Funmoods removal assistance [Solved]

Hello,

I have recently gotten the funmoods toolbar on my computer. I humbly request your assistance in it's removal (along with any other malware that may be present and shouldn't.) Below are the requisite logs.

OTL logfile created on: 7/14/2012 2:07:52 PM - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\romeoashe\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.85 Gb Available Physical Memory | 42.35% Memory free
4.00 Gb Paging File | 2.52 Gb Available in Paging File | 63.11% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 698.54 Gb Total Space | 184.44 Gb Free Space | 26.40% Space Free | Partition Type: NTFS
Drive E: | 5.54 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ROMEO-PC | User Name: romeoashe | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\romeoashe\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
PRC - C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll ()
MOD - C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Stardock\ObjectDockFree\zlib.dll ()
MOD - C:\Program Files (x86)\Stardock\ObjectDockFree\CrashRpt.dll ()
MOD - C:\Program Files (x86)\Stardock\ObjectDockFree\DockShellHook.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD FUEL Service) – C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD Reservation Manager) – C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe (Advanced Micro Devices)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (vToolbarUpdater11.2.0) – C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe ()
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AVGIDSAgent) – C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVG Security Toolbar Service) – C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (AVGIDSHA) – C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Avgtdia) – C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (Avgldx64) – C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgrkx64) – C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (SBRE) – C:\Windows\SysNative\drivers\SBREDrv.sys (GFI Software)
DRV:64bit: - (Avgmfx64) – C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSFilter) – C:\Windows\SysNative\drivers\avgidsfiltera.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSDriver) – C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (MotioninJoyXFilter) – C:\Windows\SysNative\drivers\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (sptd) – C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (amdiox64) – C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (xnacc) – C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation )
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (mcdbus) – C:\Windows\SysNative\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (mcdbus) – C:\Windows\SysWOW64\drivers\mcdbus.sys (MagicISO, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a;=fmtob…p;cr=1724900466
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}: "URL" = http://start.funmoods.com/results.php?f=4&…p;cr=1724900466
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a;=fmtob…p;cr=1724900466
IE - HKLM\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{095DE46B-2FF1-7C93-8A70-352BAEC12404}: "URL" = http://www.searchqu.com/web?src=ieb≈…q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}: "URL" = http://start.funmoods.com/results.php?f=4&…p;cr=1724900466
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT1060933

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a;=fmtob…p;cr=1724900466
IE - HKCU\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {90eee664-34b1-422a-a782-779af65cdf6d} - No CLSID value found
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,Backup.Old.DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{095DE46B-2FF1-7C93-8A70-352BAEC12404}: "URL" = http://www.searchqu.com/web?src=ieb≈…q={searchTerms}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={0F59786…mp;d=2011-09-25 12:35:13&v;=9.0.0.18&sap;=dsp&q;={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}: "URL" = http://start.funmoods.com/results.php?f=4&…p;cr=1724900466
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT1060933
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredimail.com/mb59/?searc…541763329670175
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..backup.old.browser.search.defaultenginename: "Searchqu Web Search"
FF - prefs.js..backup.old.browser.search.selectedEngine: "IncrediMail MediaBar 4 Customized Web Search"
FF - prefs.js..browser.startup.homepage: "www.yahoo.com"
FF - prefs.js..browser.search.defaultenginename: "Search"
FF - prefs.js..browser.search.defaultthis.engineName: "IncrediMail MediaBar 4 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2878731&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..browser.search.order.1: "Searchqu Web Search"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.yahoo.com"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.260.0
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}:5.0.0.0
FF - prefs.js..extensions.enabledItems: [removed]:1.1.4
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1319
FF - prefs.js..extensions.enabledItems: avg@igeared:6.103.018.001
FF - prefs.js..extensions.enabledItems: [removed]:0.6.20101009
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4b74d716&v;=7.008.031.001&i;=23&tp;=ab&iy;=b&ychte;=us&lng;=en-US&q;="


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@mywebsearch.com/Plugin: File not found
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\romeoashe\AppData\Local\Facebook\Messenger\2.1.4570.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012/05/29 14:01:12 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012/07/09 23:43:40 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/03/24 19:49:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files (x86)\AVG\AVG2012\Firefox\DoNotTrack\ [2012/05/15 18:34:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/16 08:51:18 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/05/25 22:57:27 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/16 08:51:18 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/05/25 22:57:27 | 000,000,000 | —D | M]

[2011/11/03 09:02:56 | 000,000,000 | —D | M] (No name found) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Extensions
[2012/07/07 13:43:56 | 000,000,000 | —D | M] (No name found) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions
[2012/07/03 10:49:52 | 000,000,000 | —D | M] (Bucksbee Loyalty Plugin - Air Installer) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\{003e1c8f-ebd6-f074-7551-4b31c0f547ec}
[2012/05/31 10:18:49 | 000,000,000 | —D | M] (Freecorder Community Toolbar) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}
[2011/04/12 11:17:54 | 000,000,000 | —D | M] (Freecorder Toolbar) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}
[2011/02/24 17:15:22 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/10/29 13:01:26 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]
[2012/07/03 10:50:04 | 000,000,000 | —D | M] (Funmoods.com) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]
[2011/05/12 18:52:50 | 000,000,000 | —D | M] (No name found) – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\nostmp
[2011/10/17 17:41:44 | 000,000,947 | —- | M] () – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\searchplugins\conduit.xml
[2011/10/29 12:59:41 | 000,002,207 | —- | M] () – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\searchplugins\MyStart Search.xml
[2012/07/03 10:50:07 | 000,002,307 | —- | M] () – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\searchplugins\Search.xml
[2011/10/29 13:00:14 | 000,002,520 | —- | M] () – C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\searchplugins\SearchResults.xml
[2012/03/24 19:49:05 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/05/31 23:40:34 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/06/16 08:51:18 | 000,085,472 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/10/03 05:06:04 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/10/26 13:49:56 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012/07/09 23:42:36 | 000,003,767 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/03/12 23:38:32 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/10/29 13:00:14 | 000,002,520 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml
[2012/03/12 23:38:32 | 000,002,040 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://start.funmoods.com/?f=1&a;=fmtob…p;cr=1724900466
CHR - default_search_provider: Web Search (Enabled)
CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&…p;cr=1724900466
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}
CHR - homepage: http://start.funmoods.com/?f=1&a;=fmtob…p;cr=1724900466
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\romeoashe\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.10.0.9560_0\npSkypeChromePlugin.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\romeoashe\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2161_0\plugins/avgnpss.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Facebook Desktop (Enabled) = C:\Users\romeoashe\AppData\Local\Facebook\Messenger\2.1.4570.0\npFbDesktopPlugin.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll

O1 HOSTS File: ([2010/12/19 10:52:48 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Premiumplay Codec-C) - {11111111-1111-1111-1111-110011041135} - C:\Program Files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.dll (WebPicks)
O2 - BHO: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll (Conduit Ltd.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Freecorder Toolbar) - {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll ()
O2 - BHO: (no name) - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - No CLSID value found.
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O2 - BHO: (no name) - Disabled:{02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - Disabled:{66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - No CLSID value found.
O2 - BHO: (no name) - Disabled:{A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found.
O2 - BHO: (no name) - Disabled:{DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (no name) - Disabled:{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Freecorder Toolbar) - {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Freecorder Toolbar) - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ROC_roc_dec12] C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe ()
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [Facebook Update] C:\Users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Users\romeoashe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O8:64bit: - Extra context menu item: &Search; - Reg Error: Value error. File not found
O8 - Extra context menu item: &Search; - Reg Error: Value error. File not found
O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3735079-E34F-4129-92E3-5A3A7E1A1394}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/02/04 04:33:12 | 000,000,000 | —D | M] - E:\AutoRun – [ CDFS ]
O32 - AutoRun File - [2006/02/04 04:33:04 | 000,724,992 | R— | M] (Electronic Arts Inc.) - E:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2006/01/30 21:56:47 | 000,942,080 | R— | M] (Electronic Arts Inc.) - E:\AutoRunGUI.dll – [ CDFS ]
O32 - AutoRun File - [2006/02/04 05:03:19 | 000,000,161 | R— | M] () - E:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{4f4b80f2-33bb-11df-be2c-00306715dac7}\Shell - "" = AutoRun
O33 - MountPoints2\{4f4b80f2-33bb-11df-be2c-00306715dac7}\Shell\AutoRun\command - "" = E:\AutoRun.exe – [2006/02/04 04:33:04 | 000,724,992 | R— | M] (Electronic Arts Inc.)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3filter - C:\Windows\SysWow64\ac3filter.acm ()
Drivers32: msacm.avis - C:\Windows\SysWow64\ff_acm.acm ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/07/14 13:57:54 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Users\romeoashe\Desktop\OTL.exe
[2012/07/12 22:35:13 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2012/07/12 22:35:12 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/07/12 22:35:12 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2012/07/12 22:35:12 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2012/07/12 22:35:11 | 000,130,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieakeng.dll
[2012/07/12 22:35:11 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2012/07/12 22:35:11 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2012/07/12 22:35:10 | 000,367,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2012/07/12 22:35:10 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/07/12 22:35:10 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2012/07/12 22:35:10 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2012/07/12 22:35:10 | 000,063,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2012/07/12 22:35:10 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2012/07/12 22:35:09 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2012/07/12 22:35:09 | 000,434,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2012/07/12 22:35:09 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/07/12 22:35:09 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2012/07/12 22:35:09 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2012/07/12 22:35:09 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2012/07/12 22:35:08 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/07/12 22:35:08 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2012/07/12 22:35:08 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2012/07/12 22:35:08 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2012/07/12 22:35:08 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2012/07/12 22:35:08 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2012/07/12 22:35:07 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/07/12 22:35:07 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2012/07/12 22:35:07 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/07/12 22:35:07 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2012/07/12 22:35:06 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieaksie.dll
[2012/07/12 22:35:06 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieakui.dll
[2012/07/12 22:35:06 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\admparse.dll
[2012/07/12 22:35:06 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2012/07/12 22:35:05 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2012/07/12 22:35:05 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2012/07/12 22:35:04 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/07/12 22:35:04 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2012/07/12 22:35:03 | 000,267,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieaksie.dll
[2012/07/12 22:35:03 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieakui.dll
[2012/07/12 22:35:03 | 000,114,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\admparse.dll
[2012/07/12 22:35:03 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2012/07/12 22:35:03 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2012/07/12 22:35:02 | 002,311,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/07/12 22:35:02 | 000,818,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/07/12 22:35:02 | 000,145,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2012/07/12 22:35:02 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2012/07/12 22:35:02 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2012/07/12 22:35:02 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2012/07/12 22:35:01 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/07/12 22:35:01 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieakeng.dll
[2012/07/12 22:35:01 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2012/07/12 22:35:01 | 000,091,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2012/07/12 22:35:01 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2012/07/12 22:35:01 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2012/07/12 22:35:00 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2012/07/12 22:35:00 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2012/07/12 22:35:00 | 000,452,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2012/07/12 22:35:00 | 000,448,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2012/07/12 22:35:00 | 000,282,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2012/07/12 22:35:00 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2012/07/12 22:35:00 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2012/07/12 22:35:00 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2012/07/12 22:35:00 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2012/07/12 22:34:59 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/07/12 22:34:59 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/07/12 22:34:58 | 000,165,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2012/07/12 22:34:58 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2012/07/12 22:34:58 | 000,103,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2012/07/12 22:34:58 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/07/12 22:34:58 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2012/07/12 22:34:57 | 000,697,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/07/12 22:34:57 | 000,603,648 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/07/10 22:46:55 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msxml3r.dll
[2012/07/10 22:46:55 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msxml3r.dll
[2012/07/10 22:46:43 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2012/07/10 22:46:38 | 001,462,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/07/10 22:46:37 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2012/07/10 22:46:28 | 000,805,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\cdosys.dll
[2012/07/10 22:46:27 | 001,133,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cdosys.dll
[2012/07/09 21:23:26 | 000,000,000 | —D | C] – C:\Users\romeoashe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012/07/07 13:11:48 | 000,000,000 | —D | C] – C:\ComboFix
[2012/07/07 13:11:02 | 000,000,000 | —D | C] – C:\Qoobox
[2012/07/07 13:10:29 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/07/07 13:10:26 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2012/07/06 20:25:13 | 000,057,976 | R— | C] (GFI Software) – C:\Windows\SysNative\drivers\SBREDrv.sys
[2012/07/04 13:52:49 | 000,328,712 | —- | C] (Logitech Inc.) – C:\Windows\SysNative\MijFrc.dll
[2012/07/04 13:52:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MotioninJoy
[2012/06/25 19:33:09 | 000,000,000 | —D | C] – C:\Users\romeoashe\AppData\Local\Chromium
[2012/06/24 23:45:11 | 000,000,000 | —D | C] – C:\ProgramData\Hi-Rez Studios
[2012/06/24 23:44:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hi-Rez Studios
[2012/06/23 20:37:45 | 000,000,000 | —D | C] – C:\Users\romeoashe\AppData\Local\Macromedia
[2012/06/22 08:40:21 | 002,622,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2012/06/22 08:40:21 | 000,057,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2012/06/22 08:40:21 | 000,044,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wups2.dll
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/14 14:13:05 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/07/14 13:58:15 | 000,625,664 | —- | M] () – C:\Users\romeoashe\Desktop\dds.scr
[2012/07/14 13:57:55 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\romeoashe\Desktop\OTL.exe
[2012/07/14 13:45:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/14 12:45:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/14 12:25:01 | 000,000,944 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000UA.job
[2012/07/14 09:17:24 | 101,479,373 | —- | M] () – C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/07/14 08:02:03 | 000,017,360 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 08:02:03 | 000,017,360 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/14 07:54:45 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/07/14 07:54:44 | 1610,063,872 | -HS- | M] () – C:\hiberfil.sys
[2012/07/13 21:25:01 | 000,000,922 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000Core.job
[2012/07/12 22:42:18 | 000,001,441 | —- | M] () – C:\Users\romeoashe\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/07/12 22:35:13 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2012/07/12 22:35:12 | 000,716,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/07/12 22:35:12 | 000,162,304 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2012/07/12 22:35:12 | 000,118,784 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2012/07/12 22:35:11 | 000,130,560 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieakeng.dll
[2012/07/12 22:35:11 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2012/07/12 22:35:11 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2012/07/12 22:35:10 | 000,367,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2012/07/12 22:35:10 | 000,176,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/07/12 22:35:10 | 000,086,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2012/07/12 22:35:10 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2012/07/12 22:35:10 | 000,063,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2012/07/12 22:35:10 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2012/07/12 22:35:09 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2012/07/12 22:35:09 | 000,434,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2012/07/12 22:35:09 | 000,231,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/07/12 22:35:09 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2012/07/12 22:35:09 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2012/07/12 22:35:09 | 000,072,822 | —- | M] () – C:\Windows\SysWow64\ieuinit.inf
[2012/07/12 22:35:09 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2012/07/12 22:35:08 | 001,427,968 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/07/12 22:35:08 | 000,152,064 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2012/07/12 22:35:08 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2012/07/12 22:35:08 | 000,078,848 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2012/07/12 22:35:08 | 000,066,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2012/07/12 22:35:08 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2012/07/12 22:35:07 | 000,142,848 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/07/12 22:35:07 | 000,123,392 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2012/07/12 22:35:07 | 000,073,216 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/07/12 22:35:07 | 000,054,272 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2012/07/12 22:35:06 | 000,227,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieaksie.dll
[2012/07/12 22:35:06 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieakui.dll
[2012/07/12 22:35:06 | 000,101,888 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\admparse.dll
[2012/07/12 22:35:06 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2012/07/12 22:35:05 | 000,222,208 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2012/07/12 22:35:05 | 000,197,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2012/07/12 22:35:04 | 000,173,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/07/12 22:35:04 | 000,149,504 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2012/07/12 22:35:03 | 000,267,776 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieaksie.dll
[2012/07/12 22:35:03 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieakui.dll
[2012/07/12 22:35:03 | 000,114,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\admparse.dll
[2012/07/12 22:35:03 | 000,065,024 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2012/07/12 22:35:03 | 000,012,288 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2012/07/12 22:35:02 | 002,311,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/07/12 22:35:02 | 000,818,688 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/07/12 22:35:02 | 000,145,920 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2012/07/12 22:35:02 | 000,135,168 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2012/07/12 22:35:02 | 000,049,664 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2012/07/12 22:35:02 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2012/07/12 22:35:01 | 000,248,320 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/07/12 22:35:01 | 000,160,256 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieakeng.dll
[2012/07/12 22:35:01 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2012/07/12 22:35:01 | 000,091,648 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2012/07/12 22:35:01 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2012/07/12 22:35:01 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2012/07/12 22:35:00 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2012/07/12 22:35:00 | 000,534,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2012/07/12 22:35:00 | 000,452,608 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2012/07/12 22:35:00 | 000,448,512 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2012/07/12 22:35:00 | 000,282,112 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2012/07/12 22:35:00 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2012/07/12 22:35:00 | 000,085,504 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2012/07/12 22:35:00 | 000,082,432 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2012/07/12 22:35:00 | 000,072,822 | —- | M] () – C:\Windows\SysNative\ieuinit.inf
[2012/07/12 22:35:00 | 000,039,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2012/07/12 22:34:59 | 001,494,528 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/07/12 22:34:59 | 000,237,056 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/07/12 22:34:58 | 000,165,888 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2012/07/12 22:34:58 | 000,160,256 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2012/07/12 22:34:58 | 000,103,936 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2012/07/12 22:34:58 | 000,096,768 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/07/12 22:34:58 | 000,030,720 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2012/07/12 22:34:57 | 000,697,344 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/07/12 22:34:57 | 000,603,648 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/07/12 16:25:18 | 000,000,589 | —- | M] () – C:\Users\romeoashe\Desktop\Apprentice.lnk
[2012/07/11 23:13:39 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/07/11 23:13:39 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/07/11 21:11:12 | 000,275,528 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/07/08 03:45:02 | 000,000,366 | —- | M] () – C:\Windows\tasks\Driver Robot.job
[2012/07/07 22:25:22 | 008,346,016 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/07/07 22:25:22 | 002,719,828 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/07/07 22:25:22 | 000,004,750 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/07/07 17:52:02 | 000,481,674 | —- | M] () – C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/07/07 13:45:43 | 000,000,248 | —- | M] () – C:\Windows\SysNative\drivers\kgpcpy.cfg
[2012/07/03 10:49:45 | 000,302,425 | —- | M] () – C:\Users\romeoashe\AppData\Local\funmoods-speeddial.crx
[2012/07/03 10:49:45 | 000,031,470 | —- | M] () – C:\Users\romeoashe\AppData\Local\funmoods.crx
[2012/06/30 16:56:15 | 000,000,047 | —- | M] () – C:\Windows\SysWow64\_WKERNEL.FRE
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/14 13:58:15 | 000,625,664 | —- | C] () – C:\Users\romeoashe\Desktop\dds.scr
[2012/07/12 22:35:09 | 000,072,822 | —- | C] () – C:\Windows\SysWow64\ieuinit.inf
[2012/07/12 22:35:00 | 000,072,822 | —- | C] () – C:\Windows\SysNative\ieuinit.inf
[2012/07/12 16:24:58 | 000,000,601 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apprentice.lnk
[2012/07/12 16:24:58 | 000,000,589 | —- | C] () – C:\Users\romeoashe\Desktop\Apprentice.lnk
[2012/07/07 13:45:43 | 000,000,248 | —- | C] () – C:\Windows\SysNative\drivers\kgpcpy.cfg
[2012/07/03 10:49:48 | 000,302,425 | —- | C] () – C:\Users\romeoashe\AppData\Local\funmoods-speeddial.crx
[2012/07/03 10:49:48 | 000,031,470 | —- | C] () – C:\Users\romeoashe\AppData\Local\funmoods.crx
[2011/11/24 21:25:11 | 000,000,362 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/11/10 23:29:34 | 000,000,656 | —- | C] () – C:\Users\romeoashe\Romeo.lnk
[2011/10/29 13:00:11 | 000,484,352 | —- | C] () – C:\Windows\SysWow64\lame_enc.dll
[2011/10/29 12:47:56 | 000,003,584 | —- | C] () – C:\Users\romeoashe\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/25 16:34:54 | 000,000,218 | —- | C] () – C:\Users\romeoashe\.recently-used.xbel
[2011/07/07 22:14:26 | 000,109,784 | -H– | C] () – C:\Windows\SysWow64\mlfcache.dat
[2011/06/22 18:21:46 | 000,007,609 | —- | C] () – C:\Users\romeoashe\AppData\Local\resmon.resmoncfg
[2011/06/09 20:30:30 | 000,043,520 | —- | C] () – C:\Windows\SysWow64\CmdLineExt03.dll
[2011/03/18 13:51:18 | 000,002,560 | —- | C] () – C:\Windows\_MSRSTRT.EXE
[2010/12/20 21:27:20 | 000,003,113 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2010/11/21 19:04:59 | 000,070,411 | —- | C] () – C:\Windows\War3Unin.dat
[2010/09/13 23:39:46 | 000,000,359 | —- | C] () – C:\Windows\SIERRA.INI
[2010/06/24 14:41:11 | 000,000,048 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/04/01 06:21:51 | 000,000,000 | —- | C] () – C:\Users\romeoashe\AppData\Local\prvlcl.dat
[2010/02/24 15:02:50 | 000,001,825 | —- | C] () – C:\Users\romeoashe\.gtkrc-2.0

