Computer Auto Shutting Down, Malwarebyte's finding RootKit.0Access

I've been experiencing frequent auto shutdowns after a dialog box comes up saying "Windows encountered a fatal error". Also getting dialog boxes-ups about a Busy Server and an option to Switch To.. a program or retry. Malwarebyte's has found Rootkit.0Access but can't seem to remove it permanently. Attacks have been occuring frequently as well and Malwarebytes tries to block them.

OTL logfile created on: 6/24/2012 2:36:10 AM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Marcos\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

8.00 Gb Total Physical Memory | 6.02 Gb Available Physical Memory | 75.26% Memory free
16.00 Gb Paging File | 13.78 Gb Available in Paging File | 86.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 139.73 Gb Total Space | 10.43 Gb Free Space | 7.46% Space Free | Partition Type: NTFS
Drive E: | 698.64 Gb Total Space | 321.94 Gb Free Space | 46.08% Space Free | Partition Type: NTFS
Drive F: | 38.57 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: FAT32

Computer Name: MARCOS-PC | User Name: Marcos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Marcos\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\FacebookMessenger.exe (Facebook)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Wondershare\MobileGo for Android\MobileGoService.exe (Wondershare)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Users\Marcos\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\TechSmith\Jing\Jing.exe (TechSmith Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG)
PRC - C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe (WIBU-SYSTEMS AG)
PRC - C:\Program Files (x86)\3d-io plugins\licensing_v2\ActiveLockServerV2.exe (3d-io GmbH)
PRC - C:\Program Files (x86)\M-Audio\Axiom\AudioDevMon.exe (M-Audio)


========== Modules (No Company Name) ==========

MOD - C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\CefSharp.dll ()
MOD - C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\CefSharp.WinForms.dll ()
MOD - C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\libcef.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Users\Marcos\AppData\Local\Temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll ()
MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\a8bd6b91bf16c6727723481b42ea3293\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\16498c46d223310bc8811e193bcf1205\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\5f29a2d3dc6bdadb9751faaa0f230911\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\c21fbb4bf27a7c8705e29f08827c9c7e\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\36b3b787a2942e629e87b1b96fa049d4\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\227927e469cb6b079e4cc7d81e38f8f5\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\1741fc5f7819af118d4de616016a8b2d\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\698b02e36bac06ac74077cc3ec6eced0\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\30740aecd686555cb6800b47cc80fae7\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\5c2eff65e7e457ea372f767c024c04f7\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b4e03b2b9835e9cb4e879c703880fe74\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2d3806670b3c3e4163592b5aca62f8cc\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d4e8a005f4cdd6528f1c7295d833877f\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\TechSmith\Jing\Recorder.dll ()
MOD - C:\Program Files\TortoiseSVN\bin\libsasl32.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\243bd5a8b17896967384745d0c441ab7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a0afd596da13c708d04b0a2dd1490036\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\1d96b1ef408e2b5a2aa8de007b822aa3\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\3675db4c02d762278716f4a32db61e15\System.EnterpriseServices.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\6a5e1084d24d779e937e405672fdfbfe\System.Transactions.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\8bcef9992033319f9c1d470e497437ef\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\0018b6bfd1d96454aa8fb698d0ea51a1\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a9f6cfa4eb1436ff770995822f10e227\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\c8aa11ee6789d0f3f5542747aad7a2e4\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\173e012cca07a9b7151c574585a4ca9e\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\40404dbd013b0ca1e41ab7e57274308b\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c68401de935c813374253d4fc2a18f6a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\acbc57d41499fbc2b99194148786c677\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\338f3c91a0bea33a07a4611d324bf73a\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\16b68fcaff063835ae0ee348a1201f2a\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (ANTS Memory Profiler 7 Service) – C:\Program Files\Red Gate\ANTS Memory Profiler 7\RedGate.Memory.IISService.exe (Red Gate Software Ltd.)
SRV:64bit: - (ANTS Performance Profiler 6 Service) – C:\Program Files\Red Gate\ANTS Performance Profiler 6\RedGate.Profiler.IISService.exe (Red Gate Software Ltd.)
SRV:64bit: - (FLEXnet Licensing Service 64) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Flexera Software, Inc.)
SRV:64bit: - (TabletServiceWacom) – C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (HiPatchService) – C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PnkBstrA) – C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (CodeMeter.exe) – C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe (WIBU-SYSTEMS AG)
SRV - (3d-io License Server v2.0) – C:\Program Files (x86)\3d-io plugins\licensing_v2\ActiveLockServerV2.exe (3d-io GmbH)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AxiomAudioDevMon) – C:\Program Files (x86)\M-Audio\Axiom\AudioDevMon.exe (M-Audio)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (balancesvc) – C:\Windows\SysNative\drivers\balance.sys (Propellerhead Software)
DRV:64bit: - (BalanceWdmService) – C:\Windows\SysNative\drivers\BalanceWdm.sys (Propellerhead Software)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (ssadmdm) – C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (ssadmdfl) SAMSUNG Android USB Modem (Filter) – C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (YMIDUSBW) Yamaha USB-MIDI Driver (WDM) – C:\Windows\SysNative\drivers\ymidusbx64.sys (Yamaha Corporation)
DRV:64bit: - (sscdmdm) – C:\Windows\SysNative\drivers\sscdmdm.sys (MCCI Corporation)
DRV:64bit: - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\SysNative\drivers\sscdbus.sys (MCCI Corporation)
DRV:64bit: - (androidusb) – C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (sscdmdfl) – C:\Windows\SysNative\drivers\sscdmdfl.sys (MCCI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (cpuz135) – C:\Windows\SysNative\drivers\cpuz135_x64.sys (CPUID)
DRV:64bit: - (wacmoumonitor) – C:\Windows\SysNative\drivers\wacmoumonitor.sys (Wacom Technology)
DRV:64bit: - (wacommousefilter) – C:\Windows\SysNative\drivers\wacommousefilter.sys (Wacom Technology)
DRV:64bit: - (wacomvhid) – C:\Windows\SysNative\drivers\wacomvhid.sys (Wacom Technology)
DRV:64bit: - (MAUSBPRODUCER) – C:\Windows\SysNative\drivers\MAudioProducer.sys (Avid Technology, Inc.)
DRV:64bit: - (AXIOM) – C:\Windows\SysNative\drivers\MAudioAxiom.sys (M-Audio)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (xnacc) – C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (NVENETFD) – C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (rt61x64) – C:\Windows\SysNative\drivers\netr6164.sys (Ralink Technology, Corp.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (hamachi) – C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (dgderdrv) – C:\Windows\SysWOW64\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 AD B7 E7 D3 51 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s;=FVMh5vw…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.10: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wolfram.com/Mathematica: C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.4.2609412\npmathplugin.dll (Wolfram Research, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@onlive.com/OnLiveGameClientDetector,version=1.0.0: C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll (OnLive)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Marcos\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Marcos\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Marcos\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Marcos\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Marcos\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/06/07 01:00:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/23 12:14:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/06/07 01:00:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/11/09 12:47:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012/02/21 00:00:07 | 000,000,000 | —D | M]

[2011/07/04 16:08:44 | 000,000,000 | —D | M] (No name found) – C:\Users\Marcos\AppData\Roaming\Mozilla\Extensions
[2012/06/16 15:05:39 | 000,000,000 | —D | M] (No name found) – C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\extensions
[2012/05/20 01:47:59 | 000,000,000 | —D | M] (Greasemonkey) – C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/08/21 01:21:47 | 000,000,000 | —D | M] (ActiveGS) – C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\extensions\[removed]
[2012/05/11 15:11:36 | 000,000,000 | —D | M] (Nokia Maps 3D browser plugin) – C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\extensions\[removed]
[2012/06/23 12:14:10 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/06/07 01:00:06 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2011/10/22 14:25:15 | 000,015,162 | —- | M] () (No name found) – C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\{988DA70D-B78D-44A1-A9C7-ED11832A9E2E}.XPI
[2012/01/12 01:24:18 | 000,634,964 | —- | M] () (No name found) – C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011/10/29 14:35:37 | 000,434,392 | —- | M] () (No name found) – C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2011/11/19 00:12:04 | 000,018,894 | —- | M] () (No name found) – C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\[removed]
[2011/10/15 09:31:38 | 000,025,950 | —- | M] () (No name found) – C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\[removed]
[2012/05/05 03:11:10 | 000,226,493 | —- | M] () (No name found) – C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\[removed]
[2011/08/26 13:26:19 | 000,011,510 | —- | M] () (No name found) – C:\USERS\MARCOS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\81UU70ZS.DEFAULT\EXTENSIONS\[removed]
[2012/06/14 17:20:49 | 000,085,472 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/06/14 17:19:40 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/14 17:19:40 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Marcos\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Marcos\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Marcos\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U30 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: OnLive Game Client Detector (Enabled) = C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files (x86)\TabletPlugins\npwacom.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Marcos\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Facebook Desktop (Enabled) = C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.0.4447.0\npFbDesktopPlugin.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Marcos\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Adblock Plus (Beta) = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.2_0\
CHR - Extension: imgur = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehoopddfhgaehhmphfcooacjdpmbjlao\1.1.1_0\
CHR - Extension: AirMech = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdahlabpinmfcemhcbcfoijcpoalfgdn\7575_0\
CHR - Extension: Cloud9 = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbdmccoknlfggadpfkmcpnamfnbkmkcp\1.9.7_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\

