Spyware / Malware / Virus Removal

Smitfraud removal [Solved]

597 min read

Looking for the outcome? Ask AI

djchalf Topic Starter

Post #1January 26, 2012, 6:53 PM UTC

Hi recently I ran a scan using spybot and it found an instance of smitfraud-c attached to a svchost.exe file. I look online and found that other people with this problem were told to download and run smitfraudfix in safe mode. I ran this and it did find some threats and removed them however it was unable to remove the smitfraud. running the spybot in admin mode allowed me to remove it. however when i removed it this way my computer has a weird problem where it doesnt like to boot and instead runs windows startup repair, fails to repair itself, im forced to shut down the computer, and when i restart it, it boots normally (slower than normal) but error free. if anyone thinks that this smitfraud or deleting my svchost is the problem im having let me know even better if you know how to delete why smitfraudfix isnt working. I look forward to your reply's and thanks in advance.

Satchfan

Post #2January 27, 2012, 10:55 AM UTC

Hello djchalf and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Download and run OTL

download OTL to your desktop.
double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
when the window appears, underneath Output at the top change it to Minimal Output.
check the boxes beside LOP Check and Purity Check.
under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\*.*
Update\Results\Install|LastSuccessTime /rs
%appdata%\Microsoft\Windows\Start Menu\*.* /s
%programdata%\Microsoft\Windows\Start Menu\*.* /s
click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
you may need two posts to fit them both in.

===================================================

Run aswMBR

download aswMBR.exe to your desktop.
double click the aswMBR.exe to run it
if asked, accept the AVAST virus definition download
click the "Scan" button to start scan
on completion of the scan click Save log, save it to your desktop and post in your next reply

Logs to include with next post:

OTL.txt
Extras.txt
aswMBR log

Thanks

Satchfan

djchalf

Post #3January 28, 2012, 3:35 AM UTC

Thanks for the reply here are the logs. These are just from the OTL I'll post the avast log in a different comment.

OTL logfile created on: 1/27/2012 7:17:52 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Dillon\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.93 Gb Total Physical Memory | 1.58 Gb Available Physical Memory | 40.17% Memory free
7.85 Gb Paging File | 5.25 Gb Available in Paging File | 66.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 446.23 Gb Total Space | 185.50 Gb Free Space | 41.57% Space Free | Partition Type: NTFS

Computer Name: DILLON-PC | User Name: Dillon | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Dillon\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Windows\AsScrPro.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe (asus)
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
PRC - C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpy.exe ()
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe ()
PRC - \\.\globalroot\systemroot\svchost.exe ()
PRC - \\.\globalroot\systemroot\svchost.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()
PRC - C:\Program Files (x86)\CA\PPRT\bin\ITMRTSVC.exe (CA, Inc.)
PRC - C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpWareSE4.exe (ScanSoft, Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Users\Dillon\AppData\Local\compatGLMusic\usbcrtSupport.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\1049a76b3de293df726d380932215c91\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07cdef1a740151932dcf161f3306bd9c\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\70e2ca33ffa52c743285dc5b4910a229\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7c94a121334aeca7553c7f01290740f0\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\ControlDeck\Brightness.dll ()
MOD - C:\Program Files (x86)\ASUS\ControlDeck\P4GControl.dll ()
MOD - C:\Program Files (x86)\ASUS\ControlDeck\Resolution.dll ()
MOD - C:\Program Files (x86)\ASUS\ControlDeck\Volume.dll ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
MOD - C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpy.exe ()
MOD - C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

========== Win32 Services (SafeList) ==========

SRV:64bit: - (TMBMServer) – C:\Program Files\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.)
SRV:64bit: - (TmProxy) – C:\Program Files\Trend Micro\Internet Security\TmProxy.exe (Trend Micro Inc.)
SRV:64bit: - (SfCtlCom) – C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe (Trend Micro Inc.)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AFBAgent) – C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV:64bit: - (TurboBoost) – C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel® Corporation)
SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (BBSvc) – C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) – C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (TeamViewer6) – C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (Creative ALchemy AL6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ATKGFNEXSrv) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (AntiSpywareService) – C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe ()
SRV - (ASLDRService) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SBSDWSCService) – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (ITMRTSVC) – C:\Program Files (x86)\CA\PPRT\bin\ITMRTSVC.exe (CA, Inc.)

========== Driver Services (SafeList) ==========

DRV:64bit: - (taphss) – C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (hamachi) – C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (cpuz135) – C:\Windows\SysNative\drivers\cpuz135_x64.sys (CPUID)
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (tmxpflt) – C:\Windows\SysNative\drivers\tmxpflt.sys (Trend Micro Inc.)
DRV:64bit: - (tmpreflt) – C:\Windows\SysNative\drivers\tmpreflt.sys (Trend Micro Inc.)
DRV:64bit: - (vsapint) – C:\Windows\SysNative\drivers\vsapint.sys (Trend Micro Inc.)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (tmtdi) – C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (HECIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (AmUStor) – C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (TurboB) – C:\Windows\SysNative\drivers\TurboB.sys ()
DRV:64bit: - (kbfiltr) – C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidEqd) – C:\Windows\SysNative\drivers\LHidEqd.sys (Logitech, Inc.)
DRV:64bit: - (LEqdUsb) – C:\Windows\SysNative\drivers\LEqdUsb.sys (Logitech, Inc.)
DRV:64bit: - (SiSGbeLH) – C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) – C:\Windows\SysNative\drivers\snp2uvc.sys ()
DRV:64bit: - (RTHDMIAzAudService) – C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)
DRV:64bit: - (NuidFltr) – C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (TarFltr) – C:\Windows\SysNative\drivers\UsbFltr.sys (Razer USA Ltd.)
DRV:64bit: - (uisp) – C:\Windows\SysNative\drivers\usbicp.sys (Motorola)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.hotspotshield.com/g/?c=h
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://asus.msn.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Hotspot Shield Private Search"
FF - prefs.js..browser.startup.homepage: "http://www.xfinity.com/customer/start/?attr=mm&cid;=insDate09022011"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: [removed]:9.0.0.736
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://search.hotspotshield.com/g/results.php?c=s&q;="
FF - prefs.js..network.proxy.type: 0

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Dillon\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Dillon\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Dillon\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Dillon\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/01/02 10:20:57 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/12/05 15:50:31 | 000,000,000 | —D | M]

[2010/07/15 13:12:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Dillon\AppData\Roaming\Mozilla\Extensions
[2012/01/26 10:06:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\extensions
[2012/01/26 10:06:33 | 000,000,000 | —D | M] (XFINITY Toolbar) – C:\Users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\extensions\{4b9bcce8-a70b-402a-a7e1-db96831ee26f}
[2012/01/26 10:06:33 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2012/01/26 10:06:33 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\extensions\[removed]
[2012/01/26 10:06:33 | 000,000,000 | —D | M] (Search Toolbar) – C:\Users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\extensions\[removed]
[2012/01/26 10:06:33 | 000,000,000 | —D | M] ("Ask Toolbar") – C:\Users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\extensions\[removed]
[2011/02/28 12:58:24 | 000,001,919 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\searchplugins\bing-zugo.xml
[2012/01/26 10:06:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/01/26 10:06:06 | 000,000,000 | —D | M] (Click to call with Skype) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/01/26 10:06:06 | 000,000,000 | —D | M] (Kaspersky URL Advisor) – C:\Program Files (x86)\Mozilla Firefox\extensions\[removed]
[2012/01/02 10:20:57 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/04/15 15:05:08 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/05/06 16:16:02 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/11/10 02:25:06 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.63\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.63\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.63\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\Dillon\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\Dillon\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: QUAKE LIVE (Enabled) = C:\ProgramData\id Software\QuakeLive\npquakezero.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Ask Toolbar = C:\Users\Dillon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaapodhaoggdemfffbmjpgfgekfjjpe\7.13.1.0_0\
CHR - Extension: YouTube = C:\Users\Dillon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google Search = C:\Users\Dillon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Gmail = C:\Users\Dillon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\