========== LOP Check ==========

[2010/08/02 14:16:18 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\AnvSoft
[2011/09/25 12:34:05 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\AVG2012
[2012/07/07 22:40:28 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Azureus
[2011/01/17 20:28:51 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Big Fish Games
[2011/01/16 17:02:36 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Boomzap
[2010/02/11 22:14:50 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\CheckPoint
[2011/07/29 21:16:48 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Command and Conquer 4
[2010/03/19 19:31:26 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\DAEMON Tools Pro
[2010/02/24 16:52:35 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\devede
[2010/06/22 23:54:36 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\EurekaLog
[2012/03/24 19:50:52 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\FreeBurner
[2011/01/16 16:08:52 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Ghost Ship Studios
[2011/06/13 17:30:09 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\gtk-2.0
[2010/02/24 17:08:15 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\ImgBurn
[2011/01/12 23:01:20 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\LolClient
[2012/05/23 16:54:39 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\LolClient2
[2012/03/24 19:49:58 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\MotioninJoy
[2012/02/23 18:49:17 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\My Battle for Middle-earth™ II Files
[2010/06/28 02:35:05 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\My Games
[2012/03/24 19:39:11 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Opera
[2011/01/20 15:37:41 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Orneon
[2010/06/24 15:41:30 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Philips
[2011/03/18 13:58:57 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Stardock
[2010/06/29 20:09:14 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\TP
[2010/06/28 02:34:11 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\uTorrent
[2010/02/11 22:33:31 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\Win7codecs
[2010/07/13 12:06:14 | 000,000,000 | —D | M] – C:\Users\romeoashe\AppData\Roaming\WinAVI
[2012/07/08 03:45:02 | 000,000,366 | —- | M] () – C:\Windows\Tasks\Driver Robot.job
[2012/07/13 21:25:01 | 000,000,922 | —- | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000Core.job
[2012/07/14 12:25:01 | 000,000,944 | —- | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000UA.job
[2012/04/26 18:24:00 | 000,032,602 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/12/19 12:11:18 | 000,003,232 | —- | M] () – C:\CD3rdPartyWrapper.log
[2012/07/14 07:54:44 | 1610,063,872 | -HS- | M] () – C:\hiberfil.sys
[2012/07/14 07:54:44 | 2146,754,560 | -HS- | M] () – C:\pagefile.sys
[2010/03/19 18:55:52 | 002,073,703 | —- | M] () – C:\VS_EXPBSLN_x64_enu.CAB

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/02/10 00:46:34 | 003,013,120 | —- | M] (KellySoftware) – C:\Windows\Matrix_ks.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/07/12 22:42:18 | 000,000,221 | -HS- | M] () – C:\Users\romeoashe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/12/19 10:44:37 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\romeoashe\Desktop\HijackThis.exe
[2012/07/14 13:57:55 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Users\romeoashe\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:AECF4772
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:A819A132
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:9BAC4211
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:2AE74FF9
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >
OTL Extras logfile created on: 7/14/2012 2:07:52 PM - Run 1
OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\romeoashe\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.85 Gb Available Physical Memory | 42.35% Memory free
4.00 Gb Paging File | 2.52 Gb Available in Paging File | 63.11% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 698.54 Gb Total Space | 184.44 Gb Free Space | 26.40% Space Free | Partition Type: NTFS
Drive E: | 5.54 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: ROMEO-PC | User Name: romeoashe | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – "C:\Program Files (x86)\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS)
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – "C:\Program Files (x86)\File Type Assistant\tsassist.exe" "%1" (Trusted Software ApS)
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01688C53-FA41-4724-B937-7700332FA31F}" = lport=6964 | protocol=17 | dir=in | name=league of legends launcher |
"{035C4400-2217-4B1D-BF8B-55A730633515}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{073D4112-7A94-43F0-B684-6166DF8F8D1C}" = lport=3390 | protocol=6 | dir=in | app=system |
"{087A424C-8192-4219-BD4E-03C3412B12CB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0D83977D-8C53-4F43-9E87-BE3FC33669BF}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{106345AA-03CE-499C-A1E8-80ED82C258E2}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |
"{18138464-99B9-410A-B314-8D7FFD8A7533}" = rport=137 | protocol=17 | dir=out | app=system |
"{202B9262-FEC4-4BDA-8E15-76908E6D9D3D}" = lport=6918 | protocol=6 | dir=in | name=league of legends launcher |
"{20B36765-8829-4548-A6B6-3AC4B211C3A2}" = lport=6954 | protocol=6 | dir=in | name=league of legends launcher |
"{236C75F2-831A-4202-9E51-232A8C35135C}" = rport=138 | protocol=17 | dir=out | app=system |
"{24FE9EB6-B8DE-47A1-A00D-3FD10369BA45}" = lport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{256C6354-F72B-48DE-9405-775D53CCD418}" = lport=3390 | protocol=6 | dir=in | app=system |
"{26BCFAD7-677F-43CC-B830-D9DAE4EE2D0F}" = lport=6899 | protocol=17 | dir=in | name=league of legends launcher |
"{3EEF197F-B3C4-4622-8694-C71C521B1001}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{40154BF5-5EAF-4894-A8FD-3113AB346F30}" = lport=6954 | protocol=17 | dir=in | name=league of legends launcher |
"{410BD8B3-300E-4472-B6A3-D1A7AD9A5757}" = lport=2869 | protocol=6 | dir=in | app=system |
"{44B47EA4-3D33-40DA-AED5-48CBA3B6FB77}" = lport=8383 | protocol=6 | dir=in | name=league of legends launcher |
"{4CF7F048-931D-410F-845F-538012053572}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{51E6B50A-359D-4E57-93DA-A712AC442B7D}" = lport=6918 | protocol=17 | dir=in | name=league of legends launcher |
"{568EF1D4-D5B1-456D-8447-50DDA0F55250}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{57236D9D-8B2F-4DDA-82F5-A13699ED1BD0}" = lport=2869 | protocol=6 | dir=in | app=system |
"{57B943A2-BEDA-468C-BC25-64CE252686DF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5823A911-9436-4F6C-BC27-EB0139429800}" = rport=139 | protocol=6 | dir=out | app=system |
"{5F44EE3B-451F-46B0-B351-ECA7C963B19B}" = lport=6982 | protocol=6 | dir=in | name=league of legends launcher |
"{63441256-77AF-48B4-9CF8-4CB6F51880AC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{64829931-9BA1-41CC-808C-C2FD6A0FFB97}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{68CC7573-483F-4A10-9B29-F31E1CE43377}" = lport=137 | protocol=17 | dir=in | app=system |
"{6A684CAE-0CA1-4648-B3F3-65AF92924366}" = lport=58015 | protocol=6 | dir=in | name=pando media booster |
"{6B1B4278-8757-421D-BAAC-233310C812D6}" = lport=8383 | protocol=17 | dir=in | name=league of legends launcher |
"{78C7ED1D-4BC5-41B8-9EAC-EC7FBC0D5588}" = lport=139 | protocol=6 | dir=in | app=system |
"{79398694-C762-436E-A2B2-F8568AE24CB0}" = lport=10244 | protocol=6 | dir=in | app=system |
"{79AC715B-49EB-4B0C-94BB-33EE50466949}" = lport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{817D4741-C92E-4ACA-9FB9-B8B2F3D11370}" = rport=10243 | protocol=6 | dir=out | app=system |
"{825113ED-3CF8-41DC-B15B-23D78175078A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{829EC7C8-7444-41A6-B8B4-0C83B38513C5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{833BF91B-6363-490B-BFC7-85BA33778D07}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |
"{85948AE4-13E4-4F43-8B81-13A72E022FBC}" = lport=6982 | protocol=17 | dir=in | name=league of legends launcher |
"{89503DFB-B3A8-4D0D-9655-E4F36A3A2E4B}" = lport=10243 | protocol=6 | dir=in | app=system |
"{89E2FB9B-628A-4519-8CE8-33A7AC2DA518}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{8A4923FF-AEFB-4BA6-A39D-42949C7EC909}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{8B1BACC3-B72C-4C72-A9DC-F8F0D7B549E2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9163AEFE-7B8A-4505-8AAB-A9E340CE37BB}" = lport=138 | protocol=17 | dir=in | app=system |
"{9604AA20-275D-4012-AE08-EE18A871DA20}" = lport=58015 | protocol=17 | dir=in | name=pando media booster |
"{983BC361-B2A7-47F6-BE39-54ECB3381ADF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{993CECC2-FACC-46D1-A222-C87E2DF7AA20}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9ACDBDC6-BABE-4934-857F-6C76B6973CE5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{9CA40F38-6BBA-41DE-9F6D-DE94EA709931}" = rport=445 | protocol=6 | dir=out | app=system |
"{A65E0D99-413F-477C-B3B2-CDD47EA3C685}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{AD79E9BE-FF0E-47F8-AC02-6FECA0796152}" = lport=8381 | protocol=6 | dir=in | name=league of legends launcher |
"{AE906EA3-D74B-4F36-BB6B-1ADE007CFE45}" = lport=6964 | protocol=6 | dir=in | name=league of legends launcher |
"{B007721A-FA2F-4612-9627-0CB199E55179}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B1E0DB91-5224-43FC-83A5-643B6635574A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{B2D3776F-9A5F-444F-BE2A-0D38C2ED6544}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B9E2F50B-4A53-497A-A981-BF0976FC6EF8}" = lport=8382 | protocol=6 | dir=in | name=league of legends launcher |
"{BD04AF2D-33F7-48B6-8C05-C06C1621A9A0}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{BFF6B087-D965-4CC5-81DF-4407EB8E2454}" = lport=6899 | protocol=6 | dir=in | name=league of legends launcher |
"{C27B0C56-CEBD-4170-9ABC-84ADC6D14B06}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C46CF211-274B-462E-8516-00C52D62AC56}" = lport=58015 | protocol=17 | dir=in | name=pando media booster |
"{C5268800-0F11-485B-9992-90EE036E580F}" = lport=56737 | protocol=6 | dir=in | name=pando media booster |
"{C5BB0ED0-9412-47DE-AF44-3BB2B7B3FEC3}" = lport=56737 | protocol=6 | dir=in | name=pando media booster |
"{C6014F08-75E2-474F-897C-B44DDA00E8EF}" = lport=56737 | protocol=17 | dir=in | name=pando media booster |
"{CB0D12F1-53CA-4D60-8CCC-DF624BEC7586}" = lport=56737 | protocol=17 | dir=in | name=pando media booster |
"{CE463BF2-303C-4A8A-96BB-D967079F9E40}" = lport=10244 | protocol=6 | dir=in | app=system |
"{D6AB0678-82FF-49E1-8A77-98B89FF3B48A}" = lport=445 | protocol=6 | dir=in | app=system |
"{DBA7846F-E084-4D2E-B0C0-CEB176761161}" = lport=8381 | protocol=17 | dir=in | name=league of legends launcher |
"{DD4E2213-C83B-42FC-BEF7-2F2DDEA5A2DB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{E130FEDE-81BE-4EE6-8D49-D3062779AD2C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{E970F1B7-0161-44DD-A3CD-3AC645CD5CC7}" = lport=8382 | protocol=17 | dir=in | name=league of legends launcher |
"{EB01A697-48C9-407A-9BBA-8A33115F899D}" = lport=58015 | protocol=6 | dir=in | name=pando media booster |
"{EFAC86F4-3BC7-40D7-BDEF-6916D66BCBD3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F00E9D4A-6864-4273-AFA3-0224FD33AD40}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008CDB8F-C358-41F2-9C08-86421773CA11}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{06C1CFF7-C812-45BF-B084-DB884FFAD143}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{09464025-558A-43DB-A175-CEB4132A9181}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgemca.exe |
"{0B662F8F-8C01-4133-8FA0-B6A70D812297}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{0B83D73C-1E90-4621-89A2-314EBB44D3F6}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{0D95E903-8B1F-4FF9-86F8-A3E4F0BE3587}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0DF80DF0-C7EA-47AD-AD86-60FF5417E6A2}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe |
"{245438D2-D109-4B62-83C6-FAFC1F6907D9}" = protocol=6 | dir=out | svc=fdphost | app=c:\windows\system32\svchost.exe |
"{28254D30-C1BE-4037-B7F7-A7CCC9AEA771}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{28E73A31-6336-48EB-81C7-FCF51E8F31B1}" = protocol=6 | dir=in | app=c:\program files (x86)\atari\neverwinter nights 2\nwupdate.exe |
"{2A50F763-793B-4261-B1FF-AD3649D6FFC9}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe |
"{2D54F233-87B5-4A44-9BA8-5765ACC62E24}" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\warlords\civ4warlords.exe |
"{30A09024-0D4F-4481-946C-774E60C3DE24}" = protocol=17 | dir=in | app=c:\program files (x86)\atari\neverwinter nights 2\nwn2main.exe |
"{36B06AE1-B236-4D7F-A9BC-E3BC5E98F772}" = protocol=17 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
"{3C2B5937-269A-4822-9156-C281786EDA7F}" = protocol=17 | dir=in | app=c:\program files (x86)\atari\neverwinter nights 2\nwn2main_amdxp.exe |
"{3F91BCC2-6977-44E0-A742-A22D4025672A}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe |
"{3FF91750-301C-4CBE-B2C0-AD1DD3F33D13}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgemca.exe |
"{401A22C1-13A3-4DC9-93DD-0317E0530B6F}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{4AFA684F-F902-4943-B73A-6FB555CB8933}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe |
"{4D0E0884-E825-47D8-A1EE-26AF4CE16768}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{4D2D5A5D-9178-41EB-909D-3E4D564F66AA}" = protocol=6 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
"{4FCDFCB4-D3EA-4F8A-9474-36FCE9D77E7A}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{578F888A-64C1-486E-8265-6B18931C8EB8}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe |
"{59B35769-7C4E-497E-A865-B8B2879B156A}" = protocol=6 | dir=out | app=c:\windows\ehome\mcrmgr.exe |
"{5A5282C5-088D-4BD0-99DD-96702D4CADE3}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{5F6F9422-FE94-417F-A73A-8049B7021818}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{65C206F9-CFCA-4000-B04D-4179740760CE}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{674630D9-30AD-4F07-AF27-387D9A93D51B}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{68E9BDB0-F386-4689-B134-EECCE3CDEE3E}" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe |
"{6C100B52-0480-4B1A-B38E-D4DC6D14BAF2}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{6C5F952B-C5C4-41F1-9012-15E7AF6418F8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6D6D8175-D72E-41B8-B0EE-BFF3D155A928}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6EE20F93-7737-49EB-BDFD-AD47924FE68E}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe |
"{74756982-6F55-45F0-AB4C-7963D7608B44}" = protocol=17 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |
"{76C2C9C5-A8D5-47F5-AFFE-5DE04B317BB9}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{77E58B2E-1DA4-4A7E-B532-7DDADA84679B}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{7FEA4EC9-C9ED-469D-8EFF-D61878BC5582}" = protocol=6 | dir=in | app=c:\program files (x86)\atari\neverwinter nights 2\nwn2server.exe |
"{8423BD9D-5846-4C6A-8F3A-2C76F89FD1F5}" = protocol=17 | dir=in | app=c:\program files (x86)\atari\neverwinter nights 2\nwn2server.exe |
"{84D422B9-EEA9-491C-BB19-BF6C33CEB905}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{86EA6FBD-B867-420E-A44E-46381FEBA0BA}" = protocol=6 | dir=in | app=c:\program files (x86)\atari\neverwinter nights 2\nwn2main_amdxp.exe |
"{87F8E7A6-AA5D-4B03-9EDB-98E5F5396080}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{88BA28EF-E1B9-4C58-AEBA-66301CD08B04}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\the battle for middle-earth ™ ii\game.dat |
"{8F6DA16C-5545-4312-84D3-DB2D15331630}" = protocol=6 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
"{8FB0FF4D-50E8-4F04-A32B-718379991D9B}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{8FD6212D-2939-4551-B318-D2374DD7548E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{94FDC910-EB21-4021-8646-F196744C58F8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9BB51C21-859C-467B-8C36-CBF7817436B1}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{9DC74DAB-CD56-4752-BD57-7624087E2B91}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{9F332351-90F1-49E8-9443-1D69956F022F}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe |
"{A1597C21-A158-4A72-A09C-DBDFBB1B2484}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{A3276EF2-7C98-444D-AF7C-A53FC678F233}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgemca.exe |
"{B00F22C4-280D-4B46-96E2-4862FC82D19E}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{B4F93328-44D2-4A9D-A8A8-A3A1B2B1D90B}" = protocol=6 | dir=in | app=c:\program files (x86)\atari\neverwinter nights 2\nwn2main.exe |
"{B6097622-F990-429F-9D24-B450C3DBF9BF}" = protocol=6 | dir=out | svc=fdphost | app=c:\windows\system32\svchost.exe |
"{B92D0057-C1A9-425E-8A9E-30DB56A2425C}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe |
"{BC1A766A-4A10-4E81-A265-84B7DF1E9A6E}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\the battle for middle-earth ™ ii\game.dat |
"{BDC37468-5A62-42B0-95C6-4C01EC5BDDC0}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgemca.exe |
"{BF88A00B-E5A3-4C53-9EF8-CE506DFA66D3}" = protocol=17 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
"{C0245F94-0469-4ECF-ACCA-319AB2F7FF5C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C0E1BA0D-7823-452B-BFEC-D4DC2332D6F2}" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\warlords\civ4warlords.exe |
"{C3AD6C51-8EF5-427D-A9B2-149A32FDBDE8}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{C6286EC4-7F43-4EB7-AAD7-3319359399C3}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{C7EA37D6-9F9B-44C4-AB4A-E89FD4B15912}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{CA3DDB9E-FB27-437D-BC3E-737693090601}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{CA996B20-6EB4-4E89-9133-3121B9319A1A}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{CC6FDFB6-AEF9-499A-B565-1BE66AEF8DDA}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe |
"{D03A16D9-60FB-4718-858D-BFBBD246D3EC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D5F4DE24-C21D-42AB-9FE5-B680CDB21FFC}" = protocol=6 | dir=out | app=c:\windows\ehome\mcrmgr.exe |
"{D6CC5312-D2D4-4957-BE7C-332A1B26E716}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{D81C45C5-DC37-4B33-A422-777C39955D72}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe |
"{D94D1A87-29CD-4A94-967B-841A7549C5D5}" = protocol=6 | dir=out | app=system |
"{DF25950D-014D-4425-B142-B97A70D17D65}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DF5796F0-8FAF-4DAD-AC53-3BFA32459687}" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe |
"{EA182A23-88BD-4770-B9B0-775D296C3F3E}" = protocol=17 | dir=in | app=c:\program files (x86)\atari\neverwinter nights 2\nwupdate.exe |
"{EB8F799D-2AD0-4B01-94C7-979C9B9CEB2F}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EBE80CC1-2898-46CE-B23B-22028BE564EB}" = protocol=6 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |
"{EDEA3436-2C6F-4F92-B050-0E7E741BC07F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F1440BF5-73F0-4DB8-BB12-D01D3D8880A7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{FD5336D7-C6F8-49F7-9283-70231B55828F}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"TCP Query User{EA6D08D3-BCB1-48C6-B8FC-258F516414DA}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"UDP Query User{9C1FA30F-288B-4187-94CE-A98B0FF281C5}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{22441735-5983-AD2A-5CC5-FA2CCD7EF732}" = ATI Stream SDK v2 Developer
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy ds3 driver version 0.6.0003
"{3C8159DD-1890-4625-A5B2-E3D8D78D4486}" = AVG 2012
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5E2BDF97-E0C7-75AE-29E1-5EA9DA262F2F}" = WMV9/VC-1 Video Playback
"{6A9B5F9E-CAF3-2264-9DA0-E374F9A34279}" = AMD Drag and Drop Transcoding
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{857B32C1-7C87-40B5-B2A5-D06F49B80002}" = AVG 2012
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{AE57C044-8912-A181-A0E4-BC2DAB3A092A}" = ATI Catalyst Install Manager
"{B2C5B378-546F-75A7-7757-C1EAAFAF9E33}" = ccc-utility64
"{BBA7005D-8C56-FFD3-81AE-D0481829BC70}" = AMD Fuel
"{D9C50188-12D5-4D3E-8F00-682346C2AA5F}" = Microsoft Xbox 360 Accessories 1.2
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"AVG" = AVG 2012
"CCleaner" = CCleaner

