Java Agent AKG and Java Agent AKF [Solved]

Hello:

Two days ago, I ran an Avast Boot-time scan, and it came back positive for "Java Agent AKG" and "Java Agent AKF" in the chest. Subsequent scans came back negative, but a new browser that I downloaded, a 64-bit version of Firefox called "Waterfox" now has a redirect problem. Games are also acting buggy (not sure if virus-caused or not). I had a similar problem before, but this time I have decided to submit a request for help before the issue becomes worse, as it did last time. I did a Hijack This scan and these are the results. I'm not sure if I'm infected now, but I've become suspicious of the new browser, and I'm wondering if the virus has gotten to the rest of the hard drive. I run Vista x64 Service Pack 2.

Please help. Thanks.

Gary.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:48:46 PM, on 1/13/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe
C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\Razer\Naga Epic\NagaEpicSysTray.exe
C:\Windows\SysWOW64\Ctxfihlp.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe
C:\Program Files (x86)\Ideazon\ZEngine\Zboard.exe
C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe
C:\Program Files (x86)\Seagate\DiscWizard\TimounterMonitor.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\SysWOW64\CTXFISPI.EXE
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Gary\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Razer Naga Driver] C:\Program Files (x86)\Razer\Naga Epic\NagaEpicSysTray.exe
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [AmazonGSDownloaderTray] "C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe"
O4 - HKLM\..\Run: [Zboard] C:\Program Files (x86)\Ideazon\ZEngine\Zboard.exe
O4 - HKLM\..\Run: [DiscWizardMonitor.exe] C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files (x86)\Seagate\DiscWizard\TimounterMonitor.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MtdAcqu] "C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe" /s
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [VueMinder] "C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe" 1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: ScreenHunter 5.1 Free.lnk = C:\Program Files (x86)\Wisdom-soft ScreenHunter 5 Free\ScreenHunter.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {483EB14D-AF1C-4951-81B0-4E2B41829FF6} (QOLCheck Control) - https://www.select2perform.com/cabs/QOLCheck.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Amazon Download Agent - Amazon.com - C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - E:\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Seagate Scheduler2 Service (SgtSch2Svc) - Seagate - C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 11547 bytes

Hello Jeff…nice to meet you. Thanks for the reply and for looking into this.

First off, I'm not aware of any script-blocking programs, so just to be safe, I temporarily deactivated avast! just to be sure. First off, here is DDS.txt