O1 HOSTS File: ([2012/05/21 12:05:08 | 000,001,269 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com
O1 - Hosts: 127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [M-Audio Taskbar Icon] C:\Windows\SysNative\M-AudioTaskBarIcon.exe (Avid Technology, Inc.)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [Facebook Update] C:\Users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [Jing] C:\Program Files (x86)\TechSmith\Jing\Jing.exe (TechSmith Corporation)
O4 - HKCU..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup File not found
O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Marcos\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Marcos\AppData\Local\Facebook\Messenger\2.1.4554.0\FacebookMessenger.exe (Facebook)
O4 - Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mozilla Thunderbird.lnk = C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 10.3.1)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{59DD3D3F-B7ED-404C-BA1F-84E544261B0D}: DhcpNameServer = 10.254.40.1 [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BA53C310-0C3C-4C99-B8B5-E2651CEBED41}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBFB7911-C70E-47D2-A6E5-84773522C303}: DhcpNameServer = 10.254.40.1 [removed] [removed] [removed]
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/12/20 02:35:27 | 000,000,000 | —- | M] () - E:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: vidc.tscc - C:\Windows\SysWOW64\tsccvid64.dll (TechSmith Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.tscc - C:\Windows\SysWOW64\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/24 01:15:15 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\For Emma, Forever Ago
[2012/06/24 01:15:13 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Bon Iver - Bon Iver'
[2012/06/24 00:09:25 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\RoyAwesome-XNA-Voronoi-Diagram-af32ff9
[2012/06/23 14:12:46 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012/06/23 14:12:45 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2012/06/23 12:14:11 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Maintenance Service
[2012/06/23 12:14:11 | 000,000,000 | —D | C] – C:\ProgramData\Mozilla
[2012/06/18 18:13:18 | 002,622,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/18 18:13:18 | 000,057,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/18 18:13:18 | 000,044,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/18 18:13:11 | 000,701,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/18 18:13:11 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/18 18:13:11 | 000,038,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/18 18:12:56 | 000,186,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/18 18:12:56 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/17 23:11:49 | 000,000,000 | —D | C] – C:\Users\Marcos\Documents\Propellerhead Logs
[2012/06/17 22:10:02 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\ReasonEssentials1.5
[2012/06/17 18:24:06 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Will'sBud
[2012/06/17 17:38:40 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\RemoteDroidServer
[2012/06/17 17:22:56 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\New folder (2)
[2012/06/15 22:11:33 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2012/06/14 18:50:29 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Hydorah
[2012/06/14 12:49:35 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Suzuki Method
[2012/06/13 18:48:45 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Local\Macromedia
[2012/06/12 23:57:40 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Creative Development Modeling a Female Character for Animation in Maya with Gene Arvan
[2012/06/12 22:39:23 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\NEX.v1.6.1.83_For_Maya_2011-2013_32_64_Cracked-LCT
[2012/06/12 00:49:31 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Digital-Tutors - Modeling a Female Character for Animation in Maya
[2012/06/12 00:49:31 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Digital Tutors - Object Tracking in MatchMover 2011 and NUKE 6.1
[2012/06/10 14:09:42 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Roaming\Mathematica
[2012/06/10 14:09:42 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Local\Mathematica
[2012/06/10 14:01:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram Mathematica
[2012/06/10 13:59:11 | 000,465,936 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysNative\mltcpip64.mlp
[2012/06/10 13:59:11 | 000,436,240 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysNative\ml64i3.dll
[2012/06/10 13:59:11 | 000,302,608 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysNative\ml64i2.dll
[2012/06/10 13:59:11 | 000,203,792 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysNative\mlmodule64.dll
[2012/06/10 13:59:11 | 000,103,440 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysNative\mltcp64.mlp
[2012/06/10 13:59:11 | 000,099,344 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysNative\mlshm64.mlp
[2012/06/09 13:52:02 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Roaming\MathematicaPlayer
[2012/06/09 13:52:02 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Local\MathematicaPlayer
[2012/06/09 13:52:02 | 000,000,000 | —D | C] – C:\ProgramData\MathematicaPlayer
[2012/06/09 13:50:26 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wolfram Research
[2012/06/09 13:50:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\ResearchSoft
[2012/06/09 13:50:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram CDF Player
[2012/06/09 13:47:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wolfram Research
[2012/06/09 13:47:17 | 000,000,000 | —D | C] – C:\ProgramData\Mathematica
[2012/06/09 13:47:02 | 000,370,704 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysWow64\ml32i3.dll
[2012/06/09 13:47:02 | 000,334,352 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysWow64\mltcpip32.mlp
[2012/06/09 13:47:02 | 000,260,112 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysWow64\ml32i2.dll
[2012/06/09 13:47:02 | 000,253,968 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysWow64\ml32i1.dll
[2012/06/09 13:47:02 | 000,163,344 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysWow64\mlmodule32.dll
[2012/06/09 13:47:02 | 000,093,712 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysWow64\mltcp32.mlp
[2012/06/09 13:47:02 | 000,088,080 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysWow64\mlshm32.mlp
[2012/06/09 13:47:02 | 000,079,376 | —- | C] (Wolfram Research, Inc.) – C:\Windows\SysWow64\mlmap32.mlp
[2012/06/09 13:46:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Wolfram Research
[2012/06/07 01:09:45 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Local\DDMSettings
[2012/06/07 01:00:00 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Roaming\DivX
[2012/06/07 00:59:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\PX Storage Engine
[2012/06/07 00:59:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus
[2012/06/07 00:59:45 | 000,000,000 | —D | C] – C:\Program Files\DivX
[2012/06/07 00:59:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DivX Shared
[2012/06/07 00:58:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\DivX
[2012/06/07 00:57:38 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2012/06/05 23:06:36 | 000,000,000 | —D | C] – C:\Users\Marcos\Documents\Trials 2
[2012/06/05 23:04:06 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Local\Redlynx
[2012/06/05 23:03:28 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RedLynx Trials 2 Second Edition
[2012/06/05 23:03:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RedLynx Trials 2 Second Edition
[2012/06/05 23:03:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trials 2 Second Edition
[2012/06/05 22:53:19 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Mercury Particle Engine 3.1 for XNA 4.0 (Binaries)
[2012/06/05 22:39:57 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Project Zomboid v0.2.0q
[2012/06/02 23:58:38 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Farseer Physics Engine 3.3.1 Samples XNA
[2012/06/02 21:46:25 | 000,000,000 | —D | C] – C:\Windows\SysNative\appmgmt
[2012/06/02 21:02:15 | 004,830,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx9d_33.dll
[2012/06/02 21:02:15 | 002,686,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9d_43.dll
[2012/06/02 21:02:15 | 000,964,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudioD2_7.dll
[2012/06/02 21:02:15 | 000,411,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XactEngineA3_7.dll
[2012/06/02 21:02:15 | 000,327,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XactEngineD3_7.dll
[2012/06/02 21:02:15 | 000,139,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFXD1_5.dll
[2012/06/02 21:02:15 | 000,053,080 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\X3DAudioD1_7.dll
[2012/06/02 21:02:14 | 002,947,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d9d.dll
[2012/06/02 21:02:14 | 001,931,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCSXd_43.dll
[2012/06/02 21:02:14 | 000,645,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3D11SDKLayers.dll
[2012/06/02 21:02:14 | 000,639,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3D11Ref.dll
[2012/06/02 21:02:14 | 000,608,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3D10SDKLayers.DLL
[2012/06/02 21:02:14 | 000,568,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX10d_43.dll
[2012/06/02 21:02:14 | 000,453,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3D10Ref.DLL
[2012/06/02 21:02:14 | 000,447,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dref9.dll
[2012/06/02 21:02:14 | 000,308,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX11d_43.dll
[2012/06/02 21:02:13 | 003,795,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx9d_33.dll
[2012/06/02 21:02:13 | 002,719,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d9d.dll
[2012/06/02 21:02:13 | 002,261,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3dx9d_43.dll
[2012/06/02 21:02:13 | 001,883,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCSXd_43.dll
[2012/06/02 21:02:13 | 000,954,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudioD2_7.dll
[2012/06/02 21:02:13 | 000,525,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3D11Ref.dll
[2012/06/02 21:02:13 | 000,514,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX10d_43.dll
[2012/06/02 21:02:13 | 000,496,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3D11SDKLayers.dll
[2012/06/02 21:02:13 | 000,442,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3D10SDKLayers.DLL
[2012/06/02 21:02:13 | 000,435,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XactEngineA3_7.dll
[2012/06/02 21:02:13 | 000,367,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3D10Ref.DLL
[2012/06/02 21:02:13 | 000,349,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XactEngineD3_7.dll
[2012/06/02 21:02:13 | 000,348,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dref9.dll
[2012/06/02 21:02:13 | 000,268,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX11d_43.dll
[2012/06/02 21:02:13 | 000,131,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFXD1_5.dll
[2012/06/02 21:02:13 | 000,045,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\X3DAudioD1_7.dll
[2012/06/02 21:02:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft DirectX SDK (June 2010)
[2012/06/02 20:59:12 | 000,111,960 | —- | C] (Microsoft Corporation) – C:\Windows\dxsdkuninst.exe
[2012/06/02 20:59:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft DirectX SDK (June 2010)
[2012/06/01 14:42:03 | 000,000,000 | -HSD | C] – C:\Windows\SysNative\%APPDATA%
[2012/05/31 21:27:22 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\StarForge_V0.1
[2012/05/31 13:08:23 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\Heimdall Suite
[2012/05/31 13:05:43 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012/05/31 13:05:43 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/05/31 13:02:38 | 001,721,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WdfCoInstaller01009.dll
[2012/05/31 13:02:38 | 001,002,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WinUSBCoInstaller2.dll
[2012/05/31 13:02:38 | 000,000,000 | —D | C] – C:\usb_driver
[2012/05/31 12:52:42 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\BackupContacts
[2012/05/31 12:44:14 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Local\Wondershare
[2012/05/31 12:44:14 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wondershare
[2012/05/31 12:44:13 | 000,000,000 | —D | C] – C:\Users\Marcos\AppData\Roaming\Wondershare
[2012/05/31 12:44:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
[2012/05/31 12:44:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Wondershare
[2012/05/31 11:52:39 | 000,177,640 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\ssadmdm.sys
[2012/05/31 11:52:39 | 000,157,672 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\ssadbus.sys
[2012/05/31 11:52:39 | 000,036,328 | —- | C] (Google Inc) – C:\Windows\SysNative\drivers\ssadadb.sys
[2012/05/31 11:52:39 | 000,016,872 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\ssadmdfl.sys
[2012/05/31 11:52:39 | 000,013,800 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\ssadwhnt.sys
[2012/05/31 11:52:39 | 000,013,288 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\ssadcmnt.sys
[2012/05/31 11:52:11 | 000,015,944 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\sscdwhnt.sys
[2012/05/31 11:52:10 | 000,172,104 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\sscdmdm.sys
[2012/05/31 11:52:10 | 000,136,264 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\sscdbus.sys
[2012/05/31 11:52:10 | 000,019,016 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\sscdmdfl.sys
[2012/05/31 11:52:10 | 000,015,432 | —- | C] (MCCI Corporation) – C:\Windows\SysNative\drivers\sscdcmnt.sys
[2012/05/31 11:24:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2012/05/31 11:24:30 | 000,821,824 | —- | C] (Devguru Co., Ltd.) – C:\Windows\SysWow64\dgderapi.dll
[2012/05/31 11:06:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/05/31 11:06:09 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2012/05/31 03:13:05 | 000,000,000 | —D | C] – C:\Users\Marcos\Desktop\TowerClimb_betaV1_1
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/24 02:38:01 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/24 02:30:17 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/24 02:29:55 | 2146,332,671 | -HS- | M] () – C:\hiberfil.sys