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A053D60-9267-11D5-8A2B-0050DA8B7D89}" = Planescape - Torment
"{0E2B767B-EA6A-489B-BF83-8083FE1DB661}" = Pcsx2 0.9.6
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{16F0EE77-B2B1-4417-A8CC-07E06C78CCC4}" = Matrix-ks
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 29
"{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}" = The Battle for Middle-earth ™ II
"{2C13F8C1-570B-42A9-87B4-8C7903ECD602}" = ObjectDock Free
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3E4B349F-10B5-4586-9D99-489A90A8B228}" = Sid Meier's Civilization 4 - Warlords
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4925C0C2-E4E2-456B-9791-0F228BDDC428}" = Facebook Messenger 2.1.4570.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5FD89EA1-99C2-40EE-BBF5-20F8991ED756}" = Catalyst Control Center - Branding
"{664D6E1D-2A6C-D54D-31A5-B6BC30CEB0C6}" = CCC Help English
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7B9F5775-8C8C-2A4E-0CAB-74EA7AF5CB09}" = ccc-core-static
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A0B0BCE9-2994-36F2-BE66-D23C884372E8}" = Visual C++ 9.0 OpenMP (x86) WinSXS MSM
"{A1DD0268-4069-4D39-B6D2-E00DB50CA9C4}" = League of Legends
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA2EBBCC-4E3B-3442-865E-7BB3E9F45F0C}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{AA945C94-285E-DE48-A30F-70105C6580DE}" = Catalyst Control Center Graphics Previews Common
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.6
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B46C6F8A-D818-4E4B-B0A0-C9BEE1B535E9}" = DeVeDe
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{CC29B835-95A5-3CD9-087B-F94D7B9ECC9B}" = Catalyst Control Center InstallProxy
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{EB5BA578-FF7F-3863-8E53-7A003222B7FC}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{EB6C11E5-449C-3BA3-9086-80B18BCFF947}" = Visual C++ 9.0 OpenMP (x86) WinSXS MSM
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F20C1251-1D0A-4944-B2AE-678581B33B19}" = Neverwinter Nights 2
"{FC274982-5AAD-4C20-848D-4424A5043010}_is1" = WinUtilities 10.44 Free Edition
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"7-Zip" = 7-Zip 4.65
"8461-7759-5462-8226" = Vuze
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Any Video Converter_is1" = Any Video Converter 3.0.7
"conduitEngine" = Conduit Engine
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup" = DivX Setup
"DOSBox" = DOSBox 0.73 Installer
"Free Easy Burner_is1" = Free Easy Burner V 5.0
"Freecorder 5.0" = Freecorder 5
"Freecorder Toolbar" = Freecorder Toolbar
"Freecorder4.02B" = Freecorder 4.02B Application
"Freecorder5.05" = Freecorder 5
"freecordertoolbar" = Freecorder Toolbar
"gBurner" = gBurner
"Google Chrome" = Google Chrome
"ImgBurn" = ImgBurn
"InstaCodecs_is1" = InstaCodecs
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"ObjectDock Free" = ObjectDock Free
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"pcsx2-r3878" = PCSX2 - Playstation 2 Emulator
"Premiumplay Codec-C" = Premiumplay Codec-C
"QFG5: Dragon Fire" = Quest for Glory V: Dragon Fire
"Quest for Glory IV: Shadows of Darkness" = Quest for Glory IV: Shadows of Darkness
"Sierra Utilities" = Sierra Utilities
"SpeedFan" = SpeedFan (remove only)
"Trusted Software Assistant_is1" = File Type Assistant
"Veoh Web Player Beta" = Veoh Web Player
"Vuze_Remote Toolbar" = Vuze Remote Toolbar
"Warcraft III" = Warcraft III
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Quest for Glory II" = Quest for Glory IIstall Information
"Warcraft III" = Warcraft III: All Products
"Winamp Detect" = Winamp Detector Plug-in

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 12/31/2011 2:45:21 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. The BaseIndex value from the
Performance registry is the first DWORD in the Data section, LastCounter value
is the second DWORD in the Data section, and LastHelp value is the third DWORD in
the Data section.

Error - 12/31/2011 2:45:21 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The first DWORD in the Data section contains the error code.

Error - 1/1/2012 2:56:57 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. The BaseIndex value from the
Performance registry is the first DWORD in the Data section, LastCounter value
is the second DWORD in the Data section, and LastHelp value is the third DWORD in
the Data section.

Error - 1/1/2012 2:56:57 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The first DWORD in the Data section contains the error code.

Error - 1/2/2012 5:13:19 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. The BaseIndex value from the
Performance registry is the first DWORD in the Data section, LastCounter value
is the second DWORD in the Data section, and LastHelp value is the third DWORD in
the Data section.

Error - 1/2/2012 5:13:19 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The first DWORD in the Data section contains the error code.

Error - 1/3/2012 5:06:17 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = The performance strings in the Performance registry value is corrupted
when process Performance extension counter provider. The BaseIndex value from the
Performance registry is the first DWORD in the Data section, LastCounter value
is the second DWORD in the Data section, and LastHelp value is the third DWORD in
the Data section.

Error - 1/3/2012 5:06:17 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The first DWORD in the Data section contains the error code.

Error - 1/4/2012 3:15:10 AM | Computer Name = Romeo-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Civ4Warlords.exe, version: 2.1.3.0, time
stamp: 0x464b927a Faulting module name: Civ4Warlords.exe, version: 2.1.3.0, time
stamp: 0x464b927a Exception code: 0xc0000005 Fault offset: 0x000e057b Faulting process
id: 0x1314 Faulting application start time: 0x01cccab07d96638e Faulting application
path: C:\Program Files (x86)\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe
Faulting
module path: C:\Program Files (x86)\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe
Report
Id: d63709f0-36a3-11e1-9972-00306715dac7

Error - 1/4/2012 3:15:35 AM | Computer Name = Romeo-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Civ4Warlords.exe, version: 2.1.3.0, time
stamp: 0x464b927a Faulting module name: Civ4Warlords.exe, version: 2.1.3.0, time
stamp: 0x464b927a Exception code: 0xc0000005 Fault offset: 0x000e057b Faulting process
id: 0x1064 Faulting application start time: 0x01cccab0a398c495 Faulting application
path: C:\Program Files (x86)\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe
Faulting
module path: C:\Program Files (x86)\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe
Report
Id: e4ce5825-36a3-11e1-9972-00306715dac7

[ Media Center Events ]
Error - 11/24/2011 10:25:39 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-Media Center Extender | ID = 539
Description =

Error - 11/24/2011 10:27:35 PM | Computer Name = Romeo-PC | Source = Microsoft-Windows-Media Center Extender | ID = 538
Description =

Error - 11/25/2011 1:39:17 PM | Computer Name = Romeo-PC | Source = MCUpdate | ID = 0
Description = 11:39:12 AM - Error connecting to the internet. 11:39:12 AM - Unable
to contact server..

[ System Events ]
Error - 7/13/2012 11:40:06 AM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7000
Description = The Sftfs service failed to start due to the following error: %%31

Error - 7/13/2012 11:40:06 AM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7001
Description = The Application Virtualization Client service depends on the Sftfs
service which failed to start because of the following error: %%31

Error - 7/13/2012 11:40:06 AM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7001
Description = The Client Virtualization Handler service depends on the Application
Virtualization Client service which failed to start because of the following error:
%%1068

Error - 7/13/2012 7:41:59 PM | Computer Name = Romeo-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 1:43:07 PM on ?7/?13/?2012 was unexpected.

