Spyware / Malware / Virus Removal

Google Redirect and Savings Sidekick [Solved]

51 min read

Looking for the outcome? Ask AI

arkm Topic Starter

Post #1November 6, 2012, 12:44 AM UTC

Hi, I'm running Windows 7 and using Firefox as a browser. I frequently get redirected when I click on Google links (which has been happening for at least a couple weeks now). Also, for the past few days, most websites I go to have random text underlined in blue. When I scroll over this text a "Savings Sidekick" ad pops up, and clearly this shouldn't be happening. I don't think I have any plugins installed which would lead to this issue. When I run MBAM and AVG, they find nothing. Here's my HJT log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:38:25 PM, on 11/5/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal

Running processes:
C:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe
C:\Users\Mike\AppData\Local\Akamai\netsession_win.exe
C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Users\Mike\AppData\Local\Akamai\netsession_win.exe
C:\Windows\AsScrPro.exe
C:\ExpressGateUtil\VAWinAgent.exe
C:\Program Files (x86)\AVG\AVG10\avgtray.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\SafeConnect\scClient.exe
C:\Users\Mike\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Mike\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Users\Mike\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.claro-search.com/?affID=114508&…0006a5d60c80419
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Claro LTD Helper Object - {000F18F2-09EB-4A59-82B2-5AE4184C39C3} - C:\Program Files (x86)\Claro LTD\claro\1.8.3.10\bh\claro.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
O2 - BHO: dTPodcastBHO - {65134FDF-F8A5-4B3D-91D9-CDF273CFD578} - C:\Program Files (x86)\Common Files\doubleTwist\IEPodcastPlugin.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.32\AVG Secure Search_toolbar.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.32\AVG Secure Search_toolbar.dll
O3 - Toolbar: (no name) - {D0F4A166-B8D4-48b8-9D63-80849FE137CB} - (no file)
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [VAWinAgent] C:\ExpressGateUtil\VAWinAgent.exe
O4 - HKLM\..\Run: [FLxHCIm] "C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ROC_ROC_JULY_P1] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Mike\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Mike\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKUS\S-1-5-21-1998286848-2347478098-3866965016-1003\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1998286848-2347478098-3866965016-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Startup: Dropbox.lnk = Mike\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: AsusVibeLauncher.lnk = C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: SafeConnect.lnk = ?
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: c:\progra~3\browse~1\24897~1.175\{61d8b~1\browse~1.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Browser Manager - Unknown owner - C:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SafeConnect Manager (SCManager) - Unknown owner - C:\Program Files (x86)\SafeConnect\scManager.sys servicestart (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Intel® Turbo Boost Technology Monitor (TurboBoost) - Intel® Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: VideAceWindowsService - Unknown owner - C:\ExpressGateUtil\VAWinService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater12.2.6 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 14805 bytes

OCD

Post #2November 6, 2012, 4:00 AM UTC

Hello arkm,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise, this will be a team effort. This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can.

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Important Note for Vista and Windows 7 users:

These tools MUST be run from the executable.(.exe) every time you run them with Admin Rights (Right click, choose "Run as Administrator")

Please stay with this topic until I let you know that your system appears to be "All Clear"

arkm

Post #3November 6, 2012, 4:59 AM UTC

Thank you for helping me out, OCD.

OCD

Post #4November 6, 2012, 4:18 PM UTC

Hello arkm,

Download AdwCleaner to your desktop.

Right click and select "Run as Administrator".

Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

Next

Download OTL to your desktop.

Right click and select "Run as Administrator".

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
DRIVES
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Next

Download aswMBR to your desktop.

Right click and select "Run as Administrator".

Click the Scan button to start scan.
When it finishes, press the save log button, save the log file to your desktop.

[external image: Posted Image]
Click the image to enlarge it

In your next post please provide the following:
AdwCleaner log
OTL.txt
Extras.txt
aswMBR log

arkm

Post #5November 6, 2012, 5:51 PM UTC

# AdwCleaner v2.007 - Logfile created 11/06/2012 at 12:08:39
# Updated 06/11/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Mike - MIKE-PC
# Boot Mode : Normal
# Running from : C:\Users\Mike\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

Stopped & Deleted : Browser Manager

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search
Deleted on reboot : C:\ProgramData\Browser Manager
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Folder Deleted : C:\Program Files (x86)\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Claro LTD
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\Users\Mike\AppData\Local\APN
Folder Deleted : C:\Users\Mike\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Mike\AppData\Local\Savings Sidekick
Folder Deleted : C:\Users\Mike\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\Mike\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Mike\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]
Folder Deleted : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\FCTB