[2012/06/24 02:27:30 | 000,000,132 | —- | M] () – C:\Users\Marcos\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/06/24 02:24:10 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job
[2012/06/24 02:12:06 | 000,000,932 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job
[2012/06/24 01:49:39 | 000,001,270 | —- | M] () – C:\Users\Marcos\Desktop\Cancel Shutdown.lnk
[2012/06/23 22:09:55 | 006,796,125 | —- | M] () – C:\Users\Marcos\Desktop\Reflex.mp3
[2012/06/23 22:06:47 | 077,898,364 | —- | M] () – C:\Users\Marcos\Desktop\Reflex.wav
[2012/06/23 16:24:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job
[2012/06/23 14:12:47 | 000,001,338 | —- | M] () – C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012/06/23 14:12:00 | 000,000,910 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job
[2012/06/23 12:14:11 | 000,001,053 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/06/23 11:55:04 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/06/23 11:55:04 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/06/23 11:30:39 | 000,001,095 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun23-11-30-39.wbb
[2012/06/22 01:48:43 | 000,001,095 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun22-01-48-43.wbb
[2012/06/21 00:47:32 | 000,001,095 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun21-00-47-32.wbb
[2012/06/20 00:40:18 | 000,001,095 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun20-00-40-18.wbb
[2012/06/19 00:39:32 | 000,001,095 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun19-00-39-32.wbb
[2012/06/18 04:29:16 | 000,014,096 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/18 04:29:16 | 000,014,096 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/17 23:10:56 | 000,001,095 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun17-23-10-56.wbb
[2012/06/17 22:19:42 | 000,002,199 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk
[2012/06/17 22:18:59 | 000,000,988 | —- | M] () – C:\Users\Public\Desktop\Reason Essentials.lnk
[2012/06/17 19:34:50 | 025,811,577 | —- | M] () – C:\Users\Marcos\Desktop\WillsBud.zip
[2012/06/17 18:15:22 | 000,872,838 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/06/17 18:15:22 | 000,726,452 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/06/17 18:15:22 | 000,146,470 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/06/17 04:39:43 | 000,235,120 | —- | M] () – C:\Users\Marcos\Desktop\filterRape.png
[2012/06/16 22:30:40 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun16-22-30-40.wbb
[2012/06/16 18:59:00 | 000,128,481 | —- | M] () – C:\Users\Marcos\Desktop\testCrash.jpg
[2012/06/16 18:53:49 | 000,130,379 | —- | M] () – C:\Users\Marcos\Desktop\2012-06-16_1853.png
[2012/06/15 02:02:35 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun15-02-02-35.wbb
[2012/06/14 23:38:33 | 077,898,364 | —- | M] () – C:\Users\Marcos\Desktop\Relax.wav
[2012/06/14 01:48:42 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun14-01-48-42.wbb
[2012/06/13 19:26:21 | 000,065,310 | —- | M] () – C:\Users\Marcos\Desktop\DITWSolo.png
[2012/06/13 01:21:24 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun13-01-21-24.wbb
[2012/06/12 01:18:26 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun12-01-18-26.wbb
[2012/06/11 00:23:47 | 052,019,073 | —- | M] () – C:\Users\Marcos\Desktop\UPDATA_07X024.ZIP
[2012/06/10 20:23:02 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun10-20-23-02.wbb
[2012/06/10 03:46:46 | 004,891,976 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/06/09 20:10:28 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun09-20-10-28.wbb
[2012/06/07 01:00:08 | 000,002,120 | —- | M] () – C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012/06/07 01:00:07 | 000,001,615 | —- | M] () – C:\Users\Marcos\Desktop\DivX Movies.lnk
[2012/06/07 00:59:56 | 000,001,116 | —- | M] () – C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012/06/05 22:40:09 | 000,001,634 | —- | M] () – C:\Users\Marcos\Desktop\Project Zomboid v0.2.0q Launcher.lnk
[2012/06/05 19:45:30 | 000,175,674 | —- | M] () – C:\Users\Marcos\Desktop\0610957.jpg
[2012/06/03 21:45:25 | 000,158,728 | —- | M] () – C:\Users\Marcos\Documents\recpeit.xps
[2012/06/02 23:03:58 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun02-23-03-58.wbb
[2012/06/02 21:47:11 | 000,111,960 | —- | M] (Microsoft Corporation) – C:\Windows\dxsdkuninst.exe
[2012/06/02 20:06:45 | 000,001,051 | —- | M] () – C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/06/02 17:19:46 | 000,038,424 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wups.dll
[2012/06/02 17:19:42 | 000,057,880 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/02 17:19:42 | 000,044,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[2012/06/02 17:19:23 | 000,701,976 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2012/06/02 17:15:31 | 002,622,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/02 17:15:08 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2012/06/02 15:19:42 | 000,186,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2012/06/02 15:15:12 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2012/06/01 22:52:03 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun01-22-52-03.wbb
[2012/06/01 20:44:25 | 000,045,994 | —- | M] () – C:\Users\Marcos\Desktop\Untitled-1.png
[2012/06/01 14:37:51 | 000,000,398 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2012/06/01 11:29:27 | 000,001,113 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/05/31 22:47:42 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12May31-22-47-42.wbb
[2012/05/31 22:47:29 | 000,061,228 | —- | M] () – C:\Users\Marcos\Desktop\WTCReceipt.png
[2012/05/31 13:02:38 | 001,721,576 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\WdfCoInstaller01009.dll
[2012/05/31 13:02:38 | 001,002,728 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\WinUSBCoInstaller2.dll
[2012/05/31 12:44:14 | 000,002,240 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MobileGo Service.lnk
[2012/05/31 12:44:13 | 000,002,173 | —- | M] () – C:\Users\Public\Desktop\Wondershare MobileGo for Android.lnk
[2012/05/31 11:26:19 | 000,001,957 | —- | M] () – C:\Users\Public\Desktop\Samsung Kies.lnk
[2012/05/31 11:09:30 | 000,014,230 | —- | M] () – C:\Users\Marcos\Documents\RegBackup5-31-12.reg
[2012/05/31 11:06:10 | 000,000,822 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/05/30 18:25:59 | 000,107,076 | —- | M] () – C:\Users\Marcos\Desktop\mock.png
[2012/05/27 21:35:47 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12May27-21-35-47.wbb
[2012/05/26 21:30:49 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12May26-21-30-49.wbb
[2012/05/25 21:05:12 | 000,000,963 | —- | M] () – C:\Windows\SysWow64\CM-Backup2-1874032-12May25-21-05-12.wbb
[2012/05/25 15:42:26 | 000,241,210 | —- | M] () – C:\Users\Marcos\Desktop\PastryStore.psd
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/24 01:49:13 | 000,001,270 | —- | C] () – C:\Users\Marcos\Desktop\Cancel Shutdown.lnk
[2012/06/23 22:08:25 | 006,796,125 | —- | C] () – C:\Users\Marcos\Desktop\Reflex.mp3
[2012/06/23 22:06:13 | 077,898,364 | —- | C] () – C:\Users\Marcos\Desktop\Reflex.wav
[2012/06/23 12:14:11 | 000,001,053 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/06/23 11:55:05 | 000,000,830 | —- | C] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/06/23 11:30:39 | 000,001,095 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun23-11-30-39.wbb
[2012/06/22 01:48:43 | 000,001,095 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun22-01-48-43.wbb
[2012/06/21 00:47:32 | 000,001,095 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun21-00-47-32.wbb
[2012/06/20 00:40:18 | 000,001,095 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun20-00-40-18.wbb
[2012/06/19 00:39:32 | 000,001,095 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun19-00-39-32.wbb
[2012/06/17 23:10:56 | 000,001,095 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun17-23-10-56.wbb
[2012/06/17 22:18:59 | 000,000,988 | —- | C] () – C:\Users\Public\Desktop\Reason Essentials.lnk
[2012/06/17 19:34:49 | 025,811,577 | —- | C] () – C:\Users\Marcos\Desktop\WillsBud.zip
[2012/06/17 03:14:19 | 000,235,120 | —- | C] () – C:\Users\Marcos\Desktop\filterRape.png
[2012/06/16 22:30:40 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun16-22-30-40.wbb
[2012/06/16 18:58:58 | 000,128,481 | —- | C] () – C:\Users\Marcos\Desktop\testCrash.jpg
[2012/06/16 18:53:49 | 000,130,379 | —- | C] () – C:\Users\Marcos\Desktop\2012-06-16_1853.png
[2012/06/15 02:02:35 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun15-02-02-35.wbb
[2012/06/14 23:38:01 | 077,898,364 | —- | C] () – C:\Users\Marcos\Desktop\Relax.wav
[2012/06/14 01:48:42 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun14-01-48-42.wbb
[2012/06/13 19:26:21 | 000,065,310 | —- | C] () – C:\Users\Marcos\Desktop\DITWSolo.png
[2012/06/13 01:21:24 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun13-01-21-24.wbb
[2012/06/12 01:18:26 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun12-01-18-26.wbb
[2012/06/11 00:24:45 | 052,006,912 | —- | C] () – C:\Users\Marcos\Desktop\BD07-VUD.BIN
[2012/06/11 00:24:45 | 000,000,080 | —- | C] () – C:\Users\Marcos\Desktop\SONY_VUP.ID
[2012/06/11 00:22:26 | 052,019,073 | —- | C] () – C:\Users\Marcos\Desktop\UPDATA_07X024.ZIP
[2012/06/10 20:23:02 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun10-20-23-02.wbb
[2012/06/09 20:10:28 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun09-20-10-28.wbb
[2012/06/07 01:00:07 | 000,001,615 | —- | C] () – C:\Users\Marcos\Desktop\DivX Movies.lnk
[2012/06/07 00:59:56 | 000,001,116 | —- | C] () – C:\Users\Public\Desktop\DivX Plus Player.lnk
[2012/06/07 00:59:49 | 000,002,120 | —- | C] () – C:\Users\Public\Desktop\DivX Plus Converter.lnk
[2012/06/05 22:30:27 | 000,001,634 | —- | C] () – C:\Users\Marcos\Desktop\Project Zomboid v0.2.0q Launcher.lnk
[2012/06/05 19:45:29 | 000,175,674 | —- | C] () – C:\Users\Marcos\Desktop\0610957.jpg
[2012/06/03 21:45:24 | 000,158,728 | —- | C] () – C:\Users\Marcos\Documents\recpeit.xps
[2012/06/02 23:03:58 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun02-23-03-58.wbb
[2012/06/02 12:23:31 | 000,016,896 | —- | C] () – C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@
[2012/06/02 12:23:29 | 000,001,648 | —- | C] () – C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@
[2012/06/01 22:52:03 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12Jun01-22-52-03.wbb
[2012/06/01 20:44:23 | 000,045,994 | —- | C] () – C:\Users\Marcos\Desktop\Untitled-1.png
[2012/06/01 11:24:53 | 000,016,896 | —- | C] () – C:\Windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@
[2012/06/01 11:24:52 | 000,001,648 | —- | C] () – C:\Windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@
[2012/05/31 22:47:42 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12May31-22-47-42.wbb
[2012/05/31 22:47:29 | 000,061,228 | —- | C] () – C:\Users\Marcos\Desktop\WTCReceipt.png
[2012/05/31 13:02:39 | 000,000,398 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2012/05/31 12:44:14 | 000,002,240 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MobileGo Service.lnk
[2012/05/31 12:44:13 | 000,002,173 | —- | C] () – C:\Users\Public\Desktop\Wondershare MobileGo for Android.lnk
[2012/05/31 11:26:19 | 000,001,957 | —- | C] () – C:\Users\Public\Desktop\Samsung Kies.lnk
[2012/05/31 11:08:51 | 000,014,230 | —- | C] () – C:\Users\Marcos\Documents\RegBackup5-31-12.reg
[2012/05/31 11:06:10 | 000,000,822 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/05/30 18:25:59 | 000,107,076 | —- | C] () – C:\Users\Marcos\Desktop\mock.png
[2012/05/27 21:35:47 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12May27-21-35-47.wbb
[2012/05/26 21:30:49 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12May26-21-30-49.wbb
[2012/05/25 21:05:12 | 000,000,963 | —- | C] () – C:\Windows\SysWow64\CM-Backup2-1874032-12May25-21-05-12.wbb
[2012/05/25 15:42:12 | 000,241,210 | —- | C] () – C:\Users\Marcos\Desktop\PastryStore.psd
[2012/05/23 18:49:34 | 000,030,568 | —- | C] () – C:\Windows\MusiccityDownload.exe
[2012/04/03 19:16:11 | 000,000,015 | —- | C] () – C:\Users\Marcos\AppData\Local\X-Plane_drm.prf
[2012/04/03 19:15:39 | 000,000,080 | —- | C] () – C:\Users\Marcos\AppData\Local\X-Plane Installer.prf
[2012/03/07 03:19:32 | 000,135,316 | -H– | C] () – C:\Windows\SysWow64\mlfcache.dat
[2012/01/25 14:30:12 | 000,079,360 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2011/12/24 18:00:21 | 000,000,132 | —- | C] () – C:\Users\Marcos\AppData\Roaming\Adobe Targa Format CS5 Prefs
[2011/12/12 17:47:16 | 000,001,456 | —- | C] () – C:\Users\Marcos\AppData\Local\Adobe Save for Web 12.0 Prefs
[2011/12/12 17:41:28 | 000,000,132 | —- | C] () – C:\Users\Marcos\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011/11/29 17:38:12 | 000,974,848 | —- | C] () – C:\Windows\SysWow64\cis-2.4.dll
[2011/11/29 17:38:12 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011/11/29 17:38:12 | 000,065,536 | —- | C] () – C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011/11/29 17:38:12 | 000,057,344 | —- | C] () – C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011/10/15 01:54:52 | 000,321,856 | —- | C] () – C:\Windows\SysWow64\nvStreaming.exe
[2011/10/04 21:05:52 | 000,000,043 | —- | C] () – C:\Users\Marcos\mercurial.ini
[2011/10/03 22:08:00 | 000,000,218 | —- | C] () – C:\Users\Marcos\.recently-used.xbel
[2011/09/30 00:23:52 | 000,280,904 | —- | C] () – C:\Windows\SysWow64\PnkBstrB.exe
[2011/09/30 00:23:51 | 000,075,136 | —- | C] () – C:\Windows\SysWow64\PnkBstrA.exe
[2011/09/08 22:04:25 | 000,000,132 | —- | C] () – C:\Users\Marcos\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011/07/24 23:33:50 | 000,002,048 | -HS- | C] () – C:\Windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\@
[2011/07/24 23:33:50 | 000,002,048 | -HS- | C] () – C:\Users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\@
[2011/07/24 17:03:55 | 000,007,605 | —- | C] () – C:\Users\Marcos\AppData\Local\Resmon.ResmonCfg
[2011/07/13 18:07:35 | 000,000,132 | —- | C] () – C:\Users\Marcos\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011/07/07 22:32:43 | 000,866,562 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/07/06 09:58:12 | 000,052,387 | —- | C] () – C:\Windows\MaxwellMayaPluginUninstall.exe
[2011/07/04 16:08:40 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2011/04/09 18:55:28 | 000,179,261 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat

========== LOP Check ==========

[2011/09/14 20:18:21 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\.minecraft
[2012/01/20 13:40:46 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\1837E
[2011/10/17 02:46:31 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Ableton
[2011/12/25 17:00:41 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Astroburn Lite
[2011/07/07 01:30:56 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\AtomZombieData
[2011/07/15 19:58:41 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Audacity
[2011/07/06 10:37:11 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Autodesk
[2011/07/12 12:50:45 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/07/30 02:38:18 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Crayon Physics Deluxe
[2012/04/17 01:55:28 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\David Walters Development
[2011/11/11 23:33:38 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\digipen
[2012/06/24 02:33:48 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Dropbox
[2012/05/31 11:12:55 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\FileZilla
[2011/11/13 14:01:37 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\fotw
[2011/09/01 17:49:34 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Golly
[2011/10/17 19:45:27 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Image-Line
[2011/10/03 21:55:05 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\inkscape
[2012/02/08 15:37:43 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\IrfanView
[2011/09/27 23:47:44 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\JetBrains
[2011/09/21 01:37:52 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\JustDecompile
[2011/07/30 02:23:14 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Lazy 8 Studios
[2012/04/25 23:59:06 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Line 6
[2012/02/27 02:35:19 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\LOVE
[2012/03/19 16:58:22 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\MinerWars
[2012/03/06 21:26:15 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\MonoDevelop-Unity-2.8
[2011/11/13 05:15:49 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Nicalis
[2011/07/04 17:32:16 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Notepad++
[2011/10/04 22:18:17 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\NuGet
[2012/03/01 03:15:37 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\OnLive App
[2011/07/04 17:46:09 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\OpenOffice.org
[2012/03/06 16:15:59 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\PACE Anti-Piracy
[2012/04/14 02:54:27 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Polynomial
[2012/06/17 22:43:21 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Propellerhead Software
[2011/07/27 18:03:40 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\REAPER
[2012/05/21 11:19:03 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\redsn0w
[2012/05/31 11:23:47 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Samsung
[2012/01/26 01:40:27 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Scoregasm
[2012/04/30 00:49:13 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Scribus
[2011/09/19 19:48:35 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/01/18 22:50:32 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Subversion
[2011/12/06 02:01:11 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\superhudeditor
[2011/08/28 11:11:19 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Thunderbird
[2011/11/29 01:19:39 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\UDP Software
[2012/03/06 16:16:10 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Unity
[2012/06/24 01:33:57 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\uTorrent
[2011/09/29 23:28:36 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\VertexDispenser
[2011/11/01 13:29:15 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Voxatron
[2012/05/31 12:44:40 | 000,000,000 | —D | M] – C:\Users\Marcos\AppData\Roaming\Wondershare
[2012/06/23 14:12:00 | 000,000,910 | —- | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job
[2012/06/24 02:12:06 | 000,000,932 | —- | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job
[2012/04/10 11:36:07 | 000,032,652 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/20 07:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2011/07/04 16:09:34 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/06/24 02:29:55 | 2146,332,671 | -HS- | M] () – C:\hiberfil.sys
[2012/06/24 02:30:11 | 4293,435,391 | -HS- | M] () – C:\pagefile.sys
[2011/09/30 16:35:17 | 000,015,104 | —- | M] () – C:\shared.log

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/07/04 13:52:46 | 000,000,221 | -HS- | M] () – C:\Users\Marcos\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 1183 bytes -> C:\ProgramData\Microsoft:BKXE8W95G1VeCgLp8Rj8
@Alternate Data Stream - 1137 bytes -> C:\Users\Marcos\AppData\Local\0G198sB6Z:kGFmpSgyzcNqO134cWP7K
@Alternate Data Stream - 1115 bytes -> C:\ProgramData\Microsoft:avx58ODF2Ii38Y1ZK2e0Q
@Alternate Data Stream - 1091 bytes -> C:\Users\Marcos\AppData\Local\QZsVxr1ZXB:Q0WmQ85HmO7VowQ0W4oI5c8

< End of report >

OTL Extras logfile created on: 6/24/2012 2:36:10 AM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Marcos\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

8.00 Gb Total Physical Memory | 6.02 Gb Available Physical Memory | 75.26% Memory free
16.00 Gb Paging File | 13.78 Gb Available in Paging File | 86.12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 139.73 Gb Total Space | 10.43 Gb Free Space | 7.46% Space Free | Partition Type: NTFS
Drive E: | 698.64 Gb Total Space | 321.94 Gb Free Space | 46.08% Space Free | Partition Type: NTFS
Drive F: | 38.57 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: FAT32

