Something has hijacked my computer! [Solved]

OTL logfile created on: 4/7/2012 8:08:35 AM - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Byron\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.97 Gb Total Physical Memory | 1.41 Gb Available Physical Memory | 35.48% Memory free
7.93 Gb Paging File | 4.88 Gb Available in Paging File | 61.60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 73.79 Gb Free Space | 63.38% Space Free | Partition Type: NTFS
Drive D: | 331.01 Gb Total Space | 330.90 Gb Free Space | 99.97% Space Free | Partition Type: NTFS

Computer Name: BYRON-PC | User Name: Byron | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Byron\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Users\Byron\AppData\Local\Workspace\workspaceupdate.exe ()
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\BitTorrent\BitTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files (x86)\Workspace\offSyncService.exe (Starfield Technologies)
PRC - C:\Users\Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
PRC - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
PRC - C:\Program Files (x86)\Uniblue\RegistryBooster\rbmonitor.exe (Uniblue Systems Limited)
PRC - C:\Program Files (x86)\Research In Motion\BlackBerry Desktop\Rim.Desktop.AutoUpdate.exe (Research In Motion)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Research In Motion Limited)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe ()
PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
MOD - C:\Users\Byron\AppData\Local\Workspace\workspaceupdate.exe ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\f01c5c76d0a19516a37b7bd191a02cda\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\74fcc0f56435d0396f9524cd4293d3e5\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\10d61b241fbf27d82942eecb454105e1\PresentationUI.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\02f7846cbc5c02a5dbf50fd34325eb61\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\f4b2424c1b32fbd11130482bb899b7ae\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\47b9e7f070271ff50f988f75ea68fa3e\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()
MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (UxTuneUp) – C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
SRV:64bit: - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SRV:64bit: - (ATKGFNEXSrv) – C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (File Backup) – C:\Program Files (x86)\Workspace\offSyncService.exe (Starfield Technologies)
SRV - (TuneUp.UtilitiesSvc) – C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) – C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (PCToolsSSDMonitorSvc) – C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
SRV - (AVGIDSAgent) – C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FastBootAgent) – C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe (ASUSTeK Computer Inc.)
SRV - (ASLDRService) – C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Avgldx64) – C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgrkx64) – C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (eamonm) – C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:64bit: - (Avgmfx64) – C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (epfwwfpr) – C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:64bit: - (Avgtdia) – C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSFilter) – C:\Windows\SysNative\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSDriver) – C:\Windows\SysNative\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSEH) – C:\Windows\SysNative\drivers\AVGIDSEH.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (NuidFltr) – C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation)
DRV:64bit: - (ZTEusbwwan) – C:\Windows\SysNative\drivers\ZTEusbwwan.sys (ZTE Incorporated)
DRV:64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV:64bit: - (ZTEusbgps) – C:\Windows\SysNative\drivers\ZTEusbgps.sys (ZTE Incorporated)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tmobile_mf691_dc_enum) – C:\Windows\SysNative\drivers\tmobile_mf691_dc_enum.sys (T-Mobile)
DRV:64bit: - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (kbfiltr) – C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (VIAHdAudAddService) – C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (lullaby) – C:\Windows\SysNative\drivers\lullaby.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (ETD) – C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronic Corp.)
DRV:64bit: - (SiSGbeLH) – C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (L1E) – C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) – C:\Windows\SysNative\drivers\snp2uvc.sys ()
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (AmUStor) – C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\drivers\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (ASMMAP64) – C:\Program Files\ATKGFNEX\ASMMAP64.sys ()
DRV - (TuneUpUtilitiesDrv) – C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z007&form;=ZGAPHP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A3 B2 34 07 86 1E CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {B4D84896-6918-41DD-B848-1268BE62AF29}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{645701DB-0A59-AE3F-8D62-BAA040AFB663}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{B4D84896-6918-41DD-B848-1268BE62AF29}: "URL" = http://www.google.com/search?q={searchTerm…utputEncoding?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z007&form;=ZGAADF&q;="


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Byron\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@starfield.com/off: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npoff.dll ( Starfield Technologies, LLC.)
FF - HKCU\Software\MozillaPlugins\@starfield.com/wbe: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npwbe.dll (Starfield Technology, LLC)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012/03/17 16:47:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/03/17 13:58:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/04/03 07:50:02 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011/12/11 13:49:14 | 000,000,000 | —D | M]

[2011/06/14 09:10:26 | 000,000,000 | -H-D | M] (No name found) – C:\Users\Byron\AppData\Roaming\Mozilla\Extensions
[2012/03/08 19:40:54 | 000,000,000 | -H-D | M] (No name found) – C:\Users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\extensions
[2012/01/26 00:34:41 | 000,000,000 | -H-D | M] (Yahoo! Toolbar) – C:\Users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/03/08 19:40:54 | 000,000,000 | -H-D | M] (BitTorrentBar Community Toolbar) – C:\Users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\extensions\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}
[2011/04/29 21:58:05 | 000,000,000 | -H-D | M] (Conduit Engine) – C:\Users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\extensions\[removed]
[2011/06/07 10:19:16 | 000,001,919 | -H– | M] () – C:\Users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\searchplugins\bing-zugo.xml
[2012/04/03 07:44:36 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/04/03 07:44:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012/03/17 13:58:07 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/03 07:44:26 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/02/19 14:12:49 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010/01/01 01:00:00 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml.old
[2012/02/19 14:12:49 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Byron\AppData\Local\Google\Chrome\Application\11.0.696.60\gcswf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Byron\AppData\Local\Google\Chrome\Application\11.0.696.60\pdf.dll
CHR - plugin: Chrome NaCl (Disabled) = C:\Users\Byron\AppData\Local\Google\Chrome\Application\11.0.696.60\ppGoogleNaClPluginChrome.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Byron\AppData\Local\Google\Chrome\Application\11.0.696.60\gears.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Byron\AppData\Local\Google\Update\1.3.21.53\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Minimal = C:\Users\Byron\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnfhcmjkebafbfikmbkhdpbmfpfjgiog\1.0_0\