***** [Registry] *****

Data Deleted : HKLM\..\Windows [AppInit_DLLs] = c:\progra~3\browse~1\24897~1.175\{61d8b~1\browse~1.dll
Key Deleted : HKCU\Software\AppDataLow\Software\CompeteInc
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\Savings Sidekick
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Claro LTD
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\Headlight
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\Claro LTD
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\Software\CompeteInc
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{05340575-7D2A-4266-9A84-7EEBDC476884}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97C47A30-3CFB-474B-94E3-6019A7EE0610}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EE4FC43F-84CE-4E20-88C2-2188525B47FB}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhdepfaagokllfmhfbcfmocaeigmoebo
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{60295942-9E5F-4EE8-B785-3A655904D24F}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKU\S-1-5-21-1998286848-2347478098-3866965016-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{9E131A93-EED7-4BEB-B015-A0ADB30B5646}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.claro-search.com/?affID=114508&tt;=311012_ctrl_4412_6&babsrc;=HP_clro&mntrId;=7a3187110000000000006a5d60c80419 –> hxxp://www.google.com
Deleted : [HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page]

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default
File : C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\prefs.js

C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\user.js … Deleted !

Deleted : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\9.0.0.18");
Deleted : user_pref("avg.install.userHPSettings", "hxxp://www.claro-search.com/?affID=114508&tt;=311012_ctrl_44[…]
Deleted : user_pref("avg.install.userSPSettings", "Claro Search");
Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultenginename", "Claro Search");
Deleted : user_pref("browser.search.order.1", "Claro Search");
Deleted : user_pref("browser.startup.homepage", "hxxps://mail.google.com/mail/?shva=1#inbox");
Deleted : user_pref("[removed]-event-fired", true);
Deleted : user_pref("extensions.claro.admin", false);
Deleted : user_pref("extensions.claro.aflt", "babsst");
Deleted : user_pref("extensions.claro.appId", "{C3110516-8EFC-49D6-8B72-69354F332062}");
Deleted : user_pref("extensions.claro.dfltLng", "en");
Deleted : user_pref("extensions.claro.excTlbr", false);
Deleted : user_pref("extensions.claro.id", "7a3187110000000000006a5d60c80419");
Deleted : user_pref("extensions.claro.instlDay", "15645");
Deleted : user_pref("extensions.claro.instlRef", "sst");
Deleted : user_pref("extensions.claro.prdct", "claro");
Deleted : user_pref("extensions.claro.prtnrId", "claro");
Deleted : user_pref("extensions.claro.tlbrId", "claro");
Deleted : user_pref("extensions.claro.tlbrSrchUrl", "");
Deleted : user_pref("extensions.claro.vrsn", "[removed]");
Deleted : user_pref("extensions.claro.vrsni", "[removed]");
Deleted : user_pref("extensions.claro_i.smplGrp", "none");
Deleted : user_pref("extensions.claro_i.vrsnTs", "1.8.3.1017:29:28");
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationThankYouPage", true);
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationTime", 1351805356);
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationUserSettings.searchUserConifr
mation", false[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationUserSettings.setHomepage", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationUserSettings.setNewTab", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.InstallationUserSettings.setSearch", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.active", true);
Deleted : user_pref("extensions.crossriderapp5060.5060.addressbar", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.backgroundver", 7);
Deleted : user_pref("extensions.crossriderapp5060.5060.can_run_bg_code", true);
Deleted : user_pref("extensions.crossriderapp5060.5060.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.InstallationTime.value", "1351805356");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 […]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_aoi.value", "1351805356");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_blocklist.expiration", "Tue Nov 06 2012 10:[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_country_code.expiration", "Sat Nov 10 2012 […]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_country_code.value", "%22US%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 […]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_crr.value", "1352214340");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 […]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_hotfix20111102645.value", "%221%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_installer_params.value", "%7B%22source_id%2[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_parent_zoneid.value", "%2245989%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_pc_20120828.value", "1351951743793");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_product_id.value", "%221265%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie._GPL_zoneid.value", "%22100894%22");
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.cookie.dbtest.value", "1351951700056");
Deleted : user_pref("extensions.crossriderapp5060.5060.description", "Savings Sidekick");
Deleted : user_pref("extensions.crossriderapp5060.5060.domain", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.group", 0);
Deleted : user_pref("extensions.crossriderapp5060.5060.homepage", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.iframe", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.InstallerIdentifiers.expiratio
n", "Fri Feb 0[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.InstallerIdentifiers.value", "%7B%22installe[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_appVer.value", "37");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_lastVersion.expirati
on", "Fri Feb […]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_lastVersion.value", "0");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_meta.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_nextCheck.expiration", "Tue Nov 06[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_nextCheck.value", "true");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_queue.expiration", "Fri Feb 01 203[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_queue.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_remote_resources.exp
iration", "Fri[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.Resources_remote_resources.val
ue", "%7B%22re[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.SoftwareDetected.expiration", "Fri Feb 01 20[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.internaldb.SoftwareDetected.value", "%7B%22AnySoftware%[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.name", "Savings Sidekick");
Deleted : user_pref("extensions.crossriderapp5060.5060.newtab", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.opensearch", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1.code", "appAPI._cr_config={appID:funct[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1.name", "base");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000014.code", "Array.prototype.indexOf|[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000014.ver", 7);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000015.name", "GPL Background (BG)");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_1000015.ver", 4);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_13.code", "(function(a){a.selectedText=f[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_13.name", "CrossriderAppUtils");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_13.ver", 2);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_14.name", "CrossriderUtils");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_14.ver", 2);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_15.code", "(function(f){var u={};var e=M[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_15.name", "FacebookFFIE");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_15.ver", 1);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_16.code", "(function(f,