Error - 7/13/2012 7:42:00 PM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7000
Description = The Sftfs service failed to start due to the following error: %%31

Error - 7/13/2012 7:42:00 PM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7001
Description = The Application Virtualization Client service depends on the Sftfs
service which failed to start because of the following error: %%31

Error - 7/13/2012 7:42:00 PM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7001
Description = The Client Virtualization Handler service depends on the Application
Virtualization Client service which failed to start because of the following error:
%%1068

Error - 7/14/2012 8:54:47 AM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7000
Description = The Sftfs service failed to start due to the following error: %%31

Error - 7/14/2012 8:54:47 AM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7001
Description = The Application Virtualization Client service depends on the Sftfs
service which failed to start because of the following error: %%31

Error - 7/14/2012 8:54:47 AM | Computer Name = Romeo-PC | Source = Service Control Manager | ID = 7001
Description = The Client Virtualization Handler service depends on the Application
Virtualization Client service which failed to start because of the following error:
%%1068


< End of report >

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:26:29 PM, on 7/14/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\romeoashe\Desktop\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=fmtob…p;cr=1724900466
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=fmtob…p;cr=1724900466
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
R3 - URLSearchHook: (no name) - {90eee664-34b1-422a-a782-779af65cdf6d} - (no file)
O2 - BHO: (no name) - Disabled:{02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - Disabled:{66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - (no file)
O2 - BHO: (no name) - Disabled:{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: (no name) - Disabled:{DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: (no name) - Disabled:{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - (no file)
O2 - BHO: CrossriderApp0000435 - {11111111-1111-1111-1111-110011041135} - C:\Program Files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.dll
O2 - BHO: Freecorder - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
O2 - BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
O2 - BHO: Freecorder Toolbar - {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll
O2 - BHO: Funmoods Helper Object - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - (no file)
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Vuze Remote - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: Freecorder Toolbar - {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
O3 - Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - (no file)
O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
O3 - Toolbar: (no name) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - (no file)
O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
O9 - Extra button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: AMD Reservation Manager - Advanced Micro Devices - C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater11.2.0 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 11122 bytes


.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by [removed] at 14:19:14.03 on Sat 07/14/2012
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2047.831 [GMT -5:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG2012\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgemca.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\Stardock\ObjectDockFree\Dock64.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\romeoashe\Desktop\dds.scr
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466
mDefault_Page_URL = hxxp://www.yahoo.com
mStart Page = hxxp://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466
uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
uURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
uURLSearchHooks: H - No File
mURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
mURLSearchHooks: H - No File
BHO: Disabled:{02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Disabled:{66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - No File
BHO: Disabled:{A3BC75A2-1F87-4686-AA43-5347D756017C} - No File
BHO: Disabled:{DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO: Disabled:{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - No File
BHO: Premiumplay Codec-C: {11111111-1111-1111-1111-110011041135} - C:\Program Files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.dll
BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
BHO: AVG Do Not Track: {31332eef-cb9f-458f-afeb-d30e9a66b6ba} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: Freecorder Toolbar: {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll
BHO: {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - No File
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
TB: Freecorder Toolbar: {70dd86e8-b5bc-4e4a-9d5c-b6234c24323c} - C:\Program Files (x86)\freecordertoolbar\vmntemplateX.dll
TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
TB: {99079a25-328f-4bd4-be04-00955acaa0a7} - No File
TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
TB: {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - No File
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [Facebook Update] "C:\Users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
mRun: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
StartupFolder: C:\Users\ROMEOA~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\STARDO~1.LNK - C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Search
IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
AppInit_DLLs:
BHO-X64: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll
BHO-X64: AVG Do Not Track - No File
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
TB-X64: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB-X64: {BA14329E-9550-4989-B3F2-9732E92D17CC} - No File
TB-X64: {1392B8D2-5C05-419F-A8F6-B9F15A596612} - No File
TB-X64: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
mRun-x64: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
AppInit_DLLs-X64:
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\ROMEOA~1\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2878731&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4b74d716&v=7.008.031.001&i=23&tp=ab&iy=b&ychte=us&lng=en-US&q=
FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff4.dll
FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\components\TrustCheckerMozillaPlugin.dll
FF - component: C:\Users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}\components\dtTransparency.dll
FF - plugin: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\npsitesafety.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Users\romeoashe\AppData\Local\Facebook\Messenger\2.1.4570.0\npFbDesktopPlugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
.
—- FIREFOX POLICIES —-
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
FF - user.js: extensions.funmoods.hmpg - true
FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466
FF - user.js: extensions.funmoods.dfltSrch - true
FF - user.js: extensions.funmoods.srchPrvdr - Search
FF - user.js: extensions.funmoods.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466
FF - user.js: extensions.funmoods.tlbrSrchUrl -
FF - user.js: extensions.funmoods.id - 00f6c61c00000000000000306715dac7
FF - user.js: extensions.funmoods.instlDay - 15524
FF - user.js: extensions.funmoods.vrsn - 1.5.23.22
FF - user.js: extensions.funmoods.vrsni - 1.5.23.22
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2210:49:44
FF - user.js: extensions.funmoods.prtnrId - funmoods
FF - user.js: extensions.funmoods.prdct - funmoods
FF - user.js: extensions.funmoods.aflt - fmtoby
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods.tlbrId - base
FF - user.js: extensions.funmoods.instlRef - fmtoby
FF - user.js: extensions.funmoods.dfltLng -
FF - user.js: extensions.funmoods.excTlbr - false
FF - user.js: extensions.funmoods.autoRvrt - false
FF - user.js: extensions.funmoods.envrmnt - production
FF - user.js: extensions.funmoods.isdcmntcmplt - true
FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-4-19 28480]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2012-1-31 36944]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-2-22 289872]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2011-12-23 47696]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-3-19 383808]
R1 SBRE;SBRE;C:\Windows\System32\drivers\SBREDrv.sys [2012-7-6 57976]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-1-26 203776]
R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-1-26 354304]
R2 AMD Reservation Manager;AMD Reservation Manager;C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-6-17 194496]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe [2012-4-30 5106744]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-2-14 193288]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [2012-7-9 935008]
R3 amdiox64;AMD IO Driver;C:\Windows\System32\drivers\amdiox64.sys [2011-2-22 46136]
R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2011-1-26 9085952]
R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2011-1-26 299520]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2010-11-17 115216]
R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2011-12-23 124496]
R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\System32\drivers\avgidsfiltera.sys [2011-12-23 29776]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-6-10 187392]
R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2009-12-2 269672]
R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2009-12-2 22376]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-2 209768]
S2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-17 135664]
S2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-2 483688]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-5-3 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-3-30 250056]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-4-25 1025352]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-17 135664]
S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;C:\Windows\System32\drivers\MijXfilt.sys [2011-11-7 117520]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-5 113120]
S3 nosGetPlusHelper;getPlus® Helper 3004;C:\Windows\System32\svchost.exe -k nosGetPlusHelper [2009-7-13 27136]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2011-6-23 20992]
S3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2009-12-2 721768]
S3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2009-12-2 25960]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-23 59392]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-3-4 1255736]
.
=============== Created Last 30 ================
.
2012-07-13 03:34:59 455680 —-a-w- C:\Program Files\Internet Explorer\networkinspection.dll
2012-07-11 05:55:00 3148800 —-a-w- C:\Windows\System32\win32k.sys
2012-07-07 18:11:48 ——– d—–w- C:\ComboFix
2012-07-07 01:25:13 57976 —-a-r- C:\Windows\System32\drivers\SBREDrv.sys
2012-07-04 18:52:49 328712 —-a-w- C:\Windows\System32\MijFrc.dll
2012-06-26 00:33:09 ——– d—–w- C:\Users\ROMEOA~1\AppData\Local\Chromium
2012-06-25 04:45:11 ——– d—–w- C:\PROGRA~3\Hi-Rez Studios
2012-06-25 04:44:53 ——– d—–w- C:\Program Files (x86)\Hi-Rez Studios
2012-06-24 01:37:45 ——– d—–w- C:\Users\ROMEOA~1\AppData\Local\Macromedia
2012-06-22 13:40:21 2622464 —-a-w- C:\Windows\System32\wucltux.dll
.
==================== Find3M ====================
.
2012-07-13 03:34:59 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2012-07-13 03:34:58 30720 —-a-w- C:\Windows\System32\licmgr10.dll
2012-07-13 03:34:58 165888 —-a-w- C:\Windows\System32\iexpress.exe
2012-07-13 03:34:58 160256 —-a-w- C:\Windows\System32\wextract.exe
2012-07-13 03:34:57 603648 —-a-w- C:\Windows\System32\vbscript.dll
2012-07-12 04:13:39 70344 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-12 04:13:39 426184 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-06-06 06:06:16 2004480 —-a-w- C:\Windows\System32\msxml6.dll
2012-06-06 06:06:16 1881600 —-a-w- C:\Windows\System32\msxml3.dll
2012-06-06 06:02:54 1133568 —-a-w- C:\Windows\System32\cdosys.dll
2012-06-06 05:05:52 1390080 —-a-w- C:\Windows\SysWow64\msxml6.dll
2012-06-06 05:05:52 1236992 —-a-w- C:\Windows\SysWow64\msxml3.dll
2012-06-06 05:03:06 805376 —-a-w- C:\Windows\SysWow64\cdosys.dll
2012-06-02 22:15:08 99840 —-a-w- C:\Windows\System32\wudriver.dll
2012-06-02 20:19:42 186752 —-a-w- C:\Windows\System32\wuwebv.dll
2012-06-02 20:15:12 36864 —-a-w- C:\Windows\System32\wuapp.exe
2012-06-02 05:50:10 458704 —-a-w- C:\Windows\System32\drivers\cng.sys
2012-06-02 05:48:16 95600 —-a-w- C:\Windows\System32\drivers\ksecdd.sys
2012-06-02 05:48:16 151920 —-a-w- C:\Windows\System32\drivers\ksecpkg.sys
2012-06-02 05:45:31 340992 —-a-w- C:\Windows\System32\schannel.dll
2012-06-02 05:44:21 307200 —-a-w- C:\Windows\System32\ncrypt.dll
2012-06-02 04:40:42 22016 —-a-w- C:\Windows\SysWow64\secur32.dll
2012-06-02 04:40:39 225280 —-a-w- C:\Windows\SysWow64\schannel.dll
2012-06-02 04:39:10 219136 —-a-w- C:\Windows\SysWow64\ncrypt.dll
2012-06-02 04:34:09 96768 —-a-w- C:\Windows\SysWow64\sspicli.dll
2012-05-04 11:06:22 5559664 —-a-w- C:\Windows\System32\ntoskrnl.exe
2012-05-04 10:03:53 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03:50 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-04-28 05:32:05 1112064 —-a-w- C:\Windows\System32\rdpcorets.dll
2012-04-28 03:55:21 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-04-26 05:41:56 77312 —-a-w- C:\Windows\System32\rdpwsx.dll
2012-04-26 05:41:55 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll
2012-04-26 05:34:27 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe
2012-04-24 05:37:37 184320 —-a-w- C:\Windows\System32\cryptsvc.dll
2012-04-24 05:37:37 140288 —-a-w- C:\Windows\System32\cryptnet.dll
2012-04-24 05:37:36 1462272 —-a-w- C:\Windows\System32\crypt32.dll
2012-04-24 04:36:42 140288 —-a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-04-24 04:36:42 1158656 —-a-w- C:\Windows\SysWow64\crypt32.dll
2012-04-24 04:36:42 103936 —-a-w- C:\Windows\SysWow64\cryptnet.dll
2012-04-19 09:50:26 28480 —-a-w- C:\Windows\System32\drivers\avgidsha.sys
2012-04-19 01:56:30 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2012-04-19 01:56:30 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts
.
============= FINISH: 14:19:36.90 ===============

Hi,

Please download aswMBR.exe and save it to your desktop.

• Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)
• Allow it to update where necessary
• Click Scan
  
  
• Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
• You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

===================================================

Please download TDSSKiller.zip and and extract it.

• Run TDSSKiller.exe.
• Click on Change Parameters
• Put a check in the box of Detect TDLFS file system
• Click Start scan.
• When it is finished the utility outputs a list of detected objects with description.
  The utility automatically selects an action (Cure or Delete) for malicious objects.
  The utility prompts the user to select an action to apply to suspicious objects (Skip, by default). Let the options as it is and click Continue
• Let reboot if needed and tell me if the tool needed a reboot.
• Click on Report and post the contents of the text file that will open.
  
  Note: By default, the utility outputs the log into system disk (it is usually the disk with installed operating system, C:\) root folder. The Log have a name like: TDSSKiller.Version_Date_Time_log.txt.