Computer Name: MARCOS-PC | User Name: Marcos | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView;] – "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView;] – "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server – (WIBU-SYSTEMS AG)
"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server – (WIBU-SYSTEMS AG)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server – (WIBU-SYSTEMS AG)
"C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server – (WIBU-SYSTEMS AG)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{034106B5-54B7-467F-B477-5B7DBB492624}" = Microsoft Sync Framework Services v1.0 SP1 (x64)
"{03AC245F-4C64-425C-89CF-7783C1D3AB2C}" = Microsoft Sync Framework 2.0 Provider Services (x64) ENU
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0826F9E4-787E-481D-83E0-BC6A57B056D5}" = Microsoft SQL Server VSS Writer
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{1111706F-666A-4037-7777-203648764D10}" = JavaFX 2.0.3 (64-bit)
"{1AB7EDC5-D891-34C5-9FF1-BE6A85ACC44B}" = Microsoft Team Foundation Server 2010 Object Model - ENU
"{1B1D83BE-BAB8-4220-A850-036C67590C73}" = TortoiseSVN 1.7.4.22459 (64 bit)
"{1CB6C387-65A7-327F-B4A5-7DDC75A291AF}" = Microsoft Visual Studio 2010 Office Developer Tools (x64)
"{1D1CEEF8-3741-45BD-8E77-963E1DEBDDD3}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64)
"{1D5CE83C-BFDD-4668-8BCB-E8614334A657}" = Adobe Photoshop Lightroom 3.4 64-bit
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{2222706F-666A-4037-7777-203648764D10}" = JavaFX 2.0.3 SDK (64-bit)
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417003FF}" = Java™ 7 Update 3 (64-bit)
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{4529F749-C362-4119-AFA0-0A3F1CA924AB}" = Autodesk MatchMover 2012 64-bit
"{4554DBB6-40D0-43BB-ADB8-75399FF11284}" = ANTS Memory Profiler 7
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{491DF203-7B61-4F0E-BDCB-A1218C4DAFE9}" = Native Instruments Massive
"{4A8CE6D7-4D52-43B9-970B-03FC75FAD667}" = Microsoft SQL Server System CLR Types (x64)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{502EAA3C-5887-4B62-83BC-7FCE593A8A89}" = ANTS Performance Profiler 6
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{5494E6CE-2212-4CE4-8E20-BE8BECF84B4D}" = Reason Essentials Ignition Key Support
"{5D068141-189F-39E2-A052-E40D4B561256}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{64A3A4F4-B792-11D6-A78A-00B0D0170030}" = Java™ SE Development Kit 7 Update 3 (64-bit)
"{6617A518-55F2-42F8-9DED-7A3EBDFA42EE}_is1" = Balance Driver 1.0.17
"{662014D2-0450-37ED-ABAE-157C88127BEB}" = Visual Studio 2010 Prerequisites - English
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7608CF6F-EB13-4E89-A4F0-8732FB6EAF98}" = Maxwell Shell Extension (x64)
"{77BBAFA6-A43D-4FBE-8888-4E397025878C}" = M-Audio Producer Driver 6.0.4 (x64)
"{7A780DF7-359E-42F6-A258-A1AA602024F4}" = .NET Reflector 7
"{7ACE202B-1B01-4B43-B6AE-03D66D621CDE}" = Microsoft SQL Server 2008 RsFx Driver
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8304B583-73E1-452B-8C67-DC7211586C1B}" = Authorizer Ignition Key Support
"{8438EC02-B8A9-462D-AC72-1B521349C001}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64)
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{88DAAF05-5A72-46D2-A7C5-C3759697E943}" = SyncToy 2.1 (x64)
"{893F27E6-D6BE-4B9F-80E6-0ADA694A31A8}" = Microsoft SQL Server 2008 Common Files
"{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}" = Microsoft Sync Framework 2.0 Core Components (x64) ENU
"{8D99210A-25E1-4920-8231-D12490FB8E2C}" = M-Audio Axiom Driver 1.1.1 (x64)
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64
"{918473BA-67C9-498B-BE7A-BC3A3CBC3338}" = TortoiseHg 2.1.3 (x64)
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010 x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{9E6BB4E4-0B20-4922-AA37-260FA5ACFBA5}" = Autodesk Maya 2012 64-bit
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B40EE88B-400A-4266-A17B-E3DE64E94431}" = Microsoft SQL Server 2008 Setup Support Files
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{BBDE8A3D-64A2-43A6-95F3-C27B87DF7AC1}" = Microsoft SQL Server 2008 Native Client
"{BCA26999-EC22-3007-BB79-638913079C9A}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{C9A5048A-26A6-440B-A059-9DF9956C4D44}" = Yamaha USB-MIDI Driver
"{CC7C5BA5-0010-1033-B966-42899C00BD23}" = Autodesk Mudbox 2012 64-bit - English
"{CC7C5BA5-09B5-428E-B966-42899C00BD23}" = Autodesk Mudbox 2012 64-bit - English
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DA67488A-2689-4F10-B90F-D2F6977509D6}" = Microsoft SQL Server 2008 R2 Management Objects (x64)
"{DE0248C8-0701-4132-95A5-9130D22B3A24}" = ANTS Profiler Visual Studio Add-in 1
"{DF167CE3-60E7-44EA-99EC-2507C51F37AE}" = Microsoft SQL Server 2008 Database Engine Shared
"{F5079164-1DB9-3BDA-853B-F78AF67CE071}" = Microsoft Visual C++ 2010 x64 Designtime - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6762963-9AE5-4bc6-A70F-2D749F6AC02F}_is1" = Authorizer 2.0
"{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = Microsoft SQL Server 2008 Database Engine Services
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FC4AD39F-9DCE-4BD0-B7D0-7C81CEB9F04B}" = NVIDIA PhysX Plug-in for Autodesk Maya 2012 64 bit
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Autodesk Maya 2012 64-bit" = Autodesk Maya 2012 64-bit
"Autodesk Mudbox 2012 64-bit - English" = Autodesk Mudbox 2012 64-bit - English
"A-WIN-Extras 8.0.4 2609412_is1" = Mathematica Extras 8.0 (2609412)
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.58
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.18
"Mari 1.3v1_is1" = Mari 1.3v1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Microsoft Team Foundation Server 2010 Object Model - ENU" = Microsoft Team Foundation Server 2010 Object Model - ENU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"M-WIN-L 8.0.1 2063990_is1" = Wolfram Mathematica 8 (M-WIN-L 8.0.1 2063990)
"Nuke 6.2v2_is1" = Nuke 6.2v2
"ReasonEssentials1.5_64_is1" = Reason Essentials 1.5
"V-Ray for Maya 2012 for x64" = V-Ray for Maya 2012 for x64
"Wacom Tablet Driver" = Wacom Tablet
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.44-1 (x64)
"WinRAR archiver" = WinRAR 4.01 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01C79EF3-DE84-4B56-B638-8BEA0D507506}" = Microsoft XNA Game Studio 4.0 (XnaLiveProxy)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0666E46E-A860-4353-BE6D-13AA72FABB57}" = Microsoft XNA Game Studio Platform Tools
"{08C84CC6-E7FD-4B2D-BBF9-B02CC90EE031}" = Microsoft XNA Game Studio 4.0 (Shared Components)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0DDCEC37-369C-484B-B16D-B4413FD42FB9}" = Microsoft SQL Server 2008 R2 Data-Tier Application Framework
"{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}" = Microsoft Sync Framework SDK v1.0 SP1
"{0FDCF6BC-AB79-4CEF-9A7D-01FD838A6C61}" = JetBrains ReSharper 6.0
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1E04C795-7359-4E05-8A0E-5644F777AA08}_is1" = Wondershare MobileGo for Android ( Version 2.0.0 )
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{21AF2C88-A2D7-436D-A261-017865640E84}" = Imgur Uploader
"{265E2F1D-0025-45DF-B83B-8320466108A8}" = Python 3.2 pygame-1.9.2a0
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 30
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2D9FEBEE-F1B7-344F-BFDF-760E18332D96}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{325045C9-F040-3D98-892D-53D5E840266C}" = Google Talk Plugin
"{34b2530c-6349-4292-9dc3-60bda4aed93c}" = Python 3.2.1
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{37542828-0F05-4BAA-BEB7-B633F27D3E7B}" = SlimDX SDK (September 2011)
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend Closed Beta
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{3F4EB5FE-B5BE-4069-A5A8-6D9262E1B379}" = Microsoft XNA Game Studio 4.0 Documentation
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}" = Dotfuscator Software Services - Community Edition
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{59F24743-2EA1-3A45-B8C2-6E0E1E078FA8}" = Microsoft Visual C# 2010 Express - ENU
"{5AFD94F5-CB9F-4CEF-B271-2A636C895451}_is1" = Window On Top version 1.2
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{68BD57D3-D606-411E-A7E0-3EB6EA5660F6}" = Microsoft XNA Game Studio 4.0 (Redists)
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{73BE04D9-BA0E-4BAF-9C9D-677278BDB3DC}" = Microsoft XNA Game Studio 4.0 (ARP entry)
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{78C3657E-742C-40B1-9F53-E5A921D40F17}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{7AB01508-C2B2-43C8-8B44-514801E7CCC9}" = Jing