{if(typeof(

==[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_16.name", "FFAppAPIWrapper");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_16.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_17.code", "if(typeof window!==\"undefine[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_17.name", "jQuery");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_17.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_21.code", "var CrossriderDebugManager=(f[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_21.name", "debug");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_21.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_22.code", "(function(a){appAPI.queueMana[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_22.name", "resources");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_22.ver", 2);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_28.code", "var CrossriderInitializerPlug[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_28.name", "initializer");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_28.ver", 2);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_4.code", "/*! jQuery v1.7.1 jquery.com |[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_4.name", "jquery_1_7_1");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_4.ver", 3);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_47.code", "(function(){appAPI.ready=func[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_47.name", "resources_background");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins.plugin_47.ver", 1);
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins_lists.plugins_0", "17,14,16,47,1000015");
Deleted : user_pref("extensions.crossriderapp5060.5060.plugins_lists.plugins_1", "17,14,13,16,15,4,1,21,22,100[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[…]
Deleted : user_pref("extensions.crossriderapp5060.5060.pluginsversion", 15);
Deleted : user_pref("extensions.crossriderapp5060.5060.publisher", "215 Apps");
Deleted : user_pref("extensions.crossriderapp5060.5060.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp5060.5060.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp5060.5060.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.thankyou", "");
Deleted : user_pref("extensions.crossriderapp5060.5060.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp5060.5060.ver", 37);
Deleted : user_pref("extensions.crossriderapp5060.apps", "5060");
Deleted : user_pref("extensions.crossriderapp5060.bic", "13ac699a62aa7e9d5bea256a102bdfa6");
Deleted : user_pref("extensions.crossriderapp5060.cid", 5060);
Deleted : user_pref("extensions.crossriderapp5060.firstrun", false);
Deleted : user_pref("extensions.crossriderapp5060.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp5060.installationdate", 1351951689);
Deleted : user_pref("extensions.crossriderapp5060.lastcheck", 22536906);
Deleted : user_pref("extensions.crossriderapp5060.lastcheckitem", 22536906);
Deleted : user_pref("extensions.crossriderapp5060.modetype", "production");
Deleted : user_pref("extensions.crossriderapp5060.reportInstall", true);
Deleted : user_pref("extensions.enabledAddons", "[removed]:1.0,{2f17f610-5e97-4fed-828f-9940b7[…]
Deleted : user_pref("[removed]-event-fired", true);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.DNSCatch", false);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.FirstLaunchShown", true);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.LastDate", 9);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.customNewTab", false);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.CaptureType", 3);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.clickSendingStats.2011110
9.connection_e[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.clickSendingStats.2011110
9.invalid_cert[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.clickSendingStats.2011110
9.server_error[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.clickSendingStats.2011110
9.success", 0)[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.currentOffset", -84);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.dcaConfigInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.enableVoicebox", false);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.epochTimeInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.eulaVersion", 20110301);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.externalJSInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.externalJSSerpInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.externalJSShoppingcartInt
erval", "1440"[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastDcaConfigModification", "");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastDcaConfigTime", "1320852870457");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastDcaConfigUrl", "hxxps://dcs-config.[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastDcaStatus", 1);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastEpochTime", "1320852651759");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastEpochTimeUrl", "hxxps://dcs.consume[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastEventSendAttemptDate", "20111109");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastEventSendSuccessDate", "20111109");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSModificatio
n", "Fri, 30 S[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSSerpModific
ation", "Fri, […]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSSerpTime", "1320852651932[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSSerpUrl", "hxxps://dcs-fi[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSShoppingcar
tModification"[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSShoppingcar
tTime", "13208[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSShoppingcar
tUrl", "hxxps:[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSTime", "1320852653594");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastExternalJSUrl", "hxxps://dcs-files.[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastPingTime", "1320852709849");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastPrivacyRulesModificat
ion", "Tue, 18[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastPrivacyRulesTime", "1320852652168")[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastPrivacyRulesUrl", "hxxps://dcs-file[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastWhitelistModification", "Mon, 07 No[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastWhitelistTime", "1320852653589");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.lastWhitelistUrl", "hxxps://dcs-files.c[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.panelID", "FCZ3F9Lfox");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.pingInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.privacyFailures", 0);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.privacyFailuresThreshold", 15);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.privacyRulesInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.probationLength", 14400);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.rulesVersion", "1403");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.userID", "FCZ3F9L39136493");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.version", "1.7.0.9392");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dca.whitelistInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.dcaConfigInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.epochTimeInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.eulaVersion", 20110301);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.externalJSInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.externalJSSerpInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.externalJSShoppingcartInterva
l", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.installDate", "11092011");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastDcaConfigModification", "");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastDcaConfigTime", "1320815876317");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastDcaConfigUrl", "hxxps://dcs-config.cons[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastEpochTime", "1320815876279");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSModification", "Fri, 30 Sep 2[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSSerpModificatio
n", "Fri, 04 N[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSSerpTime", "1320815875659");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSSerpUrl", "hxxps://dcs-files.[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSShoppingcartMod
ification", "F[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSShoppingcartTim
e", "132081587[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSShoppingcartUrl", "hxxps://dc[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSTime", "1320815875632");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastExternalJSUrl", "hxxps://dcs-files.cons[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastPingTime", "1320815933188");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastPrivacyFailureDate", 20111025);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastPrivacyRulesModification", "Tue, 18 Oct[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastPrivacyRulesTime", "1320815875686");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastPrivacyRulesUrl", "hxxps://dcs-files.co[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastWhitelistModification", "Mon, 07 Nov 20[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastWhitelistTime", "1320815875987");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.lastWhitelistUrl", "hxxps://dcs-files.consu[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.pingInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.privacyFailures", 0);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.privacyFailuresThreshold", 15);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.privacyRulesInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.probationLength", 14400);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.rulesVersion", "1403");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.version", "1.0.29");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.dca.whitelistInterval", "1440");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.processAddrBar", false);
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.tb_lang", "en");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.user_id", "39136493");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.vars.dcaAlertShown", "1");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.vars.disablecuidinject", "1");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.vars.lastcheck", "Wed%20Nov%2009%202011%2000%3A[…]
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.version", "0");
Deleted : user_pref("freecause46d606b0a64511df981c0800200c9a66.yahooSearch", false);
Deleted : user_pref("keyword.URL", "hxxp://www.claro-search.com/?affID=114508&tt;=311012_ctrl_4412_6&babsrc;=KW_[…]