O1 HOSTS File: ([2009/06/10 14:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKCU..\Run: [Starfield Updater] C:\Users\Byron\AppData\Local\Workspace\WorkspaceUpdate.exe ()
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\Byron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21F61DA4-AB4C-4C37-8B36-981EF53CC0A4}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{46EDC8B3-83DB-45A5-9391-D954A6ADFF95}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{581c2cdc-4ab1-11e1-bcae-485b39822c6a}\Shell - "" = AutoRun
O33 - MountPoints2\{581c2cdc-4ab1-11e1-bcae-485b39822c6a}\Shell\AutoRun\command - "" = F:\AutoLaunch.exe
O33 - MountPoints2\{8ebb97a1-550d-11e1-830b-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8ebb97a1-550d-11e1-830b-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoLaunch.exe
O33 - MountPoints2\{da007408-3057-11e1-943d-485b39822c6a}\Shell - "" = AutoRun
O33 - MountPoints2\{da007408-3057-11e1-943d-485b39822c6a}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoLaunch.exe
O34 - HKLM BootExecute: (autocheck autochk /r \??\C:)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs:64bit: UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/04/07 08:05:14 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\Selling Simplified _ Shameless Sales Tips from Shamus Brown_files
[2012/04/07 08:03:02 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\What the Tech_files
[2012/04/04 14:53:23 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\Uni_files
[2012/04/04 01:17:04 | 008,767,136 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerInstaller.exe
[2012/04/04 00:39:58 | 000,418,464 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/04/03 07:44:31 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2012/04/03 07:44:31 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2012/04/03 07:44:31 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2012/04/03 07:44:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2012/04/03 07:41:18 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\watch_files
[2012/03/27 22:42:23 | 000,000,000 | —D | C] – C:\Users\Byron\AppData\Roaming\Uniblue
[2012/03/27 22:42:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
[2012/03/27 09:36:58 | 000,000,000 | -H-D | C] – C:\ProgramData\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2012/03/26 22:45:26 | 000,000,000 | —D | C] – C:\ProgramData\SecTaskMan
[2012/03/26 22:45:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2012/03/26 22:45:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Security Task Manager
[2012/03/26 18:40:32 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\how-to-remove-data-recovery-uninstall_files
[2012/03/25 12:41:19 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\Miller-Gold-is-Has-Investment-158160.S.103224214_files
[2012/03/23 15:38:30 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\remove-win-7-antispyware-2012_files
[2012/03/23 13:34:58 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\Email Salutation_files
[2012/03/19 07:27:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Mechanic
[2012/03/19 05:39:38 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2012/03/19 05:39:28 | 000,000,000 | —D | C] – C:\Users\Byron\AppData\Local\PackageAware
[2012/03/19 04:48:44 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\New folder
[2012/03/19 03:41:18 | 000,000,000 | —D | C] – C:\Users\Byron\AppData\Roaming\Registry Mechanic
[2012/03/19 03:35:50 | 001,101,824 | —- | C] (Woodbury Associates Limited) – C:\Windows\SysWow64\UniBox210.ocx
[2012/03/19 03:35:50 | 000,880,640 | —- | C] (Woodbury Associates Limited) – C:\Windows\SysWow64\UniBox10.ocx
[2012/03/19 03:35:50 | 000,506,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml.dll
[2012/03/19 03:35:50 | 000,212,992 | —- | C] (Woodbury Associates Limited) – C:\Windows\SysWow64\UniBoxVB12.ocx
[2012/03/19 03:35:49 | 000,658,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MSCOMCT2.OCX
[2012/03/19 03:35:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\PC Tools
[2012/03/19 03:35:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\Registry Mechanic
[2012/03/17 23:43:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ManageEngine Desktop Central
[2012/03/17 23:43:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\DesktopCentral_Server
[2012/03/17 17:59:52 | 000,000,000 | -H-D | C] – C:\$AVG
[2012/03/17 16:50:20 | 000,000,000 | —D | C] – C:\Users\Byron\AppData\Roaming\AVG2012
[2012/03/17 16:47:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012
[2012/03/17 16:47:31 | 000,000,000 | —D | C] – C:\Windows\SysWow64\drivers\AVG
[2012/03/17 16:46:40 | 000,000,000 | —D | C] – C:\ProgramData\AVG2012
[2012/03/17 16:46:40 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\AVG
[2012/03/17 16:46:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVG
[2012/03/17 14:38:19 | 000,000,000 | -H-D | C] – C:\Users\Byron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check
[2012/03/17 14:00:23 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\LAEDC - Doing Business in L.A. County_files
[2012/03/15 23:45:20 | 000,000,000 | R–D | C] – C:\Users\Byron\Desktop\Perk Nation
[2012/03/15 23:42:34 | 000,000,000 | R–D | C] – C:\Users\Byron\Desktop\Fitness
[2012/03/15 02:00:21 | 000,000,000 | -H-D | C] – C:\Users\Byron\Documents\Acoustica
[2012/03/15 02:00:21 | 000,000,000 | -H-D | C] – C:\Users\Byron\AppData\Roaming\Acoustica
[2012/03/15 02:00:20 | 000,000,000 | -H-D | C] – C:\Users\Byron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Acoustica CD Label Maker
[2012/03/15 02:00:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Acoustica CD Label Maker
[2012/03/14 03:02:30 | 005,559,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/03/14 03:02:28 | 003,968,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2012/03/14 03:02:27 | 003,913,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2012/03/13 22:28:52 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\Worship
[2012/03/13 22:28:42 | 000,000,000 | —D | C] – C:\Users\Byron\Desktop\Praise
[2012/03/13 19:20:38 | 001,544,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2012/03/13 10:19:30 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcorekmts.dll
[2012/03/13 10:19:30 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpwsx.dll
[2012/03/13 10:19:30 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdrmemptylst.exe
[2012/03/13 10:19:29 | 001,031,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rdpcore.dll
[2012/03/13 10:19:29 | 000,826,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\rdpcore.dll
[2012/03/11 01:41:12 | 000,000,000 | -H-D | C] – C:\Users\Byron\AppData\Local\IsolatedStorage
[2012/03/11 01:32:14 | 000,000,000 | -H-D | C] – C:\ProgramData\IsolatedStorage
[2012/03/11 01:31:49 | 000,000,000 | -H-D | C] – C:\Users\Byron\AppData\Local\Palo_Alto_Software
[2012/03/11 01:31:49 | 000,000,000 | -H-D | C] – C:\Users\Byron\AppData\Roaming\bppenu11
[2012/03/11 01:31:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Plan Pro
[2012/03/11 01:30:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Business Plan Pro
[2012/03/11 01:29:01 | 000,000,000 | -H-D | C] – C:\Users\Byron\AppData\Local\Downloaded Installations
[1 C:\Users\Byron\Documents\*.tmp files -> C:\Users\Byron\Documents\*.tmp -> ]
[1 C:\Users\Byron\Desktop\*.tmp files -> C:\Users\Byron\Desktop\*.tmp -> ]
[1 C:\Users\Byron\AppData\Local\*.tmp files -> C:\Users\Byron\AppData\Local\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/07 08:05:20 | 000,030,976 | —- | M] () – C:\Users\Byron\Desktop\Selling Simplified _ Shameless Sales Tips from Shamus Brown.htm
[2012/04/07 08:03:08 | 000,047,784 | —- | M] () – C:\Users\Byron\Desktop\What the Tech.htm
[2012/04/07 07:57:20 | 000,010,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/07 07:57:20 | 000,010,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/07 07:44:00 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/07 07:17:01 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/07 06:29:00 | 000,000,928 | -H– | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3700817450-263443993-1340972289-1000UA.job
[2012/04/06 21:58:03 | 000,000,264 | —- | M] () – C:\Windows\tasks\RMSchedule.job
[2012/04/06 21:29:00 | 000,000,906 | -H– | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3700817450-263443993-1340972289-1000Core.job
[2012/04/06 20:16:27 | 000,000,892 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/06 20:16:04 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/04 22:21:21 | 000,000,344 | —- | M] () – C:\Windows\tasks\RegistryBooster.job
[2012/04/04 22:21:06 | 3193,765,888 | -HS- | M] () – C:\hiberfil.sys