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{8472BE38-4100-44EB-96D5-6B0D936EE1C6}" = SlimDX SDK (January 2012)
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C496FBF-DB4A-468D-A3A1-15E127382218}" = Microsoft XNA Game Studio 4.0 (Visual Studio)
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B55759D-424F-4CB1-B84E-AAE83CC1D20A}_is1" = Nitronic Rush (2011-11-11) version 20111111.0
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A8AF728F-2EE8-4322-96B3-656CAD1F7805}" = Facebook Messenger 2.1.4554.0
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{C0E8FE43-C35B-451D-B35F-D4BD056D70E7}" = Camtasia Studio 7
"{C28DD992-5B7B-D195-6841-4EC57DF512BD}" = Adobe Story
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{C95443CF-EE78-4CB5-A25E-6CF71C0127C5}" = Telerik JustDecompile Beta
"{ceca424e-2d49-4406-b1ff-b570a1a2933a}" = MinerWars
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.8 Game
"{D6B15AE6-B052-363E-B6BB-C4714CBA6509}" = Microsoft Visual Studio 2010 Professional - ENU
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E14F0598-ACB9-4953-90E0-458B880852CB}" = RockScroll
"{E5AE9031-79A5-4627-9641-BEFA82819B08}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{E82097B9-A3B8-404A-9A92-AC16A8AC9576}" = Adobe After Effects CS5.5
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{FAB1F336-1B7C-4057-A7BC-2922CD82A781}" = Ralink RT6x Wireless LAN Card
"{FD9C31B6-F572-414D-81E3-89368C97A125}_is1" = CamStudio OSS Desktop Recorder
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Android SDK Tools" = Android SDK Tools
"ASIO4ALL" = ASIO4ALL
"Astroburn Lite" = Astroburn Lite
"Audacity_is1" = Audacity 1.2.6
"Authorizer_is1" = Authorizer 1.0.5
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Story
"Contour Storyteller 3.0.8" = Contour Storyteller
"Diablo III" = Diablo III
"DivX Setup" = DivX Setup
"dRasterNEX_is1" = NEX [removed]
"DROD 4: Gunthro and the Epic Blunder Demo_is1" = DROD 4: Gunthro and the Epic Blunder Demo 4.0.1
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"ffdshow_is1" = ffdshow v1.1.4257 [2012-01-15]
"FileZilla Client" = FileZilla Client 3.5.0
"FoxyTunesForFirefox" = FoxyTunes for Firefox
"Fraps" = Fraps (remove only)
"Google Desktop" = Google Desktop
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"IrfanView" = IrfanView (remove only)
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"Line 6 Uninstaller" = Line 6 Uninstaller
"Live 8.2.6" = Live 8.2.6
"LOVE" = LOVE (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Maxwell 2" = Maxwell 2
"MaxwellMaya" = Maxwell Plugin for Maya
"Microsoft DirectX SDK (June 2010)" = Microsoft DirectX SDK (June 2010)
"Microsoft Visual C# 2010 Express - ENU" = Microsoft Visual C# 2010 Express - ENU
"Microsoft Visual Studio 2010 Professional - ENU" = Microsoft Visual Studio 2010 Professional - ENU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Miro Video Converter" = Miro Video Converter
"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)
"Mozilla Thunderbird 9.0.1 (x86 en-US)" = Mozilla Thunderbird 9.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"M-WIN-D 8.0.4 2609533_is1" = Wolfram CDF Player (M-WIN-D 8.0.4 2609533)
"Native Instruments Massive" = Native Instruments Massive
"Notepad++" = Notepad++
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OnLive" = OnLive
"OpenAL" = OpenAL
"Orcs Must Die!_is1" = Orcs Must Die!
"Outerra Anteworld" = Outerra - Anteworld - Outerra Anteworld Demo
"OVERGROWTH" = Overgrowth (remove only)
"PowerISO" = PowerISO
"Proun" = Proun
"RealFlow 5" = RealFlow 5
"REAPER" = REAPER
"ReCycle_is1" = ReCycle 2.1.2
"Rigs of Rods 0.38.67" = Rigs of Rods 0.38.67
"Scribus 1.4.0" = Scribus 1.4.0
"Steam App 105600" = Terraria
"Steam App 105800" = PixelJunk Eden
"Steam App 107100" = Bastion
"Steam App 107400" = ARMA 2: Free
"Steam App 113200" = The Binding Of Isaac
"Steam App 12210" = Grand Theft Auto IV
"Steam App 202410" = Scoregasm
"Steam App 203850" = Microsoft Flight
"Steam App 204060" = Superbrothers: Sword & Sworcery EP
"Steam App 205730" = Insanely Twisted Shadow Planet
"Steam App 205870" = Auditorium
"Steam App 207170" = Legend of Grimrock
"Steam App 207530" = Noitu Love 2 Devolution
"Steam App 22000" = World of Goo
"Steam App 22350" = Brink
"Steam App 24420" = Aquaria
"Steam App 25010" = Lugaru HD
"Steam App 26500" = Cogs
"Steam App 26800" = Braid
"Steam App 26900" = Crayon Physics Deluxe
"Steam App 29180" = Osmos
"Steam App 37400" = Time Gentlemen, Please!
"Steam App 37420" = Ben There, Dan That!
"Steam App 40700" = Machinarium
"Steam App 40720" = Samorost 2
"Steam App 41100" = Hammerfight
"Steam App 44320" = DiRT 3
"Steam App 50000" = Nimbus
"Steam App 70300" = VVVVVV
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 91600" = Sanctum
"Steam App 93200" = Revenge of the Titans
"Steam App 94200" = Jamestown
"Steam App 9500" = Gish
"Steam App 96200" = Steel Storm: Burning Retribution
"Steam App 98200" = Frozen Synapse
"Steam App 99700" = NightSky
"Steam App 99810" = Bulletstorm
"Super Box Factory_is1" = Super Box Factory
"Trials 2 SE" = Trials 2 Second Edition
"Unity" = Unity
"Unwrella_Maya" = Unwrella_Maya 2.13
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.10
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"XNA Game Studio 4.0" = Microsoft XNA Game Studio 4.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"0ab833f7f99039b3" = RoadWare
"161d74b240b47115" = WindowsFormsApplication1
"Akamai" = Akamai NetSession Interface
"b14223fc30a0843d" = RTS
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"JoinMe" = join.me
"OpenTK" = OpenTK 1.0
"Sweet Volcano- The Game" = Sweet Volcano- The Game
"UnityWebPlayer" = Unity Web Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/23/2012 11:58:57 AM | Computer Name = Marcos-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

Error - 6/23/2012 12:16:57 PM | Computer Name = Marcos-PC | Source = Application Error | ID = 1000
Description = Faulting application name: svchost.exe, version: 6.1.7600.16385, time
stamp: 0x4a5bc3c1 Faulting module name: Flash64_11_2_202_235.ocx, version: 11.2.202.235,
time stamp: 0x4f9af802 Exception code: 0xc0000005 Fault offset: 0x00000000005fce65
Faulting
process id: 0x14ec Faulting application start time: 0x01cd515b2116a390 Faulting application
path: C:\Windows\system32\svchost.exe Faulting module path: C:\Windows\system32\Macromed\Flash\Flash64_11_2_202_235.ocx
Report
Id: da2fc500-bd4e-11e1-aa1f-00044b15890c

Error - 6/24/2012 2:33:10 AM | Computer Name = Marcos-PC | Source = Application Error | ID = 1000
Description = Faulting application name: services.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bc10e Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c8f9 Exception code: 0xc0000005 Fault offset: 0x000000000004e4b4
Faulting
process id: 0x280 Faulting application start time: 0x01cd51590ee22020 Faulting application
path: C:\Windows\system32\services.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 76d06a50-bdc6-11e1-aa1f-00044b15890c

Error - 6/24/2012 2:35:11 AM | Computer Name = MARCOS-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

Error - 6/24/2012 2:45:38 AM | Computer Name = Marcos-PC | Source = Application Error | ID = 1000
Description = Faulting application name: services.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bc10e Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c8f9 Exception code: 0xc0000005 Fault offset: 0x000000000004e4b4
Faulting
process id: 0x264 Faulting application start time: 0x01cd51d37ff079e0 Faulting application
path: C:\Windows\system32\services.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 34cf76d0-bdc8-11e1-bb12-00044b15890c

Error - 6/24/2012 2:47:54 AM | Computer Name = Marcos-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

Error - 6/24/2012 2:59:11 AM | Computer Name = Marcos-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

Error - 6/24/2012 3:12:05 AM | Computer Name = Marcos-PC | Source = Google Update | ID = 20
Description =

Error - 6/24/2012 3:28:18 AM | Computer Name = Marcos-PC | Source = Application Error | ID = 1000
Description = Faulting application name: services.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bc10e Faulting module name: ntdll.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7c8f9 Exception code: 0xc0000005 Fault offset: 0x000000000004e4b4
Faulting
process id: 0x2a4 Faulting application start time: 0x01cd51d6d11f19e0 Faulting application
path: C:\Windows\system32\services.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 2ab623f0-bdce-11e1-8b43-00044b15890c

Error - 6/24/2012 3:30:33 AM | Computer Name = Marcos-PC | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x80070005.