===================================================

On your next reply please post :
aswMBR log
TDSS Killer log


Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Your assistance is greatly appreciated Conspire. Here are the logs you requested. aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-07-15 00:39:42 —————————– 00:39:42.751 OS Version: Windows x64 6.1.7601 Service Pack 1 00:39:42.751 Number of processors: 4 586 0x402 00:39:42.751 ComputerName: ROMEO-PC UserName: 00:39:46.321 Initialize success 00:40:57.748 AVAST engine defs: 12071402 00:41:08.136 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T1L0-4 00:41:08.138 Disk 0 Vendor: WDC_WD7501AALS-00E8B0 05.00K05 Size: 715404MB BusType: 3 00:41:08.155 Disk 0 MBR read successfully 00:41:08.157 Disk 0 MBR scan 00:41:08.162 Disk 0 Windows 7 default MBR code 00:41:08.172 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 00:41:08.178 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 715302 MB offset 206848 00:41:08.196 Disk 0 scanning C:\Windows\system32\drivers 00:41:19.188 Service scanning 00:41:38.610 Modules scanning 00:41:38.616 Disk 0 trace - called modules: 00:41:38.624 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80018872c0]< \Device\Harddisk0\DR0[0xfffffa8002999060] 00:41:38.632 3 CLASSPNP.SYS[fffff8800181743f] -> nt!IofCallDriver -> [0xfffffa80026ef9b0] 00:41:38.640 5 ACPI.sys[fffff8800118a7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T1L0-4[0xfffffa8002767680] 00:41:38.645 \Driver\atapi[0xfffffa80026ca980] -> IRP_MJ_CREATE -> 0xfffffa80018872c0 00:41:41.380 AVAST engine scan C:\Windows 00:41:44.528 AVAST engine scan C:\Windows\system32 00:44:51.520 AVAST engine scan C:\Windows\system32\drivers 00:45:05.934 AVAST engine scan C:\Users\romeoashe 00:50:08.840 AVAST engine scan C:\ProgramData 00:51:45.139 Scan finished successfully 00:51:52.814 Disk 0 MBR has been saved successfully to "C:\Users\romeoashe\Desktop\MBR.dat" 00:51:52.814 The log file has been saved successfully to "C:\Users\romeoashe\Desktop\aswMBR.txt" TDSSKiller did not require a reboot. 00:53:13.0204 4452 TDSS rootkit removing tool 2.7.45.0 Jul 9 2012 12:46:35 00:53:13.0531 4452 ============================================================ 00:53:13.0531 4452 Current date / time: 2012/07/15 00:53:13.0531 00:53:13.0531 4452 SystemInfo: 00:53:13.0531 4452 00:53:13.0531 4452 OS Version: 6.1.7601 ServicePack: 1.0 00:53:13.0531 4452 Product type: Workstation 00:53:13.0531 4452 ComputerName: ROMEO-PC 00:53:13.0531 4452 UserName: romeoashe 00:53:13.0531 4452 Windows directory: C:\Windows 00:53:13.0531 4452 System windows directory: C:\Windows 00:53:13.0531 4452 Running under WOW64 00:53:13.0531 4452 Processor architecture: Intel x64 00:53:13.0531 4452 Number of processors: 4 00:53:13.0531 4452 Page size: 0x1000 00:53:13.0531 4452 Boot type: Normal boot 00:53:13.0531 4452 ============================================================ 00:53:15.0591 4452 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x540BE, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040 00:53:15.0606 4452 ============================================================ 00:53:15.0606 4452 \Device\Harddisk0\DR0: 00:53:15.0606 4452 MBR partitions: 00:53:15.0606 4452 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 00:53:15.0606 4452 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x57513000 00:53:15.0606 4452 ============================================================ 00:53:15.0684 4452 C: <-> \Device\Harddisk0\DR0\Partition1 00:53:15.0747 4452 ============================================================ 00:53:15.0747 4452 Initialize success 00:53:15.0747 4452 ============================================================ 00:53:46.0276 4352 ============================================================ 00:53:46.0276 4352 Scan started 00:53:46.0276 4352 Mode: Manual; TDLFS; 00:53:46.0276 4352 ============================================================ 00:53:46.0806 4352 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 00:53:46.0822 4352 1394ohci - ok 00:53:46.0869 4352 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 00:53:46.0869 4352 ACPI - ok 00:53:46.0915 4352 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 00:53:46.0915 4352 AcpiPmi - ok 00:53:47.0040 4352 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 00:53:47.0040 4352 AdobeFlashPlayerUpdateSvc - ok 00:53:47.0087 4352 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 00:53:47.0087 4352 adp94xx - ok 00:53:47.0118 4352 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 00:53:47.0118 4352 adpahci - ok 00:53:47.0165 4352 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 00:53:47.0165 4352 adpu320 - ok 00:53:47.0196 4352 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 00:53:47.0196 4352 AeLookupSvc - ok 00:53:47.0243 4352 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 00:53:47.0259 4352 AFD - ok 00:53:47.0274 4352 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 00:53:47.0290 4352 agp440 - ok 00:53:47.0290 4352 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 00:53:47.0290 4352 ALG - ok 00:53:47.0305 4352 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 00:53:47.0305 4352 aliide - ok 00:53:47.0337 4352 AMD External Events Utility (5eba5e837d6635aea999bae47e186c6f) C:\Windows\system32\atiesrxx.exe 00:53:47.0337 4352 AMD External Events Utility - ok 00:53:47.0399 4352 AMD FUEL Service - ok 00:53:47.0446 4352 AMD Reservation Manager (dd27f6c3de9bfe50635c721e09edc5dd) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe 00:53:47.0446 4352 AMD Reservation Manager - ok 00:53:47.0461 4352 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 00:53:47.0461 4352 amdide - ok 00:53:47.0477 4352 amdiox64 (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys 00:53:47.0477 4352 amdiox64 - ok 00:53:47.0493 4352 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 00:53:47.0493 4352 AmdK8 - ok 00:53:47.0961 4352 amdkmdag (dcc8177244fe79c61c4e73c65e63922a) C:\Windows\system32\DRIVERS\atikmdag.sys 00:53:48.0070 4352 amdkmdag - ok 00:53:48.0163 4352 amdkmdap (7fe67d107329dc2cf89136a8e19bceb7) C:\Windows\system32\DRIVERS\atikmpag.sys 00:53:48.0163 4352 amdkmdap - ok 00:53:48.0195 4352 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 00:53:48.0195 4352 AmdPPM - ok 00:53:48.0226 4352 amdsata (6ec6d772eae38dc17c14aed9b178d24b) C:\Windows\system32\drivers\amdsata.sys 00:53:48.0226 4352 amdsata - ok 00:53:48.0241 4352 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 00:53:48.0257 4352 amdsbs - ok 00:53:48.0257 4352 amdxata (1142a21db581a84ea5597b03a26ebaa0) C:\Windows\system32\drivers\amdxata.sys 00:53:48.0273 4352 amdxata - ok 00:53:48.0335 4352 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 00:53:48.0335 4352 AppID - ok 00:53:48.0366 4352 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 00:53:48.0366 4352 AppIDSvc - ok 00:53:48.0397 4352 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll 00:53:48.0397 4352 Appinfo - ok 00:53:48.0429 4352 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll 00:53:48.0429 4352 AppMgmt - ok 00:53:48.0444 4352 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 00:53:48.0460 4352 arc - ok 00:53:48.0475 4352 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 00:53:48.0475 4352 arcsas - ok 00:53:48.0491 4352 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 00:53:48.0491 4352 AsyncMac - ok 00:53:48.0522 4352 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 00:53:48.0522 4352 atapi - ok 00:53:48.0585 4352 AtiHDAudioService (4bf5bca6e2608cd8a00bc4a6673a9f47) C:\Windows\system32\drivers\AtihdW76.sys 00:53:48.0585 4352 AtiHDAudioService - ok 00:53:48.0616 4352 AtiHdmiService (d481083348138b4933acfe95812db71c) C:\Windows\system32\drivers\AtiHdmi.sys 00:53:48.0616 4352 AtiHdmiService - ok 00:53:48.0678 4352 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 00:53:48.0678 4352 AudioEndpointBuilder - ok 00:53:48.0678 4352 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 00:53:48.0694 4352 AudioSrv - ok 00:53:48.0897 4352 AVG Security Toolbar Service (124d235185004f699faf115ebd85733e) C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe 00:53:48.0897 4352 AVG Security Toolbar Service - ok 00:53:49.0193 4352 AVGIDSAgent (ba60fd7a64b9759a14c0fba4a9ed4c7b) C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe 00:53:49.0255 4352 AVGIDSAgent - ok 00:53:49.0380 4352 AVGIDSDriver (1b2e9fcdc26dc7c81d4131430e2dc936) C:\Windows\system32\DRIVERS\avgidsdrivera.sys 00:53:49.0380 4352 AVGIDSDriver - ok 00:53:49.0411 4352 AVGIDSFilter (0f293406f64b48d5d2f0d3a1117f3a83) C:\Windows\system32\DRIVERS\avgidsfiltera.sys 00:53:49.0411 4352 AVGIDSFilter - ok 00:53:49.0443 4352 AVGIDSHA (cffc3a4a638f462e0561cb368b9a7a3a) C:\Windows\system32\DRIVERS\avgidsha.sys 00:53:49.0443 4352 AVGIDSHA - ok 00:53:49.0521 4352 Avgldx64 (59955b4c288dd2a8b9fd2cd5158355c5) C:\Windows\system32\DRIVERS\avgldx64.sys 00:53:49.0521 4352 Avgldx64 - ok 00:53:49.0552 4352 Avgmfx64 (a6aec362aae5e2dda7445e7690cb0f33) C:\Windows\system32\DRIVERS\avgmfx64.sys 00:53:49.0552 4352 Avgmfx64 - ok 00:53:49.0614 4352 Avgrkx64 (645c7f0a0e39758a0024a9b1748273c0) C:\Windows\system32\DRIVERS\avgrkx64.sys 00:53:49.0614 4352 Avgrkx64 - ok 00:53:49.0645 4352 Avgtdia (1bee674ad792b1c63bb0dac5fa724b23) C:\Windows\system32\DRIVERS\avgtdia.sys 00:53:49.0645 4352 Avgtdia - ok 00:53:49.0801 4352 avgwd (ea1145debcd508fd25bd1e95c4346929) C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe 00:53:49.0801 4352 avgwd - ok 00:53:49.0848 4352 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll 00:53:49.0848 4352 AxInstSV - ok 00:53:49.0895 4352 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 00:53:49.0911 4352 b06bdrv - ok 00:53:49.0926 4352 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 00:53:49.0926 4352 b57nd60a - ok 00:53:49.0957 4352 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 00:53:49.0957 4352 BDESVC - ok 00:53:49.0957 4352 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 00:53:49.0957 4352 Beep - ok 00:53:50.0067 4352 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll 00:53:50.0067 4352 BFE - ok 00:53:50.0129 4352 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll 00:53:50.0145 4352 BITS - ok 00:53:50.0176 4352 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 00:53:50.0176 4352 blbdrive - ok 00:53:50.0223 4352 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 00:53:50.0238 4352 bowser - ok 00:53:50.0238 4352 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 00:53:50.0238 4352 BrFiltLo - ok 00:53:50.0254 4352 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 00:53:50.0254 4352 BrFiltUp - ok 00:53:50.0285 4352 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll 00:53:50.0285 4352 Browser - ok 00:53:50.0301 4352 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 00:53:50.0301 4352 Brserid - ok 00:53:50.0316 4352 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 00:53:50.0316 4352 BrSerWdm - ok 00:53:50.0316 4352 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 00:53:50.0316 4352 BrUsbMdm - ok 00:53:50.0332 4352 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 00:53:50.0332 4352 BrUsbSer - ok 00:53:50.0347 4352 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 00:53:50.0347 4352 BTHMODEM - ok 00:53:50.0363 4352 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 00:53:50.0363 4352 bthserv - ok 00:53:50.0379 4352 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 00:53:50.0379 4352 cdfs - ok 00:53:50.0410 4352 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 00:53:50.0410 4352 cdrom - ok 00:53:50.0472 4352 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 00:53:50.0472 4352 CertPropSvc - ok 00:53:50.0488 4352 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 00:53:50.0488 4352 circlass - ok 00:53:50.0503 4352 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 00:53:50.0519 4352 CLFS - ok 00:53:50.0550 4352 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 00:53:50.0550 4352 clr_optimization_v2.0.50727_32 - ok 00:53:50.0581 4352 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 00:53:50.0581 4352 clr_optimization_v2.0.50727_64 - ok 00:53:50.0597 4352 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 00:53:50.0597 4352 CmBatt - ok 00:53:50.0628 4352 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 00:53:50.0628 4352 cmdide - ok 00:53:50.0691 4352 CNG (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys 00:53:50.0706 4352 CNG - ok 00:53:50.0706 4352 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 00:53:50.0706 4352 Compbatt - ok 00:53:50.0737 4352 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 00:53:50.0737 4352 CompositeBus - ok 00:53:50.0737 4352 COMSysApp - ok 00:53:50.0737 4352 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 00:53:50.0737 4352 crcdisk - ok 00:53:50.0784 4352 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll 00:53:50.0784 4352 CryptSvc - ok 00:53:50.0831 4352 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys 00:53:50.0847 4352 CSC - ok 00:53:50.0940 4352 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll 00:53:50.0940 4352 CscService - ok 00:53:51.0034 4352 cvhsvc (61a86809b62769643892bc0812b204aa) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE 00:53:51.0049 4352 cvhsvc - ok 00:53:51.0174 4352 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 00:53:51.0190 4352 DcomLaunch - ok 00:53:51.0237 4352 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 00:53:51.0237 4352 defragsvc - ok 00:53:51.0283 4352 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 00:53:51.0283 4352 DfsC - ok 00:53:51.0315 4352 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll 00:53:51.0315 4352 Dhcp - ok 00:53:51.0330 4352 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 00:53:51.0330 4352 discache - ok 00:53:51.0346 4352 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 00:53:51.0361 4352 Disk - ok 00:53:51.0424 4352 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll 00:53:51.0424 4352 Dnscache - ok 00:53:51.0455 4352 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll 00:53:51.0455 4352 dot3svc - ok 00:53:51.0486 4352 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll 00:53:51.0486 4352 DPS - ok 00:53:51.0533 4352 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 00:53:51.0533 4352 drmkaud - ok 00:53:51.0596 4352 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 00:53:51.0611 4352 DXGKrnl - ok 00:53:51.0627 4352 EagleX64 - ok 00:53:51.0674 4352 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 00:53:51.0674 4352 EapHost - ok 00:53:51.0830 4352 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 00:53:51.0876 4352 ebdrv - ok 00:53:52.0017 4352 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe 00:53:52.0017 4352 EFS - ok 00:53:52.0064 4352 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe 00:53:52.0079 4352 ehRecvr - ok 00:53:52.0095 4352 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 00:53:52.0095 4352 ehSched - ok 00:53:52.0126 4352 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 00:53:52.0142 4352 elxstor - ok 00:53:52.0204 4352 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 00:53:52.0204 4352 ErrDev - ok 00:53:52.0235 4352 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 00:53:52.0251 4352 EventSystem - ok 00:53:52.0266 4352 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 00:53:52.0266 4352 exfat - ok 00:53:52.0282 4352 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 00:53:52.0298 4352 fastfat - ok 00:53:52.0360 4352 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe 00:53:52.0376 4352 Fax - ok 00:53:52.0376 4352 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 00:53:52.0376 4352 fdc - ok 00:53:52.0391 4352 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 00:53:52.0391 4352 fdPHost - ok 00:53:52.0391 4352 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 00:53:52.0391 4352 FDResPub - ok 00:53:52.0454 4352 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 00:53:52.0454 4352 FileInfo - ok 00:53:52.0454 4352 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 00:53:52.0454 4352 Filetrace - ok 00:53:52.0469 4352 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 00:53:52.0469 4352 flpydisk - ok 00:53:52.0516 4352 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 00:53:52.0516 4352 FltMgr - ok 00:53:52.0578 4352 FontCache (b4447f606bb19fd8ad0bafb59b90f5d9) C:\Windows\system32\FntCache.dll 00:53:52.0610 4352 FontCache - ok 00:53:52.0703 4352 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 00:53:52.0703 4352 FontCache3.0.0.0 - ok 00:53:52.0734 4352 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 00:53:52.0734 4352 FsDepends - ok 00:53:52.0750 4352 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys 00:53:52.0750 4352 Fs_Rec - ok 00:53:52.0797 4352 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 00:53:52.0797 4352 fvevol - ok 00:53:52.0812 4352 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 00:53:52.0812 4352 gagp30kx - ok 00:53:52.0844 4352 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll 00:53:52.0859 4352 gpsvc - ok 00:53:53.0015 4352 gupdate (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 00:53:53.0015 4352 gupdate - ok 00:53:53.0031 4352 gupdatem (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 00:53:53.0031 4352 gupdatem - ok 00:53:53.0046 4352 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 00:53:53.0046 4352 hcw85cir - ok 00:53:53.0093 4352 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 00:53:53.0109 4352 HdAudAddService - ok 00:53:53.0124 4352 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\DRIVERS\HDAudBus.sys 00:53:53.0124 4352 HDAudBus - ok 00:53:53.0124 4352 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 00:53:53.0124 4352 HidBatt - ok 00:53:53.0140 4352 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 00:53:53.0140 4352 HidBth - ok 00:53:53.0156 4352 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 00:53:53.0156 4352 HidIr - ok 00:53:53.0187 4352 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll 00:53:53.0187 4352 hidserv - ok 00:53:53.0280 4352 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys 00:53:53.0280 4352 HidUsb - ok 00:53:53.0312 4352 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll 00:53:53.0312 4352 hkmsvc - ok 00:53:53.0358 4352 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll 00:53:53.0358 4352 HomeGroupListener - ok 00:53:53.0405 4352 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll 00:53:53.0405 4352 HomeGroupProvider - ok 00:53:53.0405 4352 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 00:53:53.0421 4352 HpSAMD - ok 00:53:53.0483 4352 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 00:53:53.0499 4352 HTTP - ok 00:53:53.0546 4352 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 00:53:53.0546 4352 hwpolicy - ok 00:53:53.0577 4352 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 00:53:53.0577 4352 i8042prt - ok 00:53:53.0608 4352 iaStorV (3df4395a7cf8b7a72a5f4606366b8c2d) C:\Windows\system32\drivers\iaStorV.sys 00:53:53.0608 4352 iaStorV - ok 00:53:53.0686 4352 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 00:53:53.0686 4352 IDriverT - ok 00:53:53.0842 4352 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 00:53:53.0858 4352 idsvc - ok 00:53:53.0920 4352 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 00:53:53.0920 4352 iirsp - ok 00:53:53.0967 4352 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll 00:53:53.0982 4352 IKEEXT - ok 00:53:54.0138 4352 IntcAzAudAddService (42943bb3ab7a405b30eff7c8283cc129) C:\Windows\system32\drivers\RTKVHD64.sys 00:53:54.0154 4352 IntcAzAudAddService - ok 00:53:54.0232 4352 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 00:53:54.0232 4352 intelide - ok 00:53:54.0263 4352 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 00:53:54.0279 4352 intelppm - ok 00:53:54.0310 4352 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 00:53:54.0310 4352 IPBusEnum - ok 00:53:54.0341 4352 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 00:53:54.0341 4352 IpFilterDriver - ok 00:53:54.0388 4352 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll 00:53:54.0404 4352 iphlpsvc - ok 00:53:54.0435 4352 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 00:53:54.0435 4352 IPMIDRV - ok 00:53:54.0450 4352 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 00:53:54.0450 4352 IPNAT - ok 00:53:54.0497 4352 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 00:53:54.0513 4352 IRENUM - ok 00:53:54.0513 4352 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 00:53:54.0513 4352 isapnp - ok 00:53:54.0544 4352 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 00:53:54.0560 4352 iScsiPrt - ok 00:53:54.0591 4352 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 00:53:54.0591 4352 kbdclass - ok 00:53:54.0622 4352 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys 00:53:54.0622 4352 kbdhid - ok 00:53:54.0653 4352 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 00:53:54.0653 4352 KeyIso - ok 00:53:54.0684 4352 KSecDD (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys 00:53:54.0684 4352 KSecDD - ok 00:53:54.0700 4352 KSecPkg (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys 00:53:54.0700 4352 KSecPkg - ok 00:53:54.0700 4352 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 00:53:54.0700 4352 ksthunk - ok 00:53:54.0762 4352 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 00:53:54.0762 4352 KtmRm - ok 00:53:54.0809 4352 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll 00:53:54.0809 4352 LanmanServer - ok 00:53:54.0840 4352 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll 00:53:54.0840 4352 LanmanWorkstation - ok 00:53:54.0872 4352 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 00:53:54.0872 4352 lltdio - ok 00:53:54.0887 4352 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 00:53:54.0903 4352 lltdsvc - ok 00:53:54.0903 4352 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 00:53:54.0918 4352 lmhosts - ok 00:53:54.0934 4352 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 00:53:54.0934 4352 LSI_FC - ok 00:53:54.0981 4352 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 00:53:54.0981 4352 LSI_SAS - ok 00:53:54.0981 4352 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 00:53:54.0981 4352 LSI_SAS2 - ok 00:53:54.0996 4352 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 00:53:54.0996 4352 LSI_SCSI - ok 00:53:55.0028 4352 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 00:53:55.0028 4352 luafv - ok 00:53:55.0090 4352 mcdbus (79d51e7f5926e8ce1b3ebecebae28cff) C:\Windows\system32\DRIVERS\mcdbus.sys 00:53:55.0090 4352 mcdbus - ok 00:53:55.0121 4352 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll 00:53:55.0121 4352 Mcx2Svc - ok 00:53:55.0137 4352 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 00:53:55.0137 4352 megasas - ok 00:53:55.0152 4352 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 00:53:55.0152 4352 MegaSR - ok 00:53:55.0168 4352 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 00:53:55.0168 4352 MMCSS - ok 00:53:55.0199 4352 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 00:53:55.0215 4352 Modem - ok 00:53:55.0230 4352 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 00:53:55.0230 4352 monitor - ok 00:53:55.0262 4352 MotioninJoyXFilter (eb03d4164e7f10b601d280413655ade4) C:\Windows\system32\DRIVERS\MijXfilt.sys 00:53:55.0262 4352 MotioninJoyXFilter - ok 00:53:55.0293 4352 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 00:53:55.0293 4352 mouclass - ok 00:53:55.0308 4352 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 00:53:55.0308 4352 mouhid - ok 00:53:55.0340 4352 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 00:53:55.0340 4352 mountmgr - ok 00:53:55.0449 4352 MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 00:53:55.0449 4352 MozillaMaintenance - ok 00:53:55.0480 4352 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 00:53:55.0496 4352 mpio - ok 00:53:55.0496 4352 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 00:53:55.0496 4352 mpsdrv - ok 00:53:55.0574 4352 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll 00:53:55.0589 4352 MpsSvc - ok 00:53:55.0620 4352 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 00:53:55.0620 4352 MRxDAV - ok 00:53:55.0698 4352 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 00:53:55.0698 4352 mrxsmb - ok 00:53:55.0730 4352 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 00:53:55.0745 4352 mrxsmb10 - ok 00:53:55.0745 4352 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 00:53:55.0745 4352 mrxsmb20 - ok 00:53:55.0761 4352 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 00:53:55.0761 4352 msahci - ok 00:53:55.0808 4352 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 00:53:55.0808 4352 msdsm - ok 00:53:55.0823 4352 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 00:53:55.0823 4352 MSDTC - ok 00:53:55.0839 4352 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 00:53:55.0839 4352 Msfs - ok 00:53:55.0854 4352 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 00:53:55.0854 4352 mshidkmdf - ok 00:53:55.0870 4352 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 00:53:55.0886 4352 msisadrv - ok 00:53:55.0932 4352 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 00:53:55.0932 4352 MSiSCSI - ok 00:53:55.0932 4352 msiserver - ok 00:53:55.0948 4352 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 00:53:55.0948 4352 MSKSSRV - ok 00:53:55.0948 4352 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 00:53:55.0948 4352 MSPCLOCK - ok 00:53:55.0964 4352 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 