.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_30
Run by [removed] at 13:04:24 on 2012-01-15
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4086.2373 [GMT -5:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Google\Update\1.3.21.79\GoogleCrashHandler.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe
C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files (x86)\Razer\Naga Epic\NagaEpicSysTray.exe
C:\Windows\SysWOW64\Ctxfihlp.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe
C:\Windows\SysWOW64\CTXFISPI.EXE
C:\Program Files (x86)\Ideazon\ZEngine\Zboard.exe
C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe
C:\Program Files (x86)\Seagate\DiscWizard\TimounterMonitor.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Common Files\Steam\SteamService.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bing.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll
uRun: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [MtdAcqu] "C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe" /s
uRun: [igndlm.exe] C:\Program Files (x86)\Download Manager\DLM.exe /windowsstart /startifwork
uRun: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [VueMinder] "C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe" 1
mRun: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
mRun: [Razer Naga Driver] C:\Program Files (x86)\Razer\Naga Epic\NagaEpicSysTray.exe
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
mRun: [AmazonGSDownloaderTray] "C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe"
mRun: [Zboard] C:\Program Files (x86)\Ideazon\ZEngine\Zboard.exe
mRun: [DiscWizardMonitor.exe] C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe
mRun: [AcronisTimounterMonitor] C:\Program Files (x86)\Seagate\DiscWizard\TimounterMonitor.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
StartupFolder: C:\Users\Gary\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SCREEN~1.LNK - C:\Program Files (x86)\Wisdom-soft ScreenHunter 5 Free\ScreenHunter.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
Trusted Zone: taleo.net\macys
DPF: {483EB14D-AF1C-4951-81B0-4E2B41829FF6} - hxxps://www.select2perform.com/cabs/QOLCheck.ocx
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{BA4D8439-BEEC-4F64-8BE3-5EB84D713914} : DhcpNameServer = [removed] [removed]
LSA: Authentication Packages = msv1_0 relog_ap
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Winamp Toolbar Loader: {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll
BHO-X64: Winamp Toolbar Loader - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB-X64: Winamp Toolbar: {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll
mRun-x64: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
mRun-x64: [Razer Naga Driver] C:\Program Files (x86)\Razer\Naga Epic\NagaEpicSysTray.exe
mRun-x64: [CTxfiHlp] CTXFIHLP.EXE
mRun-x64: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
mRun-x64: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
mRun-x64: [AmazonGSDownloaderTray] "C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe"
mRun-x64: [Zboard] C:\Program Files (x86)\Ideazon\ZEngine\Zboard.exe
mRun-x64: [DiscWizardMonitor.exe] C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe
mRun-x64: [AcronisTimounterMonitor] C:\Program Files (x86)\Seagate\DiscWizard\TimounterMonitor.exe
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys –> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys –> C:\Windows\system32\drivers\aswSP.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 Amazon Download Agent;Amazon Download Agent;C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2011-1-10 401920]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys –> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys –> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-8-18 44768]
R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-8-19 21504]
R2 SgtSch2Svc;Seagate Scheduler2 Service;C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [2009-10-16 606048]
R2 SSPORT;SSPORT;\??\C:\Windows\system32\Drivers\SSPORT.sys –> C:\Windows\system32\Drivers\SSPORT.sys [?]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdLH6.sys –> C:\Windows\system32\drivers\AtihdLH6.sys [?]
R3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\system32\drivers\CT20XUT.SYS –> C:\Windows\system32\drivers\CT20XUT.SYS [?]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\system32\drivers\CTEXFIFX.SYS –> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
R3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\system32\drivers\CTHWIUT.SYS –> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
R3 RzSynapse;Razer Driver;C:\Windows\system32\DRIVERS\RzSynapse.sys –> C:\Windows\system32\DRIVERS\RzSynapse.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-8-18 136176]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-2-28 183560]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-8-19 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-8-19 79360]
S3 CT20XUT;CT20XUT;C:\Windows\system32\drivers\CT20XUT.SYS –> C:\Windows\system32\drivers\CT20XUT.SYS [?]
S3 CTEXFIFX;CTEXFIFX;C:\Windows\system32\drivers\CTEXFIFX.SYS –> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
S3 CTHWIUT;CTHWIUT;C:\Windows\system32\drivers\CTHWIUT.SYS –> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;E:\Dragon Age\bin_ship\daupdatersvc.service.exe [2011-1-16 25832]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-8-18 136176]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2010-8-19 19968]
S3 Point64;Microsoft IntelliPoint Filter Driver;C:\Windows\system32\DRIVERS\point64k.sys –> C:\Windows\system32\DRIVERS\point64k.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2010-8-19 89920]
.
=============== File Associations ===============
.
JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
.
=============== Created Last 30 ================
.
2012-01-07 17:59:36 ——– d—–w- C:\Program Files (x86)\AMD APP
2012-01-03 13:10:44 182672 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll
2012-01-02 02:32:59 ——– d—–w- C:\Users\Gary\AppData\Local\Skyrim
2011-12-31 08:20:13 ——– d—–w- C:\Users\Gary\AppData\Local\The Witcher 2
2011-12-28 11:12:37 ——– d—–w- C:\Fraps
2011-12-28 01:19:39 525544 —-a-w- C:\Windows\System32\deployJava1.dll
2011-12-28 01:11:09 ——– d—–w- C:\Program Files\Waterfox
2011-12-23 18:12:23 ——– d—–w- C:\Program Files\Speccy
.
==================== Find3M ====================
.
2012-01-13 00:43:38 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-10 20:24:08 23152 —-a-w- C:\Windows\System32\drivers\mbam.sys
2011-11-28 18:01:25 41184 —-a-w- C:\Windows\avastSS.scr
2011-11-28 17:54:06 591192 —-a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-11-28 17:52:11 66904 —-a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-11-25 16:25:32 451072 —-a-w- C:\Windows\System32\winsrv.dll
2011-11-23 13:57:38 2764800 —-a-w- C:\Windows\System32\win32k.sys
2011-11-18 20:55:05 1585152 —-a-w- C:\Windows\System32\ntdll.dll
2011-11-18 20:55:05 1167984 —-a-w- C:\Windows\SysWow64\ntdll.dll
2011-11-18 18:07:45 76800 —-a-w- C:\Windows\System32\packager.dll
2011-11-18 17:47:03 66560 —-a-w- C:\Windows\SysWow64\packager.dll
2011-11-10 10:54:13 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2011-11-10 03:45:30 10567680 —-a-w- C:\Windows\System32\drivers\atikmdag.sys
2011-11-10 03:39:50 69632 —-a-w- C:\Windows\System32\OpenVideo64.dll
2011-11-10 03:39:44 59904 —-a-w- C:\Windows\SysWow64\OpenVideo.dll
2011-11-10 03:39:36 61952 —-a-w- C:\Windows\System32\OVDecode64.dll
2011-11-10 03:39:32 54784 —-a-w- C:\Windows\SysWow64\OVDecode.dll
2011-11-10 03:39:22 17442304 —-a-w- C:\Windows\System32\amdocl64.dll
2011-11-10 03:38:40 14375936 —-a-w- C:\Windows\SysWow64\amdocl.dll
2011-11-10 03:37:50 51200 —-a-w- C:\Windows\System32\OpenCL.dll
2011-11-10 03:37:46 44032 —-a-w- C:\Windows\SysWow64\OpenCL.dll
2011-11-10 03:20:50 25218048 —-a-w- C:\Windows\System32\atio6axx.dll
2011-11-10 03:17:10 159744 —-a-w- C:\Windows\System32\atiapfxx.exe
2011-11-10 03:16:56 774656 —-a-w- C:\Windows\SysWow64\aticfx32.dll
2011-11-10 03:15:20 927232 —-a-w- C:\Windows\System32\aticfx64.dll
2011-11-10 03:12:24 466944 —-a-w- C:\Windows\System32\ATIDEMGX.dll
2011-11-10 03:12:10 516608 —-a-w- C:\Windows\System32\atieclxx.exe
2011-11-10 03:11:32 204288 —-a-w- C:\Windows\System32\atiesrxx.exe
2011-11-10 03:10:18 120320 —-a-w- C:\Windows\System32\atitmm64.dll
2011-11-10 03:09:58 423424 —-a-w- C:\Windows\System32\atipdl64.dll
2011-11-10 03:09:52 360448 —-a-w- C:\Windows\SysWow64\atipdlxx.dll
2011-11-10 03:09:40 278528 —-a-w- C:\Windows\SysWow64\Oemdspif.dll
2011-11-10 03:09:34 21504 —-a-w- C:\Windows\System32\atimuixx.dll
2011-11-10 03:09:30 59392 —-a-w- C:\Windows\System32\atiedu64.dll
2011-11-10 03:09:24 43520 —-a-w- C:\Windows\SysWow64\ati2edxx.dll
2011-11-10 03:06:20 6077952 —-a-w- C:\Windows\SysWow64\atidxx32.dll
2011-11-10 02:58:20 18996224 —-a-w- C:\Windows\SysWow64\atioglxx.dll
2011-11-10 02:51:18 7405056 —-a-w- C:\Windows\System32\atidxx64.dll
2011-11-10 02:40:52 1113088 —-a-w- C:\Windows\System32\atiumd6v.dll
2011-11-10 02:40:18 1828864 —-a-w- C:\Windows\SysWow64\atiumdmv.dll
2011-11-10 02:40:04 4061696 —-a-w- C:\Windows\System32\atiumd6a.dll
2011-11-10 02:34:54 51200 —-a-w- C:\Windows\System32\aticalrt64.dll
2011-11-10 02:34:52 46080 —-a-w- C:\Windows\SysWow64\aticalrt.dll
2011-11-10 02:34:44 44544 —-a-w- C:\Windows\System32\aticalcl64.dll
2011-11-10 02:34:42 44032 —-a-w- C:\Windows\SysWow64\aticalcl.dll
2011-11-10 02:34:28 13552640 —-a-w- C:\Windows\System32\aticaldd64.dll
2011-11-10 02:33:52 5852672 —-a-w- C:\Windows\SysWow64\atiumdag.dll
2011-11-10 02:29:58 11300864 —-a-w- C:\Windows\SysWow64\aticaldd.dll
2011-11-10 02:29:46 4200960 —-a-w- C:\Windows\SysWow64\atiumdva.dll
2011-11-10 02:24:26 7439360 —-a-w- C:\Windows\System32\atiumd64.dll
2011-11-10 02:18:44 58880 —-a-w- C:\Windows\System32\coinst.dll
2011-11-10 02:13:32 494592 —-a-w- C:\Windows\System32\atiadlxx.dll
2011-11-10 02:13:22 348160 —-a-w- C:\Windows\SysWow64\atiadlxy.dll
2011-11-10 02:13:08 17408 —-a-w- C:\Windows\System32\atig6pxx.dll
2011-11-10 02:13:04 14336 —-a-w- C:\Windows\SysWow64\atiglpxx.dll
2011-11-10 02:13:04 14336 —-a-w- C:\Windows\System32\atiglpxx.dll
2011-11-10 02:13:00 39936 —-a-w- C:\Windows\System32\atig6txx.dll
2011-11-10 02:12:52 32768 —-a-w- C:\Windows\SysWow64\atigktxx.dll
2011-11-10 02:12:44 325632 —-a-w- C:\Windows\System32\drivers\atikmpag.sys
2011-11-10 02:11:54 41984 —-a-w- C:\Windows\System32\atiuxp64.dll
2011-11-10 02:11:46 32256 —-a-w- C:\Windows\SysWow64\atiuxpag.dll
2011-11-10 02:11:40 39424 —-a-w- C:\Windows\System32\atiu9p64.dll
2011-11-10 02:11:32 54784 —-a-w- C:\Windows\System32\atimpc64.dll
2011-11-10 02:11:32 54784 —-a-w- C:\Windows\System32\amdpcom64.dll
2011-11-10 02:11:32 29184 —-a-w- C:\Windows\SysWow64\atiu9pag.dll
2011-11-10 02:11:26 53760 —-a-w- C:\Windows\SysWow64\atimpc32.dll
2011-11-10 02:11:26 53760 —-a-w- C:\Windows\SysWow64\amdpcom32.dll
2011-11-10 02:11:14 45056 —-a-w- C:\Windows\System32\atitmp64.dll
2011-11-10 02:10:54 53248 —-a-w- C:\Windows\System32\drivers\ati2erec.dll
2011-11-08 14:58:31 2048 —-a-w- C:\Windows\System32\tzres.dll
2011-11-08 14:42:19 2048 —-a-w- C:\Windows\SysWow64\tzres.dll
2011-11-04 01:53:39 2309120 —-a-w- C:\Windows\System32\jscript9.dll
2011-11-04 01:44:47 1390080 —-a-w- C:\Windows\System32\wininet.dll
2011-11-04 01:44:21 1493504 —-a-w- C:\Windows\System32\inetcpl.cpl
2011-11-04 01:34:43 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2011-11-03 22:47:42 1798144 —-a-w- C:\Windows\SysWow64\jscript9.dll
2011-11-03 22:40:21 1427456 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2011-11-03 22:39:47 1127424 —-a-w- C:\Windows\SysWow64\wininet.dll
2011-11-03 22:31:57 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2011-10-26 02:21:40 66560 —-a-w- C:\Windows\System32\OVDecoder64.dll
2011-10-26 02:21:34 56832 —-a-w- C:\Windows\SysWow64\OVDecoder.dll
2011-10-25 16:13:33 1570816 —-a-w- C:\Windows\System32\quartz.dll
2011-10-25 16:13:31 352256 —-a-w- C:\Windows\System32\qdvd.dll
2011-10-25 16:09:37 85504 —-a-w- C:\Windows\System32\csrsrv.dll
2011-10-25 15:58:55 1314816 —-a-w- C:\Windows\SysWow64\quartz.dll
2011-10-25 15:58:54 497152 —-a-w- C:\Windows\SysWow64\qdvd.dll
2011-10-24 19:29:02 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2011-10-24 19:29:02 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts
2011-10-22 11:21:42 71680 —-a-w- C:\Windows\System32\frapsv64.dll
2011-10-22 11:21:38 65536 —-a-w- C:\Windows\SysWow64\frapsvid.dll
2011-10-22 01:16:12 1843200 —-a-w- C:\Windows\SysWow64\SlotMaximizerBe.dll
2011-10-22 01:15:46 104448 —-a-w- C:\Windows\SysWow64\SlotMaximizerAg.dll
2011-10-22 01:12:32 2763264 —-a-w- C:\Windows\System32\SlotMaximizerBe.dll
2011-10-22 01:07:42 125440 —-a-w- C:\Windows\System32\SlotMaximizerAg.dll
.
============= FINISH: 13:05:01.82 ===============


