | Computer Name = laptop-PC | Source = Service Control Manager | ID = 7003
Description = The IKE and AuthIP IPsec Keying Modules service depends the following
service: BFE. This service might not be installed.

Error - 12/16/2011 11:06:45 AM | Computer Name = laptop-PC | Source = Service Control Manager | ID = 7003
Description = The IPsec Policy Agent service depends the following service: BFE.
This service might not be installed.

Error - 12/16/2011 11:06:46 AM | Computer Name = laptop-PC | Source = Service Control Manager | ID = 7003
Description = The Internet Connection Sharing (ICS) service depends the following
service: BFE. This service might not be installed.

Error - 12/16/2011 11:07:44 AM | Computer Name = laptop-PC | Source = DCOM | ID = 10016
Description =

Error - 12/16/2011 11:07:44 AM | Computer Name = laptop-PC | Source = Service Control Manager | ID = 7024
Description = The HomeGroup Listener service terminated with service-specific error
%%-2147023143.

Error - 12/16/2011 11:50:31 AM | Computer Name = laptop-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 12/16/2011 11:50:44 AM | Computer Name = laptop-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%840


< End of report >