00:53:55.0964 4352 MSPQM - ok 00:53:56.0010 4352 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 00:53:56.0010 4352 MsRPC - ok 00:53:56.0010 4352 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 00:53:56.0026 4352 mssmbios - ok 00:53:56.0026 4352 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 00:53:56.0026 4352 MSTEE - ok 00:53:56.0042 4352 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 00:53:56.0042 4352 MTConfig - ok 00:53:56.0057 4352 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 00:53:56.0057 4352 Mup - ok 00:53:56.0120 4352 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll 00:53:56.0120 4352 napagent - ok 00:53:56.0229 4352 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 00:53:56.0229 4352 NativeWifiP - ok 00:53:56.0291 4352 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 00:53:56.0322 4352 NDIS - ok 00:53:56.0338 4352 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 00:53:56.0338 4352 NdisCap - ok 00:53:56.0354 4352 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 00:53:56.0354 4352 NdisTapi - ok 00:53:56.0432 4352 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 00:53:56.0432 4352 Ndisuio - ok 00:53:56.0463 4352 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 00:53:56.0463 4352 NdisWan - ok 00:53:56.0478 4352 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 00:53:56.0478 4352 NDProxy - ok 00:53:56.0494 4352 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 00:53:56.0494 4352 NetBIOS - ok 00:53:56.0541 4352 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 00:53:56.0541 4352 NetBT - ok 00:53:56.0572 4352 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 00:53:56.0572 4352 Netlogon - ok 00:53:56.0619 4352 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 00:53:56.0619 4352 Netman - ok 00:53:56.0681 4352 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 00:53:56.0681 4352 netprofm - ok 00:53:56.0728 4352 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 00:53:56.0728 4352 NetTcpPortSharing - ok 00:53:56.0744 4352 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 00:53:56.0744 4352 nfrd960 - ok 00:53:56.0775 4352 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll 00:53:56.0790 4352 NlaSvc - ok 00:53:56.0915 4352 nosGetPlusHelper (25d6b2eb0a1fc4ab413afe7ec4793ec1) C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll 00:53:56.0915 4352 nosGetPlusHelper - ok 00:53:56.0931 4352 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 00:53:56.0931 4352 Npfs - ok 00:53:56.0946 4352 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 00:53:56.0946 4352 nsi - ok 00:53:56.0946 4352 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 00:53:56.0946 4352 nsiproxy - ok 00:53:57.0040 4352 Ntfs (05d78aa5cb5f3f5c31160bdb955d0b7c) C:\Windows\system32\drivers\Ntfs.sys 00:53:57.0056 4352 Ntfs - ok 00:53:57.0149 4352 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 00:53:57.0149 4352 Null - ok 00:53:57.0180 4352 nvraid (5d9fd91f3d38dc9da01e3cb5fa89cd48) C:\Windows\system32\drivers\nvraid.sys 00:53:57.0180 4352 nvraid - ok 00:53:57.0196 4352 nvstor (f7cd50fe7139f07e77da8ac8033d1832) C:\Windows\system32\drivers\nvstor.sys 00:53:57.0196 4352 nvstor - ok 00:53:57.0227 4352 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 00:53:57.0227 4352 nv_agp - ok 00:53:57.0258 4352 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 00:53:57.0258 4352 ohci1394 - ok 00:53:57.0305 4352 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 00:53:57.0305 4352 ose - ok 00:53:57.0555 4352 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 00:53:57.0633 4352 osppsvc - ok 00:53:57.0695 4352 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 00:53:57.0695 4352 p2pimsvc - ok 00:53:57.0726 4352 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 00:53:57.0726 4352 p2psvc - ok 00:53:57.0773 4352 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 00:53:57.0773 4352 Parport - ok 00:53:57.0804 4352 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys 00:53:57.0804 4352 partmgr - ok 00:53:57.0914 4352 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 00:53:57.0914 4352 PcaSvc - ok 00:53:57.0945 4352 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 00:53:57.0945 4352 pci - ok 00:53:57.0945 4352 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 00:53:57.0945 4352 pciide - ok 00:53:57.0976 4352 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 00:53:57.0976 4352 pcmcia - ok 00:53:57.0976 4352 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 00:53:57.0976 4352 pcw - ok 00:53:58.0023 4352 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 00:53:58.0038 4352 PEAUTH - ok 00:53:58.0101 4352 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll 00:53:58.0132 4352 PeerDistSvc - ok 00:53:58.0179 4352 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 00:53:58.0179 4352 PerfHost - ok 00:53:58.0304 4352 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll 00:53:58.0319 4352 pla - ok 00:53:58.0382 4352 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll 00:53:58.0382 4352 PlugPlay - ok 00:53:58.0397 4352 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 00:53:58.0397 4352 PNRPAutoReg - ok 00:53:58.0428 4352 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 00:53:58.0428 4352 PNRPsvc - ok 00:53:58.0475 4352 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll 00:53:58.0475 4352 PolicyAgent - ok 00:53:58.0506 4352 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 00:53:58.0506 4352 Power - ok 00:53:58.0584 4352 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 00:53:58.0584 4352 PptpMiniport - ok 00:53:58.0600 4352 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 00:53:58.0600 4352 Processor - ok 00:53:58.0616 4352 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll 00:53:58.0631 4352 ProfSvc - ok 00:53:58.0662 4352 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 00:53:58.0662 4352 ProtectedStorage - ok 00:53:58.0694 4352 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 00:53:58.0694 4352 Psched - ok 00:53:58.0772 4352 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 00:53:58.0787 4352 ql2300 - ok 00:53:58.0896 4352 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 00:53:58.0896 4352 ql40xx - ok 00:53:58.0912 4352 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 00:53:58.0912 4352 QWAVE - ok 00:53:58.0928 4352 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 00:53:58.0928 4352 QWAVEdrv - ok 00:53:58.0943 4352 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 00:53:58.0943 4352 RasAcd - ok 00:53:58.0959 4352 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 00:53:58.0959 4352 RasAgileVpn - ok 00:53:58.0959 4352 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 00:53:58.0974 4352 RasAuto - ok 00:53:59.0006 4352 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 00:53:59.0006 4352 Rasl2tp - ok 00:53:59.0037 4352 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll 00:53:59.0052 4352 RasMan - ok 00:53:59.0084 4352 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 00:53:59.0084 4352 RasPppoe - ok 00:53:59.0084 4352 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 00:53:59.0084 4352 RasSstp - ok 00:53:59.0115 4352 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 00:53:59.0115 4352 rdbss - ok 00:53:59.0146 4352 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 00:53:59.0146 4352 rdpbus - ok 00:53:59.0146 4352 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 00:53:59.0146 4352 RDPCDD - ok 00:53:59.0177 4352 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys 00:53:59.0177 4352 RDPDR - ok 00:53:59.0193 4352 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 00:53:59.0193 4352 RDPENCDD - ok 00:53:59.0193 4352 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 00:53:59.0208 4352 RDPREFMP - ok 00:53:59.0240 4352 RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys 00:53:59.0240 4352 RdpVideoMiniport - ok 00:53:59.0302 4352 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys 00:53:59.0302 4352 RDPWD - ok 00:53:59.0349 4352 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 00:53:59.0349 4352 rdyboost - ok 00:53:59.0364 4352 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 00:53:59.0364 4352 RemoteAccess - ok 00:53:59.0396 4352 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 00:53:59.0396 4352 RemoteRegistry - ok 00:53:59.0411 4352 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 00:53:59.0411 4352 RpcEptMapper - ok 00:53:59.0427 4352 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 00:53:59.0427 4352 RpcLocator - ok 00:53:59.0442 4352 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 00:53:59.0458 4352 RpcSs - ok 00:53:59.0474 4352 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 00:53:59.0474 4352 rspndr - ok 00:53:59.0536 4352 RTL8167 (baefee35d27a5440d35092ce10267bec) C:\Windows\system32\DRIVERS\Rt64win7.sys 00:53:59.0536 4352 RTL8167 - ok 00:53:59.0567 4352 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys 00:53:59.0567 4352 s3cap - ok 00:53:59.0598 4352 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 00:53:59.0598 4352 SamSs - ok 00:53:59.0630 4352 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 00:53:59.0630 4352 sbp2port - ok 00:53:59.0661 4352 SBRE (9aceb2a2362fc87a3825963e61ba9076) C:\Windows\system32\drivers\SBREdrv.sys 00:53:59.0661 4352 SBRE - ok 00:53:59.0661 4352 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 00:53:59.0676 4352 SCardSvr - ok 00:53:59.0708 4352 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 00:53:59.0708 4352 scfilter - ok 00:53:59.0817 4352 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll 00:53:59.0817 4352 Schedule - ok 00:53:59.0832 4352 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 00:53:59.0848 4352 SCPolicySvc - ok 00:53:59.0879 4352 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll 00:53:59.0879 4352 SDRSVC - ok 00:53:59.0895 4352 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 00:53:59.0895 4352 secdrv - ok 00:53:59.0926 4352 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll 00:53:59.0926 4352 seclogon - ok 00:53:59.0926 4352 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 00:53:59.0942 4352 SENS - ok 00:53:59.0942 4352 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 00:53:59.0942 4352 SensrSvc - ok 00:53:59.0957 4352 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 00:53:59.0957 4352 Serenum - ok 00:53:59.0988 4352 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 00:53:59.0988 4352 Serial - ok 00:54:00.0004 4352 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 00:54:00.0004 4352 sermouse - ok 00:54:00.0020 4352 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll 00:54:00.0020 4352 SessionEnv - ok 00:54:00.0051 4352 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 00:54:00.0051 4352 sffdisk - ok 00:54:00.0066 4352 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 00:54:00.0066 4352 sffp_mmc - ok 00:54:00.0066 4352 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 00:54:00.0066 4352 sffp_sd - ok 00:54:00.0082 4352 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 00:54:00.0082 4352 sfloppy - ok 00:54:00.0160 4352 Sftfs (d5183ed285d2795491dc15bddcbee5ad) C:\Windows\system32\DRIVERS\Sftfslh.sys 00:54:00.0160 4352 Sftfs - ok 00:54:00.0269 4352 sftlist (bfdb58616ff5ea540a5f58301d50641e) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe 00:54:00.0269 4352 sftlist - ok 00:54:00.0300 4352 Sftplay (00f118b68c50d2206dd51634f9142b83) C:\Windows\system32\DRIVERS\Sftplaylh.sys 00:54:00.0300 4352 Sftplay - ok 00:54:00.0316 4352 Sftredir (76a827df5640bfe16a0cdbb4108adeca) C:\Windows\system32\DRIVERS\Sftredirlh.sys 00:54:00.0316 4352 Sftredir - ok 00:54:00.0332 4352 Sftvol (1b4c9701645086bab8cafffce30ed284) C:\Windows\system32\DRIVERS\Sftvollh.sys 00:54:00.0332 4352 Sftvol - ok 00:54:00.0332 4352 sftvsa (b94c3c4dca2093243c76ca218ede2a97) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe 00:54:00.0332 4352 sftvsa - ok 00:54:00.0363 4352 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 00:54:00.0363 4352 SharedAccess - ok 00:54:00.0410 4352 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll 00:54:00.0410 4352 ShellHWDetection - ok 00:54:00.0425 4352 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 00:54:00.0425 4352 SiSRaid2 - ok 00:54:00.0456 4352 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 00:54:00.0456 4352 SiSRaid4 - ok 00:54:00.0534 4352 SkypeUpdate (579ba0a911ff5ea70cb604cd3b744b0a) C:\Program Files (x86)\Skype\Updater\Updater.exe 00:54:00.0534 4352 SkypeUpdate - ok 00:54:00.0566 4352 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 00:54:00.0566 4352 Smb - ok 00:54:00.0597 4352 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 00:54:00.0597 4352 SNMPTRAP - ok 00:54:00.0706 4352 speedfan (5f9785e7535f8f602cb294a54962c9e7) C:\Windows\syswow64\speedfan.sys 00:54:00.0722 4352 speedfan - ok 00:54:00.0722 4352 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 00:54:00.0722 4352 spldr - ok 00:54:00.0784 4352 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe 00:54:00.0800 4352 Spooler - ok 00:54:01.0002 4352 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe 00:54:01.0049 4352 sppsvc - ok 00:54:01.0143 4352 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 00:54:01.0143 4352 sppuinotify - ok 00:54:01.0221 4352 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys 00:54:01.0221 4352 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb 00:54:01.0221 4352 sptd ( LockedFile.Multi.Generic ) - warning 00:54:01.0221 4352 sptd - detected LockedFile.Multi.Generic (1) 00:54:01.0268 4352 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 00:54:01.0268 4352 srv - ok 00:54:01.0299 4352 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 00:54:01.0299 4352 srv2 - ok 00:54:01.0330 4352 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 00:54:01.0346 4352 srvnet - ok 00:54:01.0361 4352 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 00:54:01.0361 4352 SSDPSRV - ok 00:54:01.0377 4352 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 00:54:01.0377 4352 SstpSvc - ok 00:54:01.0392 4352 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 00:54:01.0392 4352 stexstor - ok 00:54:01.0470 4352 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll 00:54:01.0486 4352 stisvc - ok 00:54:01.0502 4352 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys 00:54:01.0502 4352 storflt - ok 00:54:01.0517 4352 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys 00:54:01.0517 4352 storvsc - ok 00:54:01.0548 4352 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 00:54:01.0564 4352 swenum - ok 00:54:01.0595 4352 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 00:54:01.0611 4352 swprv - ok 00:54:01.0626 4352 Synth3dVsc - ok 00:54:01.0736 4352 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll 00:54:01.0751 4352 SysMain - ok 00:54:01.0860 4352 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll 00:54:01.0860 4352 TabletInputService - ok 00:54:01.0892 4352 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll 00:54:01.0907 4352 TapiSrv - ok 00:54:01.0907 4352 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 00:54:01.0923 4352 TBS - ok 00:54:02.0048 4352 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys 00:54:02.0079 4352 Tcpip - ok 00:54:02.0188 4352 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys 00:54:02.0204 4352 TCPIP6 - ok 00:54:02.0266 4352 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 00:54:02.0282 4352 tcpipreg - ok 00:54:02.0297 4352 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 00:54:02.0297 4352 TDPIPE - ok 00:54:02.0313 4352 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys 00:54:02.0313 4352 TDTCP - ok 00:54:02.0328 4352 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 00:54:02.0328 4352 tdx - ok 00:54:02.0360 4352 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 00:54:02.0360 4352 TermDD - ok 00:54:02.0422 4352 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll 00:54:02.0438 4352 TermService - ok 00:54:02.0453 4352 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 00:54:02.0453 4352 Themes - ok 00:54:02.0469 4352 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 00:54:02.0469 4352 THREADORDER - ok 00:54:02.0484 4352 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 00:54:02.0484 4352 TrkWks - ok 00:54:02.0516 4352 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe 00:54:02.0531 4352 TrustedInstaller - ok 00:54:02.0547 4352 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 00:54:02.0547 4352 tssecsrv - ok 00:54:02.0578 4352 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 00:54:02.0594 4352 TsUsbFlt - ok 00:54:02.0594 4352 tsusbhub - ok 00:54:02.0640 4352 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 00:54:02.0640 4352 tunnel - ok 00:54:02.0687 4352 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 00:54:02.0687 4352 uagp35 - ok 00:54:02.0734 4352 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 00:54:02.0734 4352 udfs - ok 00:54:02.0750 4352 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 00:54:02.0750 4352 UI0Detect - ok 00:54:02.0765 4352 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 00:54:02.0765 4352 uliagpkx - ok 00:54:02.0796 4352 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys 00:54:02.0796 4352 umbus - ok 00:54:02.0828 4352 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 00:54:02.0828 4352 UmPass - ok 00:54:02.0843 4352 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll 00:54:02.0859 4352 UmRdpService - ok 00:54:02.0874 4352 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 00:54:02.0890 4352 upnphost - ok 00:54:02.0937 4352 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys 00:54:02.0937 4352 usbaudio - ok 00:54:02.0952 4352 usbccgp (481dff26b4dca8f4cbac1f7dce1d6829) C:\Windows\system32\DRIVERS\usbccgp.sys 00:54:02.0952 4352 usbccgp - ok 00:54:02.0984 4352 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 00:54:02.0984 4352 usbcir - ok 00:54:02.0999 4352 usbehci (74ee782b1d9c241efe425565854c661c) C:\Windows\system32\drivers\usbehci.sys 00:54:02.0999 4352 usbehci - ok 00:54:03.0030 4352 usbhub (dc96bd9ccb8403251bcf25047573558e) C:\Windows\system32\drivers\usbhub.sys 00:54:03.0030 4352 usbhub - ok 00:54:03.0046 4352 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\drivers\usbohci.sys 00:54:03.0046 4352 usbohci - ok 00:54:03.0062 4352 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 00:54:03.0062 4352 usbprint - ok 00:54:03.0077 4352 USBSTOR (d76510cfa0fc09023077f22c2f979d86) C:\Windows\system32\DRIVERS\USBSTOR.SYS 00:54:03.0077 4352 USBSTOR - ok 00:54:03.0093 4352 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\drivers\usbuhci.sys 00:54:03.0093 4352 usbuhci - ok 00:54:03.0108 4352 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 00:54:03.0108 4352 UxSms - ok 00:54:03.0155 4352 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 00:54:03.0171 4352 VaultSvc - ok 00:54:03.0171 4352 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 00:54:03.0171 4352 vdrvroot - ok 00:54:03.0218 4352 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe 00:54:03.0233 4352 vds - ok 00:54:03.0249 4352 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 00:54:03.0249 4352 vga - ok 00:54:03.0264 4352 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 00:54:03.0264 4352 VgaSave - ok 00:54:03.0280 4352 VGPU - ok 00:54:03.0296 4352 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 00:54:03.0296 4352 vhdmp - ok 00:54:03.0311 4352 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 00:54:03.0311 4352 viaide - ok 00:54:03.0327 4352 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys 00:54:03.0327 4352 vmbus - ok 00:54:03.0342 4352 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys 00:54:03.0342 4352 VMBusHID - ok 00:54:03.0389 4352 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 00:54:03.0389 4352 volmgr - ok 00:54:03.0436 4352 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 00:54:03.0436 4352 volmgrx - ok 00:54:03.0452 4352 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 00:54:03.0467 4352 volsnap - ok 00:54:03.0483 4352 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 00:54:03.0483 4352 vsmraid - ok 00:54:03.0576 4352 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe 00:54:03.0592 4352 VSS - ok 00:54:03.0779 4352 vToolbarUpdater11.2.0 (8ed347bad8d1fb7c40b593bfb01786d2) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe 00:54:03.0795 4352 vToolbarUpdater11.2.0 - ok 00:54:03.0935 4352 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 00:54:03.0951 4352 vwifibus - ok 00:54:03.0998 4352 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 00:54:03.0998 4352 W32Time - ok 00:54:04.0013 4352 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 00:54:04.0013 4352 WacomPen - ok 00:54:04.0029 4352 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 00:54:04.0029 4352 WANARP - ok 00:54:04.0029 4352 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 00:54:04.0029 4352 Wanarpv6 - ok 00:54:04.0138 4352 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 00:54:04.0154 4352 WatAdminSvc - ok 00:54:04.0247 4352 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe 00:54:04.0263 4352 wbengine - ok 00:54:04.0310 4352 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 00:54:04.0310 4352 WbioSrvc - ok 00:54:04.0388 4352 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll 00:54:04.0403 4352 wcncsvc - ok 00:54:04.0403 4352 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 00:54:04.0403 4352 WcsPlugInService - ok 00:54:04.0419 4352 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 00:54:04.0419 4352 Wd - ok 00:54:04.0450 4352 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 00:54:04.0466 4352 Wdf01000 - ok 00:54:04.0481 4352 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 00:54:04.0481 4352 WdiServiceHost - ok 00:54:04.0481 4352 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 00:54:04.0497 4352 WdiSystemHost - ok 00:54:04.0528 4352 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll 00:54:04.0528 4352 WebClient - ok 00:54:04.0559 4352 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 00:54:04.0559 4352 Wecsvc - ok 00:54:04.0575 4352 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 00:54:04.0575 4352 wercplsupport - ok 00:54:04.0622 4352 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 00:54:04.0622 4352 WerSvc - ok 00:54:04.0653 4352 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 00:54:04.0653 4352 WfpLwf - ok 00:54:04.0668 4352 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 00:54:04.0668 4352 WIMMount - ok 00:54:04.0684 4352 WinDefend - ok 00:54:04.0684 4352 WinHttpAutoProxySvc - ok 00:54:04.0731 4352 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 00:54:04.0731 4352 Winmgmt - ok 00:54:04.0856 4352 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll 00:54:04.0887 4352 WinRM - ok 00:54:04.0980 4352 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys 00:54:04.0980 4352 WinUsb - ok 00:54:05.0027 4352 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 00:54:05.0043 4352 Wlansvc - ok 00:54:05.0090 4352 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 00:54:05.0090 4352 WmiAcpi - ok 00:54:05.0105 4352 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 00:54:05.0121 4352 wmiApSrv - ok 00:54:05.0121 4352 WMPNetworkSvc - ok 00:54:05.0121 4352 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 00:54:05.0121 4352 WPCSvc - ok 00:54:05.0152 4352 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll 00:54:05.0168 4352 WPDBusEnum - ok 00:54:05.0183 4352 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 00:54:05.0183 4352 ws2ifsl - ok 00:54:05.0199 4352 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll 00:54:05.0199 4352 wscsvc - ok 00:54:05.0214 4352 WSearch - ok 00:54:05.0370 4352 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll 00:54:05.0402 4352 wuauserv - ok 00:54:05.0464 4352 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 00:54:05.0464 4352 WudfPf - ok 00:54:05.0480 4352 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 00:54:05.0495 4352 WUDFRd - ok 00:54:05.0558 4352 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll 00:54:05.0558 4352 wudfsvc - ok 00:54:05.0589 4352 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 00:54:05.0589 4352 WwanSvc - ok 00:54:05.0667 4352 xnacc (4a5ce13408945e525503b5f73d29b9c5) C:\Windows\system32\DRIVERS\xnacc.sys 00:54:05.0682 4352 xnacc - ok 00:54:05.0745 4352 xusb21 (9176c0822faa649e45121875be32f5d2) C:\Windows\system32\DRIVERS\xusb21.sys 00:54:05.0745 4352 xusb21 - ok 00:54:05.0854 4352 YahooAUService (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe 00:54:05.0870 4352 YahooAUService - ok 00:54:05.0885 4352 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 00:54:06.0244 4352 \Device\Harddisk0\DR0 - ok 00:54:06.0275 4352 Boot (0x1200) (cb3664d7c9942e6595f3869c98bb6ad4) \Device\Harddisk0\DR0\Partition0 00:54:06.0275 4352 \Device\Harddisk0\DR0\Partition0 - ok 00:54:06.0291 4352 Boot (0x1200) (6efbd5004f5575741632f24935031c18) \Device\Harddisk0\DR0\Partition1 00:54:06.0291 4352 \Device\Harddisk0\DR0\Partition1 - ok 00:54:06.0291 4352 ============================================================ 00:54:06.0291 4352 Scan finished 00:54:06.0291 4352 ============================================================ 00:54:06.0306 3568 Detected object count: 1 00:54:06.0306 3568 Actual detected object count: 1 00:54:17.0538 3568 sptd ( LockedFile.Multi.Generic ) - skipped by user 00:54:17.0538 3568 sptd ( LockedFile.Multi.Generic ) - User select action: Skip