Here is aswMBR


aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-15 13:07:35
—————————–
13:07:35.596 OS Version: Windows x64 6.0.6002 Service Pack 2
13:07:35.596 Number of processors: 4 586 0x1E05
13:07:35.596 ComputerName: GARY-PC UserName: Gary
13:07:41.394 Initialize success
13:07:44.477 AVAST engine defs: 12011501
13:08:21.474 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-3
13:08:21.476 Disk 0 Vendor: ST3200822A 3.01 Size: 190779MB BusType: 3
13:08:21.477 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-4
13:08:21.478 Disk 1 Vendor: WDC_WD2500KS-00MJB0 02.01C03 Size: 238475MB BusType: 3
13:08:21.480 Disk 2 (boot) \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T0L0-6
13:08:21.482 Disk 2 Vendor: ST31000528AS CC38 Size: 953869MB BusType: 3
13:08:21.489 Disk 2 MBR read successfully
13:08:21.491 Disk 2 MBR scan
13:08:21.493 Disk 2 Windows VISTA default MBR code
13:08:21.495 Disk 2 Partition 1 80 (A) 07 HPFS/NTFS NTFS 953867 MB offset 63
13:08:21.497 Service scanning
13:08:22.867 Modules scanning
13:08:22.869 Disk 2 trace - called modules:
13:08:22.873 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
13:08:22.876 1 nt!IofCallDriver -> \Device\Harddisk2\DR2[0xfffffa80065886e0]
13:08:22.878 3 CLASSPNP.SYS[fffffa60011bac33] -> nt!IofCallDriver -> [0xfffffa80050b9520]
13:08:22.881 5 acpi.sys[fffffa60008c5fde] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-6[0xfffffa80050c9060]
13:08:23.605 AVAST engine scan C:\Windows
13:08:25.969 AVAST engine scan C:\Windows\system32
13:09:37.299 AVAST engine scan C:\Windows\system32\drivers
13:09:47.138 AVAST engine scan C:\Users\Gary
13:37:04.722 AVAST engine scan C:\ProgramData
13:37:29.629 Scan finished successfully
13:41:05.006 Disk 2 MBR has been saved successfully to "C:\Users\Gary\Desktop\MBR.dat"
13:41:05.009 The log file has been saved successfully to "C:\Users\Gary\Desktop\aswMBR.txt"

The program DDS requested that I not post attach.txt, so I have zipped and attached it.

LOL….Very sorry….I'll do it this way. It seems I have to upload the file separately from posting. Didn't know that. "Upload" seems a lot like "post reply".

Gary.