O1 HOSTS File: ([2009/06/10 13:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll File not found
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (XFINITY Toolbar) - {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll ()
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files (x86)\Search Toolbar\SearchToolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Updater For XFIN_PORTAL) - {bb46be07-13eb-4c49-b0f0-fc78b9ea4983} - C:\Program Files (x86)\xfin_portal\auxi\comcastAu.dll (Visicom Media)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (XFINITY Toolbar) - {4b9bcce8-a70b-402a-a7e1-db96831ee26f} - C:\Program Files (x86)\xfin_portal\comcastdx.dll ()
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files (x86)\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files (x86)\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4:64bit: - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [ComcastAntispyClient] C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe ()
O4 - HKCU..\Run: [Desktop Software] C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [NetMeter] C:\Program Files (x86)\NetMeter\NetMeter.exe File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [usbcrtSupport] C:\Users\Dillon\AppData\Local\compatGLMusic\usbcrtSupport.dll ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0…inAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5970D945-3B6F-4730-BF11-65C7F8262269}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/23 12:25:06 | 000,000,000 | —D | C] – C:\Users\Dillon\AppData\Roaming\SpeedyPC Software
[2012/01/23 12:25:06 | 000,000,000 | —D | C] – C:\Users\Dillon\AppData\Roaming\DriverCure
[2012/01/23 12:24:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\SpeedyPC Software
[2012/01/23 12:24:51 | 000,000,000 | —D | C] – C:\ProgramData\SpeedyPC Software
[2012/01/23 12:24:51 | 000,000,000 | —D | C] – C:\Program Files (x86)\SpeedyPC Software
[2012/01/22 21:20:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\F47BA
[2012/01/22 21:20:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\LP
[2012/01/22 21:19:50 | 000,000,000 | —D | C] – C:\Windows\system64
[2012/01/22 11:16:00 | 000,000,000 | -H-D | C] – C:\$AVG
[2012/01/22 10:55:21 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2012/01/22 10:54:58 | 000,000,000 | —D | C] – C:\Windows\SysWow64\drivers\AVG
[2012/01/22 10:54:10 | 000,000,000 | —D | C] – C:\ProgramData\AVG2012
[2012/01/22 10:53:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVG
[2012/01/22 10:50:27 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2012/01/22 10:44:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/01/22 10:44:21 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2012/01/22 10:44:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spybot - Search & Destroy
[2012/01/22 10:41:31 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\svchost.exe
[2012/01/21 21:17:08 | 000,000,000 | —D | C] – C:\Windows\Sun
[2012/01/14 18:27:10 | 000,000,000 | —D | C] – C:\Users\Dillon\AppData\Local\compatGLMusic
[2012/01/11 09:31:23 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\packager.dll
[2012/01/11 09:31:23 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\packager.dll
[2012/01/11 09:31:22 | 001,572,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\quartz.dll
[2012/01/11 09:31:22 | 001,328,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\quartz.dll
[2012/01/11 09:31:22 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\qdvd.dll
[2012/01/11 09:31:22 | 000,366,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\qdvd.dll
[2012/01/11 09:31:20 | 000,918,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/01/11 09:31:20 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/01/11 09:31:19 | 001,731,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntdll.dll

========== Files - Modified Within 30 Days ==========

[2012/01/27 19:13:37 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/27 19:08:43 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/27 19:08:06 | 000,010,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/27 19:08:06 | 000,010,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/27 19:05:29 | 000,784,224 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/01/27 19:05:29 | 000,663,886 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/01/27 19:05:29 | 000,122,464 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/01/27 19:01:03 | 000,000,434 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.ics
[2012/01/27 19:00:33 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/27 19:00:26 | 3161,886,720 | -HS- | M] () – C:\hiberfil.sys
[2012/01/26 10:32:52 | 000,001,447 | —- | M] () – C:\Windows\SysNative\ServiceFilter.ini
[2012/01/26 10:32:49 | 000,002,490 | —- | M] () – C:\Windows\SysNative\AutoRunFilter.ini
[2012/01/22 10:50:37 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2135112261-1923993808-919250933-1001UA.job
[2012/01/22 10:44:27 | 000,001,284 | —- | M] () – C:\Users\Dillon\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/01/22 10:44:27 | 000,001,260 | —- | M] () – C:\Users\Dillon\Desktop\Spybot - Search & Destroy.lnk
[2012/01/22 10:41:03 | 000,045,056 | —- | M] () – C:\Windows\SysNative\acovcnt.exe
[2012/01/17 21:50:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2135112261-1923993808-919250933-1001Core.job
[2012/01/11 09:27:57 | 000,778,440 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/06 21:51:36 | 000,002,342 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2012/01/02 10:21:05 | 000,002,054 | —- | M] () – C:\Users\Dillon\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

========== Files Created - No Company Name ==========

[2012/01/22 10:44:27 | 000,001,284 | —- | C] () – C:\Users\Dillon\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/01/22 10:44:27 | 000,001,260 | —- | C] () – C:\Users\Dillon\Desktop\Spybot - Search & Destroy.lnk
[2011/12/11 20:38:52 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/12/11 20:23:10 | 000,158,720 | —- | C] () – C:\Windows\SysWow64\WS_VideoConverterContextMenu.dll
[2011/12/11 20:15:50 | 000,003,584 | —- | C] () – C:\Users\Dillon\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/15 10:19:41 | 000,000,032 | R— | C] () – C:\ProgramData\hash.dat
[2011/05/28 20:31:28 | 000,000,428 | —- | C] () – C:\Windows\MAXLINK.INI
[2010/07/27 12:21:16 | 000,778,440 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/07/15 13:18:11 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/06/01 21:27:03 | 000,053,248 | —- | C] () – C:\Windows\SysWow64\LogonStart.dll
[2010/06/01 21:23:07 | 000,000,735 | —- | C] () – C:\Windows\FF05_Render_Spk_Hp.ini
[2010/06/01 21:23:07 | 000,000,508 | —- | C] () – C:\Windows\FF05_not_Spk_Hp.ini
[2010/06/01 21:20:51 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2010/06/01 21:20:51 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2010/06/01 21:18:15 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2009/08/19 00:33:09 | 000,020,480 | —- | C] () – C:\Windows\OOBEPlayer.exe
[2009/08/19 00:33:09 | 000,000,232 | —- | C] () – C:\Windows\OOBEPlayer.ini
[2009/07/28 21:20:40 | 000,000,010 | —- | C] () – C:\Windows\SysWow64\ABLKSR.ini
[2009/07/13 21:38:36 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 18:35:51 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 18:34:42 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2009/07/13 16:10:29 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 15:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 13:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 13:26:10 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2008/12/01 17:32:32 | 000,362,029 | —- | C] () – C:\Windows\SysWow64\sqlite3.dll

========== LOP Check ==========

[2012/01/26 10:06:32 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\.minecraft
[2011/09/05 08:55:15 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\DAEMON Tools Lite
[2012/01/23 12:25:06 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\DriverCure
[2010/10/12 18:57:28 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\Elluminate
[2011/06/25 13:20:29 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\GARMIN
[2011/11/30 10:36:11 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\gtk-2.0
[2010/12/27 21:26:30 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\Leadertech
[2011/12/11 20:28:13 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\Leawo
[2010/07/17 11:12:27 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\LolClient
[2011/09/24 23:49:22 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\NetMeter
[2011/09/17 11:43:01 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\Rainmeter
[2011/09/05 17:03:14 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\runic games
[2011/05/28 20:31:19 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\ScanSoft
[2012/01/26 10:06:33 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\SoftGrid Client
[2012/01/23 12:25:06 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\SpeedyPC Software
[2011/09/03 19:24:10 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\TeamViewer
[2011/12/11 20:28:59 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\tiger-k
[2010/07/27 12:21:59 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\TP
[2011/12/01 16:49:05 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\TS3Client
[2011/12/16 11:36:08 | 000,000,000 | —D | M] – C:\Users\Dillon\AppData\Roaming\uTorrent
[2011/10/29 15:22:15 | 000,032,572 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/06/15 03:11:59 | 000,000,054 | —- | M] () – C:\AdobeReader.log
[2010/11/20 04:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2009/07/28 22:03:37 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2010/06/01 21:23:58 | 000,000,086 | —- | M] () – C:\creative.log
[2010/06/01 21:36:05 | 000,017,376 | —- | M] () – C:\devlist.txt
[2008/04/11 09:07:18 | 000,003,820 | —- | M] () – C:\eula.1028.txt
[2008/04/11 09:07:18 | 000,015,428 | —- | M] () – C:\eula.1031.txt
[2008/04/11 09:07:18 | 000,010,058 | —- | M] () – C:\eula.1033.txt
[2008/04/11 09:07:18 | 000,012,246 | —- | M] () – C:\eula.1036.txt
[2008/04/11 09:07:18 | 000,013,912 | —- | M] () – C:\eula.1040.txt
[2008/04/11 09:07:18 | 000,005,868 | —- | M] () – C:\eula.1041.txt
[2008/04/11 09:07:18 | 000,005,970 | —- | M] () – C:\eula.1042.txt
[2008/04/11 09:07:18 | 000,010,134 | —- | M] () – C:\eula.1049.txt
[2008/04/11 09:07:18 | 000,003,814 | —- | M] () – C:\eula.2052.txt
[2008/04/11 09:07:18 | 000,012,936 | —- | M] () – C:\eula.3082.txt
[2010/06/01 21:36:04 | 000,000,009 | —- | M] () – C:\Finish.log
[2010/01/05 00:11:29 | 002,097,152 | -H– | M] () – C:\G73Jh.BIN
[2010/01/05 06:03:50 | 000,000,018 | —- | M] () – C:\G73JH_WIN7.10
[2008/04/11 09:07:18 | 000,001,110 | —- | M] () – C:\globdata.ini
[2012/01/27 19:00:26 | 3161,886,720 | -HS- | M] () – C:\hiberfil.sys
[2010/06/01 21:26:20 | 000,458,886 | —- | M] () – C:\if.log
[2008/04/11 07:03:48 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe
[2008/04/11 09:07:18 | 000,000,843 | —- | M] () – C:\install.ini
[2008/04/11 07:03:48 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2008/04/11 07:03:48 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2008/04/11 07:03:48 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2008/04/11 07:03:48 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2008/04/11 07:03:48 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2008/04/11 07:03:48 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2008/04/11 07:03:48 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2008/04/11 09:09:24 | 000,093,200 | —- | M] (Microsoft Corporation) – C:\install.res.1049.dll
[2008/04/11 07:03:48 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2008/04/11 07:03:48 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2006/12/01 23:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2012/01/27 19:00:31 | 4215,853,056 | -HS- | M] () – C:\pagefile.sys
[2010/06/01 08:19:22 | 000,000,163 | —- | M] () – C:\Pass.txt
[2012/01/23 18:19:57 | 000,002,303 | —- | M] () – C:\rapport.txt
[2010/01/05 06:03:50 | 000,000,007 | —- | M] () – C:\RECOVERY.DAT
[2010/06/01 21:20:56 | 000,003,340 | —- | M] () – C:\RHDSetup.log
[2011/06/05 19:31:33 | 000,000,083 | —- | M] () – C:\setup.log
[2006/05/13 08:22:24 | 000,000,005 | —- | M] () – C:\store.log
[2010/06/01 21:27:27 | 000,000,166 | —- | M] () – C:\SumHidd.txt
[2010/06/01 21:26:46 | 000,000,098 | —- | M] () – C:\SumOS.txt
[2008/04/11 09:07:18 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2008/04/11 09:09:38 | 003,797,292 | —- | M] () – C:\VC_RED.cab
[2008/04/11 09:11:40 | 000,233,472 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2008/12/04 21:55:20 | 000,307,560 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2011/09/07 14:07:02 | 000,001,702 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\LastFlashConfig.wfc