[ System Events ]
Error - 6/24/2012 2:59:49 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7003
Description = The IKE and AuthIP IPsec Keying Modules service depends the following
service: BFE. This service might not be installed.

Error - 6/24/2012 3:00:26 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the SQL
Server (SQLEXPRESS) service to connect.

Error - 6/24/2012 3:00:26 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7000
Description = The SQL Server (SQLEXPRESS) service failed to start due to the following
error: %%1053

Error - 6/24/2012 3:00:28 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7003
Description = The IPsec Policy Agent service depends the following service: BFE.
This service might not be installed.

Error - 6/24/2012 3:30:19 AM | Computer Name = Marcos-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 2:23:34 AM on ?6/?24/?2012 was unexpected.

Error - 6/24/2012 3:30:38 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7023
Description = The Computer Browser service terminated with the following error:
%%1060

Error - 6/24/2012 3:31:25 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7003
Description = The IKE and AuthIP IPsec Keying Modules service depends the following
service: BFE. This service might not be installed.

Error - 6/24/2012 3:31:41 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7003
Description = The IPsec Policy Agent service depends the following service: BFE.
This service might not be installed.

Error - 6/24/2012 3:33:27 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7023
Description = The Function Discovery Resource Publication service terminated with
the following error: %%-2147024891

Error - 6/24/2012 3:33:27 AM | Computer Name = Marcos-PC | Source = Service Control Manager | ID = 7001
Description = The HomeGroup Provider service depends on the Function Discovery Resource
Publication service which failed to start because of the following error: %%-2147024891


< End of report >

ComboFix 12-06-24.03 - Marcos 06/24/2012 18:29:49.5.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8191.6560 [GMT -5:00] Running from: c:\users\[removed]\Desktop\vageta.com.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Propellerhead Software\ReCycle c:\programdata\Propellerhead Software\ReCycle\ReCycle212.dat c:\users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\@ c:\users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\n c:\users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@ c:\users\Marcos\AppData\Local\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@ c:\users\Marcos\AppData\Local\assembly\tmp c:\users\Marcos\AppData\Roaming\Love c:\users\Marcos\AppData\Roaming\Love\BR2\cache\2acdfefc6e33a4c1bbbd327dd02441f7.brc c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\logic\maps\intro.lua c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\logic\maps\mainmenu.lua c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\maps\intro.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\maps\mainmenu.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\maps\sandbox.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\maps\test.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\styles.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\tilesets\menu.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\data\tilesets\outside_n.bdf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\fonts\trebuc.ttf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\fonts\trebucbd.ttf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\fonts\trebucbi.ttf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\fonts\trebucit.ttf c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\bg\menu.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\bg\test.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\bg\test.psd c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\bg\test2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player.biq c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player.psd c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player2.pdn c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\game\player2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\bar_l.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\bar_m.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\bar_r.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\btm.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\btm_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\btm_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\hud\hud.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\icons\coins.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\icons\star.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\icons\troll.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\icons\user.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\bg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\btn.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\btn_d.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\btn_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\btn_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but.biq c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but_a.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but_d.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\but_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_a.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_a_c.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_d.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_d_c.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_h_c.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_n.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\cbx_n_c.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\chk_0.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\chk_0_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\chk_1.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\chk_1_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dialog.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_bg.old.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_bg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_close.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_close_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_close_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_item.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_item_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\dlc_item_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\inp.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\inp_a.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\inp_d.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\inp_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\panel.biq c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\panel.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\sb_thumb.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\menu\userbg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\props\table.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\set.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\bg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\buts_1.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\buts_1h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\buts_2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\buts_2h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\collide.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\grid.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\handle.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item_a.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item_f.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item_fs.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\sidebar\item_h.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\splash.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\3.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\4.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\5.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\control_room\computer 1.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\control_room\computer 2.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\menu\metal.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\brick.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\brickwall.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\concrete.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\dirt.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\grass.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\day\stonepath.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\bg.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\brick.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\brickwall.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\concrete.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\dirt.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\grass.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\outside\night\stonepath.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\void.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\img\tiles\white.png c:\users\Marcos\AppData\Roaming\Love\BR2\dlc\default\info.txt c:\users\Marcos\AppData\Roaming\Love\BR2\reg.sav c:\users\Marcos\AppData\Roaming\Love\not_tetris_2\highscoresA.txt c:\users\Marcos\AppData\Roaming\Love\not_tetris_2\highscoresB.txt c:\users\Marcos\AppData\Roaming\Love\not_tetris_2\options.txt c:\users\Marcos\AppData\Roaming\Propellerhead Software\ReCycle c:\users\Marcos\AppData\Roaming\Propellerhead Software\ReCycle\ReCycle Preferences File.prf c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\@ c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\n c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\00000001.@ c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\80000000.@ c:\windows\Installer\{5289e239-1d10-a468-cbdf-061c682fa27e}\U\800000cb.@ c:\windows\SysWow64\DEBUG.log c:\windows\SysWow64\muzapp.exe . Infected copy of c:\windows\system32\services.exe was found and disinfected Restored copy from - c:\windows\ERDNT\cache64\services.exe . . ((((((((((((((((((((((((( Files Created from 2012-05-24 to 2012-06-24 ))))))))))))))))))))))))))))))) . . 2012-06-24 23:36 . 2012-06-24 23:36 ——– d—–w- c:\users\Public\AppData\Local\temp 2012-06-24 23:36 . 2012-06-24 23:36 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-23 17:14 . 2012-06-23 17:14 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service 2012-06-23 17:14 . 2012-06-14 22:20 85472 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2012-06-23 17:14 . 2012-06-14 22:20 157608 —-a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe 2012-06-23 17:14 . 2012-06-14 22:20 113120 —-a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe 2012-06-23 17:14 . 2012-06-14 22:19 770384 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll 2012-06-23 17:14 . 2012-06-14 22:19 421200 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll 2012-06-18 23:13 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-18 23:13 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-18 23:13 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-18 23:13 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-18 23:13 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-18 23:13 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-18 23:13 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-18 23:12 . 2012-06-02 20:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-18 23:12 . 2012-06-02 20:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-13 23:48 . 2012-06-13 23:48 ——– d—–w- c:\users\Marcos\AppData\Local\Macromedia 2012-06-10 19:09 . 2012-06-10 21:38 ——– d—–w- c:\users\Marcos\AppData\Roaming\Mathematica 2012-06-10 19:09 . 2012-06-10 19:24 ——– d—–w- c:\users\Marcos\AppData\Local\Mathematica 2012-06-10 18:59 . 2011-02-24 00:40 465936 —-a-w- c:\windows\system32\mltcpip64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 103440 —-a-w- c:\windows\system32\mltcp64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 99344 —-a-w- c:\windows\system32\mlshm64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 203792 —-a-w- c:\windows\system32\mlmodule64.dll 2012-06-10 18:59 . 2011-02-24 00:40 436240 —-a-w- c:\windows\system32\ml64i3.dll 2012-06-10 18:59 . 2011-02-24 00:40 302608 —-a-w- c:\windows\system32\ml64i2.dll 2012-06-09 18:50 . 2012-06-09 18:50 ——– d—–w- c:\program files\Common Files\Wolfram Research 2012-06-09 18:50 . 2012-06-09 18:50 ——– d—–w- c:\program files (x86)\Common Files\ResearchSoft 2012-06-09 18:47 . 2012-06-09 18:50 ——– d—–w- c:\program files (x86)\Common Files\Wolfram Research 2012-06-09 18:47 . 2012-06-10 19:25 ——– d—–w- c:\programdata\Mathematica 2012-06-09 18:47 . 2011-10-03 23:45 334352 —-a-w- c:\windows\SysWow64\mltcpip32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 93712 —-a-w- c:\windows\SysWow64\mltcp32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 88080 —-a-w- c:\windows\SysWow64\mlshm32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 163344 —-a-w- c:\windows\SysWow64\mlmodule32.dll 2012-06-09 18:47 . 2011-10-03 23:45 79376 —-a-w- c:\windows\SysWow64\mlmap32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 370704 —-a-w- c:\windows\SysWow64\ml32i3.dll 2012-06-09 18:47 . 2011-10-03 23:45 260112 —-a-w- c:\windows\SysWow64\ml32i2.dll 2012-06-09 18:47 . 2011-10-03 23:45 253968 —-a-w- c:\windows\SysWow64\ml32i1.dll 2012-06-09 18:46 . 2012-06-09 18:46 ——– d—–w- c:\program files (x86)\Wolfram Research 2012-06-07 06:09 . 2012-06-07 06:09 ——– d—–w- c:\users\Marcos\AppData\Local\DDMSettings 2012-06-07 06:00 . 2012-06-07 06:00 ——– d—–w- c:\users\Marcos\AppData\Roaming\DivX 2012-06-07 05:59 . 2012-06-07 05:59 ——– d—–w- c:\program files (x86)\Common Files\PX Storage Engine 2012-06-07 05:59 . 2012-06-07 05:59 ——– d—–w- c:\program files\DivX 2012-06-07 05:59 . 2012-06-07 05:59 ——– d—–w- c:\program files (x86)\Common Files\DivX Shared 2012-06-07 05:58 . 2012-06-07 06:00 ——– d—–w- c:\program files (x86)\DivX 2012-06-07 05:57 . 2012-06-07 06:08 ——– d—–w- c:\programdata\DivX 2012-06-06 04:04 . 2012-06-06 04:04 ——– d—–w- c:\users\Marcos\AppData\Local\Redlynx 2012-06-06 04:03 . 2012-06-06 04:05 ——– d—–w- c:\program files (x86)\Trials 2 Second Edition 2012-06-03 02:46 . 2012-06-03 02:46 ——– d—–w- c:\windows\system32\appmgmt 2012-06-03 01:59 . 2012-06-03 02:47 111960 —-a-w- c:\windows\dxsdkuninst.exe 2012-06-03 01:59 . 2012-06-03 02:02 ——– d—–w- c:\program files (x86)\Microsoft DirectX SDK (June 2010) 2012-06-01 19:42 . 2012-06-01 19:42 ——– d-sh–w- c:\windows\system32\%APPDATA% 2012-05-31 18:05 . 2012-05-31 18:05 ——– d—–w- c:\program files\7-Zip 2012-05-31 18:02 . 2012-05-31 18:02 1721576 —-a-w- c:\windows\system32\WdfCoInstaller01009.dll 2012-05-31 18:02 . 2012-05-31 18:02 1002728 —-a-w- c:\windows\system32\WinUSBCoInstaller2.dll 2012-05-31 18:02 . 2012-05-31 18:02 ——– d—–w- C:\usb_driver 2012-05-31 17:44 . 2012-05-31 17:44 ——– d—–w- c:\users\Marcos\AppData\Local\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 ——– d—–w- c:\program files (x86)\Common Files\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 ——– d—–w- c:\users\Marcos\AppData\Roaming\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 ——– d—–w- c:\program files (x86)\Wondershare 2012-05-31 16:52 . 2011-06-02 05:47 177640 —-a-w- c:\windows\system32\drivers\ssadmdm.sys 2012-05-31 16:52 . 2011-06-02 05:47 16872 —-a-w- c:\windows\system32\drivers\ssadmdfl.sys 2012-05-31 16:52 . 2011-06-02 05:47 157672 —-a-w- c:\windows\system32\drivers\ssadbus.sys 2012-05-31 16:52 . 2011-06-02 05:47 13800 —-a-w- c:\windows\system32\drivers\ssadwhnt.sys 2012-05-31 16:52 . 2011-06-02 05:47 13288 —-a-w- c:\windows\system32\drivers\ssadcmnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 36328 —-a-w- c:\windows\system32\drivers\ssadadb.sys 2012-05-31 16:52 . 2010-12-21 05:55 15944 —-a-w- c:\windows\system32\drivers\sscdwhnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 19016 —-a-w- c:\windows\system32\drivers\sscdmdfl.sys 2012-05-31 16:52 . 2010-12-21 05:55 172104 —-a-w- c:\windows\system32\drivers\sscdmdm.sys 2012-05-31 16:52 . 2010-12-21 05:55 15432 —-a-w- c:\windows\system32\drivers\sscdcmnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 136264 —-a-w- c:\windows\system32\drivers\sscdbus.sys 2012-05-31 16:24 . 2012-05-23 23:49 821824 —-a-w- c:\windows\SysWow64\dgderapi.dll 2012-05-31 16:06 . 2012-05-31 16:06 ——– d—–w- c:\program files\CCleaner . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 16:55 . 2012-04-26 01:11 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 16:55 . 2011-07-04 21:29 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-23 23:50 . 2011-08-27 18:51 4659712 —-a-w- c:\windows\SysWow64\Redemption.dll 2012-05-23 23:49 . 2012-05-23 23:49 90112 —-a-w- c:\windows\MAMCityDownload.ocx 2012-05-23 23:49 . 2012-05-23 23:49 325552 —-a-w- c:\windows\MASetupCaller.dll 2012-05-23 23:49 . 2012-05-23 23:49 30568 —-a-w- c:\windows\MusiccityDownload.exe 2012-05-23 23:49 . 2012-05-23 23:49 45320 —-a-w- c:\windows\SysWow64\MAMACExtract.dll 2012-05-15 06:17 . 2011-07-07 06:17 466456 —-a-w- c:\windows\system32\wrap_oal.dll 2012-05-15 06:17 . 2011-07-07 06:17 122904 —-a-w- c:\windows\system32\OpenAL32.dll 2012-05-15 06:17 . 2011-07-07 06:17 444952 —-a-w- c:\windows\SysWow64\wrap_oal.dll 2012-05-15 06:17 . 2011-07-07 06:17 109080 —-a-w- c:\windows\SysWow64\OpenAL32.dll 2012-05-05 05:18 . 2012-04-26 01:18 8744608 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-04-04 20:56 . 2012-01-20 18:32 24904 —-a-w- c:\windows\system32\drivers\mbam.sys . . ——- Sigcheck ——- Note: Unsigned files aren't necessarily malware. . [-] 2012-02-06 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll . [-] 2012-02-06 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll [7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "HideSCAHealth"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer8"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-06-19 8704] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x] R3 ANTS Memory Profiler 7 Service;ANTS Memory Profiler 7 Service;c:\program files\Red Gate\ANTS Memory Profiler 7\RedGate.Memory.IISService.exe [2012-01-16 164792] R3 ANTS Performance Profiler 6 Service;ANTS Performance Profiler 6 Service;c:\program files\Red Gate\ANTS Performance Profiler 6\RedGate.Profiler.IISService.exe [2012-01-16 145408] R3 AXIOM;Service for M-Audio Axiom;c:\windows\system32\DRIVERS\MAudioAxiom.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-07-04 1431888] R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-07-14 30192] R3 MAUSBPRODUCER;Service for M-Audio Producer;c:\windows\system32\DRIVERS\MAudioProducer.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-14 113120] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 YMIDUSBW;Yamaha USB-MIDI Driver (WDM);c:\windows\system32\drivers\ymidusbx64.sys [x] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-22 61976] R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [x] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 427880] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 3d-io License Server v2.0;3d-io License Server v2.0;c:\program files (x86)\3d-io plugins\licensing_v2\ActiveLockServerV2.exe [2011-03-31 34816] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AxiomAudioDevMon;Axiom Audio Device Monitor;c:\program files (x86)\M-Audio\Axiom\AudioDevMon.exe [2010-02-19 1632776] S2 CodeMeter.exe;CodeMeter Runtime Server;c:\program files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe [2011-07-06 2304912] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 381248] S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2010-11-15 5716848] S3 balancesvc;Propellerhead Balance Driver;c:\windows\system32\DRIVERS\balance.sys [x] S3 BalanceWdmService;Balance Wdm Audio;c:\windows\system32\DRIVERS\BalanceWdm.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-06-24 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26 16:55] . 2012-06-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job - c:\users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-07 20:07] . 2012-06-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job - c:\users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-07 20:07] . 2012-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job - c:\users\Marcos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-29 18:04] . 2012-06-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job - c:\users\Marcos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-29 18:04] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs AtiPcie . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-AdobeBridge - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-UnityWebPlayer - c:\users\Marcos\AppData\Local\Unity\WebPlayer\Uninstall.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1943473726-2824459890-2441723098-1000\Software\SecuROM\License information*] "datasecu"=hex:48,3d,44,b1,2b,cd,bd,b0,f5,3a,d9,c8,ec,44,6a,ec,b4,58,2a,16,52, db,68,43,df,c5,d4,88,4d,46,b1,0d,90,06,67,81,a3,09,55,a5,f7,ab,53,66,40,b0,\ "rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Completion time: 2012-06-24 18:46:31 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-24 23:46 . Pre-Run: 10,773,049,344 bytes free Post-Run: 11,723,886,592 bytes free . - - End Of File - - 5396CCB8083F50A78F913EE47EECB4E8