ComboFix 12-01-16.02 - Gary 01/16/2012 7:31.1.4 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4086.2535 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\java.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-16 to 2012-01-16 )))))))))))))))))))))))))))))))
.
.
2012-01-16 12:38 . 2012-01-16 12:38 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-01-11 00:43 . 2012-01-11 00:43 ——– d—–w- c:\program files (x86)\Microsoft Silverlight
2012-01-07 17:59 . 2012-01-07 17:59 ——– d—–w- c:\programdata\ATI
2012-01-07 17:59 . 2012-01-07 17:59 ——– d—–w- c:\program files (x86)\AMD APP
2012-01-03 13:10 . 2012-01-03 13:10 182672 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2012-01-02 02:32 . 2012-01-02 02:32 ——– d—–w- c:\users\Gary\AppData\Local\Skyrim
2011-12-31 08:20 . 2011-12-31 08:20 ——– d—–w- c:\users\Gary\AppData\Local\The Witcher 2
2011-12-28 11:12 . 2011-12-28 11:12 ——– d—–w- C:\Fraps
2011-12-28 01:19 . 2011-12-28 01:19 525544 —-a-w- c:\windows\system32\deployJava1.dll
2011-12-28 01:19 . 2011-12-28 01:19 ——– d—–w- c:\program files\Java
2011-12-28 01:18 . 2011-12-28 01:18 ——– d—–w- c:\windows\system32\Macromed
2011-12-28 01:11 . 2011-12-28 01:11 ——– d—–w- c:\program files\Waterfox
2011-12-27 19:57 . 2011-12-27 19:57 ——– d—–w- c:\program files (x86)\Apple Software Update
2011-12-23 18:12 . 2011-12-23 18:12 ——– d—–w- c:\program files\Speccy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-13 00:43 . 2011-05-14 16:01 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-14 17:02 . 2011-12-14 17:02 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 20:24 . 2010-08-19 19:36 23152 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-11-28 18:01 . 2010-08-19 02:32 41184 —-a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2010-08-19 02:32 199816 —-a-w- c:\windows\SysWow64\aswBoot.exe
2011-11-28 18:01 . 2011-01-13 23:52 256960 —-a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:54 . 2011-03-04 05:53 591192 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2010-08-19 02:33 304472 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2010-08-19 02:33 42328 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2010-08-19 02:33 58712 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2010-08-19 02:33 66904 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-11-28 17:51 . 2010-08-19 02:33 24408 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-26 01:45 . 2011-11-26 01:45 652296 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-11-26 01:44 . 2011-11-26 01:44 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2011-11-23 13:57 . 2011-12-13 21:10 2764800 —-a-w- c:\windows\system32\win32k.sys
2011-11-10 10:54 . 2011-01-17 21:21 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
2011-11-10 03:45 . 2011-11-10 03:45 10567680 —-a-w- c:\windows\system32\drivers\atikmdag.sys
2011-11-10 03:39 . 2011-11-10 03:39 69632 —-a-w- c:\windows\system32\OpenVideo64.dll
2011-11-10 03:39 . 2011-11-10 03:39 59904 —-a-w- c:\windows\SysWow64\OpenVideo.dll
2011-11-10 03:39 . 2011-11-10 03:39 61952 —-a-w- c:\windows\system32\OVDecode64.dll
2011-11-10 03:39 . 2011-11-10 03:39 54784 —-a-w- c:\windows\SysWow64\OVDecode.dll
2011-11-10 03:39 . 2011-11-10 03:39 17442304 —-a-w- c:\windows\system32\amdocl64.dll
2011-11-10 03:38 . 2011-11-10 03:38 14375936 —-a-w- c:\windows\SysWow64\amdocl.dll
2011-11-10 03:37 . 2011-11-10 03:37 51200 —-a-w- c:\windows\system32\OpenCL.dll
2011-11-10 03:37 . 2011-11-10 03:37 44032 —-a-w- c:\windows\SysWow64\OpenCL.dll
2011-11-10 03:20 . 2011-11-10 03:20 25218048 —-a-w- c:\windows\system32\atio6axx.dll
2011-11-10 03:17 . 2011-11-10 03:17 159744 —-a-w- c:\windows\system32\atiapfxx.exe
2011-11-10 03:16 . 2011-03-09 04:56 774656 —-a-w- c:\windows\SysWow64\aticfx32.dll
2011-11-10 03:15 . 2010-07-07 01:53 927232 —-a-w- c:\windows\system32\aticfx64.dll
2011-11-10 03:12 . 2011-11-10 03:12 466944 —-a-w- c:\windows\system32\ATIDEMGX.dll
2011-11-10 03:12 . 2011-11-10 03:12 516608 —-a-w- c:\windows\system32\atieclxx.exe
2011-11-10 03:11 . 2011-11-10 03:11 204288 —-a-w- c:\windows\system32\atiesrxx.exe
2011-11-10 03:10 . 2011-11-10 03:10 120320 —-a-w- c:\windows\system32\atitmm64.dll
2011-11-10 03:09 . 2011-11-10 03:09 423424 —-a-w- c:\windows\system32\atipdl64.dll
2011-11-10 03:09 . 2011-11-10 03:09 360448 —-a-w- c:\windows\SysWow64\atipdlxx.dll
2011-11-10 03:09 . 2011-11-10 03:09 278528 —-a-w- c:\windows\SysWow64\Oemdspif.dll
2011-11-10 03:09 . 2011-11-10 03:09 21504 —-a-w- c:\windows\system32\atimuixx.dll
2011-11-10 03:09 . 2011-11-10 03:09 59392 —-a-w- c:\windows\system32\atiedu64.dll
2011-11-10 03:09 . 2011-11-10 03:09 43520 —-a-w- c:\windows\SysWow64\ati2edxx.dll
2011-11-10 03:06 . 2011-11-10 03:06 6077952 —-a-w- c:\windows\SysWow64\atidxx32.dll
2011-11-10 02:58 . 2011-11-10 02:58 18996224 —-a-w- c:\windows\SysWow64\atioglxx.dll
2011-11-10 02:51 . 2011-11-10 02:51 7405056 —-a-w- c:\windows\system32\atidxx64.dll
2011-11-10 02:40 . 2011-11-10 02:40 1113088 —-a-w- c:\windows\system32\atiumd6v.dll
2011-11-10 02:40 . 2011-11-10 02:40 1828864 —-a-w- c:\windows\SysWow64\atiumdmv.dll
2011-11-10 02:40 . 2011-03-09 03:41 4061696 —-a-w- c:\windows\system32\atiumd6a.dll
2011-11-10 02:34 . 2011-11-10 02:34 51200 —-a-w- c:\windows\system32\aticalrt64.dll
2011-11-10 02:34 . 2011-11-10 02:34 46080 —-a-w- c:\windows\SysWow64\aticalrt.dll
2011-11-10 02:34 . 2011-11-10 02:34 44544 —-a-w- c:\windows\system32\aticalcl64.dll
2011-11-10 02:34 . 2011-11-10 02:34 44032 —-a-w- c:\windows\SysWow64\aticalcl.dll
2011-11-10 02:34 . 2011-11-10 02:34 13552640 —-a-w- c:\windows\system32\aticaldd64.dll
2011-11-10 02:33 . 2011-03-09 04:30 5852672 —-a-w- c:\windows\SysWow64\atiumdag.dll
2011-11-10 02:29 . 2011-11-10 02:29 11300864 —-a-w- c:\windows\SysWow64\aticaldd.dll
2011-11-10 02:29 . 2011-03-09 03:34 4200960 —-a-w- c:\windows\SysWow64\atiumdva.dll
2011-11-10 02:24 . 2010-07-07 01:22 7439360 —-a-w- c:\windows\system32\atiumd64.dll
2011-11-10 02:18 . 2010-07-07 01:24 58880 —-a-w- c:\windows\system32\coinst.dll
2011-11-10 02:13 . 2011-03-09 04:18 494592 —-a-w- c:\windows\system32\atiadlxx.dll
2011-11-10 02:13 . 2011-11-10 02:13 348160 —-a-w- c:\windows\SysWow64\atiadlxy.dll
2011-11-10 02:13 . 2011-11-10 02:13 17408 —-a-w- c:\windows\system32\atig6pxx.dll
2011-11-10 02:13 . 2011-11-10 02:13 14336 —-a-w- c:\windows\SysWow64\atiglpxx.dll
2011-11-10 02:13 . 2011-11-10 02:13 14336 —-a-w- c:\windows\system32\atiglpxx.dll
2011-11-10 02:13 . 2011-11-10 02:13 39936 —-a-w- c:\windows\system32\atig6txx.dll
2011-11-10 02:12 . 2011-11-10 02:12 32768 —-a-w- c:\windows\SysWow64\atigktxx.dll
2011-11-10 02:12 . 2011-11-10 02:12 325632 —-a-w- c:\windows\system32\drivers\atikmpag.sys
2011-11-10 02:11 . 2011-11-10 02:11 41984 —-a-w- c:\windows\system32\atiuxp64.dll
2011-11-10 02:11 . 2011-11-10 02:11 32256 —-a-w- c:\windows\SysWow64\atiuxpag.dll
2011-11-10 02:11 . 2010-07-07 01:14 39424 —-a-w- c:\windows\system32\atiu9p64.dll
2011-11-10 02:11 . 2011-11-10 02:11 54784 —-a-w- c:\windows\system32\atimpc64.dll
2011-11-10 02:11 . 2011-11-10 02:11 54784 —-a-w- c:\windows\system32\amdpcom64.dll
2011-11-10 02:11 . 2010-07-07 01:14 29184 —-a-w- c:\windows\SysWow64\atiu9pag.dll
2011-11-10 02:11 . 2011-11-10 02:11 53760 —-a-w- c:\windows\SysWow64\atimpc32.dll
2011-11-10 02:11 . 2011-11-10 02:11 53760 —-a-w- c:\windows\SysWow64\amdpcom32.dll
2011-11-10 02:11 . 2010-07-07 01:14 45056 —-a-w- c:\windows\system32\atitmp64.dll
2011-11-10 02:10 . 2011-11-10 02:10 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll
2011-11-08 14:58 . 2011-12-13 21:11 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-08 14:42 . 2011-12-13 21:11 2048 —-a-w- c:\windows\SysWow64\tzres.dll
2011-11-04 01:53 . 2011-12-13 22:59 2309120 —-a-w- c:\windows\system32\jscript9.dll
2011-11-04 01:44 . 2011-12-13 22:59 1390080 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 01:44 . 2011-12-13 22:59 1493504 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 01:34 . 2011-12-13 22:59 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-11-03 22:47 . 2011-12-13 22:59 1798144 —-a-w- c:\windows\SysWow64\jscript9.dll
2011-11-03 22:40 . 2011-12-13 22:59 1427456 —-a-w- c:\windows\SysWow64\inetcpl.cpl
2011-11-03 22:39 . 2011-12-13 22:59 1127424 —-a-w- c:\windows\SysWow64\wininet.dll
2011-11-03 22:31 . 2011-12-13 22:59 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-10-26 02:21 . 2011-10-26 02:21 66560 —-a-w- c:\windows\system32\OVDecoder64.dll
2011-10-26 02:21 . 2011-10-26 02:21 56832 —-a-w- c:\windows\SysWow64\OVDecoder.dll
2011-10-25 16:09 . 2011-12-13 21:11 85504 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-24 19:29 . 2011-10-24 19:29 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 19:29 . 2011-10-24 19:29 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts
2011-10-22 11:21 . 2011-10-22 11:21 71680 —-a-w- c:\windows\system32\frapsv64.dll
2011-10-22 11:21 . 2011-10-22 11:21 65536 —-a-w- c:\windows\SysWow64\frapsvid.dll
2011-10-22 01:16 . 2011-10-22 01:16 1843200 —-a-w- c:\windows\SysWow64\SlotMaximizerBe.dll
2011-10-22 01:15 . 2011-10-22 01:15 104448 —-a-w- c:\windows\SysWow64\SlotMaximizerAg.dll
2011-10-22 01:12 . 2011-10-22 01:12 2763264 —-a-w- c:\windows\system32\SlotMaximizerBe.dll
2011-10-22 01:07 . 2011-10-22 01:07 125440 —-a-w- c:\windows\system32\SlotMaximizerAg.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-02 1242448]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]
"MtdAcqu"="c:\program files (x86)\Creative\MediaSource5\MtdAcqu.exe" [2006-03-08 278528]
"igndlm.exe"="c:\program files (x86)\Download Manager\DLM.exe" [2009-10-27 1103216]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 138240]
"VueMinder"="c:\program files (x86)\VueSoft\VueMinder\VueMinder.exe" [2011-08-27 4926976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-07-11 74752]
"Razer Naga Driver"="c:\program files (x86)\Razer\Naga Epic\NagaEpicSysTray.exe" [2010-12-30 957840]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-06-04 25600]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]
"Zboard"="c:\program files (x86)\Ideazon\ZEngine\Zboard.exe" [2009-06-04 57344]
"DiscWizardMonitor.exe"="c:\program files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe" [2009-10-16 1325936]
"AcronisTimounterMonitor"="c:\program files (x86)\Seagate\DiscWizard\TimounterMonitor.exe" [2009-10-16 904840]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-10 343168]
.
c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ScreenHunter 5.1 Free.lnk - c:\program files (x86)\Wisdom-soft ScreenHunter 5 Free\ScreenHunter.exe [2010-9-6 5324800]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-19 02:33]
.
2012-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-19 02:33]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 134384 —-a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
"Seagate Scheduler2 Service"="c:\program files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe" [2009-10-16 136544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
Trusted Zone: taleo.net\macys
TCP: DhcpNameServer = [removed] [removed]