[2012/04/04 14:53:24 | 000,039,392 | —- | M] () – C:\Users\Byron\Desktop\Uni.htm
[2012/04/04 01:17:08 | 000,418,464 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/04/04 01:17:08 | 000,070,304 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/04/04 01:17:04 | 008,767,136 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerInstaller.exe
[2012/04/03 07:44:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deployJava1.dll
[2012/04/03 07:44:24 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2012/04/03 07:44:24 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2012/04/03 07:44:24 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2012/04/03 07:41:42 | 000,360,042 | —- | M] () – C:\Users\Byron\Desktop\watch.htm
[2012/04/02 18:17:16 | 001,399,288 | —- | M] () – C:\Users\Byron\Desktop\Perk Nation LLC.pdf
[2012/04/02 18:12:10 | 000,039,424 | -H– | M] () – C:\Users\Byron\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/27 22:42:22 | 000,001,800 | —- | M] () – C:\Users\Byron\Desktop\Uniblue RegistryBooster.lnk
[2012/03/27 22:42:22 | 000,001,790 | —- | M] () – C:\Users\Byron\Application Data\Microsoft\Internet Explorer\Quick Launch\Uniblue RegistryBooster.lnk
[2012/03/27 01:25:21 | 000,007,597 | -H– | M] () – C:\Users\Byron\AppData\Local\Resmon.ResmonCfg
[2012/03/26 18:40:32 | 000,181,946 | —- | M] () – C:\Users\Byron\Desktop\how-to-remove-data-recovery-uninstall.html
[2012/03/25 12:41:29 | 000,125,359 | —- | M] () – C:\Users\Byron\Desktop\Miller-Gold-is-Has-Investment-158160.S.103224214.htm
[2012/03/25 12:22:42 | 000,153,134 | -H– | M] () – C:\Users\Byron\Documents\Small Business Economy Program.pdf
[2012/03/24 10:49:05 | 000,153,008 | —- | M] () – C:\Users\Byron\Documents\Glamour Beauty Salon.pdf
[2012/03/23 13:35:01 | 000,171,903 | —- | M] () – C:\Users\Byron\Desktop\Email Salutation.htm
[2012/03/20 23:35:41 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/03/20 23:35:41 | 000,624,178 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/03/20 23:35:41 | 000,106,522 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/03/19 07:27:47 | 000,001,133 | —- | M] () – C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
[2012/03/18 18:37:17 | 092,178,359 | —- | M] () – C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/03/18 18:36:29 | 000,058,220 | —- | M] () – C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/03/17 16:47:34 | 000,000,967 | —- | M] () – C:\Users\Public\Desktop\AVG 2012.lnk
[2012/03/17 16:47:31 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2012/03/17 16:47:31 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2012/03/17 16:14:04 | 000,001,594 | —- | M] () – C:\Users\Byron\Desktop\mbam - Shortcut.lnk
[2012/03/17 14:40:02 | 000,000,440 | -H– | M] () – C:\ProgramData\TtFsssGC9NcELH
[2012/03/17 14:38:22 | 000,000,272 | -H– | M] () – C:\ProgramData\~TtFsssGC9NcELH
[2012/03/17 14:38:22 | 000,000,192 | -H– | M] () – C:\ProgramData\~TtFsssGC9NcELHr
[2012/03/17 14:00:33 | 000,010,307 | —- | M] () – C:\Users\Byron\Desktop\LAEDC - Doing Business in L.A. County.htm
[2012/03/15 21:59:03 | 000,005,353 | -H– | M] () – C:\Users\Byron\Documents\Praise Volume 3.nra
[2012/03/15 21:54:14 | 000,018,244 | -H– | M] () – C:\Users\Byron\Documents\Worship Music Volume 3.lbl
[2012/03/15 21:46:43 | 000,026,460 | -H– | M] () – C:\Users\Byron\Documents\Worship Music Volume 1.lbl
[2012/03/15 21:28:21 | 000,031,088 | -H– | M] () – C:\Users\Byron\Documents\Praise Volume 2.lbl
[2012/03/15 21:00:27 | 000,021,656 | -H– | M] () – C:\Users\Byron\Documents\Worship Music Volume 2.lbl
[2012/03/15 02:01:19 | 000,001,018 | —- | M] () – C:\Users\Byron\Desktop\Acoustica CD Label Maker.lnk
[2012/03/14 04:22:35 | 000,413,400 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/03/13 22:45:01 | 000,037,675 | —- | M] () – C:\Users\Byron\Desktop\Roam Pay Application- new fees 11.11.pdf
[1 C:\Users\Byron\Documents\*.tmp files -> C:\Users\Byron\Documents\*.tmp -> ]
[1 C:\Users\Byron\Desktop\*.tmp files -> C:\Users\Byron\Desktop\*.tmp -> ]
[1 C:\Users\Byron\AppData\Local\*.tmp files -> C:\Users\Byron\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/07 08:05:13 | 000,030,976 | —- | C] () – C:\Users\Byron\Desktop\Selling Simplified _ Shameless Sales Tips from Shamus Brown.htm
[2012/04/07 08:03:02 | 000,047,784 | —- | C] () – C:\Users\Byron\Desktop\What the Tech.htm
[2012/04/04 14:53:23 | 000,039,392 | —- | C] () – C:\Users\Byron\Desktop\Uni.htm
[2012/04/04 00:39:58 | 000,000,830 | —- | C] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/03 07:41:42 | 000,360,042 | —- | C] () – C:\Users\Byron\Desktop\watch.htm
[2012/04/02 18:17:33 | 001,399,288 | —- | C] () – C:\Users\Byron\Desktop\Perk Nation LLC.pdf
[2012/03/27 22:42:22 | 000,001,800 | —- | C] () – C:\Users\Byron\Desktop\Uniblue RegistryBooster.lnk
[2012/03/27 22:39:53 | 000,001,790 | —- | C] () – C:\Users\Byron\Application Data\Microsoft\Internet Explorer\Quick Launch\Uniblue RegistryBooster.lnk
[2012/03/26 21:55:59 | 000,002,617 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk
[2012/03/26 18:40:31 | 000,181,946 | —- | C] () – C:\Users\Byron\Desktop\how-to-remove-data-recovery-uninstall.html
[2012/03/25 12:41:19 | 000,125,359 | —- | C] () – C:\Users\Byron\Desktop\Miller-Gold-is-Has-Investment-158160.S.103224214.htm
[2012/03/24 10:49:04 | 000,153,008 | —- | C] () – C:\Users\Byron\Documents\Glamour Beauty Salon.pdf
[2012/03/23 13:34:57 | 000,171,903 | —- | C] () – C:\Users\Byron\Desktop\Email Salutation.htm
[2012/03/20 23:39:01 | 049,052,637 | —- | C] () – C:\Users\Byron\Desktop\VID-20111222-00079.3GP
[2012/03/19 07:27:47 | 000,001,133 | —- | C] () – C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
[2012/03/19 07:10:49 | 000,000,344 | —- | C] () – C:\Windows\tasks\RegistryBooster.job
[2012/03/19 03:36:41 | 000,000,264 | —- | C] () – C:\Windows\tasks\RMSchedule.job
[2012/03/19 03:35:50 | 000,040,408 | —- | C] () – C:\Windows\SysNative\CleanMFT64.exe
[2012/03/18 18:37:17 | 092,178,359 | —- | C] () – C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/03/18 18:36:29 | 000,058,220 | —- | C] () – C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/03/17 16:47:34 | 000,000,967 | —- | C] () – C:\Users\Public\Desktop\AVG 2012.lnk
[2012/03/17 16:47:31 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2012/03/17 16:47:31 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2012/03/17 16:14:04 | 000,001,594 | —- | C] () – C:\Users\Byron\Desktop\mbam - Shortcut.lnk
[2012/03/17 14:38:22 | 000,000,272 | -H– | C] () – C:\ProgramData\~TtFsssGC9NcELH
[2012/03/17 14:38:22 | 000,000,192 | -H– | C] () – C:\ProgramData\~TtFsssGC9NcELHr
[2012/03/17 14:38:14 | 000,000,440 | -H– | C] () – C:\ProgramData\TtFsssGC9NcELH
[2012/03/17 14:00:23 | 000,010,307 | —- | C] () – C:\Users\Byron\Desktop\LAEDC - Doing Business in L.A. County.htm
[2012/03/15 21:59:03 | 000,005,353 | -H– | C] () – C:\Users\Byron\Documents\Praise Volume 3.nra
[2012/03/15 21:54:14 | 000,018,244 | -H– | C] () – C:\Users\Byron\Documents\Worship Music Volume 3.lbl
[2012/03/15 21:46:43 | 000,026,460 | -H– | C] () – C:\Users\Byron\Documents\Worship Music Volume 1.lbl
[2012/03/15 21:28:21 | 000,031,088 | -H– | C] () – C:\Users\Byron\Documents\Praise Volume 2.lbl
[2012/03/15 21:00:27 | 000,021,656 | -H– | C] () – C:\Users\Byron\Documents\Worship Music Volume 2.lbl
[2012/03/15 02:01:19 | 000,001,018 | —- | C] () – C:\Users\Byron\Desktop\Acoustica CD Label Maker.lnk
[2012/03/15 02:01:18 | 000,299,552 | —- | C] () – C:\Windows\wmsysprx.prx
[2012/03/13 22:45:01 | 000,037,675 | —- | C] () – C:\Users\Byron\Desktop\Roam Pay Application- new fees 11.11.pdf
[2012/02/17 22:33:19 | 000,000,126 | —- | C] () – C:\Windows\QUICKEN.INI
[2011/12/19 23:56:30 | 000,009,908 | -HS- | C] () – C:\Users\Byron\AppData\Local\811410x6x458s346j352j8tkd0v6
[2011/12/19 23:56:30 | 000,009,908 | -HS- | C] () – C:\ProgramData\811410x6x458s346j352j8tkd0v6
[2011/12/15 01:22:10 | 000,010,348 | -HS- | C] () – C:\Users\Byron\AppData\Local\k5ne3dx5w3g8lgoeol54uau4jn5g6uu0ml770
[2011/12/15 01:22:10 | 000,010,348 | -HS- | C] () – C:\ProgramData\k5ne3dx5w3g8lgoeol54uau4jn5g6uu0ml770
[2011/12/11 02:34:58 | 000,012,408 | -H– | C] () – C:\Users\Byron\AppData\Local\mqfhxd5j5dcs1adb7nby5l851v3b
[2011/12/11 02:34:58 | 000,012,408 | -H– | C] () – C:\ProgramData\mqfhxd5j5dcs1adb7nby5l851v3b
[2011/06/03 10:48:13 | 000,007,597 | -H– | C] () – C:\Users\Byron\AppData\Local\Resmon.ResmonCfg
[2011/05/16 00:33:29 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\mfc45.dll
[2011/04/30 01:57:31 | 000,039,424 | -H– | C] () – C:\Users\Byron\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/30 01:01:30 | 000,000,024 | —- | C] () – C:\Windows\ATKPF.ini