< %PROGRAMFILES%\*.* >
[2009/07/13 20:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/07/15 12:54:32 | 000,000,221 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto >

< HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\*.* >

< Update\Results\Install|LastSuccessTime /rs >

< %appdata%\Microsoft\Windows\Start Menu\*.* /s >
[2011/07/13 13:37:38 | 000,000,174 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
[2011/07/13 13:37:38 | 000,000,476 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
[2010/07/15 12:29:06 | 000,001,411 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2010/07/15 12:29:06 | 000,001,445 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2009/07/13 20:54:27 | 000,001,280 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk
[2009/07/13 20:54:32 | 000,000,678 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
[2009/07/13 20:54:32 | 000,001,304 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk
[2009/07/13 20:49:38 | 000,000,262 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk
[2009/07/13 20:49:38 | 000,001,228 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
[2009/07/13 20:54:02 | 000,000,704 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
[2009/07/13 20:54:01 | 000,001,358 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk
[2009/07/13 20:54:00 | 000,001,258 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk
[2009/07/13 20:54:02 | 000,001,262 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
[2009/07/13 20:54:00 | 000,001,250 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
[2009/07/13 20:49:38 | 000,000,262 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk
[2009/07/13 20:49:38 | 000,000,262 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk
[2010/07/15 12:29:06 | 000,000,738 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
[2010/07/15 12:29:06 | 000,001,495 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
[2009/07/13 20:54:59 | 000,001,306 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk
[2011/07/13 13:37:38 | 000,000,174 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
[2011/12/14 20:39:11 | 000,000,242 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games\Command & Conquer™ Red Alert™ 2.lnk
[2011/12/10 21:42:49 | 000,000,240 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games\Oblivion The Elder Scrolls IV™.lnk
[2009/07/13 20:49:38 | 000,000,318 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
[2009/07/13 20:49:38 | 000,000,262 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk
[2011/02/21 15:03:29 | 000,001,089 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft (Beta v1.2_01)\Change Playername.lnk
[2011/02/21 15:03:29 | 000,001,174 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft (Beta v1.2_01)\Uninstall Minecraft (Beta v1.2_01).lnk
[2011/07/07 01:32:58 | 000,002,035 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rainmeter\RainBackup.lnk
[2011/07/07 01:32:58 | 000,002,051 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rainmeter\RainBrowser.lnk
[2011/07/07 01:32:58 | 000,000,068 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rainmeter\Rainmeter Help.URL
[2011/07/07 01:32:58 | 000,001,732 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rainmeter\Rainmeter.lnk
[2011/07/07 01:32:58 | 000,002,051 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rainmeter\Rainstaller.lnk
[2011/07/07 01:32:58 | 000,002,035 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rainmeter\RainThemes.lnk
[2011/07/07 01:32:58 | 000,001,491 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rainmeter\Remove Rainmeter.lnk
[2011/11/29 02:24:14 | 000,001,215 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II Public Test.lnk
[2011/07/13 13:37:38 | 000,000,174 | -HS- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
[2011/06/04 06:33:01 | 000,001,294 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
[2010/08/30 01:53:16 | 000,000,994 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
[2010/08/30 01:53:16 | 000,001,013 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
[2010/08/30 01:53:16 | 000,001,013 | —- | M] () – C:\Users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk