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-2732050901.elitistjerks.com - c:\program files (x86)\Microsoft Silverlight\4.0.60531.0\Silverlight.Configuration.exe
AddRemove-{AD1FE8DD-0A6A-46E7-9B5F-8A70DD75CA93} - c:\users\Gary\AppData\Local\{AD4FF8EF-B0C1-424D-B091-EE480EE8C7B5}\ThumbsPlus8setup-3516.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \cars]
"Order"=hex:08,00,00,00,02,00,00,00,c2,04,00,00,01,00,00,00,06,00,00,00,84,00,
00,00,05,00,00,00,76,00,32,00,84,00,00,00,00,f9,b1,89,20,00,41,55,54,4f,53,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \computer shopping]
"Order"=hex:08,00,00,00,02,00,00,00,e4,0b,00,00,01,00,00,00,11,00,00,00,78,00,
00,00,01,00,00,00,6a,00,31,00,00,00,00,00,00,42,7a,16,10,00,42,41,52,45,42,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \computer shopping\Barebones shopping]
"Order"=hex:08,00,00,00,02,00,00,00,e6,02,00,00,01,00,00,00,03,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,78,7f,1e,20,00,4d,4f,54,48,45,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \gay buying]
"Order"=hex:08,00,00,00,02,00,00,00,2c,04,00,00,01,00,00,00,06,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,5a,6a,3e,20,00,41,42,4f,55,54,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \headphones]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0c,00,00,00,a8,00,
00,00,00,00,00,00,9a,00,32,00,84,00,00,00,00,11,5d,e6,20,00,41,55,44,49,4f,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \Norwegian Forest catteries]
"Order"=hex:08,00,00,00,02,00,00,00,58,02,00,00,01,00,00,00,04,00,00,00,a4,00,
00,00,00,00,00,00,96,00,32,00,84,00,00,00,00,99,54,3f,20,00,46,42,52,4c,4e,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \Online Pharmacies]
"Order"=hex:08,00,00,00,02,00,00,00,d6,07,00,00,01,00,00,00,0a,00,00,00,ea,00,
00,00,00,00,00,00,dc,00,32,00,84,00,00,00,00,f0,1a,c8,20,00,43,41,4e,41,44,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \Sheet Music]
"Order"=hex:08,00,00,00,02,00,00,00,62,02,00,00,01,00,00,00,03,00,00,00,e4,00,
00,00,00,00,00,00,d6,00,32,00,84,00,00,00,00,2c,b3,0f,20,00,43,4c,41,53,53,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \Shoes]
"Order"=hex:08,00,00,00,02,00,00,00,60,02,00,00,01,00,00,00,03,00,00,00,64,00,
00,00,02,00,00,00,56,00,32,00,84,00,00,00,00,fa,d9,36,20,00,62,61,73,65,2e,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \work]
"Order"=hex:08,00,00,00,02,00,00,00,cc,06,00,00,01,00,00,00,0a,00,00,00,aa,00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,67,a5,1d,20,00,45,4b,47,54,55,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \audiobooks]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Bills]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \bittorrent]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Broadband]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers]
"Order"=hex:08,00,00,00,02,00,00,00,46,03,00,00,01,00,00,00,07,00,00,00,74,00,
00,00,00,00,00,00,66,00,31,00,00,00,00,00,00,4e,d9,7e,10,00,36,34,42,49,54,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\64 bit computing]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\BlackViper nest]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\G15]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\Linux stuff]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\video help]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\Windows tips]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \employment]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,5e,01,00,00,01,00,00,00,03,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,21,b6,82,10,00,41,43,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \entertainment\Actor sites]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \entertainment\Ifilm michael jackson]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \entertainment\music sites]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming]
"Order"=hex:08,00,00,00,02,00,00,00,36,06,00,00,01,00,00,00,0d,00,00,00,74,00,
00,00,00,00,00,00,66,00,31,00,00,00,00,00,00,f5,e2,46,10,00,42,55,59,47,41,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\buy games online]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Fable]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Halo I game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Knights of the old republic game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\mass effect]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Medieval 2 total war]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Oblivion]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\physical fitness and diet]
"Order"=hex:08,00,00,00,02,00,00,00,5e,03,00,00,01,00,00,00,05,00,00,00,c6,00,
00,00,01,00,00,00,b8,00,32,00,84,00,00,00,00,71,bc,2d,20,00,31,33,57,41,59,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Pirates game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Prince of Persia game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Rome Total War game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\WoW]
"Order"=hex:08,00,00,00,02,00,00,00,62,02,00,00,01,00,00,00,05,00,00,00,70,00,
00,00,02,00,00,00,62,00,31,00,00,00,00,00,00,e7,8e,49,10,00,4d,41,43,52,4f,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\WoW\macros for wow]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\WoW\pally prot advice]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\WoW\WoW mods]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \History]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \ians links]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \inmate]
"Order"=hex:08,00,00,00,02,00,00,00,0c,0b,00,00,01,00,00,00,14,00,00,00,76,00,
00,00,00,00,00,00,68,00,31,00,00,00,00,00,00,a3,4e,71,10,00,44,45,50,41,52,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \inmate\Department search]
"Order"=hex:08,00,00,00,02,00,00,00,ae,00,00,00,01,00,00,00,01,00,00,00,a2,00,
00,00,00,00,00,00,94,00,32,00,84,00,00,00,00,f0,b9,98,20,00,41,52,49,5a,4f,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Links]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \movie streaming sites]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \news]
"Order"=hex:08,00,00,00,02,00,00,00,dc,00,00,00,01,00,00,00,02,00,00,00,6c,00,
00,00,00,00,00,00,5e,00,31,00,00,00,00,00,00,b5,cd,b2,10,00,42,52,49,54,49,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \news\British news]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \news\gay news]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Personals]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Pittsburgh]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \politics]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Recipes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Reddit links]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Religion or nonreligion]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Search Reference Education]
"Order"=hex:08,00,00,00,02,00,00,00,6a,00,00,00,01,00,00,00,01,00,00,00,5e,00,
00,00,00,00,00,00,50,00,31,00,00,00,00,00,00,ea,f9,96,10,00,50,6f,65,74,72,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Search Reference Education\Poetry]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping]
"Order"=hex:08,00,00,00,02,00,00,00,c4,03,00,00,01,00,00,00,09,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,75,d6,84,10,00,63,61,72,73,00,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\cars]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\computer shopping]
"Order"=hex:08,00,00,00,02,00,00,00,84,00,00,00,01,00,00,00,01,00,00,00,78,00,
00,00,00,00,00,00,6a,00,31,00,00,00,00,00,00,22,f5,ed,10,00,42,41,52,45,42,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\computer shopping\Barebones shopping]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\gay buying]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\headphones]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Norwegian Forest catteries]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Online Pharmacies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Sheet Music]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Shoes]
"Order"=hex:08,00,00,00,02,00,00,00,64,00,00,00,01,00,00,00,01,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,1a,a0,11,10,00,63,61,72,73,00,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Shoes\cars]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\work]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Sports]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff]
"Order"=hex:08,00,00,00,02,00,00,00,f8,03,00,00,01,00,00,00,0a,00,00,00,68,00,
00,00,00,00,00,00,5a,00,31,00,00,00,00,00,00,37,1e,ee,10,00,42,49,47,4d,55,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\big muscle]
"Order"=hex:08,00,00,00,02,00,00,00,46,09,00,00,01,00,00,00,0f,00,00,00,a4,00,
00,00,00,00,00,00,96,00,32,00,84,00,00,00,00,d7,e5,4b,20,00,42,4d,50,52,4f,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\bigmusclebears]
"Order"=hex:08,00,00,00,02,00,00,00,d0,11,00,00,01,00,00,00,1f,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,05,1b,59,20,00,42,4d,42,2d,42,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\cams]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\escorts]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\favorite stuff]
"Order"=hex:08,00,00,00,02,00,00,00,6a,09,00,00,01,00,00,00,10,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,77,b6,7a,20,00,41,44,41,4d,43,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\fetish]
"Order"=hex:08,00,00,00,02,00,00,00,fe,04,00,00,01,00,00,00,07,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,77,89,ac,20,00,43,4f,56,45,52,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\History]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\MSN Groups]
"Order"=hex:08,00,00,00,02,00,00,00,7a,00,00,00,01,00,00,00,01,00,00,00,6e,00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,b4,32,89,10,00,4d,41,4c,45,50,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\MSN Groups\malepornstars]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\personals]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\shrines]
"Order"=hex:08,00,00,00,02,00,00,00,a4,01,00,00,01,00,00,00,03,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,bf,c7,9a,20,00,42,4f,44,49,58,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \translation]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Web Channels]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \work]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:50,8f,8d,81,6d,fb,df,6e,74,82,a3,dd,74,34,10,00,4c,99,30,23,b2,
12,6c,7d,92,63,99,44,3f,f9,25,08,c2,3c,ad,4a,f6,0c,7e,c3,be,10,c4,62,77,04,\
"rkeysecu"=hex:a0,65,15,fc,94,59,12,bd,69,cf,0d,f5,86,68,b2,ef
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Completion time: 2012-01-16 07:41:41
ComboFix-quarantined-files.txt 2012-01-16 12:41
.
Pre-Run: 501,842,833,408 bytes free
Post-Run: 501,732,790,272 bytes free
.
- - End Of File - - A03CCC51A10789D0F681F790AB4A1B67