Done. But I had to restart my computer after Combofix created the log because I couldn't access any programs (I got an error message about registry values being marked for deletion.) ComboFix 12-07-14.01 - romeoashe 07/15/2012 12:16:13.1.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2047.1166 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\drivers\etc\lmhosts c:\windows\SysWow64\Cache c:\windows\SysWow64\Cache\234594eb331f6ca3.fb c:\windows\SysWow64\Cache\272512937d9e61a4.fb c:\windows\SysWow64\Cache\287204568329e189.fb c:\windows\SysWow64\Cache\28bc8f716fd76a47.fb c:\windows\SysWow64\Cache\2c53092c95605355.fb c:\windows\SysWow64\Cache\31a0997e9a5b5eb3.fb c:\windows\SysWow64\Cache\32c84fe32bb74d60.fb c:\windows\SysWow64\Cache\3917078cb68ec657.fb c:\windows\SysWow64\Cache\5415b6e4a5ef13b7.fb c:\windows\SysWow64\Cache\590ba23ce359fd0c.fb c:\windows\SysWow64\Cache\610289e025a3ee9a.fb c:\windows\SysWow64\Cache\651c5d3cdbfb8bd1.fb c:\windows\SysWow64\Cache\6c59ac5e7e7a3ad0.fb c:\windows\SysWow64\Cache\6d03dad1035885d3.fb c:\windows\SysWow64\Cache\a8556537add6dfc5.fb c:\windows\SysWow64\Cache\ab7481b00d4bc161.fb c:\windows\SysWow64\Cache\ad10a52aff5e038d.fb c:\windows\SysWow64\Cache\b443729770d97c04.fb c:\windows\SysWow64\Cache\c1fa887b03019701.fb c:\windows\SysWow64\Cache\c4d28dca2e7648be.fb c:\windows\SysWow64\Cache\d201ef9910cd39de.fb c:\windows\SysWow64\Cache\d2e94710a5708128.fb c:\windows\SysWow64\Cache\d72cd84c1e09fadf.fb c:\windows\SysWow64\Cache\d79b9dfe81484ec4.fb c:\windows\SysWow64\Cache\e0de16f883bea794.fb c:\windows\SysWow64\Cache\f998975c9cc711ee.fb . —- Previous Run ——- . c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed] c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome.manifest c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\background.html c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\browser.xul c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\crossrider.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\crossriderapi.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\dialog.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\options.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\options.xul c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\search_dialog.xul c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\chrome\content\update.html c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\defaults\preferences\prefs.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome.manifest c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\background.html c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\browser.xul c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\crossrider.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\crossriderapi.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\dialog.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\options.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\options.xul c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\search_dialog.xul c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\chrome\content\update.html c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\defaults\preferences\prefs.js c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\install.rdf c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\locale\en-US\translations.dtd c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\button1.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\button2.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\button3.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\button4.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\button5.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\crossrider_statusbar.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\icon24.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\icon48.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\panelarrow-up.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\popup.css c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\popup.html c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\popup_binding.xml c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\skin.css c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\firefox-production\skin\update.css c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\install.rdf c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\locale\en-US\translations.dtd c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\button1.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\button2.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\button3.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\button4.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\button5.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\crossrider_statusbar.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\icon128.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\icon16.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\icon24.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\icon48.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\panelarrow-up.png c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\popup.css c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\popup.html c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\popup_binding.xml c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\skin.css c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\extensions\[removed]\skin\update.css c:\windows\system32\drivers\etc\lmhosts c:\windows\SysWow64\Cache c:\windows\SysWow64\Cache\234594eb331f6ca3.fb c:\windows\SysWow64\Cache\272512937d9e61a4.fb c:\windows\SysWow64\Cache\287204568329e189.fb c:\windows\SysWow64\Cache\28bc8f716fd76a47.fb c:\windows\SysWow64\Cache\2c53092c95605355.fb c:\windows\SysWow64\Cache\31a0997e9a5b5eb3.fb c:\windows\SysWow64\Cache\32c84fe32bb74d60.fb c:\windows\SysWow64\Cache\3917078cb68ec657.fb c:\windows\SysWow64\Cache\5415b6e4a5ef13b7.fb c:\windows\SysWow64\Cache\590ba23ce359fd0c.fb c:\windows\SysWow64\Cache\610289e025a3ee9a.fb c:\windows\SysWow64\Cache\651c5d3cdbfb8bd1.fb c:\windows\SysWow64\Cache\6c59ac5e7e7a3ad0.fb c:\windows\SysWow64\Cache\6d03dad1035885d3.fb c:\windows\SysWow64\Cache\a8556537add6dfc5.fb c:\windows\SysWow64\Cache\ab7481b00d4bc161.fb c:\windows\SysWow64\Cache\ad10a52aff5e038d.fb c:\windows\SysWow64\Cache\c1fa887b03019701.fb c:\windows\SysWow64\Cache\c4d28dca2e7648be.fb c:\windows\SysWow64\Cache\d201ef9910cd39de.fb c:\windows\SysWow64\Cache\d2e94710a5708128.fb c:\windows\SysWow64\Cache\d72cd84c1e09fadf.fb c:\windows\SysWow64\Cache\d79b9dfe81484ec4.fb c:\windows\SysWow64\Cache\e0de16f883bea794.fb c:\windows\SysWow64\Cache\f998975c9cc711ee.fb . . ((((((((((((((((((((((((( Files Created from 2012-06-15 to 2012-07-15 ))))))))))))))))))))))))))))))) . . 2012-07-15 17:23 . 2012-07-15 17:23 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-07-15 00:25 . 2012-07-15 06:57 ——– d—–w- C:\Magic Workstation 2012-07-13 03:34 . 2012-07-13 03:34 455680 —-a-w- c:\program files\Internet Explorer\networkinspection.dll 2012-07-11 05:55 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-07 01:25 . 2012-01-12 14:28 57976 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-07-04 18:52 . 2010-05-03 21:12 328712 —-a-w- c:\windows\system32\MijFrc.dll 2012-06-26 00:33 . 2012-06-26 00:33 ——– d—–w- c:\users\romeoashe\AppData\Local\Chromium 2012-06-25 04:45 . 2012-06-30 21:52 ——– d—–w- c:\programdata\Hi-Rez Studios 2012-06-25 04:44 . 2012-06-30 21:52 ——– d—–w- c:\program files (x86)\Hi-Rez Studios 2012-06-24 01:37 . 2012-06-24 01:37 ——– d—–w- c:\users\romeoashe\AppData\Local\Macromedia 2012-06-22 13:40 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-22 13:40 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-22 13:40 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-22 13:40 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-14 22:56 . 2012-03-30 20:32 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-14 22:56 . 2011-05-16 13:56 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-06-02 22:19 . 2012-06-08 23:33 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-08 23:33 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-08 23:33 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 20:19 . 2012-06-08 23:32 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 20:15 . 2012-06-08 23:32 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-05-04 11:06 . 2012-06-13 23:42 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:03 . 2012-06-13 23:42 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-13 23:42 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-04-28 05:32 . 2012-06-13 23:42 1112064 —-a-w- c:\windows\system32\rdpcorets.dll 2012-04-28 03:55 . 2012-06-13 23:42 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-04-26 05:41 . 2012-06-13 23:42 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-04-26 05:41 . 2012-06-13 23:42 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-04-26 05:34 . 2012-06-13 23:42 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-04-19 09:50 . 2012-04-19 09:50 28480 —-a-w- c:\windows\system32\drivers\avgidsha.sys 2012-04-19 01:56 . 2012-04-19 01:56 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 01:56 . 2012-04-19 01:56 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\prxtbVuze.dll" [2011-01-17 175912] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] 2011-01-17 21:54 175912 —-a-w- c:\program files (x86)\Freecorder\prxtbFree.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2011-01-03 16:16 175400 —-a-w- c:\program files (x86)\ConduitEngine\prxConduitEngine.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}] 2011-03-16 11:59 81920 —-a-w- c:\program files (x86)\freecordertoolbar\vmntemplateX.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-07-10 04:42 2074208 —-a-w- c:\program files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}] 2011-01-17 22:54 175912 —-a-w- c:\program files (x86)\Vuze_Remote\prxtbVuze.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\prxConduitEngine.dll" [2011-01-03 175400] "{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}"= "c:\program files (x86)\freecordertoolbar\vmntemplateX.dll" [2011-03-16 81920] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-01-17 175912] "{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\prxtbVuze.dll" [2011-01-17 175912] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208] . [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] . [HKEY_CLASSES_ROOT\clsid\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Facebook Update"="c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-07-10 1107552] "ROC_roc_dec12"="c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-16 928096] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] . c:\users\romeoashe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Stardock ObjectDock.lnk - c:\program files (x86)\Stardock\ObjectDockFree\ObjectDock.exe [2010-10-6 3768176] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 135664] R2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-14 250056] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-05-30 1025352] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 135664] R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-11-08 117520] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120] R3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 27136] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992] R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2009-12-03 721768] R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2009-12-03 25960] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-04 1255736] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-20 834544] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-02-22 289872] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-03-19 383808] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2012-01-12 57976] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-26 203776] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-27 354304] S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2012-04-30 5106744] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288] S2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [2012-07-10 935008] S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-26 9085952] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-26 299520] S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2011-12-23 124496] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2009-12-03 269672] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2009-12-03 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper . Contents of the 'Scheduled Tasks' folder . 2012-07-15 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 22:56] . 2012-07-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000Core.job - c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-10 02:20] . 2012-07-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000UA.job - c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-10 02:20] . 2012-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 17:38] . 2012-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 17:38] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 825184] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466 mStart Page = hxxp://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466 TCP: DhcpNameServer = [removed] [removed] Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll FF - ProfilePath - c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2878731&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - www.yahoo.com FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4b74d716&v=7.008.031.001&i=23&tp=ab&iy=b&ychte=us&lng=en-US&q= FF - user.js: yahoo.ytff.general.dontshowhpoffer - true FF - user.js: extensions.funmoods.hmpg - true FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466 FF - user.js: extensions.funmoods.dfltSrch - true FF - user.js: extensions.funmoods.srchPrvdr - Search FF - user.js: extensions.funmoods.dnsErr - true FF - user.js: extensions.funmoods_i.newTab - true FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466 FF - user.js: extensions.funmoods.tlbrSrchUrl - FF - user.js: extensions.funmoods.id - 00f6c61c00000000000000306715dac7 FF - user.js: extensions.funmoods.instlDay - 15524 FF - user.js: extensions.funmoods.vrsn - 1.5.23.22 FF - user.js: extensions.funmoods.vrsni - 1.5.23.22 FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2210:49 FF - user.js: extensions.funmoods.prtnrId - funmoods FF - user.js: extensions.funmoods.prdct - funmoods FF - user.js: extensions.funmoods.aflt - fmtoby FF - user.js: extensions.funmoods_i.smplGrp - none FF - user.js: extensions.funmoods.tlbrId - base FF - user.js: extensions.funmoods.instlRef - fmtoby FF - user.js: extensions.funmoods.dfltLng - FF - user.js: extensions.funmoods.excTlbr - false FF - user.js: extensions.funmoods.autoRvrt - false FF - user.js: extensions.funmoods.envrmnt - production FF - user.js: extensions.funmoods.isdcmntcmplt - true FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0 . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{90eee664-34b1-422a-a782-779af65cdf6d} - (no file) BHO-{66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - (no file) BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-10 - (no file) Toolbar-10 - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file) WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\09\06\18\10\1f4Ú" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-15 12:43:05 - machine was rebooted ComboFix-quarantined-files.txt 2012-07-15 17:43 . Pre-Run: 200,183,078,912 bytes free Post-Run: 200,068,911,104 bytes free . - - End Of File - - DA099AC17B3D496E0C196C9A38B34415