*************************

AdwCleaner[S1].txt - [33438 octets] - [06/11/2012 12:08:39]

########## EOF - C:\AdwCleaner[S1].txt - [33499 octets] ##########

OTL logfile created on: 11/6/2012 12:14:16 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Mike\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.98 Gb Total Physical Memory | 5.98 Gb Available Physical Memory | 74.91% Memory free
15.95 Gb Paging File | 13.85 Gb Available in Paging File | 86.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 50.08 Gb Free Space | 43.01% Space Free | Partition Type: NTFS
Drive D: | 327.83 Gb Total Space | 236.71 Gb Free Space | 72.20% Space Free | Partition Type: NTFS
Drive E: | 3.90 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: MIKE-PC | User Name: Mike | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Mike\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
PRC - C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
PRC - C:\Users\Mike\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\SafeConnect\SCClient.exe (Impulse Point, LLC)
PRC - C:\Program Files (x86)\SafeConnect\scManager.sys (Impulse Point, LLC)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Users\Mike\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Windows\AsScrPro.exe (ASUS)
PRC - C:\Program Files (x86)\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
PRC - C:\ExpressGateUtil\VAWinService.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\ExpressGateUtil\VAWinAgent.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
MOD - C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
MOD - C:\ExpressGateUtil\VAWinAgent.exe ()