Hi Jeff:

It's okay if you call me Gary. I've been called worse things in my life.

I seriously goofed up and ran into some nasty problems. I followed your directions and copied the txt from your post. However, I double-clicked on Combofix instead of dragging the txt file, thinking that I could drag the txt file into the interface. (Dumb habit I guess). Combofix ran, called back to its home server and updated itself. I'm uncertain as to what happened next, perhaps it was still running an update when I clicked it again. It completed its scan without asking for a reboot. I ran another scan, this time dragging the txt files onto the icon, as requested. At that point, I tried to access the forum, but none of my browsers would operate.

Fortunately, I had an earlier, automatic restore point, and I ran a system restore. During the reboot from that, I got a BSOD and on a reboot, Vista asked me to do a repair install. I performed that, and now everything seems to be fine. I'm a bit afraid of running Combofix now, but here is the resulting log from the previous Combofix scan.

- Gary.


ComboFix 12-01-18.04 - Gary 01/18/2012 14:22:21.4.4 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4086.1815 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\virus investigation\ComboFix.exe
Command switches used :: c:\users\Gary\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-12-18 to 2012-01-18 )))))))))))))))))))))))))))))))
.
.
2012-01-18 19:27 . 2012-01-18 19:27 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-01-17 22:22 . 2011-11-16 16:42 347136 —-a-w- c:\windows\system32\schannel.dll
2012-01-17 22:22 . 2011-11-17 06:53 515968 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-17 22:22 . 2011-11-16 16:43 442368 —-a-w- c:\windows\system32\winhttp.dll
2012-01-17 22:22 . 2011-11-16 16:42 94720 —-a-w- c:\windows\system32\secur32.dll
2012-01-17 22:22 . 2011-11-16 16:41 1689600 —-a-w- c:\windows\system32\lsasrv.dll
2012-01-17 22:22 . 2011-11-16 16:24 77312 —-a-w- c:\windows\SysWow64\secur32.dll
2012-01-17 22:22 . 2011-11-16 16:23 377344 —-a-w- c:\windows\SysWow64\winhttp.dll
2012-01-17 22:22 . 2011-11-16 16:23 278528 —-a-w- c:\windows\SysWow64\schannel.dll
2012-01-17 22:22 . 2011-11-16 14:34 11264 —-a-w- c:\windows\system32\lsass.exe
2012-01-11 00:43 . 2012-01-11 00:43 ——– d—–w- c:\program files (x86)\Microsoft Silverlight
2012-01-07 17:59 . 2012-01-07 17:59 ——– d—–w- c:\programdata\ATI
2012-01-07 17:59 . 2012-01-07 17:59 ——– d—–w- c:\program files (x86)\AMD APP
2012-01-03 13:10 . 2012-01-03 13:10 182672 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2012-01-02 02:32 . 2012-01-02 02:32 ——– d—–w- c:\users\Gary\AppData\Local\Skyrim
2011-12-31 08:20 . 2011-12-31 08:20 ——– d—–w- c:\users\Gary\AppData\Local\The Witcher 2
2011-12-28 11:12 . 2011-12-28 11:12 ——– d—–w- C:\Fraps
2011-12-28 01:19 . 2011-12-28 01:19 525544 —-a-w- c:\windows\system32\deployJava1.dll
2011-12-28 01:19 . 2011-12-28 01:19 ——– d—–w- c:\program files\Java
2011-12-28 01:18 . 2011-12-28 01:18 ——– d—–w- c:\windows\system32\Macromed
2011-12-28 01:11 . 2011-12-28 01:11 ——– d—–w- c:\program files\Waterfox
2011-12-27 19:57 . 2011-12-27 19:57 ——– d—–w- c:\program files (x86)\Apple Software Update
2011-12-23 18:12 . 2011-12-23 18:12 ——– d—–w- c:\program files\Speccy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-13 00:43 . 2011-05-14 16:01 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-14 17:02 . 2011-12-14 17:02 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 20:24 . 2010-08-19 19:36 23152 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-11-28 18:01 . 2010-08-19 02:32 41184 —-a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2010-08-19 02:32 199816 —-a-w- c:\windows\SysWow64\aswBoot.exe
2011-11-28 18:01 . 2011-01-13 23:52 256960 —-a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:54 . 2011-03-04 05:53 591192 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2010-08-19 02:33 304472 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2010-08-19 02:33 42328 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2010-08-19 02:33 58712 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2010-08-19 02:33 66904 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-11-28 17:51 . 2010-08-19 02:33 24408 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-26 01:45 . 2011-11-26 01:45 652296 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-11-26 01:44 . 2011-11-26 01:44 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2011-11-23 13:57 . 2011-12-13 21:10 2764800 —-a-w- c:\windows\system32\win32k.sys
2011-11-10 10:54 . 2011-01-17 21:21 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
2011-11-10 03:45 . 2011-11-10 03:45 10567680 —-a-w- c:\windows\system32\drivers\atikmdag.sys
2011-11-10 03:39 . 2011-11-10 03:39 69632 —-a-w- c:\windows\system32\OpenVideo64.dll
2011-11-10 03:39 . 2011-11-10 03:39 59904 —-a-w- c:\windows\SysWow64\OpenVideo.dll
2011-11-10 03:39 . 2011-11-10 03:39 61952 —-a-w- c:\windows\system32\OVDecode64.dll
2011-11-10 03:39 . 2011-11-10 03:39 54784 —-a-w- c:\windows\SysWow64\OVDecode.dll
2011-11-10 03:39 . 2011-11-10 03:39 17442304 —-a-w- c:\windows\system32\amdocl64.dll
2011-11-10 03:38 . 2011-11-10 03:38 14375936 —-a-w- c:\windows\SysWow64\amdocl.dll
2011-11-10 03:37 . 2011-11-10 03:37 51200 —-a-w- c:\windows\system32\OpenCL.dll
2011-11-10 03:37 . 2011-11-10 03:37 44032 —-a-w- c:\windows\SysWow64\OpenCL.dll
2011-11-10 03:20 . 2011-11-10 03:20 25218048 —-a-w- c:\windows\system32\atio6axx.dll
2011-11-10 03:17 . 2011-11-10 03:17 159744 —-a-w- c:\windows\system32\atiapfxx.exe
2011-11-10 03:16 . 2011-03-09 04:56 774656 —-a-w- c:\windows\SysWow64\aticfx32.dll
2011-11-10 03:15 . 2010-07-07 01:53 927232 —-a-w- c:\windows\system32\aticfx64.dll
2011-11-10 03:12 . 2011-11-10 03:12 466944 —-a-w- c:\windows\system32\ATIDEMGX.dll
2011-11-10 03:12 . 2011-11-10 03:12 516608 —-a-w- c:\windows\system32\atieclxx.exe
2011-11-10 03:11 . 2011-11-10 03:11 204288 —-a-w- c:\windows\system32\atiesrxx.exe
2011-11-10 03:10 . 2011-11-10 03:10 120320 —-a-w- c:\windows\system32\atitmm64.dll
2011-11-10 03:09 . 2011-11-10 03:09 423424 —-a-w- c:\windows\system32\atipdl64.dll
2011-11-10 03:09 . 2011-11-10 03:09 360448 —-a-w- c:\windows\SysWow64\atipdlxx.dll
2011-11-10 03:09 . 2011-11-10 03:09 278528 —-a-w- c:\windows\SysWow64\Oemdspif.dll
2011-11-10 03:09 . 2011-11-10 03:09 21504 —-a-w- c:\windows\system32\atimuixx.dll
2011-11-10 03:09 . 2011-11-10 03:09 59392 —-a-w- c:\windows\system32\atiedu64.dll
2011-11-10 03:09 . 2011-11-10 03:09 43520 —-a-w- c:\windows\SysWow64\ati2edxx.dll
2011-11-10 03:06 . 2011-11-10 03:06 6077952 —-a-w- c:\windows\SysWow64\atidxx32.dll
2011-11-10 02:58 . 2011-11-10 02:58 18996224 —-a-w- c:\windows\SysWow64\atioglxx.dll
2011-11-10 02:51 . 2011-11-10 02:51 7405056 —-a-w- c:\windows\system32\atidxx64.dll
2011-11-10 02:40 . 2011-11-10 02:40 1113088 —-a-w- c:\windows\system32\atiumd6v.dll
2011-11-10 02:40 . 2011-11-10 02:40 1828864 —-a-w- c:\windows\SysWow64\atiumdmv.dll
2011-11-10 02:40 . 2011-03-09 03:41 4061696 —-a-w- c:\windows\system32\atiumd6a.dll
2011-11-10 02:34 . 2011-11-10 02:34 51200 —-a-w- c:\windows\system32\aticalrt64.dll
2011-11-10 02:34 . 2011-11-10 02:34 46080 —-a-w- c:\windows\SysWow64\aticalrt.dll
2011-11-10 02:34 . 2011-11-10 02:34 44544 —-a-w- c:\windows\system32\aticalcl64.dll
2011-11-10 02:34 . 2011-11-10 02:34 44032 —-a-w- c:\windows\SysWow64\aticalcl.dll
2011-11-10 02:34 . 2011-11-10 02:34 13552640 —-a-w- c:\windows\system32\aticaldd64.dll
2011-11-10 02:33 . 2011-03-09 04:30 5852672 —-a-w- c:\windows\SysWow64\atiumdag.dll
2011-11-10 02:29 . 2011-11-10 02:29 11300864 —-a-w- c:\windows\SysWow64\aticaldd.dll
2011-11-10 02:29 . 2011-03-09 03:34 4200960 —-a-w- c:\windows\SysWow64\atiumdva.dll
2011-11-10 02:24 . 2010-07-07 01:22 7439360 —-a-w- c:\windows\system32\atiumd64.dll
2011-11-10 02:18 . 2010-07-07 01:24 58880 —-a-w- c:\windows\system32\coinst.dll
2011-11-10 02:13 . 2011-03-09 04:18 494592 —-a-w- c:\windows\system32\atiadlxx.dll
2011-11-10 02:13 . 2011-11-10 02:13 348160 —-a-w- c:\windows\SysWow64\atiadlxy.dll
2011-11-10 02:13 . 2011-11-10 02:13 17408 —-a-w- c:\windows\system32\atig6pxx.dll
2011-11-10 02:13 . 2011-11-10 02:13 14336 —-a-w- c:\windows\SysWow64\atiglpxx.dll
2011-11-10 02:13 . 2011-11-10 02:13 14336 —-a-w- c:\windows\system32\atiglpxx.dll
2011-11-10 02:13 . 2011-11-10 02:13 39936 —-a-w- c:\windows\system32\atig6txx.dll
2011-11-10 02:12 . 2011-11-10 02:12 32768 —-a-w- c:\windows\SysWow64\atigktxx.dll
2011-11-10 02:12 . 2011-11-10 02:12 325632 —-a-w- c:\windows\system32\drivers\atikmpag.sys
2011-11-10 02:11 . 2011-11-10 02:11 41984 —-a-w- c:\windows\system32\atiuxp64.dll