< %programdata%\Microsoft\Windows\Start Menu\*.* /s >
[2009/07/13 21:01:14 | 000,001,282 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
[2009/07/13 21:01:14 | 000,000,442 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
[2009/07/13 20:49:40 | 000,001,266 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
[2010/12/24 13:04:45 | 000,000,951 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\µTorrent.lnk
[2010/06/01 21:04:51 | 000,001,011 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat.com.lnk
[2011/02/09 08:19:15 | 000,002,441 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011/08/24 23:00:52 | 000,002,519 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2010/06/01 20:55:27 | 000,001,130 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
[2009/07/28 21:08:11 | 000,001,345 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2010/06/01 20:55:20 | 000,002,435 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2010.lnk
[2011/05/06 16:16:05 | 000,001,152 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2009/07/13 20:57:08 | 000,001,330 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2011/09/05 19:51:19 | 000,001,176 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2009/07/13 20:57:09 | 000,001,352 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2009/07/28 21:08:05 | 000,001,326 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2009/07/13 20:54:59 | 000,001,210 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2010/06/01 20:55:27 | 000,001,547 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2009/07/13 20:57:08 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2009/07/13 20:55:00 | 000,001,230 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
[2009/07/28 21:08:13 | 000,001,726 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
[2009/07/13 20:54:23 | 000,001,266 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
[2009/07/28 21:08:13 | 000,001,364 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk
[2009/07/28 21:08:01 | 000,001,238 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk
[2009/07/13 20:54:32 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
[2009/07/13 20:53:55 | 000,001,367 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk
[2009/07/28 21:08:11 | 000,001,272 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
[2009/07/13 20:57:08 | 000,001,330 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk
[2009/07/28 21:08:12 | 000,001,351 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
[2009/07/13 20:54:58 | 000,001,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk
[2009/07/13 20:57:09 | 000,001,579 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
[2009/07/13 20:54:58 | 000,001,322 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk
[2009/07/13 20:57:07 | 000,000,370 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
[2009/07/13 20:57:07 | 000,001,388 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk
[2009/07/13 20:55:00 | 000,001,248 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk
[2009/07/13 20:57:09 | 000,001,338 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
[2009/07/13 20:54:25 | 000,001,290 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\dfrgui.lnk
[2009/07/13 20:54:58 | 000,001,252 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk
[2009/07/13 20:53:50 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Resource Monitor.lnk
[2009/07/13 20:53:33 | 000,001,250 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk
[2009/07/13 20:54:57 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Restore.lnk
[2009/07/13 20:54:29 | 000,001,268 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Task Scheduler.lnk
[2009/07/13 20:57:09 | 000,001,320 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer Reports.lnk
[2009/07/13 20:57:09 | 000,001,316 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk
[2009/07/28 21:08:12 | 000,000,343 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini
[2009/07/28 21:08:01 | 000,001,436 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk
[2009/07/28 21:08:00 | 000,001,386 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk
[2009/07/28 21:08:12 | 000,001,316 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk
[2009/07/13 20:57:13 | 000,000,216 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
[2009/07/13 21:32:31 | 000,001,989 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk
[2009/07/13 20:57:13 | 000,001,468 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE (x86).lnk
[2009/07/13 20:57:13 | 000,001,468 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk
[2009/07/13 21:32:31 | 000,001,899 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
[2009/07/13 20:57:13 | 000,001,242 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk
[2009/07/13 20:54:21 | 000,001,294 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk
[2009/07/13 20:53:52 | 000,001,270 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk
[2009/07/13 20:57:13 | 000,001,674 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
[2009/07/13 20:54:29 | 000,001,298 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk
[2009/07/13 20:54:22 | 000,001,274 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk
[2009/07/13 20:53:33 | 000,001,268 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk
[2009/07/13 20:53:50 | 000,001,232 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk
[2009/07/13 20:54:05 | 000,001,288 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/13 20:53:33 | 000,001,246 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
[2009/07/13 20:54:29 | 000,001,262 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk
[2009/07/13 20:53:58 | 000,001,274 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk
[2009/07/13 21:32:31 | 000,002,741 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk
[2010/06/01 21:27:03 | 000,002,613 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\AI Recovery Burner.lnk
[2011/06/05 19:32:19 | 000,002,617 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\ASUS Virtual Camera.lnk
[2011/06/05 19:30:16 | 000,002,613 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\ControlDeck.lnk
[2011/06/05 19:30:39 | 000,002,611 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\FancyStart.lnk
[2010/06/01 21:27:30 | 000,001,985 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\FastBoot.lnk
[2010/06/01 21:26:31 | 000,001,112 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\LifeFrame.lnk
[2011/09/17 09:44:21 | 000,002,575 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\Power4Gear Hybrid.lnk
[2011/06/05 19:32:41 | 000,001,128 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\WinFlash.Lnk
[2010/06/01 21:26:25 | 000,001,832 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\ASUS Live Update\ASUS Live Update.lnk
[2010/06/01 21:27:19 | 000,001,134 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\ASUS Splendid Utility\Splendid Compatibility Tool.Lnk
[2010/06/01 21:27:20 | 000,001,134 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\ASUS Splendid Utility\Splendid Utility.Lnk
[2011/06/05 19:31:04 | 000,001,116 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\SmartLogon\General disclaimer.lnk
[2011/06/05 19:31:04 | 000,001,167 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\SmartLogon\SmartLogon Console.lnk
[2011/06/05 19:31:04 | 000,001,174 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility\SmartLogon\SmartLogon Manager.lnk
[2010/06/01 21:29:06 | 000,001,051 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Best Buy Software Installer\Best Buy Software Installer.lnk
[2010/06/01 21:29:06 | 000,000,837 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Best Buy Software Installer\Uninstall Best Buy Software Installer.lnk
[2011/12/24 08:35:01 | 000,000,121 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\ElderScrolls.com.url
[2011/12/24 08:35:01 | 000,001,046 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\Oblivion.lnk
[2011/12/24 08:35:01 | 000,000,996 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\Readme.txt.lnk
[2011/12/24 08:35:01 | 000,000,131 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\Register Oblivion.url
[2011/12/24 08:35:01 | 000,001,445 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\Uninstall Oblivion.lnk
[2011/05/28 20:26:51 | 000,002,290 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon IJ Notes for Windows Vista\Canon IJ Notes for Windows Vista.lnk
[2011/05/28 20:26:52 | 000,001,180 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon IJ Notes for Windows Vista\Uninstall.lnk
[2011/05/28 20:26:47 | 000,002,282 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP160 Manual\MP160 On-screen Manual.lnk
[2011/05/28 20:26:50 | 000,001,161 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP160 Manual\Uninstall.lnk
[2011/05/28 20:35:02 | 000,002,021 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP160 User Registration\User Registration Uninstall.LNK
[2011/05/28 20:35:02 | 000,002,021 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP160 User Registration\User Registration.LNK
[2011/05/28 20:26:36 | 000,001,202 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP160\Readme.lnk
[2011/05/28 20:26:37 | 000,001,526 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP160\Uninstall.lnk
[2011/05/28 20:27:01 | 000,001,815 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities\My Printer\My Printer Readme.lnk
[2011/05/28 20:27:01 | 000,001,837 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities\My Printer\My Printer Uninstall.lnk
[2011/05/28 20:27:01 | 000,001,822 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities\My Printer\My Printer.lnk
[2010/06/01 21:16:54 | 000,002,094 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center\CCC - Advanced.lnk
[2010/06/01 21:16:54 | 000,002,088 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center\CCC - Wizard.lnk
[2010/06/01 21:16:54 | 000,002,082 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center\CCC.lnk
[2010/06/01 21:16:54 | 000,002,096 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center\Help.lnk
[2010/06/01 21:16:54 | 000,002,078 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center\Restart Runtime.lnk
[2011/09/05 08:51:36 | 000,000,082 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner Homepage.url
[2011/09/05 08:51:36 | 000,000,842 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk
[2011/09/05 08:51:36 | 000,000,603 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\Uninstall CCleaner.lnk
[2011/11/08 10:42:34 | 000,000,956 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID\HWMonitor\HWMonitor.lnk
[2011/11/08 10:42:34 | 000,000,951 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID\HWMonitor\Uninstall HWMonitor.lnk
[2010/06/01 21:23:04 | 000,002,040 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative\ALchemy\Creative ALchemy.lnk
[2010/06/01 21:23:24 | 000,002,087 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative\Creative MediaSource 5\Creative MediaSource 5 Audio Converter.lnk
[2010/06/01 21:23:24 | 000,002,102 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative\Creative MediaSource 5\Creative MediaSource 5 Organizer.lnk
[2010/06/01 21:23:24 | 000,002,096 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative\Creative MediaSource 5\Creative MediaSource 5 Player.lnk
[2010/06/01 21:22:57 | 000,002,238 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative\Sound Blaster Audigy HD\Creative Audio Center.lnk
[2010/06/01 21:23:03 | 000,002,238 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative\Sound Blaster Audigy HD\Creative WaveStudio 7.lnk
[2010/06/01 21:23:01 | 000,002,254 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative\Sound Blaster Audigy HD\Volume Panel.lnk
[2011/10/07 11:30:20 | 000,000,988 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Digital Copy\Download Manager.lnk
[2011/10/07 11:30:20 | 000,000,968 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Digital Copy\Redeem a Digital Copy.lnk
[2010/06/01 21:25:27 | 000,001,706 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Gate\Express Gate Installer\Help.lnk
[2010/06/01 21:25:27 | 000,001,943 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Gate\Express Gate Installer\Repair this software.lnk
[2010/06/01 21:25:27 | 000,001,942 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Gate\Express Gate Installer\Uninstall.lnk
[2011/10/03 02:23:36 | 000,000,202 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Age of Conan.lnk
[2009/07/28 21:08:00 | 000,000,352 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Chess.lnk
[2009/07/28 21:08:01 | 000,001,128 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini
[2009/07/13 20:55:00 | 000,000,364 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\FreeCell.lnk
[2009/07/13 20:54:59 | 000,000,258 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\GameExplorer.lnk
[2009/07/13 20:57:12 | 000,000,356 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Hearts.lnk
[2009/07/28 21:08:00 | 000,000,474 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Internet Backgammon.lnk
[2009/07/28 21:08:01 | 000,000,470 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Internet Checkers.lnk
[2009/07/28 21:08:00 | 000,000,466 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Internet Spades.lnk
[2009/07/28 21:08:01 | 000,000,360 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Mahjong.lnk
[2009/07/13 20:57:12 | 000,000,376 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Minesweeper.lnk
[2009/07/13 20:57:12 | 000,000,370 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\More Games from Microsoft.lnk
[2009/07/13 20:57:12 | 000,000,378 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Purble Place.lnk