========== Services (SafeList) ==========

SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (TurboBoost) – C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel® Corporation)
SRV:64bit: - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (vToolbarUpdater12.2.6) – C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe ()
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (SCManager) – C:\Program Files (x86)\SafeConnect\scManager.sys (Impulse Point, LLC)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AVG Security Toolbar Service) – C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (AVGIDSAgent) – C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (VideAceWindowsService) – C:\ExpressGateUtil\VAWinService.exe ()
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ATKGFNEXSrv) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (ASLDRService) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (avgtp) – C:\Windows\SysNative\drivers\avgtpx64.sys (AVG Technologies)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (iPodDrv) – C:\Windows\SysNative\drivers\iPodDrv.sys (Windows ® Codename Longhorn DDK provider)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (AVGIDSDriver) – C:\Windows\SysNative\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Avgtdia) – C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgrkx64) – C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (Avgmfx64) – C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSEH) – C:\Windows\SysNative\drivers\AVGIDSEH.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSFilter) – C:\Windows\SysNative\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Avgldx64) – C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (FLxHCIc) – C:\Windows\SysNative\drivers\FLxHCIc.sys (Fresco Logic)
DRV:64bit: - (FLxHCIh) – C:\Windows\SysNative\drivers\FLxHCIh.sys (Fresco Logic)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (RSUSBVSTOR) – C:\Windows\SysNative\drivers\rtsuvstor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (TurboB) – C:\Windows\SysNative\drivers\TurboB.sys ()
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (btusbflt) – C:\Windows\SysNative\drivers\btusbflt.sys (Broadcom Corporation.)
DRV:64bit: - (MBfilt) – C:\Windows\SysNative\drivers\MBfilt64.sys (Creative Technology Ltd.)
DRV:64bit: - (kbfiltr) – C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (SiSGbeLH) – C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (WDC_SAM) – C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies)
DRV - (ATKWMIACPIIO) – C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{C025B67B-5A2D-47D2-AB18-D2C0FFDAB88F}: "URL" = http://websearch.ask.com/redirect?client=i…9F-BDE81605E9ED
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: [removed]:1.0
FF - prefs.js..extensions.enabledAddons: {2f17f610-5e97-4fed-828f-9940b7b577a4}:16.0.0
FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.11
FF - prefs.js..extensions.enabledAddons: [removed]:0.85.36
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@doubletwist.com/NPPodcast: C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll (doubleTwist Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files (x86)\Google\Update\1.2.183.13\npGoogleOneClick8.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Mike\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Mike\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Mike\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Mike\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG10\Firefox4\ [2011/06/29 15:40:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/12/18 15:58:58 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/28 10:13:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/10/28 10:13:46 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{dfefbe51-ca52-484b-adf0-6b158b05262d}: C:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\FirefoxExtension

[2011/11/10 01:32:16 | 000,000,000 | —D | M] (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Extensions
[2012/11/01 21:33:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions
[2012/10/28 10:13:33 | 000,000,000 | —D | M] (TV-Fox) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
[2012/07/16 22:23:55 | 000,000,000 | —D | M] (ShopToWin9) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}
[2012/11/01 10:06:29 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/11/01 16:29:18 | 000,000,000 | —D | M] ("Savings Sidekick") – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]
[2012/07/16 22:23:54 | 000,000,000 | —D | M] (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\extensionManager
[2012/11/01 16:29:17 | 000,000,000 | —D | M] (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\chrome\content\extensionCode
[2011/06/19 23:13:27 | 000,550,833 | —- | M] () (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]
[2012/03/14 22:13:37 | 000,004,728 | —- | M] () (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]
[2012/10/20 13:57:39 | 000,741,958 | —- | M] () (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/07/12 16:10:17 | 000,000,598 | —- | M] () (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\voicebox\validators\VBExpiredValidator.js
[2012/10/28 10:13:46 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/10/28 10:13:48 | 000,261,600 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/08/29 08:45:33 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010/01/01 03:00:00 | 000,002,252 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml.old
[2012/10/19 13:28:37 | 000,002,058 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/07/27 15:36:18 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (PodcastBHO Class) - {65134FDF-F8A5-4B3D-91D9-CDF273CFD578} - C:\Program Files (x86)\Common Files\doubleTwist\IEPodcastPlugin.dll (doubleTwist Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {9E131A93-EED7-4BEB-B015-A0ADB30B5646} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [FLxHCIm] C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe (Windows ® Win 7 DDK provider)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 File not found
O4 - HKLM..\Run: [ROC_ROC_JULY_P1] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1 File not found
O4 - HKLM..\Run: [VAWinAgent] C:\ExpressGateUtil\VAWinAgent.exe ()
O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Mike\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - Startup: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Mike\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{925CA84C-60CB-4A71-91FE-D34C2EBBD981}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CC36EEFD-0C00-4CD8-8D96-361A8E7A7B3F}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/10/01 10:42:00 | 000,018,813 | R— | M] () - E:\autorun.dat – [ CDFS ]
O32 - AutoRun File - [2007/10/01 10:42:00 | 000,000,069 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgchsva.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/11/06 12:11:21 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Mike\Desktop\OTL.exe
[2012/11/04 16:53:38 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Roaming\Leadertech
[2012/11/04 16:51:34 | 000,000,000 | —D | C] – C:\ProgramData\Pinnacle
[2012/11/04 15:35:41 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Local\PMB Files
[2012/11/04 15:35:40 | 000,000,000 | —D | C] – C:\ProgramData\PMB Files
[2012/11/04 15:35:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Pando Networks
[2012/11/04 15:28:33 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Local\Downloaded Installations
[2012/11/04 15:28:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avid
[2012/11/04 15:28:10 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Propellerhead Software
[2012/11/04 15:28:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Propellerhead Software
[2012/11/04 15:27:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Avid
[2012/11/04 15:27:03 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Sibelius Example Scores
[2012/11/04 15:26:56 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Roaming\Avid
[2012/11/04 15:26:56 | 000,000,000 | —D | C] – C:\ProgramData\Avid
[2012/11/04 15:26:56 | 000,000,000 | —D | C] – C:\Program Files\Avid
[2012/11/04 15:26:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Avid
[2012/11/01 17:10:57 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/11/01 17:10:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012/11/01 17:10:51 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2012/11/01 17:09:09 | 000,000,000 | —D | C] – C:\Users\Mike\AppData\Roaming\WinRAR
[2012/11/01 16:46:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Project64 1.6
[2012/11/01 16:28:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Activision
[2012/10/30 13:34:05 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2012/10/30 13:34:05 | 000,174,056 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2012/10/30 13:34:05 | 000,095,208 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012/10/28 10:13:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2012/10/10 07:34:45 | 005,559,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2012/10/10 07:34:43 | 003,914,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2012/10/10 07:34:40 | 003,968,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2012/10/10 07:34:32 | 001,162,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/10/10 07:34:32 | 000,424,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/10/10 07:34:32 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/10/10 07:34:32 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/10/10 07:34:32 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/10/10 07:34:32 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/10/10 07:34:32 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/10/10 07:34:32 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/10/10 07:34:31 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/10/10 07:34:31 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/10/10 07:34:31 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/10/10 07:34:31 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/10/10 07:34:31 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/10/10 07:34:31 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/10/10 07:34:31 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/10/10 07:34:31 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/10/10 07:34:31 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/10/10 07:34:31 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/10/10 07:34:31 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/10/10 07:34:30 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/10/10 07:34:22 | 000,220,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wintrust.dll
[2012/10/10 07:33:12 | 001,464,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2012/10/10 07:33:11 | 000,140,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll

========== Files - Modified Within 30 Days ==========

[2012/11/06 12:17:47 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/06 12:17:47 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/06 12:17:06 | 000,780,196 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/11/06 12:17:06 | 000,660,998 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/11/06 12:17:06 | 000,121,636 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/11/06 12:11:38 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/11/06 12:11:21 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Mike\Desktop\OTL.exe
[2012/11/06 12:10:08 | 000,045,056 | —- | M] () – C:\Windows\SysNative\acovcnt.exe
[2012/11/06 12:09:57 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/11/06 12:09:55 | 2129,526,783 | -HS- | M] () – C:\hiberfil.sys
[2012/11/06 12:08:05 | 000,541,569 | —- | M] () – C:\Users\Mike\Desktop\adwcleaner.exe
[2012/11/06 11:52:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/11/06 11:34:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1998286848-2347478098-3866965016-1001UA.job
[2012/11/06 11:10:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/11/06 09:56:31 | 063,194,916 | —- | M] () – C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/11/05 21:34:00 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1998286848-2347478098-3866965016-1001Core.job
[2012/11/05 19:36:30 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Mike\Desktop\HiJackThis.exe
[2012/11/05 19:26:00 | 000,385,952 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/11/05 10:13:07 | 063,164,069 | —- | M] () – C:\Windows\SysNative\drivers\AVG\incavi.avm.old
[2012/11/04 16:51:33 | 000,000,604 | -H– | M] () – C:\Program Files (x86)\_Z2
[2012/11/04 15:28:13 | 000,000,558 | —- | M] () – C:\Users\Public\Desktop\Sibelius 7.lnk
[2012/11/01 21:46:00 | 000,000,507 | —- | M] () – C:\Users\Mike\Desktop\THawk2 - Shortcut.lnk
[2012/10/29 00:09:32 | 000,064,000 | —- | M] () – C:\Users\Mike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/10/18 15:23:33 | 000,001,115 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/08 17:10:12 | 000,696,760 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/10/08 17:10:12 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2012/11/06 12:08:05 | 000,541,569 | —- | C] () – C:\Users\Mike\Desktop\adwcleaner.exe
[2012/11/04 16:51:33 | 000,000,604 | -H– | C] () – C:\Program Files (x86)\_Z2
[2012/11/04 15:28:13 | 000,000,558 | —- | C] () – C:\Users\Public\Desktop\Sibelius 7.lnk
[2012/11/01 21:46:02 | 000,000,507 | —- | C] () – C:\Users\Mike\Desktop\THawk2 - Shortcut.lnk
[2012/10/02 22:34:56 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2012/08/30 09:40:14 | 000,429,416 | —- | C] () – C:\Windows\SysWow64\nvStreaming.exe
[2012/04/24 14:18:40 | 000,221,184 | —- | C] () – C:\Windows\SysWow64\glut32.dll
[2012/04/24 13:32:36 | 000,000,041 | —- | C] () – C:\Windows\MinGW.INI
[2012/04/24 12:20:32 | 000,000,036 | —- | C] () – C:\Users\Mike\.org.eclipse.epp.usagedata.recording.userId
[2011/12/29 03:53:44 | 000,064,000 | —- | C] () – C:\Users\Mike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/27 07:27:49 | 000,175,616 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2011/12/27 07:27:48 | 000,650,752 | —- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2011/12/27 07:27:48 | 000,243,200 | —- | C] () – C:\Windows\SysWow64\xvidvfw.dll
[2011/12/27 07:27:48 | 000,074,752 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2011/12/13 08:52:06 | 000,774,412 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2011/10/01 20:00:21 | 000,059,518 | —- | C] () – C:\Windows\War3Unin.dat
[2011/07/08 13:19:00 | 000,000,608 | -H– | C] () – C:\ProgramData\T2
[2011/07/08 13:19:00 | 000,000,604 | -H– | C] () – C:\Program Files (x86)\STLL Notifier
[2011/05/15 10:25:39 | 000,001,200 | —- | C] () – C:\Windows\THXCfg_SP_APOIM.ini
[2011/05/15 10:25:39 | 000,001,099 | —- | C] () – C:\Windows\THXCfg_HP_APOIM.ini
[2011/05/15 10:25:39 | 000,001,099 | —- | C] () – C:\Windows\THXCfg_APOIM.ini
[2011/05/15 10:14:47 | 000,008,192 | —- | C] () – C:\Windows\SysWow64\drivers\IntelMEFWVer.dll