2011-11-10 02:11 . 2011-11-10 02:11 32256 —-a-w- c:\windows\SysWow64\atiuxpag.dll
2011-11-10 02:11 . 2010-07-07 01:14 39424 —-a-w- c:\windows\system32\atiu9p64.dll
2011-11-10 02:11 . 2011-11-10 02:11 54784 —-a-w- c:\windows\system32\atimpc64.dll
2011-11-10 02:11 . 2011-11-10 02:11 54784 —-a-w- c:\windows\system32\amdpcom64.dll
2011-11-10 02:11 . 2010-07-07 01:14 29184 —-a-w- c:\windows\SysWow64\atiu9pag.dll
2011-11-10 02:11 . 2011-11-10 02:11 53760 —-a-w- c:\windows\SysWow64\atimpc32.dll
2011-11-10 02:11 . 2011-11-10 02:11 53760 —-a-w- c:\windows\SysWow64\amdpcom32.dll
2011-11-10 02:11 . 2010-07-07 01:14 45056 —-a-w- c:\windows\system32\atitmp64.dll
2011-11-10 02:10 . 2011-11-10 02:10 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll
2011-11-08 14:58 . 2011-12-13 21:11 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-08 14:42 . 2011-12-13 21:11 2048 —-a-w- c:\windows\SysWow64\tzres.dll
2011-11-04 01:53 . 2011-12-13 22:59 2309120 —-a-w- c:\windows\system32\jscript9.dll
2011-11-04 01:44 . 2011-12-13 22:59 1390080 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 01:44 . 2011-12-13 22:59 1493504 —-a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 01:34 . 2011-12-13 22:59 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-11-03 22:47 . 2011-12-13 22:59 1798144 —-a-w- c:\windows\SysWow64\jscript9.dll
2011-11-03 22:40 . 2011-12-13 22:59 1427456 —-a-w- c:\windows\SysWow64\inetcpl.cpl
2011-11-03 22:39 . 2011-12-13 22:59 1127424 —-a-w- c:\windows\SysWow64\wininet.dll
2011-11-03 22:31 . 2011-12-13 22:59 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-10-26 02:21 . 2011-10-26 02:21 66560 —-a-w- c:\windows\system32\OVDecoder64.dll
2011-10-26 02:21 . 2011-10-26 02:21 56832 —-a-w- c:\windows\SysWow64\OVDecoder.dll
2011-10-25 16:09 . 2011-12-13 21:11 85504 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-24 19:29 . 2011-10-24 19:29 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2011-10-24 19:29 . 2011-10-24 19:29 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts
2011-10-22 11:21 . 2011-10-22 11:21 71680 —-a-w- c:\windows\system32\frapsv64.dll
2011-10-22 11:21 . 2011-10-22 11:21 65536 —-a-w- c:\windows\SysWow64\frapsvid.dll
2011-10-22 01:16 . 2011-10-22 01:16 1843200 —-a-w- c:\windows\SysWow64\SlotMaximizerBe.dll
2011-10-22 01:15 . 2011-10-22 01:15 104448 —-a-w- c:\windows\SysWow64\SlotMaximizerAg.dll
2011-10-22 01:12 . 2011-10-22 01:12 2763264 —-a-w- c:\windows\system32\SlotMaximizerBe.dll
2011-10-22 01:07 . 2011-10-22 01:07 125440 —-a-w- c:\windows\system32\SlotMaximizerAg.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-16_12.38.44 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-08-19 02:37 . 2012-01-16 11:30 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-08-19 02:37 . 2012-01-18 17:04 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-08-19 02:37 . 2012-01-16 11:30 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-08-19 02:37 . 2012-01-18 17:04 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-08-19 02:37 . 2012-01-16 11:30 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-08-19 02:37 . 2012-01-18 17:04 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-08-19 13:50 . 2012-01-18 17:05 86076 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 15:45 . 2012-01-18 17:05 67490 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2010-08-19 13:36 . 2012-01-15 19:30 24068 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4159161142-3281278779-4118727838-1000_UserData.bin
+ 2010-08-19 13:36 . 2012-01-18 17:05 24068 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4159161142-3281278779-4118727838-1000_UserData.bin
- 2012-01-15 19:28 . 2012-01-15 19:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-01-18 17:04 . 2012-01-18 17:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-01-15 19:28 . 2012-01-15 19:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-01-18 17:04 . 2012-01-18 17:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-04-01 02:26 . 2012-01-15 19:27 700104 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2011-04-01 02:26 . 2012-01-18 01:41 700104 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2010-08-19 22:28 . 2012-01-15 19:27 293420 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-08-19 22:28 . 2012-01-18 01:41 293420 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2006-11-02 12:33 . 2012-01-17 22:43 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat
- 2006-11-02 12:33 . 2012-01-12 09:05 11010048 c:\windows\system32\SMI\Store\Machine\schema.dat
- 2010-08-19 22:37 . 2012-01-15 19:27 30422584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4159161142-3281278779-4118727838-1000-8192.dat
+ 2010-08-19 22:37 . 2012-01-18 01:41 30422584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4159161142-3281278779-4118727838-1000-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-02 1242448]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]
"MtdAcqu"="c:\program files (x86)\Creative\MediaSource5\MtdAcqu.exe" [2006-03-08 278528]
"igndlm.exe"="c:\program files (x86)\Download Manager\DLM.exe" [2009-10-27 1103216]
"CTSyncU.exe"="c:\program files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 138240]
"VueMinder"="c:\program files (x86)\VueSoft\VueMinder\VueMinder.exe" [2011-08-27 4926976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-07-11 74752]
"Razer Naga Driver"="c:\program files (x86)\Razer\Naga Epic\NagaEpicSysTray.exe" [2010-12-30 957840]
"CTxfiHlp"="CTXFIHLP.EXE" [2009-06-04 25600]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]
"Zboard"="c:\program files (x86)\Ideazon\ZEngine\Zboard.exe" [2009-06-04 57344]
"DiscWizardMonitor.exe"="c:\program files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe" [2009-10-16 1325936]
"AcronisTimounterMonitor"="c:\program files (x86)\Seagate\DiscWizard\TimounterMonitor.exe" [2009-10-16 904840]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-10 343168]
.
c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ScreenHunter 5.1 Free.lnk - c:\program files (x86)\Wisdom-soft ScreenHunter 5 Free\ScreenHunter.exe [2010-9-6 5324800]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-19 02:33]
.
2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-19 02:33]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 134384 —-a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
"Seagate Scheduler2 Service"="c:\program files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe" [2009-10-16 136544]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed]
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \cars]
"Order"=hex:08,00,00,00,02,00,00,00,c2,04,00,00,01,00,00,00,06,00,00,00,84,00,
00,00,05,00,00,00,76,00,32,00,84,00,00,00,00,f9,b1,89,20,00,41,55,54,4f,53,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \computer shopping]
"Order"=hex:08,00,00,00,02,00,00,00,e4,0b,00,00,01,00,00,00,11,00,00,00,78,00,
00,00,01,00,00,00,6a,00,31,00,00,00,00,00,00,42,7a,16,10,00,42,41,52,45,42,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \computer shopping\Barebones shopping]
"Order"=hex:08,00,00,00,02,00,00,00,e6,02,00,00,01,00,00,00,03,00,00,00,f8,00,
00,00,00,00,00,00,ea,00,32,00,84,00,00,00,00,78,7f,1e,20,00,4d,4f,54,48,45,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \gay buying]
"Order"=hex:08,00,00,00,02,00,00,00,2c,04,00,00,01,00,00,00,06,00,00,00,8a,00,
00,00,00,00,00,00,7c,00,32,00,84,00,00,00,00,5a,6a,3e,20,00,41,42,4f,55,54,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \headphones]
"Order"=hex:08,00,00,00,02,00,00,00,ca,08,00,00,01,00,00,00,0c,00,00,00,a8,00,
00,00,00,00,00,00,9a,00,32,00,84,00,00,00,00,11,5d,e6,20,00,41,55,44,49,4f,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \Norwegian Forest catteries]
"Order"=hex:08,00,00,00,02,00,00,00,58,02,00,00,01,00,00,00,04,00,00,00,a4,00,
00,00,00,00,00,00,96,00,32,00,84,00,00,00,00,99,54,3f,20,00,46,42,52,4c,4e,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \Online Pharmacies]
"Order"=hex:08,00,00,00,02,00,00,00,d6,07,00,00,01,00,00,00,0a,00,00,00,ea,00,
00,00,00,00,00,00,dc,00,32,00,84,00,00,00,00,f0,1a,c8,20,00,43,41,4e,41,44,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \Sheet Music]
"Order"=hex:08,00,00,00,02,00,00,00,62,02,00,00,01,00,00,00,03,00,00,00,e4,00,
00,00,00,00,00,00,d6,00,32,00,84,00,00,00,00,2c,b3,0f,20,00,43,4c,41,53,53,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \Shoes]
"Order"=hex:08,00,00,00,02,00,00,00,60,02,00,00,01,00,00,00,03,00,00,00,64,00,
00,00,02,00,00,00,56,00,32,00,84,00,00,00,00,fa,d9,36,20,00,62,61,73,65,2e,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links\s*h*o*p*p*i*n*g*  \work]
"Order"=hex:08,00,00,00,02,00,00,00,cc,06,00,00,01,00,00,00,0a,00,00,00,aa,00,