[2009/07/13 20:55:01 | 000,000,368 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Solitaire.lnk
[2009/07/13 20:57:12 | 000,000,392 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Spider Solitaire.lnk
[2011/11/29 02:23:30 | 000,000,554 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\StarCraft II Wings of Liberty™.lnk
[2010/09/08 11:37:21 | 000,000,212 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\World of Warcraft.lnk
[2011/05/01 00:10:55 | 000,001,115 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP\GIMP 2.lnk
[2011/05/01 00:10:55 | 000,001,133 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP\Uninstall.lnk
[2012/01/06 21:51:36 | 000,002,360 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
[2012/01/06 21:51:36 | 000,002,393 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Uninstall Google Chrome.lnk
[2011/11/13 01:14:54 | 000,001,912 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth\Uninstall Google Earth Plug-in.lnk
[2011/01/14 22:43:42 | 000,000,979 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hamachi\Hamachi.lnk
[2011/01/14 22:43:42 | 000,000,997 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hamachi\Uninstall.lnk
[2011/12/05 15:48:58 | 000,002,107 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\About iTunes.lnk
[2011/12/05 15:48:58 | 000,001,803 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk
[2011/12/11 20:26:16 | 000,002,006 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Leawo\Free AVI Converter\Leawo AVI Converter Uninstall.lnk
[2011/12/11 20:26:16 | 000,001,179 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Leawo\Free AVI Converter\Leawo AVI Converter.lnk
[2011/12/11 20:26:16 | 000,001,811 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Leawo\Free AVI Converter\Xvid\Configure Decoder.lnk
[2011/12/11 20:26:16 | 000,001,176 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Leawo\Free AVI Converter\Xvid\Licence.lnk
[2010/12/27 21:24:49 | 000,001,757 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech\Mouse and Keyboard\Help Center.lnk
[2010/12/27 21:24:49 | 000,001,763 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech\Mouse and Keyboard\Mouse and Keyboard Settings.lnk
[2010/12/27 21:25:56 | 000,001,128 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech\Unifying\Logitech Unifying Software.lnk
[2009/07/13 20:57:07 | 000,001,304 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk
[2009/07/13 20:57:07 | 000,001,248 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Create Recovery Disc.lnk
[2009/07/13 20:57:09 | 000,000,606 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
[2009/07/13 20:57:09 | 000,001,212 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk
[2011/08/25 09:38:47 | 000,001,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware Help.lnk
[2011/08/25 09:38:47 | 000,001,129 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware.lnk
[2011/08/25 09:38:47 | 000,001,153 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Uninstall Malwarebytes' Anti-Malware.lnk
[2010/07/27 15:36:00 | 000,002,465 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (English)\Microsoft Excel Starter 2010.lnk
[2010/07/27 15:35:58 | 000,002,463 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (English)\Microsoft Word Starter 2010.lnk
[2010/07/27 15:35:57 | 000,002,463 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (English)\Microsoft Office 2010 Tools\Microsoft Clip Organizer.lnk
[2010/07/27 15:35:59 | 000,002,485 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (English)\Microsoft Office 2010 Tools\Microsoft Office 2010 Upload Center.lnk
[2010/07/27 15:35:58 | 000,002,479 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (English)\Microsoft Office 2010 Tools\Microsoft Office Picture Manager.lnk
[2010/07/27 15:36:00 | 000,002,515 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Starter (English)\Microsoft Office 2010 Tools\Microsoft Office Starter To-Go Device Manager 2010.lnk
[2010/08/07 14:57:51 | 000,002,919 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Access 2010.lnk
[2010/12/16 03:01:08 | 000,002,951 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Excel 2010.lnk
[2010/08/07 14:57:51 | 000,002,879 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft OneNote 2010.lnk
[2010/08/07 14:57:51 | 000,003,029 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Outlook 2010.lnk
[2010/12/16 03:01:08 | 000,002,937 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft PowerPoint 2010.lnk
[2010/08/07 14:57:51 | 000,003,041 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Publisher 2010.lnk
[2010/12/16 03:01:08 | 000,003,021 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk
[2010/08/07 14:57:51 | 000,002,977 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010 Tools\Digital Certificate for VBA Projects.lnk
[2010/08/07 14:57:51 | 000,002,917 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010 Tools\Microsoft Clip Organizer.lnk
[2010/08/07 14:57:51 | 000,002,751 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010 Tools\Microsoft Office 2010 Language Preferences.lnk
[2010/08/07 14:57:51 | 000,002,837 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010 Tools\Microsoft Office 2010 Upload Center.lnk
[2010/08/07 14:57:51 | 000,002,875 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010 Tools\Microsoft Office Picture Manager.lnk
[2010/08/07 14:57:52 | 000,002,530 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010 Tools\Office Anytime Upgrade.lnk
[2011/10/13 08:10:56 | 000,002,269 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk
[2011/12/05 15:50:24 | 000,002,441 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\About QuickTime.lnk
[2011/12/05 15:50:24 | 000,002,471 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\PictureViewer.lnk
[2011/12/05 15:50:24 | 000,002,441 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\QuickTime Player.lnk
[2011/12/05 15:50:24 | 000,001,818 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime\Uninstall QuickTime.lnk
[2011/04/29 21:45:20 | 000,000,683 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games\League of Legends\Play League of Legends.lnk
[2011/05/28 20:31:08 | 000,002,867 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft OmniPage SE 4.0\OmniPage SE 4.0.lnk
[2011/05/28 20:31:19 | 000,002,198 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft OmniPage SE 4.0\Scanner Setup Wizard.lnk
[2011/05/28 20:31:08 | 000,002,735 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft OmniPage SE 4.0\Manual\Benutzerhandbuch.lnk
[2011/05/28 20:31:08 | 000,002,737 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft OmniPage SE 4.0\Manual\Guía del usuario.lnk
[2011/05/28 20:31:08 | 000,002,741 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft OmniPage SE 4.0\Manual\Manual do usuário.lnk
[2011/05/28 20:31:08 | 000,002,737 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft OmniPage SE 4.0\Manual\Manuale d’uso.lnk
[2011/05/28 20:31:08 | 000,002,735 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft OmniPage SE 4.0\Manual\Manuel d’utilisation.lnk
[2011/05/28 20:31:08 | 000,002,737 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanSoft OmniPage SE 4.0\Manual\User’s Guide.lnk
[2011/08/25 09:47:01 | 000,002,533 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype.lnk
[2012/01/22 10:44:27 | 000,001,167 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy\File Shredder.lnk
[2012/01/22 10:44:26 | 000,001,278 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy\Spybot - Search & Destroy.lnk
[2012/01/22 10:44:27 | 000,001,306 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy\Tutorial.lnk
[2012/01/22 10:44:27 | 000,001,294 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy\Uninstall Spybot-S&D.lnk;
[2012/01/22 10:44:27 | 000,001,208 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy\Update Spybot-S&D.lnk;
[2011/11/29 02:23:30 | 000,001,305 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\Battle.net Account Management.lnk
[2011/11/29 02:23:30 | 000,001,296 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\Blizzard Technical Support.lnk
[2011/11/29 02:23:30 | 000,001,233 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II - Manual.lnk
[2011/11/29 02:23:30 | 000,001,240 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II - Map Editor.lnk
[2011/11/29 02:23:30 | 000,001,267 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II - Repair.lnk
[2011/11/29 02:23:30 | 000,001,490 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II - Uninstall.lnk
[2011/11/29 02:23:30 | 000,001,113 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II.lnk
[2009/07/13 20:54:24 | 000,000,174 | -HS- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
[2011/06/05 19:30:39 | 000,002,617 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk
[2010/12/27 21:24:49 | 000,001,751 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
[2011/07/07 13:52:09 | 000,001,849 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
[2010/07/15 14:26:27 | 000,002,573 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam Support Center.lnk
[2010/07/15 14:37:59 | 000,000,937 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk
[2011/12/11 20:31:42 | 000,001,078 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\STOIK Imaging\STOIK Video Converter 3\STOIK Video Converter 3.lnk
[2011/12/11 20:31:42 | 000,001,445 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\STOIK Imaging\STOIK Video Converter 3\Uninstall.lnk
[2010/09/14 13:24:02 | 000,001,132 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client\TeamSpeak 3 Client.lnk
[2010/06/01 21:11:56 | 000,001,172 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro Internet Security\Trend Micro Internet Security Help.lnk
[2010/06/01 21:11:56 | 000,001,182 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro Internet Security\Trend Micro Internet Security ReadMe.lnk
[2010/06/01 21:11:56 | 000,002,118 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro Internet Security\Trend Micro Internet Security.lnk
[2010/06/01 21:11:56 | 000,001,269 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro Internet Security\Trend Micro Support Diagnostic Toolkit.lnk
[2010/06/01 21:11:56 | 000,002,074 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro Internet Security\Uninstall Trend Micro Internet Security.lnk
[2011/12/14 20:21:24 | 000,001,601 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Red Alert 2\Red Alert 2 Auto Update.lnk
[2011/12/14 20:21:24 | 000,001,590 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Red Alert 2\Red Alert 2 ReadMe.lnk
[2011/12/14 20:21:24 | 000,001,614 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Red Alert 2\Red Alert 2 Uninstall.lnk
[2011/12/14 20:21:24 | 000,001,553 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Red Alert 2\Red Alert 2.lnk
[2011/12/14 20:36:09 | 000,001,614 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Yuri's Revenge\Internet Registration.lnk
[2011/12/14 20:36:09 | 000,001,637 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Yuri's Revenge\Yuri's Revenge Auto Update.lnk
[2011/12/14 20:36:09 | 000,001,596 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Yuri's Revenge\Yuri's Revenge ReadMe.lnk
[2011/12/14 20:36:09 | 000,001,620 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Yuri's Revenge\Yuri's Revenge Uninstall.lnk
[2011/12/14 20:36:08 | 000,001,575 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Westwood\Yuri's Revenge\Yuri's Revenge.lnk
[2010/06/01 21:05:51 | 000,001,961 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Call.lnk
[2010/06/01 21:07:40 | 000,002,623 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Family Safety.lnk
[2010/06/01 21:06:41 | 000,002,214 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Mail.lnk
[2010/06/01 21:06:18 | 000,002,110 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Messenger .lnk
[2010/06/01 21:07:02 | 000,002,230 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Photo Gallery.lnk
[2010/06/01 21:07:33 | 000,002,197 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\Windows Live Writer.lnk
[2010/08/30 01:53:16 | 000,000,976 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
[2010/08/30 01:53:16 | 000,000,995 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
[2010/08/30 01:53:16 | 000,000,995 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
[2011/12/11 20:23:11 | 000,001,934 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare\Video Converter Platinum\HomePage.lnk
[2011/12/11 20:23:11 | 000,001,934 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare\Video Converter Platinum\How to use.lnk
[2011/12/11 20:23:11 | 000,001,974 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare\Video Converter Platinum\Order online.lnk
[2011/12/11 20:23:11 | 000,001,297 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare\Video Converter Platinum\Uninstall Wondershare Video Converter Platinum.lnk
[2011/12/11 20:23:11 | 000,001,327 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare\Video Converter Platinum\Wondershare Video Converter Platinum.lnk
[2010/10/13 20:16:53 | 000,001,614 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\Account Billing.lnk
[2010/10/13 20:16:53 | 000,001,621 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\Blizzard Technical Support.lnk
[2010/10/13 20:16:53 | 000,001,404 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\World of Warcraft - Repair.lnk
[2010/10/13 20:16:54 | 000,001,565 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\World of Warcraft - Uninstall.lnk
[2011/09/22 12:02:09 | 000,001,270 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\World of Warcraft.lnk
[2010/10/13 20:16:53 | 000,001,804 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\Wrath of the Lich King - Manual.lnk