========== ZeroAccess Check ==========

[2012/07/22 00:00:25 | 000,000,000 | —D | M] – C:\Windows\Installer\{dddfbf3a-c921-6940-3f32-050237de932c}\L
[2012/07/22 00:00:25 | 000,000,000 | —D | M] – C:\Windows\Installer\{dddfbf3a-c921-6940-3f32-050237de932c}\U
[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/07/05 14:29:23 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Across Lite 2.0
[2012/03/04 21:36:45 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Asus WebStorage
[2011/06/29 15:41:22 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\AVG10
[2012/11/04 16:53:41 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Avid
[2011/11/14 11:05:10 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\d5ssQQJ7dEK8
[2012/11/06 12:10:51 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Dropbox
[2012/03/14 22:13:37 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\ejYCekIVrOtAuS
[2011/11/13 09:27:16 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Ewopik
[2011/11/14 10:45:15 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\g44aaQHH6sW7fL9
[2011/11/11 10:36:59 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\General Downloader
[2012/07/21 22:14:44 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\GetRightToGo
[2012/03/05 21:32:40 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\gvS2obF3pGaJdKf
[2012/07/24 09:38:47 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Jarte
[2012/03/12 20:04:39 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\JF4pmG5sQ
[2011/11/14 10:40:12 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\K9hTXwjUClBzNx1
[2012/11/04 16:53:38 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Leadertech
[2011/07/20 13:39:38 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Nuance
[2011/11/14 00:19:48 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\oFF44pmGGsQJ6E8
[2011/11/14 00:23:45 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\R6dEK8fRZhXjCl
[2012/07/22 00:50:41 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\SoftGrid Client
[2012/10/13 01:32:25 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Spotify
[2012/08/28 18:15:32 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\SystemRequirementsLab
[2011/11/14 10:45:03 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\SzPNycA1uDoFp
[2011/12/13 08:53:07 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\TP
[2011/07/10 23:06:29 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\uPlayer
[2011/11/14 00:19:43 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\V22oobF4pmG5sJd
[2011/11/14 00:19:49 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\vfRRZZ9hTXwjCeI
[2011/11/14 00:19:43 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\vtttzPP0ycAiv2o
[2011/11/14 10:45:15 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\WSSS2iibD3pn
[2011/11/14 10:56:43 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\XZ9hTXwjUeIrPyA
[2011/11/14 10:45:08 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\yIBtzPNyc1v2b4
[2011/06/20 13:11:03 | 000,000,000 | —D | M] – C:\Users\Mike\AppData\Roaming\Zeon