Completed. Log file incoming. ComboFix 12-07-14.01 - romeoashe 07/16/2012 1:26.2.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2047.1154 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\romeoashe\Desktop\CFScript.txt AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((( Files Created from 2012-06-16 to 2012-07-16 ))))))))))))))))))))))))))))))) . . 2012-07-16 06:32 . 2012-07-16 06:32 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-07-16 06:32 . 2012-07-16 06:32 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-07-15 00:25 . 2012-07-16 04:22 ——– d—–w- C:\Magic Workstation 2012-07-13 03:34 . 2012-07-13 03:34 455680 —-a-w- c:\program files\Internet Explorer\networkinspection.dll 2012-07-11 05:55 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-07 01:25 . 2012-01-12 14:28 57976 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-07-04 18:52 . 2010-05-03 21:12 328712 —-a-w- c:\windows\system32\MijFrc.dll 2012-06-26 00:33 . 2012-06-26 00:33 ——– d—–w- c:\users\romeoashe\AppData\Local\Chromium 2012-06-25 04:45 . 2012-06-30 21:52 ——– d—–w- c:\programdata\Hi-Rez Studios 2012-06-25 04:44 . 2012-06-30 21:52 ——– d—–w- c:\program files (x86)\Hi-Rez Studios 2012-06-24 01:37 . 2012-06-24 01:37 ——– d—–w- c:\users\romeoashe\AppData\Local\Macromedia 2012-06-22 13:40 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-22 13:40 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-22 13:40 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-22 13:40 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-14 22:56 . 2012-03-30 20:32 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-14 22:56 . 2011-05-16 13:56 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-06-02 22:19 . 2012-06-08 23:33 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-08 23:33 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-08 23:33 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 20:19 . 2012-06-08 23:32 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 20:15 . 2012-06-08 23:32 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-05-04 11:06 . 2012-06-13 23:42 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:03 . 2012-06-13 23:42 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-13 23:42 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-04-28 05:32 . 2012-06-13 23:42 1112064 —-a-w- c:\windows\system32\rdpcorets.dll 2012-04-28 03:55 . 2012-06-13 23:42 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-04-26 05:41 . 2012-06-13 23:42 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-04-26 05:41 . 2012-06-13 23:42 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-04-26 05:34 . 2012-06-13 23:42 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-04-19 09:50 . 2012-04-19 09:50 28480 —-a-w- c:\windows\system32\drivers\avgidsha.sys 2012-04-19 01:56 . 2012-04-19 01:56 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 01:56 . 2012-04-19 01:56 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts . . ((((((((((((((((((((((((((((( SnapShot@2012-07-15_17.40.11 ))))))))))))))))))))))))))))))))))))))))) . + 2012-07-15 22:45 . 2012-07-15 22:45 25600 c:\windows\Installer\117050b.msi - 2012-07-15 17:25 . 2012-07-15 17:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-16 06:34 . 2012-07-16 06:34 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-15 17:25 . 2012-07-15 17:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-07-16 06:34 . 2012-07-16 06:34 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 05:01 . 2012-07-16 06:33 228312 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-07-15 17:24 228312 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2010-02-16 22:34 . 2012-07-16 06:33 32393656 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3282714526-1420211796-1606457181-1000-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\prxtbVuze.dll" [2011-01-17 175912] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] 2011-01-17 21:54 175912 —-a-w- c:\program files (x86)\Freecorder\prxtbFree.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2011-01-03 16:16 175400 —-a-w- c:\program files (x86)\ConduitEngine\prxConduitEngine.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}] 2011-03-16 11:59 81920 —-a-w- c:\program files (x86)\freecordertoolbar\vmntemplateX.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-07-10 04:42 2074208 —-a-w- c:\program files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}] 2011-01-17 22:54 175912 —-a-w- c:\program files (x86)\Vuze_Remote\prxtbVuze.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\prxConduitEngine.dll" [2011-01-03 175400] "{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}"= "c:\program files (x86)\freecordertoolbar\vmntemplateX.dll" [2011-03-16 81920] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-01-17 175912] "{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\prxtbVuze.dll" [2011-01-17 175912] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208] . [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] . [HKEY_CLASSES_ROOT\clsid\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Facebook Update"="c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-07-10 1107552] "ROC_roc_dec12"="c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-16 928096] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] . c:\users\romeoashe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Stardock ObjectDock.lnk - c:\program files (x86)\Stardock\ObjectDockFree\ObjectDock.exe [2010-10-6 3768176] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 135664] R2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-14 250056] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-05-30 1025352] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 135664] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120] R3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 27136] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992] R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2009-12-03 721768] R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2009-12-03 25960] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-04 1255736] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-20 834544] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-02-22 289872] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-03-19 383808] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2012-01-12 57976] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-26 203776] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-27 354304] S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2012-04-30 5106744] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288] S2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [2012-07-10 935008] S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-26 9085952] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-26 299520] S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2011-12-23 124496] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776] S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-11-08 117520] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2009-12-03 269672] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2009-12-03 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper . Contents of the 'Scheduled Tasks' folder . 2012-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 22:56] . 2012-07-16 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000Core.job - c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-10 02:20] . 2012-07-16 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000UA.job - c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-10 02:20] . 2012-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 17:38] . 2012-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 17:38] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 825184] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm TCP: DhcpNameServer = [removed] [removed] Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll FF - ProfilePath - c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2878731&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - www.yahoo.com FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4b74d716&v=7.008.031.001&i=23&tp=ab&iy=b&ychte=us&lng=en-US&q= FF - user.js: yahoo.ytff.general.dontshowhpoffer - true FF - user.js: extensions.funmoods.hmpg - true FF - user.js: extensions.funmoods.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466 FF - user.js: extensions.funmoods.dfltSrch - true FF - user.js: extensions.funmoods.srchPrvdr - Search FF - user.js: extensions.funmoods.dnsErr - true FF - user.js: extensions.funmoods_i.newTab - true FF - user.js: extensions.funmoods.newTabUrl - hxxp://start.funmoods.com/?f=2&a=fmtoby&chnl=fmtoby&cd=2XzutAtN2Y1L1QzutDtDtAtDyCyBtCyD0D0A0CyB0CyCtC0CtN0D0TzutBtDtCtBtDyBtDtA&cr=1724900466 FF - user.js: extensions.funmoods.tlbrSrchUrl - FF - user.js: extensions.funmoods.id - 00f6c61c00000000000000306715dac7 FF - user.js: extensions.funmoods.instlDay - 15524 FF - user.js: extensions.funmoods.vrsn - 1.5.23.22 FF - user.js: extensions.funmoods.vrsni - 1.5.23.22 FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2210:49 FF - user.js: extensions.funmoods.prtnrId - funmoods FF - user.js: extensions.funmoods.prdct - funmoods FF - user.js: extensions.funmoods.aflt - fmtoby FF - user.js: extensions.funmoods_i.smplGrp - none FF - user.js: extensions.funmoods.tlbrId - base FF - user.js: extensions.funmoods.instlRef - fmtoby FF - user.js: extensions.funmoods.dfltLng - FF - user.js: extensions.funmoods.excTlbr - false FF - user.js: extensions.funmoods.autoRvrt - false FF - user.js: extensions.funmoods.envrmnt - production FF - user.js: extensions.funmoods.isdcmntcmplt - true FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0 . - - - - ORPHANS REMOVED - - - - . BHO-{66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - (no file) BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-10 - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file) WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\09\06\18\10\1f4Ú" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-16 01:39:10 - machine was rebooted ComboFix-quarantined-files.txt 2012-07-16 06:39 ComboFix2.txt 2012-07-15 17:43 . Pre-Run: 200,096,993,280 bytes free Post-Run: 199,664,316,416 bytes free . - - End Of File - - 262EBFF2362C6E196423EBD5CB1B71D3

And again… ComboFix 12-07-16.01 - romeoashe 07/16/2012 13:59:49.3.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2047.1195 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\romeoashe\Desktop\CFScript.txt AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-06-16 to 2012-07-16 ))))))))))))))))))))))))))))))) . . 2012-07-16 19:06 . 2012-07-16 19:06 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-07-16 19:06 . 2012-07-16 19:06 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-07-15 00:25 . 2012-07-16 06:53 ——– d—–w- C:\Magic Workstation 2012-07-13 03:34 . 2012-07-13 03:34 455680 —-a-w- c:\program files\Internet Explorer\networkinspection.dll 2012-07-11 05:55 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-07 01:25 . 2012-01-12 14:28 57976 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-07-04 18:52 . 2010-05-03 21:12 328712 —-a-w- c:\windows\system32\MijFrc.dll 2012-06-26 00:33 . 2012-06-26 00:33 ——– d—–w- c:\users\romeoashe\AppData\Local\Chromium 2012-06-25 04:45 . 2012-06-30 21:52 ——– d—–w- c:\programdata\Hi-Rez Studios 2012-06-25 04:44 . 2012-06-30 21:52 ——– d—–w- c:\program files (x86)\Hi-Rez Studios 2012-06-24 01:37 . 2012-06-24 01:37 ——– d—–w- c:\users\romeoashe\AppData\Local\Macromedia 2012-06-22 13:40 . 2012-06-02 22:19 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-22 13:40 . 2012-06-02 22:19 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-22 13:40 . 2012-06-02 22:15 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-22 13:40 . 2012-06-02 22:19 2428952 —-a-w- c:\windows\system32\wuaueng.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-07-14 22:56 . 2012-03-30 20:32 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-14 22:56 . 2011-05-16 13:56 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-06-02 22:19 . 2012-06-08 23:33 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-08 23:33 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-08 23:33 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 20:19 . 2012-06-08 23:32 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 20:15 . 2012-06-08 23:32 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-05-04 11:06 . 2012-06-13 23:42 5559664 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-05-04 10:03 . 2012-06-13 23:42 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-05-04 10:03 . 2012-06-13 23:42 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-04-28 05:32 . 2012-06-13 23:42 1112064 —-a-w- c:\windows\system32\rdpcorets.dll 2012-04-28 03:55 . 2012-06-13 23:42 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-04-26 05:41 . 2012-06-13 23:42 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-04-26 05:41 . 2012-06-13 23:42 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-04-26 05:34 . 2012-06-13 23:42 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-04-19 09:50 . 2012-04-19 09:50 28480 —-a-w- c:\windows\system32\drivers\avgidsha.sys 2012-04-19 01:56 . 2012-04-19 01:56 94208 —-a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-04-19 01:56 . 2012-04-19 01:56 69632 —-a-w- c:\windows\SysWow64\QuickTime.qts . . ((((((((((((((((((((((((((((( SnapShot@2012-07-15_17.40.11 ))))))))))))))))))))))))))))))))))))))))) . + 2012-07-16 18:55 . 2012-07-16 18:55 32768 c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat - 2011-08-13 18:14 . 2012-07-15 17:10 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat - 2011-08-13 18:14 . 2012-07-15 17:10 16384 c:\windows\Temp\History\History.IE5\index.dat + 2012-07-16 18:55 . 2012-07-16 18:55 16384 c:\windows\temp\History\History.IE5\index.dat + 2012-07-16 18:55 . 2012-07-16 18:55 16384 c:\windows\temp\Cookies\index.dat - 2011-08-13 18:14 . 2012-07-15 17:10 16384 c:\windows\Temp\Cookies\index.dat + 2012-07-15 22:45 . 2012-07-15 22:45 25600 c:\windows\Installer\117050b.msi - 2012-07-15 17:25 . 2012-07-15 17:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-16 19:07 . 2012-07-16 19:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-15 17:25 . 2012-07-15 17:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-07-16 19:07 . 2012-07-16 19:07 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 05:01 . 2012-07-16 19:06 228312 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-07-15 17:24 228312 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2010-02-16 22:34 . 2012-07-16 19:06 32393656 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3282714526-1420211796-1606457181-1000-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\prxtbVuze.dll" [2011-01-17 175912] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] 2011-01-17 21:54 175912 —-a-w- c:\program files (x86)\Freecorder\prxtbFree.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2011-01-03 16:16 175400 —-a-w- c:\program files (x86)\ConduitEngine\prxConduitEngine.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}] 2011-03-16 11:59 81920 —-a-w- c:\program files (x86)\freecordertoolbar\vmntemplateX.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-07-10 04:42 2074208 —-a-w- c:\program files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}] 2011-01-17 22:54 175912 —-a-w- c:\program files (x86)\Vuze_Remote\prxtbVuze.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\prxConduitEngine.dll" [2011-01-03 175400] "{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}"= "c:\program files (x86)\freecordertoolbar\vmntemplateX.dll" [2011-03-16 81920] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-01-17 175912] "{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\prxtbVuze.dll" [2011-01-17 175912] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208] . [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] . [HKEY_CLASSES_ROOT\clsid\{70dd86e8-b5bc-4e4a-9d5c-b6234c24323c}] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Facebook Update"="c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-07-10 1107552] "ROC_roc_dec12"="c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-16 928096] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] . c:\users\romeoashe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Stardock ObjectDock.lnk - c:\program files (x86)\Stardock\ObjectDockFree\ObjectDock.exe [2010-10-6 3768176] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsa.exe /sync /restart . R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 135664] R2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-14 250056] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-05-30 1025352] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 135664] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120] R3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 27136] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992] R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2009-12-03 721768] R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2009-12-03 25960] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-04 1255736] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-04-19 28480] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-01-31 36944] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-03-20 834544] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-02-22 289872] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-12-23 47696] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-03-19 383808] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2012-01-12 57976] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-26 203776] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-27 354304] S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2012-04-30 5106744] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-02-14 193288] S2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [2012-07-10 935008] S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-26 9085952] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-26 299520] S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2011-12-23 124496] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfiltera.sys [2011-12-23 29776] S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-11-08 117520] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2009-12-03 269672] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2009-12-03 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper . Contents of the 'Scheduled Tasks' folder . 2012-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 22:56] . 2012-07-16 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000Core.job - c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-10 02:20] . 2012-07-16 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3282714526-1420211796-1606457181-1000UA.job - c:\users\romeoashe\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-10 02:20] . 2012-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 17:38] . 2012-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-17 17:38] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 825184] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm TCP: DhcpNameServer = [removed] [removed] Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll FF - ProfilePath - c:\users\romeoashe\AppData\Roaming\Mozilla\Firefox\Profiles\yulrg7ko.default\ . - - - - ORPHANS REMOVED - - - - . BHO-{66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - (no file) BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-10 - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file) WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*] "value"="?\09\06\18\10\1f4Ú" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-07-16 14:21:06 - machine was rebooted ComboFix-quarantined-files.txt 2012-07-16 19:21 ComboFix2.txt 2012-07-16 06:39 ComboFix3.txt 2012-07-15 17:43 . Pre-Run: 199,902,404,608 bytes free Post-Run: 199,569,309,696 bytes free . - - End Of File - - 79FBEFA6E7E3CFAC5C2C5C4DCDB728A0