========== LOP Check ==========

[2012/03/15 02:00:21 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\Acoustica
[2011/09/02 00:59:44 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\Auslogics
[2012/03/17 16:50:20 | 000,000,000 | —D | M] – C:\Users\Byron\AppData\Roaming\AVG2012
[2012/04/07 08:13:10 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\BitTorrent
[2011/04/30 02:29:26 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\Blackberry Desktop
[2012/03/11 01:31:49 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\bppenu11
[2011/12/06 11:41:41 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\dNNyyxAA0
[2012/04/05 00:39:56 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\Dropbox
[2011/11/26 01:26:53 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\EEF2E
[2011/11/26 01:16:32 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\EF33ppnG5aQHd
[2011/11/26 01:26:53 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\FCCEE
[2011/05/16 00:33:27 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\iolo
[2012/02/17 22:30:12 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\MechCAD
[2011/05/18 22:10:44 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\Nuance
[2011/11/26 00:56:08 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\QdddWK88fRL
[2012/03/19 07:33:24 | 000,000,000 | —D | M] – C:\Users\Byron\AppData\Roaming\Registry Mechanic
[2011/04/30 01:57:14 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\Research In Motion
[2011/11/26 00:56:09 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\SXqqjjYCekIVz
[2012/02/16 20:20:40 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\TuneUp Software
[2012/03/27 22:42:23 | 000,000,000 | —D | M] – C:\Users\Byron\AppData\Roaming\Uniblue
[2011/06/08 08:07:10 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\WhiteSmoke
[2011/11/26 00:56:18 | 000,000,000 | -H-D | M] – C:\Users\Byron\AppData\Roaming\WPPPNyyxAuvSob3
[2012/04/06 21:29:00 | 000,000,906 | -H– | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3700817450-263443993-1340972289-1000Core.job
[2012/04/07 06:29:00 | 000,000,928 | -H– | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3700817450-263443993-1340972289-1000UA.job
[2012/04/04 22:21:21 | 000,000,344 | —- | M] () – C:\Windows\Tasks\RegistryBooster.job
[2012/04/06 21:58:03 | 000,000,264 | —- | M] () – C:\Windows\Tasks\RMSchedule.job
[2011/08/13 21:47:42 | 000,032,614 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2011/12/11 10:45:47 | 000,009,511 | —- | M] () – C:\aaw7boot.log
[2010/11/20 05:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2009/07/28 23:03:37 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2011/12/11 13:33:41 | 000,618,083 | —- | M] () – C:\caisslog.txt
[2012/02/11 17:01:34 | 000,187,655 | —- | M] () – C:\drivers.log
[2012/04/04 22:21:06 | 3193,765,888 | -HS- | M] () – C:\hiberfil.sys
[2009/07/10 01:35:33 | 001,048,576 | RH– | M] () – C:\K40IJ.BIN
[2009/07/10 01:40:31 | 001,048,576 | RH– | M] () – C:\K50IJ.BIN
[2012/04/04 22:21:06 | 4258,357,248 | -HS- | M] () – C:\pagefile.sys
[2012/03/26 18:39:45 | 000,255,510 | —- | M] () – C:\TDSSKiller.2.7.23.0_26.03.2012_18.34.21_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/13 22:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 22:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 22:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 22:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 13:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 21:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/12/22 11:32:35 | 000,000,221 | -HS- | M] () – C:\Users\Byron\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >
[2007/06/12 10:34:50 | 000,035,822 | —- | M] () – C:\Program Files (x86)\Common Files\ASPG_icon.ico
[2008/05/22 09:35:54 | 000,051,962 | —- | M] () – C:\Program Files (x86)\Common Files\banner.jpg
[2009/04/08 11:31:56 | 000,106,496 | —- | M] () – C:\Program Files (x86)\Common Files\CPInstallAction.dll
[2008/08/11 22:45:20 | 000,155,648 | —- | M] (ASUS) – C:\Program Files (x86)\Common Files\MSIactionall.dll

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\Windows\system64] -> \systemroot\system32 -> Mount Point

========== Alternate Data Streams ==========

@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:F35A93AD
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:07BF512B
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:0FF263E8

< End of report >


OTL Extras logfile created on: 4/7/2012 8:08:35 AM - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Byron\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.97 Gb Total Physical Memory | 1.41 Gb Available Physical Memory | 35.48% Memory free
7.93 Gb Paging File | 4.88 Gb Available in Paging File | 61.60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 73.79 Gb Free Space | 63.38% Space Free | Partition Type: NTFS
Drive D: | 331.01 Gb Total Space | 330.90 Gb Free Space | 99.97% Space Free | Partition Type: NTFS

Computer Name: BYRON-PC | User Name: Byron | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1686C4D1-B1FD-42E8-B7A8-FB4C4DBA5BA8}" = ASUS Power4Gear Hybrid
"{3ED4AD02-F631-4A4C-AAC8-2325996E5A56}" = Microsoft IntelliPoint 8.1
"{4BDE7544-0A08-4AD9-8A8F-4B7944471C36}" = iTunes
"{587F20B7-4193-4400-B404-C6E3E1919BCA}" = ESET NOD32 Antivirus
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D050583D-5CEC-47B1-88AA-8B328CAA8621}" = AVG 2012
"{E3EC7FC4-B4BF-4911-9A43-F7C753CE03F5}" = AVG 2012
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"AVG" = AVG 2012
"Elantech" = ETDWare PS/2-x64 7.0.5.5_WHQL
"HDMI" = Intel® Graphics Media Accelerator Driver
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.1" = Microsoft IntelliPoint 8.1
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam
"WinRAR archiver" = WinRAR 4.00 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}" = ASUS AI Recovery
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2
"{3E9E68FB-49FA-410A-8787-424F2A506E0F}" = Business Plan Pro 15th Anniversary Edition
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A22D889-FBDD-4AE8-86EC-089D45FC133E}" = Alcor Micro USB Card Reader
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
"{5FE545A1-D215-4216-9189-E7B39C9D1CC1}" = Quicken 2011
"{60D6618B-153F-4353-8185-908E676E5888}" = ASUS FancyStart
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{75157F34-02C6-4831-BD66-3BC49E7A8394}" = BlackBerry Desktop Software 6.1
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DE03F6E-FCD2-4497-A8FF-F6C4430618B6}" = BlackBerry App World Browser Plugin
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_PROPLUS_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{A16656CE-4B17-4484-A13F-22B9500E5223}" = Fast Boot
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A95A76C9-6F65-477E-83A0-9F884B6DC21B}" = TuneUp Utilities Language Pack (en-US)
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{F1CECE09-7CBE-4E98-B435-DA87CDA86167}" = Skype™ 5.3
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AceMoney_is1" = AceMoney
"Acoustica CD/DVD Label Maker" = Acoustica CD/DVD Label Maker
"Adobe AIR" = Adobe AIR
"am-mahjongmedleyunlimited" = Mah Jong Medley Unlimited
"BitTorrent" = BitTorrent
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.1
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{5A22D889-FBDD-4AE8-86EC-089D45FC133E}" = Alcor Micro USB Card Reader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000
"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)
"PROPLUS" = Microsoft Office Professional Plus 2007
"Registry Mechanic_is1" = PC Tools Registry Mechanic 11.0
"Security Task Manager" = Security Task Manager 1.8d
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"Uniblue RegistryBooster" = Uniblue RegistryBooster
"VLC media player" = VLC media player 1.1.10
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"workspacedesktop" = Workspace Desktop

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:42:57 AM, on 4/7/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Uniblue\RegistryBooster\rbmonitor.exe
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Users\Byron\AppData\Local\Workspace\workspaceupdate.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Program Files (x86)\Research In Motion\BlackBerry Desktop\Rim.Desktop.AutoUpdate.exe
C:\Users\Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\BitTorrent\BitTorrent.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Byron\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z007&form=ZGAPHP
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Starfield Updater] "C:\Users\Byron\AppData\Local\Workspace\WorkspaceUpdate.exe"
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: FancyStart daemon.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: FastBootAgent - ASUSTeK Computer Inc. - C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: File Backup Service (File Backup) - Starfield Technologies - C:\Program Files (x86)\Workspace\offSyncService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9769 bytes

. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 4/29/2011 7:49:56 PM System Uptime: 4/6/2012 3:21:14 AM (30 hours ago) . Motherboard: ASUSTeK Computer Inc. | | K50IJ Processor: Pentium® Dual-Core CPU T4500 @ 2.30GHz | Socket 478 | 2300/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 116 GiB total, 73.875 GiB free. D: is FIXED (NTFS) - 331 GiB total, 330.898 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP138: 4/7/2012 3:27:20 AM - Scheduled Checkpoint RP139: 4/7/2012 8:10:52 AM - OTL Restore Point - 4/7/2012 8:10:52 AM . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) AceMoney Acoustica CD/DVD Label Maker Adobe AIR Adobe Reader X (10.1.1) Alcor Micro USB Card Reader AnswerWorks 5.0 English Runtime Apple Application Support Apple Software Update ASUS AI Recovery ASUS CopyProtect ASUS FancyStart ASUS LifeFrame3 ASUS Live Update ASUS MultiFrame ASUS SmartLogon ASUS Splendid Video Enhancement Technology ASUS Virtual Camera Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver ATK Generic Function Service ATK Hotkey ATK Media ATKOSD2 BitTorrent BlackBerry App World Browser Plugin BlackBerry Desktop Software 6.1 Business Plan Pro 15th Anniversary Edition ControlDeck Dropbox Facebook Video Calling 1.2.0.159 Fast Boot Google Earth Google Update Helper High-Definition Video Playback 10 Java Auto Updater Java™ 6 Update 31 Mah Jong Medley Unlimited Malwarebytes Anti-Malware version 1.60.1.1000 Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Plus 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Primary Interoperability Assemblies 2005 Microsoft Silverlight Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 11.0 (x86 en-US) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero 10 Menu TemplatePack Basic Nero 10 Movie ThemePack Basic Nero BackItUp 10 Help (CHM) Nero Burning ROM 10 Nero BurningROM 10 Help (CHM) Nero BurnRights 10 Nero BurnRights 10 Help (CHM) Nero Control Center 10 Nero ControlCenter 10 Help (CHM) Nero Core Components 10 Nero CoverDesigner 10 Help (CHM) Nero DiscSpeed 10 Nero DiscSpeed 10 Help (CHM) Nero Dolby Files 10 Nero Express 10 Nero Express 10 Help (CHM) Nero InfoTool 10 Nero InfoTool 10 Help (CHM) Nero MediaHub 10 Help (CHM) Nero Multimedia Suite 10 Nero Recode 10 Nero Recode 10 Help (CHM) Nero RescueAgent 10 Nero RescueAgent 10 Help (CHM) Nero SoundTrax 10 Nero SoundTrax 10 Help (CHM) Nero StartSmart 10 Nero StartSmart 10 Help (CHM) Nero Vision 10 Nero Vision 10 Help (CHM) Nero WaveEditor 10 Nero WaveEditor 10 Help (CHM) PC Tools Registry Mechanic 11.0 Platform Quicken 2011 QuickTime Security Task Manager 1.8d Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Skype™ 5.3 TuneUp Utilities 2012 TuneUp Utilities Language Pack (en-US) Uniblue RegistryBooster Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2597970) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VIA Platform Device Manager Visual Studio 2008 x64 Redistributables VLC media player 1.1.10 Windows Media Player Firefox Plugin WinFlash Wireless Console 3 Workspace Desktop Yahoo! Messenger Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 4/5/2012 12:40:24 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80070422'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly. . ==== End Of File =========================== . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 9:44:31.58 on Sat 04/07/2012 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4061.1443 [GMT -7:00] . AV: CA Anti-Virus Plus *Enabled/Updated* {3EED0195-0A4B-4EF3-CC4F-4F401BDC245F} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: CA Anti-Virus Plus *Enabled/Updated* {858CE071-2C71-417D-F6FF-7432605B6EE2} . ============== Running Processes =============== . C:\PROGRA~2\AVG\AVG2012\avgrsa.exe C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\spoolsv.exe C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe C:\Program Files (x86)\Workspace\offSyncService.exe C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files (x86)\Uniblue\RegistryBooster\rbmonitor.exe C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe C:\Program Files\P4G\BatteryLife.exe C:\Program Files (x86)\ASUS\Splendid\ACMON.exe C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe C:\Windows\SysWOW64\ACEngSvr.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Users\Byron\AppData\Local\Workspace\workspaceupdate.exe C:\Windows\System32\StikyNot.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDECK.EXE C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe C:\Program Files (x86)\Research In Motion\BlackBerry Desktop\Rim.Desktop.AutoUpdate.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe C:\Program Files (x86)\BitTorrent\BitTorrent.exe C:\Windows\explorer.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\AUDIODG.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Byron\Downloads\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.bing.com/?pc=Z007&form=ZGAPHP uInternet Settings,ProxyOverride = *.local mWinlogon: Userinit=userinit.exe, BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe uRun: [Starfield Updater] "C:\Users\Byron\AppData\Local\Workspace\WorkspaceUpdate.exe" uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray StartupFolder: C:\Users\Byron\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FancyStart daemon.lnk - C:\Windows\Installer\{60D6618B-153F-4353-8185-908E676E5888}\_DCE9A4DB2A5F2786140FA3.exe uPolicies-explorer: HideSCAHealth = 1 (0x1) uPolicies-explorer: NoInstrumentation = 1 mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe mRun-x64: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe mRun-x64: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe mRun-x64: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" mRun-x64: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z007&form=ZGAADF&q= FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll FF - plugin: C:\Users\Byron\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npoff.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npoff.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npoff64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npoff64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npwbe.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npwbe.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npwbe64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npwbe64.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll . —- FIREFOX POLICIES —- FF - user.js: yahoo.ytff.general.dontshowhpoffer - true ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;C:\Windows\System32\drivers\AVGIDSEH.sys [2011-7-11 26704] R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2011-9-13 37456] R0 lullaby;lullaby;C:\Windows\System32\drivers\lullaby.sys [2000-3-22 15928] R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2011-10-7 283728] R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2011-8-8 46672] R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2011-7-11 375376] R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920] R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2000-3-22 14904] R2 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2011-8-9 202576] R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-9-22 974944] R2 epfwwfpr;epfwwfpr;C:\Windows\System32\drivers\epfwwfpr.sys [2011-8-4 137144] R2 FastBootAgent;FastBootAgent;C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe [2000-3-22 306232] R2 File Backup;File Backup Service;C:\Program Files (x86)\Workspace\offSyncService.exe [2011-2-2 1188624] R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2012-3-19 793048] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2012-2-9 2143552] R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2009-6-11 112128] R3 tmobile_mf691_dc_enum;tmobile_mf691_dc_enum;C:\Windows\System32\drivers\tmobile_mf691_dc_enum.sys [2010-4-9 75776] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2009-7-9 1222144] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-1-8 136176] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-4 253600] S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2009-5-26 40448] S3 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\AVGIDSDriver.sys [2011-7-11 120400] S3 AVGIDSFilter;AVGIDSFilter;C:\Windows\System32\drivers\AVGIDSFilter.sys [2011-7-11 29776] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-1-8 136176] S3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2011-4-30 23152] S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-3-4 59392] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-4-30 1255736] S3 ZTEusbgps;ZTE GPS Port;C:\Windows\System32\drivers\ZTEusbgps.sys [2012-2-11 123520] S3 ZTEusbwwan;ZTE MBN Miniport;C:\Windows\System32\drivers\ZTEusbwwan.sys [2012-2-11 235008] S4 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248] S4 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-8-2 192776] S4 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-2-5 652360] . =============== Created Last 30 ================ . 2012-04-04 08:17:04 8767136 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-04-04 07:39:58 418464 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-04-03 14:44:31 476904 —-a-w- C:\Program Files (x86)\Mozilla Firefox\Plugins\npdeployJava1.dll 2012-03-28 05:42:23 ——– d—–w- C:\Users\Byron\AppData\Roaming\Uniblue 2012-03-27 16:36:58 ——– dc-h–w- C:\PROGRA~3\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} 2012-03-27 05:45:26 ——– d—–w- C:\PROGRA~3\SecTaskMan 2012-03-27 05:45:21 ——– d—–w- C:\Program Files (x86)\Security Task Manager 2012-03-19 12:39:38 ——– d—–w- C:\Program Files (x86)\Uniblue 2012-03-19 12:39:28 ——– d—–w- C:\Users\Byron\AppData\Local\PackageAware 2012-03-19 10:41:18 ——– d—–w- C:\Users\Byron\AppData\Roaming\Registry Mechanic 2012-03-19 10:35:50 880640 —-a-w- C:\Windows\SysWow64\UniBox10.ocx 2012-03-19 10:35:50 506368 —-a-w- C:\Windows\SysWow64\msxml.dll 2012-03-19 10:35:50 40408 —-a-w- C:\Windows\System32\CleanMFT64.exe 2012-03-19 10:35:50 212992 —-a-w- C:\Windows\SysWow64\UniBoxVB12.ocx 2012-03-19 10:35:50 1101824 —-a-w- C:\Windows\SysWow64\UniBox210.ocx 2012-03-19 10:35:49 658432 —-a-w- C:\Windows\SysWow64\MSCOMCT2.OCX 2012-03-19 10:35:37 ——– d—–w- C:\Program Files (x86)\Common Files\PC Tools 2012-03-18 06:43:24 ——– d—–w- C:\Program Files (x86)\DesktopCentral_Server 2012-03-18 00:59:52 ——– d–h–w- C:\$AVG 2012-03-17 23:50:20 ——– d—–w- C:\Users\Byron\AppData\Roaming\AVG2012 2012-03-17 23:47:31 ——– d—–w- C:\Windows\SysWow64\drivers\AVG 2012-03-17 23:46:40 ——– d—–w- C:\Windows\System32\drivers\AVG 2012-03-17 23:46:40 ——– d—–w- C:\PROGRA~3\AVG2012 2012-03-17 23:46:13 ——– d—–w- C:\Program Files (x86)\AVG 2012-03-17 20:58:07 592824 —-a-w- C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll 2012-03-17 20:58:07 44472 —-a-w- C:\Program Files (x86)\Mozilla Firefox\mozglue.dll 2012-03-15 09:00:21 ——– d–h–w- C:\Users\Byron\AppData\Roaming\Acoustica 2012-03-15 09:00:13 ——– d—–w- C:\Program Files (x86)\Acoustica CD Label Maker 2012-03-14 10:02:30 5559152 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-03-14 10:02:28 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-03-14 10:02:27 3913584 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-03-14 02:20:40 3145728 —-a-w- C:\Windows\System32\win32k.sys 2012-03-14 02:20:38 1544192 —-a-w- C:\Windows\System32\DWrite.dll 2012-03-14 02:20:37 1077248 —-a-w- C:\Windows\SysWow64\DWrite.dll 2012-03-13 17:19:30 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe 2012-03-13 17:19:30 77312 —-a-w- C:\Windows\System32\rdpwsx.dll 2012-03-13 17:19:30 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll 2012-03-13 17:19:29 826880 —-a-w- C:\Windows\SysWow64\rdpcore.dll 2012-03-13 17:19:29 1031680 —-a-w- C:\Windows\System32\rdpcore.dll 2012-03-13 17:19:28 23552 —-a-w- C:\Windows\System32\drivers\tdtcp.sys 2012-03-13 17:19:28 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-03-11 08:41:12 ——– d–h–w- C:\Users\Byron\AppData\Local\IsolatedStorage 2012-03-11 08:32:14 ——– d–h–w- C:\PROGRA~3\IsolatedStorage 2012-03-11 08:31:49 ——– d–h–w- C:\Users\Byron\AppData\Roaming\bppenu11 2012-03-11 08:31:49 ——– d–h–w- C:\Users\Byron\AppData\Local\Palo_Alto_Software 2012-03-11 08:30:49 ——– d—–w- C:\Program Files (x86)\Business Plan Pro 2012-03-11 08:29:01 ——– d–h–w- C:\Users\Byron\AppData\Local\Downloaded Installations . ==================== Find3M ==================== . 2012-04-04 08:17:08 70304 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-03 14:44:24 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2012-03-05 03:35:28 175616 —-a-w- C:\Windows\System32\msclmd.dll 2012-03-05 03:35:28 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll 2012-02-09 13:13:28 35648 —-a-w- C:\Windows\System32\uxtuneup.dll 2012-02-09 13:13:28 34624 —-a-w- C:\Windows\System32\TURegOpt.exe 2012-02-09 13:13:18 28992 —-a-w- C:\Windows\SysWow64\uxtuneup.dll 2012-02-09 13:13:18 25920 —-a-w- C:\Windows\System32\authuitu.dll 2012-02-09 13:13:18 21312 —-a-w- C:\Windows\SysWow64\authuitu.dll 2009-04-08 18:31:56 106496 —-a-w- C:\Program Files (x86)\Common Files\CPInstallAction.dll 2008-08-12 05:45:20 155648 —-a-w- C:\Program Files (x86)\Common Files\MSIactionall.dll . ============= FINISH: 9:45:09.37 ===============