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\Windows\system64] -> \systemroot\system32 -> Mount Point

========== Alternate Data Streams ==========

@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:4C4EDBB7

< End of report >

OTL Extras logfile created on: 1/27/2012 7:17:52 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Dillon\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.93 Gb Total Physical Memory | 1.58 Gb Available Physical Memory | 40.17% Memory free
7.85 Gb Paging File | 5.25 Gb Available in Paging File | 66.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 446.23 Gb Total Space | 185.50 Gb Free Space | 41.57% Space Free | Partition Type: NTFS

Computer Name: DILLON-PC | User Name: Dillon | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AutoUpdateDisableNotify" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"Zvpebfbsg Jvaqbjf Ubfgvat Freivpr" = C:\Users\Dillon\AppData\Local\Temp\csrssr.exe
"Zvpebfbsg Jvaqbjf Ubfgvat Freivpr" = C:\Users\Dillon\AppData\Local\Temp\csrssr.exe

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160" = Canon MP160
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{26B0A622-1314-70B4-2971-DA74D58F2DDB}" = ccc-utility64
"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Intel® Turbo Boost Technology Monitor
"{48B0F24F-B828-4B1A-A22E-C65454B32A7A}" = Windows Live Family Safety
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6CFB1B20-ECAE-488F-9FFB-6AD420882E71}" = iTunes
"{6D830209-41C2-4D6B-BA25-4EF98807D9FB}" = AVG 2012
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro Internet Security
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{9221C55E-0D1E-BA0E-5219-0564AF763AE7}" = ATI Catalyst Install Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D2B0322-44AE-460E-9283-4D2D7A9205AE}" = Trend Micro Internet Security
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{F3F18612-7B5D-4C05-86C9-AB50F6F71727}" = KhalInstallWrapper
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F634E9C2-5D00-3A4B-5AB0-148C431BBDD5}" = ATI AVIVO64 Codecs
"{FBBC4667-2521-4E78-B1BD-8706F774549B}" = Best Buy Software Installer
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CanonMyPrinter" = Canon My Printer
"CCleaner" = CCleaner
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.18
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Speccy" = Speccy
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0512FBC8-37F5-11E1-630E-0E4BF115179A}" = CCC Help Norwegian
"{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}" = ASUS AI Recovery
"{07C4EA80-2F1F-B150-4CCC-0AD2E4F8FBAB}" = CCC Help Hungarian
"{07EC03E1-2831-C147-CAA7-7A900EE9FD8D}" = CCC Help Dutch
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0D052F88-18D4-FC0A-BF33-318C4FDFF6FD}" = Catalyst Control Center Graphics Light
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1E356931-3A8D-77D4-4D08-2FB6A1C01361}" = CCC Help Thai
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1" = Geeks3D.com FurMark 1.8.5
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java™ 6 Update 24
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2B81872B-A054-48DA-BE3B-FA5C164C303A}" = ASUS FancyStart
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{33A9D3F0-C131-5CCF-3630-13FDAE4931E8}" = ccc-core-static
"{33D31A9E-7D50-1B38-7D5E-FB41C89A805A}" = CCC Help Turkish
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{38F8D823-008D-4E5A-BBCE-867A86C2BF2B}" = Sound Blaster Audigy HD
"{420897E0-9294-C91D-194A-C3D53B768AB7}" = Catalyst Control Center Core Implementation
"{43E49F45-70FB-31D8-2C9A-4C80A0694F28}" = CCC Help Finnish
"{4997619D-FA9C-1987-ADD9-292E7623A7AB}" = CCC Help Chinese Standard
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5E7B9D7C-0245-A5AF-9A7F-C2A74F8A4251}" = CCC Help French
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{641BFAC0-2527-FEF8-DA90-52F42A9C82AB}" = CCC Help Portuguese
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{65CE0B7D-F67E-EE9C-A10F-85ECBDC7FF01}" = Catalyst Control Center Graphics Full New
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{6AC47082-8151-4F2E-A25C-2256EBBEB1B1}" = STOIK Video Converter 3
"{6EB8E500-1A08-5104-C0F4-B131C23BAC57}" = CCC Help Italian
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{75D48CBE-DE70-44AB-B631-C3E60F5184D5}" = STOIK Video Converter 3
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7C3B44A6-CA80-67A8-BD61-72AC2E367760}" = CCC Help Russian
"{7D42B43A-EA63-4234-B00A-757C15B2B185}_is1" = Leawo AVI Converter version 5.0.0.0
"{8385135C-A857-2F59-5226-03AF656DA9A5}" = Catalyst Control Center Localization All
"{856520DF-4018-0EAD-B02F-C506C0C52F02}" = CCC Help Swedish
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{90D9AF4D-8BA2-D322-E2B6-316CC4EEDEB9}" = CCC Help English
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B408981-8298-20FE-58E5-59113B371947}" = CCC Help Japanese
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DB3F20E-EAE9-FE53-DC08-71BC5E5F18E3}" = Catalyst Control Center Graphics Previews Vista
"{9E3234AD-F86D-7ABE-EC5B-A1BDDC770FFE}" = CCC Help Danish
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A57039DB-8A82-0DA3-CFBD-888E88A50816}" = CCC Help Korean
"{A5981835-5A34-E723-BBB1-3A4556F93B14}" = CCC Help Greek
"{A5DD7359-5EB4-4D35-BBAF-E6A88269790B}" = League of Legends
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9D0699A-714A-7AF0-7887-A880440CF1EE}" = CCC Help German
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB3C268A-E54B-4F6D-BF97-2DFCEEFA94F5}" = Catalyst Control Center - Branding
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.2 MUI
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5A5627C-0173-4DB2-ADA8-740479370F67}" = Express Gate
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{B72E80DB-DF9B-DE1E-8899-CC74B6B9456A}" = Catalyst Control Center InstallProxy
"{B9CA59A0-3B70-48F8-9054-67595DE6E72B}" = League of Legends
"{BB1FCCCB-CF8E-87FE-B989-37041A118F29}" = CCC Help Chinese Traditional
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0
"{C94ADF6E-B9F0-1221-AD6F-25D547EA0726}" = Catalyst Control Center Graphics Previews Common
"{CCF13D13-A87B-34E8-B689-1896D0C2DBA2}" = Google Talk Plugin
"{CEF7211D-CE3A-44C4-B321-D84A2099AE94}" = Comcast Desktop Software (v1.2.0.9)
"{D221681D-9B40-2078-0119-4FD158DC571B}" = Catalyst Control Center Graphics Full Existing
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{E4C16219-48E5-B6BC-637B-F16412CE5DE5}" = CCC Help Spanish
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{EE83CCB4-1DDF-153A-3E73-242A687D8C58}" = CCC Help Polish
"{F05A5232-CE5E-4274-AB27-44EB8105898D}" = CA Pest Patrol Realtime Protection
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{F81722A1-2B1A-383B-1775-26BE96E14E4E}" = CCC Help Czech
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Age of Conan_is1" = Age of Conan - Hyborian Adventures
"ASUS_Notebook_G73" = ASUS_Notebook_G73 Screen Saver
"Best Buy Software Installer" = Best Buy Software Installer
"Canon MP160 User Registration" = Canon MP160 User Registration
"conduitEngine" = Conduit Engine
"Digital Copy" = Digital Copy
"Google Chrome" = Google Chrome
"Hamachi" = Hamachi 1.0.1.5
"InstallShield_{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Minecraft (Beta v1.2_01) Beta v1.2_01" = Minecraft (Beta v1.2_01)
"Mozilla Firefox 9.0.1 (x86 en-US)" = Mozilla Firefox 9.0.1 (x86 en-US)
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"Office14.SingleImage" = Microsoft Office Professional 2010
"OpenAL" = OpenAL
"Rainmeter" = Rainmeter
"Red Alert 2" = Command & Conquer Red Alert 2
"Search Toolbar" = Search Toolbar
"StarCraft II" = StarCraft II
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 105600" = Terraria
"Steam App 200900" = Cave Story+
"Steam App 40800" = Super Meat Boy
"Steam App 41510" = Torchlight Demo
"Steam App 41800" = Gratuitous Space Battles
"Steam App 42910" = Magicka
"Steam App 440" = Team Fortress 2
"Steam App 4560" = Company of Heroes
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 6060" = Star Wars - Battlefront II
"Steam App 630" = Alien Swarm
"Steam App 65800" = Dungeon Defenders
"Steam App 94200" = Jamestown
"Steam App 99900" = Spiral Knights
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"uTorrent" = µTorrent
"uTorrentBar Toolbar" = uTorrentBar Toolbar
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"Wondershare Video Converter Platinum_is1" = Wondershare Video Converter Platinum(Build [removed])
"World of Warcraft" = World of Warcraft
"xfin_portal" = XFINITY Toolbar
"Yuri's Revenge" = Command && Conquer Red Alert 2 - Yuri's Revenge

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GeoGebra WebStart" = GeoGebra WebStart