00,00,00,00,00,00,9c,00,32,00,84,00,00,00,00,67,a5,1d,20,00,45,4b,47,54,55,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \audiobooks]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Bills]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \bittorrent]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Broadband]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers]
"Order"=hex:08,00,00,00,02,00,00,00,46,03,00,00,01,00,00,00,07,00,00,00,74,00,
00,00,00,00,00,00,66,00,31,00,00,00,00,00,00,4e,d9,7e,10,00,36,34,42,49,54,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\64 bit computing]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\BlackViper nest]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\G15]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\Linux stuff]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\video help]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \computers\Windows tips]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \employment]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,5e,01,00,00,01,00,00,00,03,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,31,00,00,00,00,00,00,21,b6,82,10,00,41,43,54,4f,52,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \entertainment\Actor sites]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \entertainment\Ifilm michael jackson]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \entertainment\music sites]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming]
"Order"=hex:08,00,00,00,02,00,00,00,36,06,00,00,01,00,00,00,0d,00,00,00,74,00,
00,00,00,00,00,00,66,00,31,00,00,00,00,00,00,f5,e2,46,10,00,42,55,59,47,41,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\buy games online]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Fable]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Halo I game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Knights of the old republic game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\mass effect]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Medieval 2 total war]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Oblivion]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\physical fitness and diet]
"Order"=hex:08,00,00,00,02,00,00,00,5e,03,00,00,01,00,00,00,05,00,00,00,c6,00,
00,00,01,00,00,00,b8,00,32,00,84,00,00,00,00,71,bc,2d,20,00,31,33,57,41,59,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Pirates game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Prince of Persia game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\Rome Total War game guide]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\WoW]
"Order"=hex:08,00,00,00,02,00,00,00,62,02,00,00,01,00,00,00,05,00,00,00,70,00,
00,00,02,00,00,00,62,00,31,00,00,00,00,00,00,e7,8e,49,10,00,4d,41,43,52,4f,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\WoW\macros for wow]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\WoW\pally prot advice]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \gaming\WoW\WoW mods]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \History]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \ians links]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \inmate]
"Order"=hex:08,00,00,00,02,00,00,00,0c,0b,00,00,01,00,00,00,14,00,00,00,76,00,
00,00,00,00,00,00,68,00,31,00,00,00,00,00,00,a3,4e,71,10,00,44,45,50,41,52,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \inmate\Department search]
"Order"=hex:08,00,00,00,02,00,00,00,ae,00,00,00,01,00,00,00,01,00,00,00,a2,00,
00,00,00,00,00,00,94,00,32,00,84,00,00,00,00,f0,b9,98,20,00,41,52,49,5a,4f,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Links]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \movie streaming sites]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \news]
"Order"=hex:08,00,00,00,02,00,00,00,dc,00,00,00,01,00,00,00,02,00,00,00,6c,00,
00,00,00,00,00,00,5e,00,31,00,00,00,00,00,00,b5,cd,b2,10,00,42,52,49,54,49,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \news\British news]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \news\gay news]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Personals]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Pittsburgh]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \podcasting]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \politics]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Recipes]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Reddit links]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Religion or nonreligion]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Search Reference Education]
"Order"=hex:08,00,00,00,02,00,00,00,6a,00,00,00,01,00,00,00,01,00,00,00,5e,00,
00,00,00,00,00,00,50,00,31,00,00,00,00,00,00,ea,f9,96,10,00,50,6f,65,74,72,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Search Reference Education\Poetry]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping]
"Order"=hex:08,00,00,00,02,00,00,00,c4,03,00,00,01,00,00,00,09,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,75,d6,84,10,00,63,61,72,73,00,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\cars]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\computer shopping]
"Order"=hex:08,00,00,00,02,00,00,00,84,00,00,00,01,00,00,00,01,00,00,00,78,00,
00,00,00,00,00,00,6a,00,31,00,00,00,00,00,00,22,f5,ed,10,00,42,41,52,45,42,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\computer shopping\Barebones shopping]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\gay buying]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\headphones]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Norwegian Forest catteries]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Online Pharmacies]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Sheet Music]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Shoes]
"Order"=hex:08,00,00,00,02,00,00,00,64,00,00,00,01,00,00,00,01,00,00,00,58,00,
00,00,00,00,00,00,4a,00,31,00,00,00,00,00,00,1a,a0,11,10,00,63,61,72,73,00,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\Shoes\cars]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \shopping\work]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Sports]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff]
"Order"=hex:08,00,00,00,02,00,00,00,f8,03,00,00,01,00,00,00,0a,00,00,00,68,00,
00,00,00,00,00,00,5a,00,31,00,00,00,00,00,00,37,1e,ee,10,00,42,49,47,4d,55,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\big muscle]
"Order"=hex:08,00,00,00,02,00,00,00,46,09,00,00,01,00,00,00,0f,00,00,00,a4,00,
00,00,00,00,00,00,96,00,32,00,84,00,00,00,00,d7,e5,4b,20,00,42,4d,50,52,4f,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\bigmusclebears]
"Order"=hex:08,00,00,00,02,00,00,00,d0,11,00,00,01,00,00,00,1f,00,00,00,98,00,
00,00,00,00,00,00,8a,00,32,00,84,00,00,00,00,05,1b,59,20,00,42,4d,42,2d,42,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\cams]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\escorts]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\favorite stuff]
"Order"=hex:08,00,00,00,02,00,00,00,6a,09,00,00,01,00,00,00,10,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,77,b6,7a,20,00,41,44,41,4d,43,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\fetish]
"Order"=hex:08,00,00,00,02,00,00,00,fe,04,00,00,01,00,00,00,07,00,00,00,88,00,
00,00,00,00,00,00,7a,00,32,00,84,00,00,00,00,77,89,ac,20,00,43,4f,56,45,52,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\History]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\MSN Groups]
"Order"=hex:08,00,00,00,02,00,00,00,7a,00,00,00,01,00,00,00,01,00,00,00,6e,00,
00,00,00,00,00,00,60,00,31,00,00,00,00,00,00,b4,32,89,10,00,4d,41,4c,45,50,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\MSN Groups\malepornstars]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\personals]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \stuff\shrines]
"Order"=hex:08,00,00,00,02,00,00,00,a4,01,00,00,01,00,00,00,03,00,00,00,76,00,
00,00,00,00,00,00,68,00,32,00,84,00,00,00,00,bf,c7,9a,20,00,42,4f,44,49,58,\
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \translation]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \Web Channels]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-4159161142-3281278779-4118727838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*i*n*k*s* \work]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Completion time: 2012-01-18 14:29:04
ComboFix-quarantined-files.txt 2012-01-18 19:29
ComboFix2.txt 2012-01-16 12:41
.
Pre-Run: 499,258,904,576 bytes free
Post-Run: 499,184,492,544 bytes free
.
- - End Of File - - 956F8F0EAF92448974BA66FA00CBC521