Thank you!!!!! . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 4/29/2011 7:49:56 PM System Uptime: 4/12/2012 11:34:35 PM (18 hours ago) . Motherboard: ASUSTeK Computer Inc. | | K50IJ Processor: Pentium® Dual-Core CPU T4500 @ 2.30GHz | Socket 478 | 2300/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 116 GiB total, 66.796 GiB free. D: is FIXED (NTFS) - 331 GiB total, 281.143 GiB free. E: is CDROM (CDFS) . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318} Description: Officejet J4680 series Device ID: ROOT\MULTIFUNCTION\0000 Manufacturer: HP Name: Officejet J4680 series PNP Device ID: ROOT\MULTIFUNCTION\0000 Service: . ==== System Restore Points =================== . RP138: 4/7/2012 3:27:20 AM - Scheduled Checkpoint RP139: 4/7/2012 8:10:52 AM - OTL Restore Point - 4/7/2012 8:10:52 AM RP140: 4/8/2012 7:01:06 PM - Windows Backup RP141: 4/9/2012 3:00:10 AM - Windows Update RP143: 4/12/2012 8:07:07 AM - Windows Modules Installer . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) 4660_4680_Help AceMoney Acoustica CD/DVD Label Maker Adobe AIR Adobe Reader X (10.1.1) Alcor Micro USB Card Reader AnswerWorks 5.0 English Runtime Apple Application Support Apple Software Update ASUS AI Recovery ASUS CopyProtect ASUS FancyStart ASUS LifeFrame3 ASUS Live Update ASUS MultiFrame ASUS SmartLogon ASUS Splendid Video Enhancement Technology ASUS Virtual Camera Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver ATK Generic Function Service ATK Hotkey ATK Media ATKOSD2 Bing Bar BitTorrent BlackBerry App World Browser Plugin BlackBerry Desktop Software 6.1 bpd_scan BPDSoftware BPDSoftware_Ini BufferChm Business Plan Pro 15th Anniversary Edition ControlDeck Destinations DeviceDiscovery DocMgr DocProc Dropbox Facebook Video Calling 1.2.0.159 Fast Boot Fax Google Earth Google Update Helper GPBaseService2 High-Definition Video Playback 10 HP Update HPPhotoSmartDiscLabelContent1 HPPhotosmartEssential HPProductAssistant HPSSupply J4680 Java Auto Updater Java™ 6 Update 31 Mah Jong Medley Unlimited Malwarebytes Anti-Malware version 1.60.1.1000 MarketResearch Microsoft Default Manager Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Plus 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Primary Interoperability Assemblies 2005 Microsoft Silverlight Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 11.0 (x86 en-US) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero 10 Menu TemplatePack Basic Nero 10 Movie ThemePack Basic Nero BackItUp 10 Help (CHM) Nero Burning ROM 10 Nero BurningROM 10 Help (CHM) Nero BurnRights 10 Nero BurnRights 10 Help (CHM) Nero Control Center 10 Nero ControlCenter 10 Help (CHM) Nero Core Components 10 Nero CoverDesigner 10 Help (CHM) Nero DiscSpeed 10 Nero DiscSpeed 10 Help (CHM) Nero Dolby Files 10 Nero Express 10 Nero Express 10 Help (CHM) Nero InfoTool 10 Nero InfoTool 10 Help (CHM) Nero MediaHub 10 Help (CHM) Nero Multimedia Suite 10 Nero Recode 10 Nero Recode 10 Help (CHM) Nero RescueAgent 10 Nero RescueAgent 10 Help (CHM) Nero SoundTrax 10 Nero SoundTrax 10 Help (CHM) Nero StartSmart 10 Nero StartSmart 10 Help (CHM) Nero Vision 10 Nero Vision 10 Help (CHM) Nero WaveEditor 10 Nero WaveEditor 10 Help (CHM) PC Tools Registry Mechanic 11.0 Platform ProductContext Quicken 2011 QuickTime Scan Security Task Manager 1.8d Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Skype™ 5.3 SmartWebPrinting SolutionCenter Status Toolbox TrayApp TuneUp Utilities 2012 TuneUp Utilities Language Pack (en-US) Uniblue RegistryBooster Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2598306) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VIA Platform Device Manager Visual Studio 2008 x64 Redistributables VLC media player 1.1.10 WebReg Windows Media Player Firefox Plugin WinFlash Wireless Console 3 Workspace Desktop Yahoo! Messenger Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 4/9/2012 7:56:48 AM, Error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 1 time(s). 4/8/2012 10:00:25 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {10DA4F3C-CC99-4190-BE4D-58330754E882} and APPID {7DDEFEA6-98EE-4F13-A25B-EC83D9BC5541} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 4/13/2012 6:19:23 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service. 4/13/2012 5:17:50 PM, Error: Service Control Manager [7001] - The Windows Image Acquisition (WIA) service depends on the Shell Hardware Detection service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 4/12/2012 8:06:51 AM, Error: Service Control Manager [7000] - The Volume Shadow Copy service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 4/12/2012 8:06:51 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service VSS with arguments "" in order to run the server: {0B5A2C52-3EB9-470A-96E2-6C6D4570E40F} 4/12/2012 8:06:49 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Volume Shadow Copy service to connect. 4/12/2012 11:40:19 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service stisvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 4/11/2012 9:32:50 PM, Error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 2 time(s). . ==== End Of File =========================== . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 17:32:13.21 on Fri 04/13/2012 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4061.2174 [GMT -7:00] . AV: CA Anti-Virus Plus *Enabled/Updated* {3EED0195-0A4B-4EF3-CC4F-4F401BDC245F} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: CA Anti-Virus Plus *Enabled/Updated* {858CE071-2C71-417D-F6FF-7432605B6EE2} . ============== Running Processes =============== . C:\PROGRA~2\AVG\AVG2012\avgrsa.exe C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe C:\Windows\System32\spoolsv.exe C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Workspace\offSyncService.exe C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k HPService C:\Windows\system32\taskhost.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe C:\Program Files (x86)\Uniblue\RegistryBooster\rbmonitor.exe C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe C:\Program Files\P4G\BatteryLife.exe C:\Windows\system32\Dwm.exe C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe C:\Program Files (x86)\ASUS\Splendid\ACMON.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe C:\Windows\SysWOW64\ACEngSvr.exe C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Elantech\ETDCtrl.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Users\Byron\AppData\Local\Workspace\workspaceupdate.exe C:\Windows\System32\StikyNot.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDECK.EXE C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files (x86)\BitTorrent\BitTorrent.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files (x86)\Uniblue\RegistryBooster\RegistryBooster.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\AUDIODG.EXE C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoUpdateCheck.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Users\Byron\Downloads\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.bing.com/?pc=Z007&form=ZGAPHP uInternet Settings,ProxyOverride = *.local mWinlogon: Userinit=userinit.exe, BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll" TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe uRun: [Starfield Updater] "C:\Users\Byron\AppData\Local\Workspace\workspaceupdate.exe" uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray mRun: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun: [] mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume StartupFolder: C:\Users\Byron\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FancyStart daemon.lnk - C:\Windows\Installer\{60D6618B-153F-4353-8185-908E676E5888}\_DCE9A4DB2A5F2786140FA3.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HP Digital Imaging Monitor.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe uPolicies-explorer: HideSCAHealth = 1 (0x1) uPolicies-explorer: NoInstrumentation = 1 mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe mRun-x64: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe mRun-x64: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe mRun-x64: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" mRun-x64: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z007&form=ZGAADF&q= FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll FF - plugin: C:\Users\Byron\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npoff.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npoff.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npoff64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npoff64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npwbe.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npwbe.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npwbe64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npwbe64.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll . —- FIREFOX POLICIES —- FF - user.js: yahoo.ytff.general.dontshowhpoffer - true ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;C:\Windows\System32\drivers\AVGIDSEH.sys [2011-7-11 26704] R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2011-9-13 37456] R0 lullaby;lullaby;C:\Windows\System32\drivers\lullaby.sys [2000-3-22 15928] R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2011-10-7 283728] R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2011-8-8 46672] R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2011-7-11 375376] R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920] R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952] R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2000-3-22 14904] R2 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2011-8-9 202576] R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-9-22 974944] R2 epfwwfpr;epfwwfpr;C:\Windows\System32\drivers\epfwwfpr.sys [2011-8-4 137144] R2 FastBootAgent;FastBootAgent;C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe [2000-3-22 306232] R2 File Backup;File Backup Service;C:\Program Files (x86)\Workspace\offSyncService.exe [2011-2-2 1188624] R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2012-3-19 793048] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2012-2-9 2143552] R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2009-6-11 112128] R3 tmobile_mf691_dc_enum;tmobile_mf691_dc_enum;C:\Windows\System32\drivers\tmobile_mf691_dc_enum.sys [2010-4-9 75776] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2009-7-9 1222144] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920] S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.EXE [2012-2-10 193816] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-1-8 136176] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-4 253600] S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2009-5-26 40448] S3 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\AVGIDSDriver.sys [2011-7-11 120400] S3 AVGIDSFilter;AVGIDSFilter;C:\Windows\System32\drivers\AVGIDSFilter.sys [2011-7-11 29776] S3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.EXE [2012-2-10 240408] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-1-8 136176] S3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2011-4-30 23152] S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-3-4 59392] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-4-30 1255736] S3 ZTEusbgps;ZTE GPS Port;C:\Windows\System32\drivers\ZTEusbgps.sys [2012-2-11 123520] S3 ZTEusbwwan;ZTE MBN Miniport;C:\Windows\System32\drivers\ZTEusbwwan.sys [2012-2-11 235008] S4 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248] S4 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-8-2 192776] S4 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-2-5 652360] . =============== Created Last 30 ================ . 2012-04-12 15:11:55 5559152 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-04-12 15:11:53 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-04-12 15:11:51 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-04-12 15:08:00 81408 —-a-w- C:\Windows\System32\imagehlp.dll 2012-04-12 15:08:00 23408 —-a-w- C:\Windows\System32\drivers\fs_rec.sys 2012-04-12 15:08:00 159232 —-a-w- C:\Windows\SysWow64\imagehlp.dll 2012-04-12 15:07:57 5120 —-a-w- C:\Windows\System32\wmi.dll 2012-04-12 15:07:57 220672 —-a-w- C:\Windows\System32\wintrust.dll 2012-04-12 15:07:57 172544 —-a-w- C:\Windows\SysWow64\wintrust.dll 2012-04-12 15:07:56 5120 —-a-w- C:\Windows\SysWow64\wmi.dll 2012-04-08 17:03:23 ——– d—–w- C:\PROGRA~3\WEBREG 2012-04-08 17:01:50 ——– d—–w- C:\Users\Byron\AppData\Local\HP 2012-04-08 17:00:26 226816 —-a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzpp5oe.dll 2012-04-08 16:58:40 ——– d—–w- C:\Program Files (x86)\Microsoft 2012-04-08 16:58:05 ——– d—–w- C:\Users\Byron\AppData\Roaming\HpUpdate 2012-04-08 16:56:14 ——– d—–w- C:\Windows\SysWow64\spool 2012-04-08 16:55:11 ——– d—–w- C:\Program Files (x86)\Common Files\HP 2012-04-08 16:55:10 ——– d—–w- C:\Program Files (x86)\Common Files\Hewlett-Packard 2012-04-08 16:54:30 235008 —-a-w- C:\Windows\SysWow64\hpzc35oe.dll 2012-04-08 16:54:29 671816 —-a-w- C:\Windows\System32\hpcdmc32.dll 2012-04-08 16:54:29 131072 —-a-w- C:\Windows\System32\hpz3l5oe.dll 2012-04-08 16:54:01 ——– d—–w- C:\Program Files (x86)\HP 2012-04-08 16:51:37 944128 —-a-w- C:\Windows\System32\hpwwiax4.dll 2012-04-08 16:51:37 358744 —-a-w- C:\Windows\System32\hpzids40.dll 2012-04-08 16:51:36 740864 —-a-w- C:\Windows\System32\hpwtscl3.dll 2012-04-08 16:51:36 540672 —-a-w- C:\Windows\System32\hppldcoi.dll 2012-04-08 16:51:36 488960 —-a-w- C:\Windows\System32\hpovst11.dll 2012-04-04 08:17:04 8767136 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-04-04 07:39:58 418464 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-04-03 14:44:31 476904 —-a-w- C:\Program Files (x86)\Mozilla Firefox\Plugins\npdeployJava1.dll 2012-03-28 05:42:23 ——– d—–w- C:\Users\Byron\AppData\Roaming\Uniblue 2012-03-27 16:36:58 ——– dc-h–w- C:\PROGRA~3\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} 2012-03-27 05:45:26 ——– d—–w- C:\PROGRA~3\SecTaskMan 2012-03-27 05:45:21 ——– d—–w- C:\Program Files (x86)\Security Task Manager 2012-03-19 12:39:38 ——– d—–w- C:\Program Files (x86)\Uniblue 2012-03-19 12:39:28 ——– d—–w- C:\Users\Byron\AppData\Local\PackageAware 2012-03-19 10:41:18 ——– d—–w- C:\Users\Byron\AppData\Roaming\Registry Mechanic 2012-03-19 10:35:50 880640 —-a-w- C:\Windows\SysWow64\UniBox10.ocx 2012-03-19 10:35:50 506368 —-a-w- C:\Windows\SysWow64\msxml.dll 2012-03-19 10:35:50 40408 —-a-w- C:\Windows\System32\CleanMFT64.exe 2012-03-19 10:35:50 212992 —-a-w- C:\Windows\SysWow64\UniBoxVB12.ocx 2012-03-19 10:35:50 1101824 —-a-w- C:\Windows\SysWow64\UniBox210.ocx 2012-03-19 10:35:49 658432 —-a-w- C:\Windows\SysWow64\MSCOMCT2.OCX 2012-03-19 10:35:37 ——– d—–w- C:\Program Files (x86)\Common Files\PC Tools 2012-03-18 06:43:24 ——– d—–w- C:\Program Files (x86)\DesktopCentral_Server 2012-03-18 00:59:52 ——– d–h–w- C:\$AVG 2012-03-17 23:50:20 ——– d—–w- C:\Users\Byron\AppData\Roaming\AVG2012 2012-03-17 23:47:31 ——– d—–w- C:\Windows\SysWow64\drivers\AVG 2012-03-17 23:46:40 ——– d—–w- C:\Windows\System32\drivers\AVG 2012-03-17 23:46:40 ——– d—–w- C:\PROGRA~3\AVG2012 2012-03-17 23:46:13 ——– d—–w- C:\Program Files (x86)\AVG 2012-03-17 20:58:07 592824 —-a-w- C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll 2012-03-17 20:58:07 44472 —-a-w- C:\Program Files (x86)\Mozilla Firefox\mozglue.dll 2012-03-15 09:00:21 ——– d–h–w- C:\Users\Byron\AppData\Roaming\Acoustica 2012-03-15 09:00:13 ——– d—–w- C:\Program Files (x86)\Acoustica CD Label Maker . ==================== Find3M ==================== . 2012-04-04 08:17:08 70304 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-03 14:44:24 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2012-03-05 03:35:28 175616 —-a-w- C:\Windows\System32\msclmd.dll 2012-03-05 03:35:28 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll 2012-02-28 06:56:48 2311168 —-a-w- C:\Windows\System32\jscript9.dll 2012-02-28 06:49:56 1390080 —-a-w- C:\Windows\System32\wininet.dll 2012-02-28 06:48:57 1493504 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-02-28 06:42:55 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-02-28 01:18:55 1799168 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-02-28 01:11:21 1427456 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-02-28 01:11:07 1127424 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-02-28 01:03:16 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-02-17 06:38:26 1031680 —-a-w- C:\Windows\System32\rdpcore.dll 2012-02-17 05:34:22 826880 —-a-w- C:\Windows\SysWow64\rdpcore.dll 2012-02-17 04:58:24 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-02-17 04:57:32 23552 —-a-w- C:\Windows\System32\drivers\tdtcp.sys 2012-02-10 06:36:07 1544192 —-a-w- C:\Windows\System32\DWrite.dll 2012-02-10 05:38:43 1077248 —-a-w- C:\Windows\SysWow64\DWrite.dll 2012-02-09 13:13:28 35648 —-a-w- C:\Windows\System32\uxtuneup.dll 2012-02-09 13:13:28 34624 —-a-w- C:\Windows\System32\TURegOpt.exe 2012-02-09 13:13:18 28992 —-a-w- C:\Windows\SysWow64\uxtuneup.dll 2012-02-09 13:13:18 25920 —-a-w- C:\Windows\System32\authuitu.dll 2012-02-09 13:13:18 21312 —-a-w- C:\Windows\SysWow64\authuitu.dll 2012-02-07 18:02:40 1070352 —-a-w- C:\Windows\SysWow64\MSCOMCTL.OCX 2012-02-03 04:34:34 3145728 —-a-w- C:\Windows\System32\win32k.sys 2012-01-25 06:38:39 77312 —-a-w- C:\Windows\System32\rdpwsx.dll 2012-01-25 06:38:38 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll 2012-01-25 06:33:30 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe 2009-04-08 18:31:56 106496 —-a-w- C:\Program Files (x86)\Common Files\CPInstallAction.dll 2008-08-12 05:45:20 155648 —-a-w- C:\Program Files (x86)\Common Files\MSIactionall.dll . ============= FINISH: 17:33:13.24 ===============