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

djchalf

Post #4January 28, 2012, 6:12 AM UTC

And here are the results from the avast scan. thanks again. aswMBR version 0.9.9.1532 Copyright© 2011 AVAST Software Run date: 2012-01-27 19:37:39 —————————– 19:37:39.541 OS Version: Windows x64 6.1.7601 Service Pack 1 19:37:39.541 Number of processors: 8 586 0x1E05 19:37:39.541 ComputerName: DILLON-PC UserName: Dillon 19:37:42.973 Initialize success 19:37:48.448 AVAST engine defs: 12012700 19:38:17.761 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 19:38:17.776 Disk 0 Vendor: ST950042 0003 Size: 476940MB BusType: 3 19:38:17.776 Device \Driver\iaStor -> MajorFunction fffffa8005ec35c4 19:38:17.792 Disk 0 MBR read successfully 19:38:17.792 Disk 0 MBR scan 19:38:17.823 Disk 0 Windows 7 default MBR code 19:38:17.823 Disk 0 Partition 1 00 1C Hidd FAT32 LBA MSDOS5.0 20002 MB offset 63 19:38:17.854 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 456936 MB offset 40965750 19:38:17.854 Service scanning 19:38:19.399 Modules scanning 19:38:19.399 Disk 0 trace - called modules: 19:38:19.414 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa8005ec35c4]<< 19:38:19.430 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004db7790] 19:38:19.445 3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> [0xfffffa8004b45db0] 19:38:19.461 5 ACPI.sys[fffff88000fac7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004b48050] 19:38:19.461 \Driver\iaStor[0xfffffa8004d2f890] -> IRP_MJ_CREATE -> 0xfffffa8005ec35c4 19:38:21.224 AVAST engine scan C:\Windows 19:38:24.422 AVAST engine scan C:\Windows\system32 19:41:43.868 AVAST engine scan C:\Windows\system32\drivers 19:42:00.077 AVAST engine scan C:\Users\Dillon 19:42:02.058 File: C:\Users\Dillon\AppData\Local\compatGLMusic\usbcrtSupport.dll **INFECTED** Win32:MalOb-JG [Cryp] 19:48:21.063 AVAST engine scan C:\ProgramData 19:52:09.088 Scan finished successfully 22:10:56.246 Disk 0 MBR has been saved successfully to "C:\Users\Dillon\Desktop\MBR.dat" 22:10:56.261 The log file has been saved successfully to "C:\Users\Dillon\Desktop\aswMBR.txt"

Satchfan

Post #5January 28, 2012, 11:21 PM UTC

Hi djchalf

Running multiple antivirus programs

You can not run two real-time antiviruses at the same time. Although many have different methods of searching for and recognising threats, they will all be 'fighting' in memory to kick each other out, rendering them both ineffective. As Trend Micro is the full security suite, I suggest you uninstall AVG

To remove it:

click Start, Control Panel, Programs, Uninstall a program
scroll down the list and look for thhe AVG 2012 entry
click on it and then on Remove.

===================================================

P2P - I see you have P2P software, (uTorrent), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall any that are installed now. You can do so via Start > Settings > Control Panel > Add/Remove Programs.

Should you decide to keep them, please don’t use them until we have finished up here.

===================================================

Ask Toolbar

Uninstall Ask Toolbar if it was not installed on purpose. See this:

See http://www.benedelman.org/spyware/ask-toolbars/ for more info.

If you choose to follow my recommendation then please uninstall the following programs if present:

AskBarDis or anything related to Ask

Then please find and delete this folder in bold (if present):

C:\Program Files\AskBarDis or anything related to Ask.

===================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

start Malwarebytes-Anti-Malware and update it, (“Update” tab}
once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
when the scan is complete, click OK, then Show Results to view the results.
be sure that everything is checked, and click Remove Selected.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Satchfan

djchalf

Post #6January 29, 2012, 3:49 AM UTC last edited January 29, 2012, 3:55 AM UTC

I've removed avg all ask instances i could find on my computer but when attempting to run MWAM i got an error message. I figured I'd uninstall and redownload the program and then run that. However, when i tried to uninstall i got another error. I got the same error trying to uninstall both from trying to remove it in add/remove programs under the control and panel as well as when i searched for MWAM in my programs and found an uninstall tool. I'm going to download a new version and run that real quick if it will let me then I will post the log. Thank you.

djchalf

Post #7January 29, 2012, 3:59 AM UTC

And here is the log from MWAM: Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.28.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Dillon :: DILLON-PC [administrator] 1/28/2012 7:50:36 PM mbam-log-2012-01-28 (19-50-36).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 202168 Time elapsed: 6 minute(s), 5 second(s) Memory Processes Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> 4220 -> Delete on reboot. Memory Modules Detected: 1 C:\Users\Dillon\AppData\Local\compatGLMusic\usbcrtSupport.dll (IPH.Trojan.Blueinit.W7) -> Delete on reboot. Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|usbcrtSupport (IPH.Trojan.Blueinit.W7) -> Data: rundll32.exe "C:\Users\Dillon\AppData\Local\compatGLMusic\usbcrtSupport.dll",CdPathAgent UtilCommon3xx -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 4 C:\Users\Dillon\AppData\Local\compatGLMusic\usbcrtSupport.dll (IPH.Trojan.Blueinit.W7) -> Delete on reboot. C:\Windows\Temp\ED31.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Windows\Temp\xrwemsanoc.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully. C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot. (end) I am now rebooting.

Satchfan

Post #8January 29, 2012, 10:00 AM UTC last edited January 29, 2012, 10:59 AM UTC

There are still some files/folders I’d like checked out.

Submit a file to VirusTotal

First:

Show hidden Files and Folders

open Windows Explorer, (Windows key+E)
at the top, click on Organise, >Folder and search options
click on the “View” tab
under “Files and Foldera”, place a check in Show hidden files, folders and drives

Next

Go to VirusTotal and submit this file for analysis:

C:\Users\Dillon\AppData\Local\Temp\csrssr.exe

click on Browse
click on the arrow and choose Local Disc (C:)
🖼Click to load external image (Posted Image)
below, double-click on Users
in the right window, double-click on Dillon
do the same for AppData, Local, Temp
locate the file csrssr.exe click on it and then on Open
click on Send File.

You will get a report back: post the report into this thread for me to see.

Repeat this for the following:

C:\Windows\System32\acovcnt.exe

============================================

Please download SystemLook from the link below and save it to your Desktop.

SystemLook (64-bit)

double-click SystemLook.exe to run it.

copy the content of the following codebox into the main textfield:
:dir C:\Program Files (x86)\F47BA\*.* /s C:\Program Files (x86)\LP\*.* /s C:\Windows\system64\*.* /s

click the Look button to start the scan.
when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Please tell me how your computer is running

Thanks

Satchfan

djchalf

Post #9January 29, 2012, 6:02 PM UTC

Hello again, for the csrss.exe file I did not have the file in my temp folder the only instance I found on my computer was in windows/system32/en-us and it was csrss.exe.mui when I ran this through the search the result was 0/43 the same for the acovcnt.exe file i found it in system64, I dont think it really matters but just letting you know. detection ratio on this one was 0/16. Here are the scan results from Systemlook. SystemLook 30.07.11 by jpshortstuff Log created at 09:57 on 29/01/2012 by Dillon Administrator - Elevation successful ========== dir ========== C:\Program Files (x86)\F47BA\*.* - Unable to find folder. C:\Program Files (x86)\LP\*.* - Unable to find folder. C:\Windows\system64\*.* - Unable to find folder. -= EOF =- Before running the scans you instructed in your previous post after waking up my computer this morning it had again shut off instead of sleeping and when attempting boot it went into startup repair. This ran for 20-30 minutes and then I got a message it was unable to solve my problem. The only option was to shut down my computer. I again tried to restart it and got the option to start windows normally or go into repair. I went through repair and the same thing happened and i was forced to shut down. On my third attempt I recieved no error messages and it booted normally. spybot usually finds 3-4 registry changes on startup should i be allowing these or not? I'm going to resart my computer now after running the scans I will let you know if anything different happens. Thank you

djchalf

Post #10January 29, 2012, 6:35 PM UTC

When put it to sleep it again booted saying that windows was not shut down properly and gave me the safe mod options and start normally. I started normally and it went into the startup repair. again this ran for 20-30 minutes and when i restarted again it ran fine.

Satchfan

Post #11January 30, 2012, 8:02 AM UTC

I think we’re going to need something a bit heftier than the previous scans.

Download and run ComboFix

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Double click on ComboFix.exe & follow the prompts.

when finished, it will produce a report for you.
please post the C:\ComboFix.txt for further review.