ComboFix 12-06-24.03 - Marcos 06/25/2012 20:39:28.6.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8191.6520 [GMT -5:00] Running from: c:\users\[removed]\Desktop\vageta.com.exe Command switches used :: c:\users\Marcos\Desktop\CFScript.txt SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-05-26 to 2012-06-26 ))))))))))))))))))))))))))))))) . . 2012-06-26 01:44 . 2012-06-26 01:44 ——– d—–w- c:\users\Public\AppData\Local\temp 2012-06-26 01:44 . 2012-06-26 01:44 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-06-25 22:36 . 2012-06-25 22:36 9310 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS 2012-06-25 22:36 . 2012-06-25 22:36 8646 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS 2012-06-25 22:36 . 2012-06-25 22:36 6429 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS 2012-06-25 22:36 . 2012-06-25 22:36 63115 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS 2012-06-25 22:36 . 2012-06-25 22:36 4599 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS 2012-06-25 22:35 . 2012-06-25 22:35 8782 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS 2012-06-25 22:35 . 2012-06-25 22:35 8613 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS 2012-06-25 22:35 . 2012-06-25 22:35 8288 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS 2012-06-25 22:35 . 2012-06-25 22:35 7271 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS 2012-06-25 22:35 . 2012-06-25 22:35 6910 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS 2012-06-25 22:35 . 2012-06-25 22:35 6208 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS 2012-06-25 22:35 . 2012-06-25 22:35 5927 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS 2012-06-25 22:35 . 2012-06-25 22:35 51852 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS 2012-06-25 22:35 . 2012-06-25 22:35 23327 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS 2012-06-25 22:35 . 2012-06-25 22:35 20719 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS 2012-06-25 22:35 . 2012-06-25 22:35 18541 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS 2012-06-25 22:35 . 2012-06-25 22:35 1651 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS 2012-06-25 06:45 . 2012-06-25 06:45 ——– d—–w- c:\program files (x86)\MagicalTimeBean 2012-06-25 06:09 . 2012-06-25 06:09 ——– d—–w- c:\program files (x86)\ExamDiff 2012-06-23 17:14 . 2012-06-23 17:14 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service 2012-06-23 17:14 . 2012-06-14 22:20 85472 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2012-06-23 17:14 . 2012-06-14 22:20 157608 —-a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe 2012-06-23 17:14 . 2012-06-14 22:20 113120 —-a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe 2012-06-23 17:14 . 2012-06-14 22:19 770384 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll 2012-06-23 17:14 . 2012-06-14 22:19 421200 —-a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll 2012-06-18 23:13 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-18 23:13 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-18 23:13 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-18 23:13 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-18 23:13 . 2012-06-02 22:19 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-18 23:13 . 2012-06-02 22:19 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-18 23:13 . 2012-06-02 22:15 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-18 23:12 . 2012-06-02 20:19 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-18 23:12 . 2012-06-02 20:15 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-06-13 23:48 . 2012-06-13 23:48 ——– d—–w- c:\users\Marcos\AppData\Local\Macromedia 2012-06-10 19:09 . 2012-06-10 21:38 ——– d—–w- c:\users\Marcos\AppData\Roaming\Mathematica 2012-06-10 19:09 . 2012-06-10 19:24 ——– d—–w- c:\users\Marcos\AppData\Local\Mathematica 2012-06-10 18:59 . 2011-02-24 00:40 465936 —-a-w- c:\windows\system32\mltcpip64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 103440 —-a-w- c:\windows\system32\mltcp64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 99344 —-a-w- c:\windows\system32\mlshm64.mlp 2012-06-10 18:59 . 2011-02-24 00:40 203792 —-a-w- c:\windows\system32\mlmodule64.dll 2012-06-10 18:59 . 2011-02-24 00:40 436240 —-a-w- c:\windows\system32\ml64i3.dll 2012-06-10 18:59 . 2011-02-24 00:40 302608 —-a-w- c:\windows\system32\ml64i2.dll 2012-06-09 18:50 . 2012-06-09 18:50 ——– d—–w- c:\program files\Common Files\Wolfram Research 2012-06-09 18:50 . 2012-06-09 18:50 ——– d—–w- c:\program files (x86)\Common Files\ResearchSoft 2012-06-09 18:47 . 2012-06-09 18:50 ——– d—–w- c:\program files (x86)\Common Files\Wolfram Research 2012-06-09 18:47 . 2012-06-10 19:25 ——– d—–w- c:\programdata\Mathematica 2012-06-09 18:47 . 2011-10-03 23:45 334352 —-a-w- c:\windows\SysWow64\mltcpip32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 93712 —-a-w- c:\windows\SysWow64\mltcp32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 88080 —-a-w- c:\windows\SysWow64\mlshm32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 163344 —-a-w- c:\windows\SysWow64\mlmodule32.dll 2012-06-09 18:47 . 2011-10-03 23:45 79376 —-a-w- c:\windows\SysWow64\mlmap32.mlp 2012-06-09 18:47 . 2011-10-03 23:45 370704 —-a-w- c:\windows\SysWow64\ml32i3.dll 2012-06-09 18:47 . 2011-10-03 23:45 260112 —-a-w- c:\windows\SysWow64\ml32i2.dll 2012-06-09 18:47 . 2011-10-03 23:45 253968 —-a-w- c:\windows\SysWow64\ml32i1.dll 2012-06-09 18:46 . 2012-06-09 18:46 ——– d—–w- c:\program files (x86)\Wolfram Research 2012-06-07 06:09 . 2012-06-07 06:09 ——– d—–w- c:\users\Marcos\AppData\Local\DDMSettings 2012-06-07 06:00 . 2012-06-07 06:00 ——– d—–w- c:\users\Marcos\AppData\Roaming\DivX 2012-06-07 05:59 . 2012-06-07 05:59 ——– d—–w- c:\program files (x86)\Common Files\PX Storage Engine 2012-06-07 05:59 . 2012-06-07 05:59 ——– d—–w- c:\program files\DivX 2012-06-07 05:59 . 2012-06-07 05:59 ——– d—–w- c:\program files (x86)\Common Files\DivX Shared 2012-06-07 05:58 . 2012-06-07 06:00 ——– d—–w- c:\program files (x86)\DivX 2012-06-07 05:57 . 2012-06-07 06:08 ——– d—–w- c:\programdata\DivX 2012-06-06 04:04 . 2012-06-06 04:04 ——– d—–w- c:\users\Marcos\AppData\Local\Redlynx 2012-06-06 04:03 . 2012-06-06 04:05 ——– d—–w- c:\program files (x86)\Trials 2 Second Edition 2012-06-03 02:46 . 2012-06-03 02:46 ——– d—–w- c:\windows\system32\appmgmt 2012-06-03 01:59 . 2012-06-03 02:47 111960 —-a-w- c:\windows\dxsdkuninst.exe 2012-06-03 01:59 . 2012-06-03 02:02 ——– d—–w- c:\program files (x86)\Microsoft DirectX SDK (June 2010) 2012-06-01 19:42 . 2012-06-01 19:42 ——– d-sh–w- c:\windows\system32\%APPDATA% 2012-05-31 18:05 . 2012-05-31 18:05 ——– d—–w- c:\program files\7-Zip 2012-05-31 18:02 . 2012-05-31 18:02 1721576 —-a-w- c:\windows\system32\WdfCoInstaller01009.dll 2012-05-31 18:02 . 2012-05-31 18:02 1002728 —-a-w- c:\windows\system32\WinUSBCoInstaller2.dll 2012-05-31 18:02 . 2012-05-31 18:02 ——– d—–w- C:\usb_driver 2012-05-31 17:44 . 2012-05-31 17:44 ——– d—–w- c:\users\Marcos\AppData\Local\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 ——– d—–w- c:\program files (x86)\Common Files\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 ——– d—–w- c:\users\Marcos\AppData\Roaming\Wondershare 2012-05-31 17:44 . 2012-05-31 17:44 ——– d—–w- c:\program files (x86)\Wondershare 2012-05-31 16:52 . 2011-06-02 05:47 177640 —-a-w- c:\windows\system32\drivers\ssadmdm.sys 2012-05-31 16:52 . 2011-06-02 05:47 16872 —-a-w- c:\windows\system32\drivers\ssadmdfl.sys 2012-05-31 16:52 . 2011-06-02 05:47 157672 —-a-w- c:\windows\system32\drivers\ssadbus.sys 2012-05-31 16:52 . 2011-06-02 05:47 13800 —-a-w- c:\windows\system32\drivers\ssadwhnt.sys 2012-05-31 16:52 . 2011-06-02 05:47 13288 —-a-w- c:\windows\system32\drivers\ssadcmnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 36328 —-a-w- c:\windows\system32\drivers\ssadadb.sys 2012-05-31 16:52 . 2010-12-21 05:55 15944 —-a-w- c:\windows\system32\drivers\sscdwhnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 19016 —-a-w- c:\windows\system32\drivers\sscdmdfl.sys 2012-05-31 16:52 . 2010-12-21 05:55 172104 —-a-w- c:\windows\system32\drivers\sscdmdm.sys 2012-05-31 16:52 . 2010-12-21 05:55 15432 —-a-w- c:\windows\system32\drivers\sscdcmnt.sys 2012-05-31 16:52 . 2010-12-21 05:55 136264 —-a-w- c:\windows\system32\drivers\sscdbus.sys 2012-05-31 16:24 . 2012-05-23 23:49 821824 —-a-w- c:\windows\SysWow64\dgderapi.dll 2012-05-31 16:06 . 2012-05-31 16:06 ——– d—–w- c:\program files\CCleaner . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-23 16:55 . 2012-04-26 01:11 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-06-23 16:55 . 2011-07-04 21:29 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-23 23:50 . 2011-08-27 18:51 4659712 —-a-w- c:\windows\SysWow64\Redemption.dll 2012-05-23 23:49 . 2012-05-23 23:49 90112 —-a-w- c:\windows\MAMCityDownload.ocx 2012-05-23 23:49 . 2012-05-23 23:49 325552 —-a-w- c:\windows\MASetupCaller.dll 2012-05-23 23:49 . 2012-05-23 23:49 30568 —-a-w- c:\windows\MusiccityDownload.exe 2012-05-23 23:49 . 2012-05-23 23:49 45320 —-a-w- c:\windows\SysWow64\MAMACExtract.dll 2012-05-15 06:17 . 2011-07-07 06:17 466456 —-a-w- c:\windows\system32\wrap_oal.dll 2012-05-15 06:17 . 2011-07-07 06:17 122904 —-a-w- c:\windows\system32\OpenAL32.dll 2012-05-15 06:17 . 2011-07-07 06:17 444952 —-a-w- c:\windows\SysWow64\wrap_oal.dll 2012-05-15 06:17 . 2011-07-07 06:17 109080 —-a-w- c:\windows\SysWow64\OpenAL32.dll 2012-05-05 05:18 . 2012-04-26 01:18 8744608 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-04-04 20:56 . 2012-01-20 18:32 24904 —-a-w- c:\windows\system32\drivers\mbam.sys . . ——- Sigcheck ——- Note: Unsigned files aren't necessarily malware. . [-] 2012-02-06 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll . [-] 2012-02-06 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll [7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll . ((((((((((((((((((((((((((((( SnapShot@2012-06-24_23.38.54 ))))))))))))))))))))))))))))))))))))))))) . + 2011-07-04 20:48 . 2012-06-26 01:48 61114 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-07-14 05:10 . 2012-06-24 23:41 28460 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-06-26 01:49 28460 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-07-04 19:57 . 2012-06-26 01:49 20722 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1943473726-2824459890-2441723098-1000_UserData.bin - 2011-07-04 21:08 . 2012-06-24 23:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-07-04 21:08 . 2012-06-26 01:47 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:46 . 2012-06-25 13:22 90152 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat + 2011-07-04 21:08 . 2012-06-26 01:47 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-07-04 21:08 . 2012-06-24 23:39 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-07-04 21:08 . 2012-06-24 23:39 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-07-04 21:08 . 2012-06-26 01:47 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-07-04 21:08 . 2012-06-24 23:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-07-04 21:08 . 2012-06-26 01:47 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-07-04 21:08 . 2012-06-26 01:47 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-07-04 21:08 . 2012-06-24 23:39 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2012-06-24 23:38 . 2012-06-24 23:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-06-26 01:45 . 2012-06-26 01:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-06-26 01:45 . 2012-06-26 01:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-06-24 23:38 . 2012-06-24 23:38 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-07-04 20:37 . 2012-06-26 01:45 901120 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-07-04 20:37 . 2012-06-24 23:38 901120 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 05:01 . 2012-06-24 23:37 397868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-06-26 01:44 397868 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-06-15 19:18 . 2012-06-15 19:18 664576 c:\windows\Installer\9c9b6a.msi + 2012-06-25 06:45 . 2012-06-25 06:45 112303 c:\windows\Installer\{B7417088-3CD3-49E9-990A-6E84C04BC800}\EscapeGoatIcon.exe - 2012-02-21 16:56 . 2012-06-24 23:38 9928704 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-02-21 16:56 . 2012-06-26 01:45 9928704 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-06-24 23:38 7389184 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2012-06-26 01:45 7389184 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:45 . 2012-06-02 17:26 5976658 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2009-07-14 04:45 . 2012-06-25 13:21 5976658 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat + 2011-07-04 20:40 . 2012-06-26 01:44 13652452 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1943473726-2824459890-2441723098-1000-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "HideSCAHealth"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer8"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x] R3 ANTS Memory Profiler 7 Service;ANTS Memory Profiler 7 Service;c:\program files\Red Gate\ANTS Memory Profiler 7\RedGate.Memory.IISService.exe [2012-01-16 164792] R3 ANTS Performance Profiler 6 Service;ANTS Performance Profiler 6 Service;c:\program files\Red Gate\ANTS Performance Profiler 6\RedGate.Profiler.IISService.exe [2012-01-16 145408] R3 AXIOM;Service for M-Audio Axiom;c:\windows\system32\DRIVERS\MAudioAxiom.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-07-04 1431888] R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-07-14 30192] R3 MAUSBPRODUCER;Service for M-Audio Producer;c:\windows\system32\DRIVERS\MAudioProducer.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-14 113120] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 YMIDUSBW;Yamaha USB-MIDI Driver (WDM);c:\windows\system32\drivers\ymidusbx64.sys [x] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-22 61976] R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [x] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 427880] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 3d-io License Server v2.0;3d-io License Server v2.0;c:\program files (x86)\3d-io plugins\licensing_v2\ActiveLockServerV2.exe [2011-03-31 34816] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AxiomAudioDevMon;Axiom Audio Device Monitor;c:\program files (x86)\M-Audio\Axiom\AudioDevMon.exe [2010-02-19 1632776] S2 CodeMeter.exe;CodeMeter Runtime Server;c:\program files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe [2011-07-06 2304912] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x] S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-06-19 8704] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 381248] S2 TabletServiceWacom;TabletServiceWacom;c:\program files\Tablet\Wacom\Wacom_Tablet.exe [2010-11-15 5716848] S3 balancesvc;Propellerhead Balance Driver;c:\windows\system32\DRIVERS\balance.sys [x] S3 BalanceWdmService;Balance Wdm Audio;c:\windows\system32\DRIVERS\BalanceWdm.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26 16:55] . 2012-06-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job - c:\users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-07 20:07] . 2012-06-26 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job - c:\users\Marcos\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-07 20:07] . 2012-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000Core.job - c:\users\Marcos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-29 18:04] . 2012-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1943473726-2824459890-2441723098-1000UA.job - c:\users\Marcos\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-29 18:04] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 16:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Marcos\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs AtiPcie . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\81uu70zs.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1943473726-2824459890-2441723098-1000\Software\SecuROM\License information*] "datasecu"=hex:48,3d,44,b1,2b,cd,bd,b0,f5,3a,d9,c8,ec,44,6a,ec,b4,58,2a,16,52, db,68,43,df,c5,d4,88,4d,46,b1,0d,90,06,67,81,a3,09,55,a5,f7,ab,53,66,40,b0,\ "rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Completion time: 2012-06-25 20:53:31 - machine was rebooted ComboFix-quarantined-files.txt 2012-06-26 01:53 ComboFix2.txt 2012-06-24 23:46 . Pre-Run: 11,788,591,104 bytes free Post-Run: 11,344,064,512 bytes free . - - End Of File - - F705FC6911B0F1952F18C72F83EEFF15