ComboFix 12-04-15.02 - Byron 04/15/2012 10:15:50.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4061.2051 [GMT -7:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: CA Anti-Virus Plus *Enabled/Updated* {3EED0195-0A4B-4EF3-CC4F-4F401BDC245F} SP: CA Anti-Virus Plus *Enabled/Updated* {858CE071-2C71-417D-F6FF-7432605B6EE2} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Resident AV is active . . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Common Files\ASPG_icon.ico c:\programdata\~TtFsssGC9NcELH c:\programdata\~TtFsssGC9NcELHr c:\programdata\TtFsssGC9NcELH c:\users\Byron\AppData\Local\uninstall.tmp c:\users\Byron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check c:\users\Byron\Documents\~WRL0002.tmp c:\users\Byron\g2mdlhlpx.exe . . ((((((((((((((((((((((((( Files Created from 2012-03-15 to 2012-04-15 ))))))))))))))))))))))))))))))) . . 2012-04-15 17:29 . 2012-04-15 17:29 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-04-15 17:29 . 2012-04-15 17:29 ——– d—–w- c:\users\Guest\AppData\Local\temp 2012-04-12 15:11 . 2012-03-06 06:53 5559152 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-04-12 15:11 . 2012-03-06 05:59 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-04-12 15:11 . 2012-03-06 05:59 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-04-12 15:08 . 2012-03-01 06:46 23408 —-a-w- c:\windows\system32\drivers\fs_rec.sys 2012-04-12 15:08 . 2012-03-01 06:33 81408 —-a-w- c:\windows\system32\imagehlp.dll 2012-04-12 15:08 . 2012-03-01 05:33 159232 —-a-w- c:\windows\SysWow64\imagehlp.dll 2012-04-12 15:07 . 2012-03-01 06:38 220672 —-a-w- c:\windows\system32\wintrust.dll 2012-04-12 15:07 . 2012-03-01 06:28 5120 —-a-w- c:\windows\system32\wmi.dll 2012-04-12 15:07 . 2012-03-01 05:37 172544 —-a-w- c:\windows\SysWow64\wintrust.dll 2012-04-12 15:07 . 2012-03-01 05:29 5120 —-a-w- c:\windows\SysWow64\wmi.dll 2012-04-08 17:03 . 2012-04-08 17:03 ——– d—–w- c:\programdata\WEBREG 2012-04-08 17:01 . 2012-04-08 17:04 ——– d—–w- c:\users\Byron\AppData\Roaming\HP 2012-04-08 16:51 . 2010-05-31 04:36 358744 —-a-w- c:\windows\system32\hpzids40.dll 2012-04-08 16:51 . 2010-02-01 06:54 944128 —-a-w- c:\windows\system32\hpwwiax4.dll 2012-04-08 16:51 . 2010-02-01 06:54 740864 —-a-w- c:\windows\system32\hpwtscl3.dll 2012-04-08 16:51 . 2010-02-01 06:54 540672 —-a-w- c:\windows\system32\hppldcoi.dll 2012-04-08 16:51 . 2010-02-01 06:54 488960 —-a-w- c:\windows\system32\hpovst11.dll 2012-04-04 08:17 . 2012-04-14 07:17 8741536 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-04-04 07:39 . 2012-04-14 07:17 418464 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-04-03 14:44 . 2012-04-03 14:44 476904 —-a-w- c:\program files (x86)\Mozilla Firefox\Plugins\npdeployJava1.dll 2012-04-03 14:44 . 2012-04-03 14:44 ——– d—–w- c:\program files (x86)\Java 2012-03-28 05:42 . 2012-03-28 05:42 ——– d—–w- c:\users\Byron\AppData\Roaming\Uniblue 2012-03-27 16:36 . 2012-03-28 05:39 ——– dc—-w- c:\programdata\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} 2012-03-27 05:45 . 2012-03-27 05:46 ——– d—–w- c:\programdata\SecTaskMan 2012-03-27 05:45 . 2012-03-27 05:45 ——– d—–w- c:\program files (x86)\Security Task Manager 2012-03-19 12:39 . 2012-03-19 12:39 ——– d—–w- c:\program files (x86)\Uniblue 2012-03-19 12:39 . 2012-03-19 12:39 ——– d—–w- c:\users\Byron\AppData\Local\PackageAware 2012-03-19 10:41 . 2012-03-19 14:33 ——– d—–w- c:\users\Byron\AppData\Roaming\Registry Mechanic 2012-03-19 10:35 . 2011-10-25 20:44 40408 —-a-w- c:\windows\system32\CleanMFT64.exe 2012-03-19 10:35 . 2008-04-02 22:54 1101824 —-a-w- c:\windows\SysWow64\UniBox210.ocx 2012-03-19 10:35 . 2008-04-02 22:53 212992 —-a-w- c:\windows\SysWow64\UniBoxVB12.ocx 2012-03-19 10:35 . 2008-04-02 22:53 880640 —-a-w- c:\windows\SysWow64\UniBox10.ocx 2012-03-19 10:35 . 2004-08-04 14:00 506368 —-a-w- c:\windows\SysWow64\msxml.dll 2012-03-19 10:35 . 2008-09-18 04:17 658432 —-a-w- c:\windows\SysWow64\MSCOMCT2.OCX 2012-03-19 10:35 . 2012-03-19 10:35 ——– d—–w- c:\program files (x86)\Common Files\PC Tools 2012-03-18 06:43 . 2012-04-04 06:46 ——– d—–w- c:\program files (x86)\DesktopCentral_Server 2012-03-18 00:59 . 2012-03-18 00:59 ——– d—–w- C:\$AVG 2012-03-17 23:50 . 2012-03-17 23:50 ——– d—–w- c:\users\Byron\AppData\Roaming\AVG2012 2012-03-17 23:47 . 2012-03-17 23:47 ——– d—–w- c:\windows\SysWow64\drivers\AVG 2012-03-17 23:46 . 2012-03-19 01:37 ——– d—–w- c:\windows\system32\drivers\AVG 2012-03-17 23:46 . 2012-03-18 00:03 ——– d—–w- c:\programdata\AVG2012 2012-03-17 23:46 . 2012-03-17 23:46 ——– d—–w- c:\program files (x86)\AVG 2012-03-17 20:58 . 2012-03-17 20:58 592824 —-a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll 2012-03-17 20:58 . 2012-03-17 20:58 44472 —-a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-14 07:17 . 2011-09-16 01:11 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-03 14:44 . 2011-05-01 08:44 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-03-05 03:35 . 2009-07-14 02:36 175616 —-a-w- c:\windows\system32\msclmd.dll 2012-03-05 03:35 . 2009-07-14 02:36 152576 —-a-w- c:\windows\SysWow64\msclmd.dll 2012-02-17 06:38 . 2012-03-13 17:19 1031680 —-a-w- c:\windows\system32\rdpcore.dll 2012-02-17 05:34 . 2012-03-13 17:19 826880 —-a-w- c:\windows\SysWow64\rdpcore.dll 2012-02-17 04:58 . 2012-03-13 17:19 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-02-17 04:57 . 2012-03-13 17:19 23552 —-a-w- c:\windows\system32\drivers\tdtcp.sys 2012-02-10 06:36 . 2012-03-14 02:20 1544192 —-a-w- c:\windows\system32\DWrite.dll 2012-02-10 05:38 . 2012-03-14 02:20 1077248 —-a-w- c:\windows\SysWow64\DWrite.dll 2012-02-09 13:13 . 2012-02-17 03:20 35648 —-a-w- c:\windows\system32\uxtuneup.dll 2012-02-09 13:13 . 2012-02-15 02:00 34624 —-a-w- c:\windows\system32\TURegOpt.exe 2012-02-09 13:13 . 2012-02-17 03:20 28992 —-a-w- c:\windows\SysWow64\uxtuneup.dll 2012-02-09 13:13 . 2012-02-15 02:00 25920 —-a-w- c:\windows\system32\authuitu.dll 2012-02-09 13:13 . 2012-02-15 02:00 21312 —-a-w- c:\windows\SysWow64\authuitu.dll 2012-02-07 18:02 . 2012-02-07 18:02 1070352 —-a-w- c:\windows\SysWow64\MSCOMCTL.OCX 2012-02-03 04:34 . 2012-03-14 02:20 3145728 —-a-w- c:\windows\system32\win32k.sys 2012-01-25 06:38 . 2012-03-13 17:19 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-01-25 06:38 . 2012-03-13 17:19 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-01-25 06:33 . 2012-03-13 17:19 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2009-04-08 18:31 . 2009-04-08 18:31 106496 —-a-w- c:\program files (x86)\Common Files\CPInstallAction.dll 2008-08-12 05:45 . 2008-08-12 05:45 155648 —-a-w- c:\program files (x86)\Common Files\MSIactionall.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Byron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Byron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Byron\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Starfield Updater"="c:\users\Byron\AppData\Local\Workspace\workspaceupdate.exe" [2012-03-18 34496] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-04-20 2988488] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-07-13 2244096] "SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2011-10-25 103896] "RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872] "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-23 150528] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208] . c:\users\Byron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-14 24246216] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ FancyStart daemon.lnk - c:\windows\Installer\{60D6618B-153F-4353-8185-908E676E5888}\_DCE9A4DB2A5F2786140FA3.exe [2000-3-22 12862] HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2010-5-28 276328] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-09-05 17:04 35736 —-a-w- c:\program files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector] 2000-03-22 10:45 3054136 —-a-w- c:\windows\AsScrPro.exe . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-09 136176] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 253088] R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x] R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408] R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x] R3 DIRECTIO;DIRECTIO; [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-09 136176] R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] R3 PCTINDIS5X64;PCTINDIS5X64 NDIS Protocol Driver; [x] R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 ZTEusbgps;ZTE GPS Port;c:\windows\system32\DRIVERS\ZTEusbgps.sys [x] R3 ZTEusbMB;ZTE NMEAExt2 Port;c:\windows\system32\DRIVERS\ZTEusbnmeaext2.sys [x] R3 ZTEusbwwan;ZTE MBN Miniport;c:\windows\system32\DRIVERS\ZTEusbwwan.sys [x] R4 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248] R4 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776] R4 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [x] S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [x] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [x] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [x] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [x] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] S2 ASMMAP64;ASMMAP64;c:\program files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904] S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816] S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-09-22 974944] S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x] S2 FastBootAgent;FastBootAgent;c:\windows\SysWOW64\Fast Boot\FastBootAgent.exe [2009-07-24 306232] S2 File Backup;File Backup Service;c:\program files (x86)\Workspace\offSyncService.exe [2012-02-21 1188624] S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-10-25 793048] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2012-02-09 2143552] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x] S3 tmobile_mf691_dc_enum;tmobile_mf691_dc_enum;c:\windows\system32\DRIVERS\tmobile_mf691_dc_enum.sys [x] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-04-15 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 07:17] . 2012-04-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3700817450-263443993-1340972289-1000Core.job - c:\users\Byron\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-08-26 04:24] . 2012-04-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3700817450-263443993-1340972289-1000UA.job - c:\users\Byron\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-08-26 04:24] . 2012-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-09 05:29] . 2012-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-09 05:29] . 2012-04-15 c:\windows\Tasks\RegistryBooster.job - c:\program files (x86)\Uniblue\RegistryBooster\rbmonitor.exe [2012-03-28 06:47] . 2012-04-15 c:\windows\Tasks\RMSchedule.job - c:\program files (x86)\Registry Mechanic\RegMech.exe [2012-03-19 14:31] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Byron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Byron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Byron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Byron\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-12 165912] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-12 387608] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-12 365592] "AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-04-09 320000] "ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-06-12 619392] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 4035152] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . ——- Supplementary Scan ——- . uStart Page = hxxp://www.bing.com/?pc=Z007&form=ZGAPHP mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] FF - ProfilePath - c:\users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z007&form=ZGAADF&q= FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe Toolbar-Locked - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe c:\program files (x86)\ASUS\ATK Hotkey\HControl.exe c:\program files (x86)\ASUS\ATK Hotkey\Atouch64.exe c:\program files (x86)\ASUS\ATK Hotkey\ATKOSD.exe c:\program files (x86)\ASUS\ATK Hotkey\KBFiltr.exe c:\program files (x86)\ASUS\ATK Hotkey\WDC.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe c:\program files (x86)\ASUS\ASUS Live Update\ALU.exe c:\program files (x86)\HP\HP Software Update\HPWUCli.exe . ************************************************************************** . Completion time: 2012-04-15 10:41:47 - machine was rebooted ComboFix-quarantined-files.txt 2012-04-15 17:41 . Pre-Run: 70,302,765,056 bytes free Post-Run: 71,459,684,352 bytes free . - - End Of File - - 9415648212E709D58953950F35ED43D6