Satchfan

djchalf

Post #12January 30, 2012, 7:08 PM UTC

Here are the logs i havent put my computer to sleep and restarted to see if it fixed anything yet. It does now force me to run almost any program (firefox,IE,Itunes,windows explorer….) as an admin or it wont start…. ComboFix 12-01-30.02 - Dillon 01/30/2012 10:09:43.1.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4021.2398 [GMT -8:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Trend Micro Internet Security *Disabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50} SP: Trend Micro Internet Security *Disabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe C:\pic.jpg c:\program files (x86)\LP c:\program files (x86)\LP\E5DC\179B.tmp c:\program files (x86)\LP\E5DC\CBFD.tmp c:\program files (x86)\LP\E5DC\E371.tmp c:\program files (x86)\LP\E5DC\F972.tmp c:\program files (x86)\Search Toolbar c:\program files (x86)\Search Toolbar\icon.ico c:\program files (x86)\Search Toolbar\SearchToolbar.dll c:\program files (x86)\Search Toolbar\SearchToolbarUninstall.exe c:\program files (x86)\Search Toolbar\SearchToolbarUpdater.exe c:\users\Dillon\AppData\Local\compatGLMusic\usbcrtSupport.dll c:\users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\searchplugins\bing-zugo.xml c:\windows\svchost.exe c:\windows\system32\drivers\etc\hosts.ics . . ((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-30 ))))))))))))))))))))))))))))))) . . 2012-01-30 05:02 . 2012-01-30 06:33 ——– d—–w- c:\users\Dillon\AppData\Roaming\NavNet Solutions 2012-01-23 20:25 . 2012-01-23 20:25 ——– d—–w- c:\users\Dillon\AppData\Roaming\SpeedyPC Software 2012-01-23 20:25 . 2012-01-23 20:25 ——– d—–w- c:\users\Dillon\AppData\Roaming\DriverCure 2012-01-23 20:24 . 2012-01-23 20:24 ——– d—–w- c:\program files (x86)\Common Files\SpeedyPC Software 2012-01-23 20:24 . 2012-01-23 20:24 ——– d—–w- c:\programdata\SpeedyPC Software 2012-01-23 20:24 . 2012-01-23 20:24 ——– d—–w- c:\program files (x86)\SpeedyPC Software 2012-01-23 05:20 . 2012-01-23 19:51 ——– d—–w- c:\program files (x86)\F47BA 2012-01-23 05:19 . 2012-01-23 05:19 ——– d—–we c:\windows\system64 2012-01-22 19:16 . 2012-01-22 19:16 ——– d—–w- C:\$AVG 2012-01-22 18:55 . 2012-01-22 18:55 ——– d–h–w- c:\programdata\Common Files 2012-01-22 18:54 . 2012-01-22 23:31 ——– d—–w- c:\windows\SysWow64\drivers\AVG 2012-01-22 18:54 . 2012-01-22 23:32 ——– d—–w- c:\programdata\AVG2012 2012-01-22 18:53 . 2012-01-26 18:05 ——– d—–w- c:\program files (x86)\AVG 2012-01-22 18:50 . 2012-01-26 18:11 ——– d—–w- c:\programdata\MFAData 2012-01-22 18:44 . 2012-01-30 17:19 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2012-01-22 18:44 . 2012-01-26 18:11 ——– d—–w- c:\program files (x86)\Spybot - Search & Destroy 2012-01-22 05:17 . 2012-01-22 05:17 ——– d—–w- c:\windows\Sun 2012-01-22 05:11 . 2012-01-22 05:11 6656 —-a-w- c:\programdata\Microsoft\Windows\DRM\AB1B.tmp 2012-01-22 05:11 . 2012-01-22 05:11 6656 —-a-w- c:\programdata\Microsoft\Windows\DRM\AB1A.tmp 2012-01-15 02:27 . 2012-01-30 18:17 ——– d—–w- c:\users\Dillon\AppData\Local\compatGLMusic 2012-01-11 17:31 . 2011-11-19 14:58 77312 —-a-w- c:\windows\system32\packager.dll 2012-01-11 17:31 . 2011-11-19 14:01 67072 —-a-w- c:\windows\SysWow64\packager.dll 2012-01-11 17:31 . 2011-10-26 05:25 1572864 —-a-w- c:\windows\system32\quartz.dll 2012-01-11 17:31 . 2011-10-26 05:25 366592 —-a-w- c:\windows\system32\qdvd.dll 2012-01-11 17:31 . 2011-10-26 04:32 514560 —-a-w- c:\windows\SysWow64\qdvd.dll 2012-01-11 17:31 . 2011-10-26 04:32 1328128 —-a-w- c:\windows\SysWow64\quartz.dll 2012-01-11 17:31 . 2011-11-17 06:41 1731920 —-a-w- c:\windows\system32\ntdll.dll 2012-01-11 17:31 . 2011-11-17 05:38 1292080 —-a-w- c:\windows\SysWow64\ntdll.dll 2012-01-02 18:20 . 2012-01-02 18:20 626688 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll 2012-01-02 18:20 . 2012-01-02 18:20 548864 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll 2012-01-02 18:20 . 2012-01-02 18:20 479232 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll 2012-01-02 18:20 . 2012-01-02 18:20 43992 —-a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-01-22 18:41 . 2010-07-16 08:20 45056 —-a-w- c:\windows\system32\acovcnt.exe 2011-12-14 16:21 . 2011-12-14 16:21 539984 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2011-12-12 04:40 . 2011-12-12 04:40 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2011-12-12 04:40 . 2011-12-12 04:40 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2011-12-12 04:40 . 2011-12-12 04:40 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2011-12-12 04:40 . 2011-12-12 04:40 539984 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2011-11-24 04:52 . 2011-12-15 04:23 3145216 —-a-w- c:\windows\system32\win32k.sys 2011-11-15 19:28 . 2011-06-18 16:34 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-05 05:41 . 2011-12-15 04:25 1188864 —-a-w- c:\windows\system32\wininet.dll 2011-11-05 05:32 . 2011-12-15 04:22 2048 —-a-w- c:\windows\system32\tzres.dll 2011-11-05 04:35 . 2011-12-15 04:25 981504 —-a-w- c:\windows\SysWow64\wininet.dll 2011-11-05 04:26 . 2011-12-15 04:22 2048 —-a-w- c:\windows\SysWow64\tzres.dll 2011-11-05 03:32 . 2011-12-15 04:25 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2011-11-05 02:48 . 2011-12-15 04:25 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2010-12-09 20:51 3911776 —-a-w- c:\program files (x86)\ConduitEngine\ConduitEngine.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] 2010-12-09 20:51 3911776 —-a-w- c:\program files (x86)\uTorrentBar\tbuTor.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\tbuTor.dll" [2010-12-09 3911776] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776] . [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}] . [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files (x86)\Steam\steam.exe" [2011-10-04 1242448] "Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320] "ComcastAntispyClient"="c:\program files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" [2009-08-19 1589208] "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-17 98304] "ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-27 6998656] "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-20 170624] "HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016] "VolPanel"="c:\program files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" [2008-12-29 237693] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896] "OpwareSE4"="c:\program files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888] . c:\users\Dillon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2011-6-5 12862] Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-12-27 1207312] Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2011-7-3 102912] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Best Buy Software Installer.lnk - c:\program files\Best Buy Software Installer\Best Buy Software Installer.exe [2010-2-15 1135560] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-10 136176] R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x] R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-06-02 79360] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-06-02 79360] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-10 136176] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x] R3 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2010-02-23 917768] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 AntiSpywareService;Comcast AntiSpyware;c:\program files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe [2009-06-17 616408] S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664] S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264] S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-17 2358656] S2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [x] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2314240] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x] S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x] S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496] S3 TarFltr;Razer Tarantula USB Keyboard;c:\windows\system32\drivers\UsbFltr.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-10 22:11] . 2012-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-10 22:11] . 2012-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2135112261-1923993808-919250933-1001Core.job - c:\users\Dillon\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-10 15:35] . 2012-01-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2135112261-1923993808-919250933-1001UA.job - c:\users\Dillon\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-10 15:35] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2010-02-23 1022904] "RunDLLEntry"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568] "AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1432144] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.hotspotshield.com/g/?c=h mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.0.1 DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB FF - ProfilePath - c:\users\Dillon\AppData\Roaming\Mozilla\Firefox\Profiles\yodw0gku.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.xfinity.com/customer/start/?attr=mm&cid=insDate09022011 FF - prefs.js: keyword.URL - hxxp://search.hotspotshield.com/g/results.php?c=s&q= FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-NetMeter - c:\program files (x86)\NetMeter\NetMeter.exe Wow6432Node-HKCU-Run-usbcrtSupport - c:\users\Dillon\AppData\Local\compatGLMusic\usbcrtSupport.dll BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll Toolbar-Locked - (no file) WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file) WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-Setwallpaper - c:\programdata\SetWallpaper.cmd AddRemove-ASUS_Notebook_G73 - c:\windows\system32\ASUS_Notebook_G73.scr AddRemove-Search Toolbar - c:\program files (x86)\Search Toolbar\SearchToolbarUninstall.exe AddRemove-GeoGebra WebStart - c:\windows\system32\javaws.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe c:\\.\globalroot\systemroot\svchost.exe c:\program files (x86)\ASUS\ControlDeck\ControlDeck.exe . ************************************************************************** . Completion time: 2012-01-30 10:26:09 - machine was rebooted ComboFix-quarantined-files.txt 2012-01-30 18:26 . Pre-Run: 210,432,622,592 bytes free Post-Run: 210,838,859,776 bytes free . - - End Of File - - 8677D7CC6D8C77514964E15128F4E874

Satchfan

Post #13January 31, 2012, 11:14 AM UTC

Have you installed or do you know about a program called Spyware GuardMon?

djchalf

Post #14January 31, 2012, 5:19 PM UTC

no ill install that now. Do you think the problem could be with one of my boot files? should I get a hold of a windows 7 disc and try to repair?

djchalf

Post #15January 31, 2012, 5:23 PM UTC

I couldnt find any thing other than digimon with a search of spyware gaurdmon on google? do you have a link?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Smitfraud removal [Solved]

✨ Ask AI

Ask AI