C:\Program Files (x86)\RealArcade\Installer\bin\OCSetupHlp.dll Win32/OpenCandy application C:\Users\Byron\Desktop\New folder\registrybooster.exe Win32/RegistryBooster application C:\Users\Byron\Downloads\Uniblue Registry Booster 2011 v6.0.3.6 + SERIAL KEY [Multilingual]\registrybooster.exe Win32/RegistryBooster application . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 4/29/2011 7:49:56 PM System Uptime: 4/15/2012 6:31:07 PM (15 hours ago) . Motherboard: ASUSTeK Computer Inc. | | K50IJ Processor: Pentium® Dual-Core CPU T4500 @ 2.30GHz | Socket 478 | 1196/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 116 GiB total, 58.12 GiB free. D: is FIXED (NTFS) - 331 GiB total, 281.143 GiB free. E: is CDROM (CDFS) . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318} Description: Officejet J4680 series Device ID: ROOT\MULTIFUNCTION\0000 Manufacturer: HP Name: Officejet J4680 series PNP Device ID: ROOT\MULTIFUNCTION\0000 Service: . ==== System Restore Points =================== . RP146: 4/15/2012 11:00:31 AM - ComboFix created restore point RP148: 4/15/2012 10:38:20 PM - Windows Update . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) 4660_4680_Help AceMoney Acoustica CD/DVD Label Maker Adobe AIR Adobe Reader X (10.1.3) Alcor Micro USB Card Reader AnswerWorks 5.0 English Runtime Apple Application Support Apple Software Update ASUS AI Recovery ASUS CopyProtect ASUS FancyStart ASUS LifeFrame3 ASUS Live Update ASUS MultiFrame ASUS SmartLogon ASUS Splendid Video Enhancement Technology ASUS Virtual Camera Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver ATK Generic Function Service ATK Hotkey ATK Media ATKOSD2 BitTorrent BlackBerry App World Browser Plugin BlackBerry Desktop Software 6.1 bpd_scan BPDSoftware BPDSoftware_Ini BufferChm Business Plan Pro 15th Anniversary Edition ControlDeck Destinations DeviceDiscovery DocMgr DocProc Dropbox ESET Online Scanner v3 Facebook Video Calling 1.2.0.159 Fast Boot Fax Google Earth Google Update Helper GPBaseService2 High-Definition Video Playback 10 HP Update HPPhotoSmartDiscLabelContent1 HPPhotosmartEssential HPProductAssistant HPSSupply J4680 Java Auto Updater Java™ 6 Update 31 Mah Jong Medley Unlimited Malwarebytes Anti-Malware version 1.60.1.1000 MarketResearch Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Plus 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Primary Interoperability Assemblies 2005 Microsoft Silverlight Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 11.0 (x86 en-US) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero 10 Menu TemplatePack Basic Nero 10 Movie ThemePack Basic Nero BackItUp 10 Help (CHM) Nero Burning ROM 10 Nero BurningROM 10 Help (CHM) Nero BurnRights 10 Nero BurnRights 10 Help (CHM) Nero Control Center 10 Nero ControlCenter 10 Help (CHM) Nero Core Components 10 Nero CoverDesigner 10 Help (CHM) Nero DiscSpeed 10 Nero DiscSpeed 10 Help (CHM) Nero Dolby Files 10 Nero Express 10 Nero Express 10 Help (CHM) Nero InfoTool 10 Nero InfoTool 10 Help (CHM) Nero MediaHub 10 Help (CHM) Nero Multimedia Suite 10 Nero Recode 10 Nero Recode 10 Help (CHM) Nero RescueAgent 10 Nero RescueAgent 10 Help (CHM) Nero SoundTrax 10 Nero SoundTrax 10 Help (CHM) Nero StartSmart 10 Nero StartSmart 10 Help (CHM) Nero Vision 10 Nero Vision 10 Help (CHM) Nero WaveEditor 10 Nero WaveEditor 10 Help (CHM) PC Tools Registry Mechanic 11.0 Platform ProductContext Quicken 2011 QuickTime Scan Security Task Manager 1.8d Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Skype™ 5.3 SmartWebPrinting SolutionCenter Status Toolbox TrayApp TuneUp Utilities 2012 TuneUp Utilities Language Pack (en-US) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2598306) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VIA Platform Device Manager Visual Studio 2008 x64 Redistributables VLC media player 1.1.10 WebReg Windows Media Player Firefox Plugin WinFlash Wireless Console 3 Workspace Desktop Yahoo! Messenger Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 4/9/2012 7:56:48 AM, Error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 1 time(s). 4/16/2012 9:01:33 AM, Error: Service Control Manager [7001] - The Windows Image Acquisition (WIA) service depends on the Shell Hardware Detection service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 4/15/2012 10:59:35 AM, Error: Service Control Manager [7034] - The hpqcxs08 service terminated unexpectedly. It has done this 1 time(s). 4/15/2012 10:59:35 AM, Error: Service Control Manager [7034] - The HP CUE DeviceDiscovery Service service terminated unexpectedly. It has done this 1 time(s). 4/15/2012 10:38:51 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Windows Defender - KB915597 (Definition 1.123.1683.0). 4/15/2012 10:38:29 PM, Error: Service Control Manager [7023] - The Windows Defender service terminated with the following error: The specified module could not be found. 4/15/2012 10:34:40 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service stisvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 4/15/2012 10:29:56 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 4/15/2012 10:28:15 AM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. 4/13/2012 6:19:23 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service. 4/12/2012 8:06:51 AM, Error: Service Control Manager [7000] - The Volume Shadow Copy service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 4/12/2012 8:06:51 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service VSS with arguments "" in order to run the server: {0B5A2C52-3EB9-470A-96E2-6C6D4570E40F} 4/12/2012 8:06:49 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Volume Shadow Copy service to connect. 4/11/2012 9:32:50 PM, Error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 2 time(s). . ==== End Of File =========================== . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 9:07:29.48 on Mon 04/16/2012 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4061.1587 [GMT -7:00] . AV: ESET NOD32 Antivirus 5.0 *Enabled/Outdated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 5.0 *Enabled/Outdated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\PROGRA~2\AVG\AVG2012\avgrsa.exe C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\System32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Workspace\offSyncService.exe C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe C:\Program Files\P4G\BatteryLife.exe C:\Program Files (x86)\ASUS\Splendid\ACMON.exe C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe C:\Windows\SysWOW64\ACEngSvr.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Windows\System32\StikyNot.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDECK.EXE C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Windows\system32\svchost.exe -k HPService C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Program Files\Windows Media Player\wmprph.exe C:\Program Files (x86)\BitTorrent\BitTorrent.exe C:\Windows\system32\AUDIODG.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Byron\Desktop\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.bing.com/?pc=Z007&form=ZGAPHP uInternet Settings,ProxyOverride = *.local BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [Starfield Updater] "C:\Users\Byron\AppData\Local\Workspace\workspaceupdate.exe" mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe mRun: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun: [] mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" StartupFolder: C:\Users\Byron\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Byron\AppData\Roaming\Dropbox\bin\Dropbox.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FancyStart daemon.lnk - C:\Windows\Installer\{60D6618B-153F-4353-8185-908E676E5888}\_DCE9A4DB2A5F2786140FA3.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HP Digital Imaging Monitor.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe uPolicies-explorer: NoInstrumentation = 1 mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe mRun-x64: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe mRun-x64: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe mRun-x64: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" mRun-x64: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Byron\AppData\Roaming\Mozilla\Firefox\Profiles\bjib83g8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z007&form=ZGAADF&q= FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll FF - plugin: C:\Users\Byron\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npoff.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npoff.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npoff64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npoff64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npwbe.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npwbe.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\plugins\npwbe64.dll FF - plugin: C:\Users\Byron\AppData\Roaming\Mozilla\Plugins\npwbe64.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll . —- FIREFOX POLICIES —- FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;C:\Windows\System32\drivers\AVGIDSEH.sys [2011-7-11 26704] R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2011-9-13 37456] R0 lullaby;lullaby;C:\Windows\System32\drivers\lullaby.sys [2000-3-22 15928] R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2011-10-7 283728] R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2011-8-8 46672] R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2011-7-11 375376] R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920] R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928] R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2000-3-22 14904] R2 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2011-8-9 202576] R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-9-22 974944] R2 epfwwfpr;epfwwfpr;C:\Windows\System32\drivers\epfwwfpr.sys [2011-8-4 137144] R2 FastBootAgent;FastBootAgent;C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe [2000-3-22 306232] R2 File Backup;File Backup Service;C:\Program Files (x86)\Workspace\offSyncService.exe [2011-2-2 1188624] R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2012-3-19 793048] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2012-2-9 2143552] R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2009-6-11 112128] R3 tmobile_mf691_dc_enum;tmobile_mf691_dc_enum;C:\Windows\System32\drivers\tmobile_mf691_dc_enum.sys [2010-4-9 75776] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2011-10-20 11856] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2009-7-9 1222144] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-1-8 136176] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-4 253088] S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2009-5-26 40448] S3 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\AVGIDSDriver.sys [2011-7-11 120400] S3 AVGIDSFilter;AVGIDSFilter;C:\Windows\System32\drivers\AVGIDSFilter.sys [2011-7-11 29776] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-1-8 136176] S3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2011-4-30 23152] S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-3-4 59392] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-4-30 1255736] S3 ZTEusbgps;ZTE GPS Port;C:\Windows\System32\drivers\ZTEusbgps.sys [2012-2-11 123520] S3 ZTEusbwwan;ZTE MBN Miniport;C:\Windows\System32\drivers\ZTEusbwwan.sys [2012-2-11 235008] S4 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248] S4 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-8-2 192776] S4 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-2-5 652360] . =============== Created Last 30 ================ . 2012-04-16 06:13:18 ——– d—–w- C:\Program Files (x86)\ESET 2012-04-16 05:38:29 8669240 ——w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\Updates\mpengine.dll 2012-04-15 17:50:03 ——– d—–w- C:\PROGRA~3\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} 2012-04-15 17:45:23 ——– d—–w- C:\Windows\Hewlett-Packard 2012-04-15 17:35:58 ——– d-sh–w- C:\$RECYCLE.BIN 2012-04-12 15:11:55 5559152 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-04-12 15:11:53 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-04-12 15:11:51 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-04-12 15:08:00 81408 —-a-w- C:\Windows\System32\imagehlp.dll 2012-04-12 15:08:00 23408 —-a-w- C:\Windows\System32\drivers\fs_rec.sys 2012-04-12 15:08:00 159232 —-a-w- C:\Windows\SysWow64\imagehlp.dll 2012-04-12 15:07:57 5120 —-a-w- C:\Windows\System32\wmi.dll 2012-04-12 15:07:57 220672 —-a-w- C:\Windows\System32\wintrust.dll 2012-04-12 15:07:57 172544 —-a-w- C:\Windows\SysWow64\wintrust.dll 2012-04-12 15:07:56 5120 —-a-w- C:\Windows\SysWow64\wmi.dll 2012-04-08 17:03:23 ——– d—–w- C:\PROGRA~3\WEBREG 2012-04-08 17:01:50 ——– d—–w- C:\Users\Byron\AppData\Local\HP 2012-04-08 17:00:26 226816 —-a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzpp5oe.dll 2012-04-08 16:58:40 ——– d—–w- C:\Program Files (x86)\Microsoft 2012-04-08 16:58:05 ——– d—–w- C:\Users\Byron\AppData\Roaming\HpUpdate 2012-04-08 16:56:14 ——– d—–w- C:\Windows\SysWow64\spool 2012-04-08 16:55:11 ——– d—–w- C:\Program Files (x86)\Common Files\HP 2012-04-08 16:55:10 ——– d—–w- C:\Program Files (x86)\Common Files\Hewlett-Packard 2012-04-08 16:54:30 235008 —-a-w- C:\Windows\SysWow64\hpzc35oe.dll 2012-04-08 16:54:29 671816 —-a-w- C:\Windows\System32\hpcdmc32.dll 2012-04-08 16:54:29 131072 —-a-w- C:\Windows\System32\hpz3l5oe.dll 2012-04-08 16:54:01 ——– d—–w- C:\Program Files (x86)\HP 2012-04-08 16:51:37 944128 —-a-w- C:\Windows\System32\hpwwiax4.dll 2012-04-08 16:51:37 358744 —-a-w- C:\Windows\System32\hpzids40.dll 2012-04-08 16:51:36 740864 —-a-w- C:\Windows\System32\hpwtscl3.dll 2012-04-08 16:51:36 540672 —-a-w- C:\Windows\System32\hppldcoi.dll 2012-04-08 16:51:36 488960 —-a-w- C:\Windows\System32\hpovst11.dll 2012-04-04 08:17:04 8741536 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-04-04 07:39:58 418464 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-04-04 05:53:56 182160 —-a-w- C:\Program Files (x86)\Mozilla Firefox\Plugins\nppdf32.dll 2012-04-04 05:53:56 182160 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll 2012-04-03 14:44:31 476904 —-a-w- C:\Program Files (x86)\Mozilla Firefox\Plugins\npdeployJava1.dll 2012-03-27 16:36:58 ——– dc—-w- C:\PROGRA~3\~0 2012-03-27 05:45:26 ——– d—–w- C:\PROGRA~3\SecTaskMan 2012-03-27 05:45:21 ——– d—–w- C:\Program Files (x86)\Security Task Manager 2012-03-19 12:39:38 ——– d—–w- C:\Program Files (x86)\Uniblue 2012-03-19 12:39:28 ——– d—–w- C:\Users\Byron\AppData\Local\PackageAware 2012-03-19 10:41:18 ——– d—–w- C:\Users\Byron\AppData\Roaming\Registry Mechanic 2012-03-19 10:35:50 880640 —-a-w- C:\Windows\SysWow64\UniBox10.ocx 2012-03-19 10:35:50 506368 —-a-w- C:\Windows\SysWow64\msxml.dll 2012-03-19 10:35:50 40408 —-a-w- C:\Windows\System32\CleanMFT64.exe 2012-03-19 10:35:50 212992 —-a-w- C:\Windows\SysWow64\UniBoxVB12.ocx 2012-03-19 10:35:50 1101824 —-a-w- C:\Windows\SysWow64\UniBox210.ocx 2012-03-19 10:35:49 658432 —-a-w- C:\Windows\SysWow64\MSCOMCT2.OCX 2012-03-19 10:35:37 ——– d—–w- C:\Program Files (x86)\Common Files\PC Tools 2012-03-18 06:43:24 ——– d—–w- C:\Program Files (x86)\DesktopCentral_Server 2012-03-18 00:59:52 ——– d—–w- C:\$AVG 2012-03-17 23:50:20 ——– d—–w- C:\Users\Byron\AppData\Roaming\AVG2012 2012-03-17 23:47:31 ——– d—–w- C:\Windows\SysWow64\drivers\AVG 2012-03-17 23:46:40 ——– d—–w- C:\Windows\System32\drivers\AVG 2012-03-17 23:46:40 ——– d—–w- C:\PROGRA~3\AVG2012 2012-03-17 23:46:13 ——– d—–w- C:\Program Files (x86)\AVG 2012-03-17 20:58:07 592824 —-a-w- C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll 2012-03-17 20:58:07 44472 —-a-w- C:\Program Files (x86)\Mozilla Firefox\mozglue.dll . ==================== Find3M ==================== . 2012-04-14 07:17:08 70304 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-03 14:44:24 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2012-03-05 03:35:28 175616 —-a-w- C:\Windows\System32\msclmd.dll 2012-03-05 03:35:28 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll 2012-02-28 06:56:48 2311168 —-a-w- C:\Windows\System32\jscript9.dll 2012-02-28 06:49:56 1390080 —-a-w- C:\Windows\System32\wininet.dll 2012-02-28 06:48:57 1493504 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-02-28 06:42:55 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-02-28 01:18:55 1799168 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-02-28 01:11:21 1427456 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-02-28 01:11:07 1127424 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-02-28 01:03:16 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-02-23 17:18:36 279656 ——w- C:\Windows\System32\MpSigStub.exe 2012-02-17 06:38:26 1031680 —-a-w- C:\Windows\System32\rdpcore.dll 2012-02-17 05:34:22 826880 —-a-w- C:\Windows\SysWow64\rdpcore.dll 2012-02-17 04:58:24 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-02-17 04:57:32 23552 —-a-w- C:\Windows\System32\drivers\tdtcp.sys 2012-02-10 06:36:07 1544192 —-a-w- C:\Windows\System32\DWrite.dll 2012-02-10 05:38:43 1077248 —-a-w- C:\Windows\SysWow64\DWrite.dll 2012-02-09 13:13:28 35648 —-a-w- C:\Windows\System32\uxtuneup.dll 2012-02-09 13:13:28 34624 —-a-w- C:\Windows\System32\TURegOpt.exe 2012-02-09 13:13:18 28992 —-a-w- C:\Windows\SysWow64\uxtuneup.dll 2012-02-09 13:13:18 25920 —-a-w- C:\Windows\System32\authuitu.dll 2012-02-09 13:13:18 21312 —-a-w- C:\Windows\SysWow64\authuitu.dll 2012-02-07 18:02:40 1070352 —-a-w- C:\Windows\SysWow64\MSCOMCTL.OCX 2012-02-03 04:34:34 3145728 —-a-w- C:\Windows\System32\win32k.sys 2012-01-25 06:38:39 77312 —-a-w- C:\Windows\System32\rdpwsx.dll 2012-01-25 06:38:38 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll 2012-01-25 06:33:30 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe 2009-04-08 18:31:56 106496 —-a-w- C:\Program Files (x86)\Common Files\CPInstallAction.dll 2008-08-12 05:45:20 155648 —-a-w- C:\Program Files (x86)\Common Files\MSIactionall.dll . ============= FINISH: 9:09:00.68 ===============