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/26 01:23:14 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 00:19:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 20:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 00:51:13 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2011/05/15 09:45:48 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 00:33:07 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\erdnt\cache86\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 01:14:34 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 07:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/05/15 09:37:07 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2011/05/15 09:45:48 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2011/05/15 09:37:07 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 08:24:45 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2011/05/15 09:45:48 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2011/05/15 09:37:07 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 20:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2011/05/15 09:45:48 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 01:26:45 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2011/05/15 09:37:07 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/13 20:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\erdnt\cache64\services.exe
[2009/07/13 20:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/13 20:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\erdnt\cache86\svchost.exe
[2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/13 20:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2012/09/29 18:54:26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/13 20:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\erdnt\cache64\svchost.exe
[2009/07/13 20:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/13 20:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 07:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\erdnt\cache86\userinit.exe
[2010/11/20 07:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 07:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 20:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 20:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\erdnt\cache64\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/20 08:25:24 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\erdnt\cache64\winlogon.exe
[2010/11/20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 08:25:30 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 20:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012/09/29 18:54:26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2011/05/15 09:45:48 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2011/05/15 09:45:48 | 000,389,632 | —- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< %systemroot%\*. /rp /s >

< %systemdrive%\$Recycle.Bin|@;true;true;true >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST9500420AS
Partitions: 3
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 21.00GB
Starting Offset: 32256
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 116.00GB
Starting Offset: 23071910400
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Extended w/Extended Int 13
Bootable: False
BootPartition: False
PrimaryPartition: False
Size: 328.00GB
Starting Offset: 148096679936
Hidden sectors: 0

< End of report >

OTL Extras logfile created on: 11/6/2012 12:14:16 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Mike\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.98 Gb Total Physical Memory | 5.98 Gb Available Physical Memory | 74.91% Memory free
15.95 Gb Paging File | 13.85 Gb Available in Paging File | 86.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 116.44 Gb Total Space | 50.08 Gb Free Space | 43.01% Space Free | Partition Type: NTFS
Drive D: | 327.83 Gb Total Space | 236.71 Gb Free Space | 72.20% Space Free | Partition Type: NTFS
Drive E: | 3.90 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: MIKE-PC | User Name: Mike | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0294BB2F-6178-459D-8C46-8D1C40D6AD6B}" = rport=445 | protocol=6 | dir=out | app=system |
"{057550CC-1C7E-4C7B-A2F8-3A8DDC978C8C}" = lport=138 | protocol=17 | dir=in | app=system |
"{08E024BB-596A-4DFF-A430-159062EB67CE}" = lport=10243 | protocol=6 | dir=in | app=system |
"{19A5737B-0BEE-43C8-BCD3-3CC714AA4FD3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2375625C-703B-4F19-8C84-49CA02C03C5F}" = lport=58182 | protocol=6 | dir=in | name=pando media booster |
"{25B9D31D-64EC-44F5-900B-17177C3E5D3C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{295EF879-34FC-4A05-A484-51AA1443280E}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FA65B31-3A9D-4C20-AFC6-469495F0EF44}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4084E937-EAAA-47EE-9520-7BE7CE434C09}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4BF5EB07-06A2-40E2-B5B6-244EF5C49A0F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5456EA1E-AF45-48BD-9C96-AB99A6CCF1D9}" = lport=139 | protocol=6 | dir=in | app=system |
"{6364B77A-8796-4078-B3CC-5963A3E70B4F}" = rport=139 | protocol=6 | dir=out | app=system |
"{6EFD3216-D4DB-448C-81DA-E8838C66FFD2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7C7BD74E-D59D-40F9-8481-A74C4729E9DD}" = rport=138 | protocol=17 | dir=out | app=system |
"{86444BB3-291D-4D31-A046-BB4AA3243C28}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9D6F7842-CA68-4099-8466-D5069F9A2A8E}" = lport=58182 | protocol=17 | dir=in | name=pando media booster |
"{AF8150A9-8B4A-4262-900E-D368942052B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BE10AB93-C4A6-464B-BE93-069E778BFF99}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C232D951-55E7-4D04-9346-F88A07FC0B22}" = lport=137 | protocol=17 | dir=in | app=system |
"{C428A183-FD79-40B5-990D-895328F43AC8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF0676E6-E2EC-438A-9741-7029DEBD00CE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E9993616-5960-46D3-BB25-42D8108C7131}" = lport=58182 | protocol=17 | dir=in | name=pando media booster |
"{EEF8C90C-213F-40F0-BE16-EBF6AD0615B3}" = lport=58182 | protocol=6 | dir=in | name=pando media booster |
"{F534D21D-02A4-4E48-A237-A3745ED5E6D3}" = rport=137 | protocol=17 | dir=out | app=system |
"{F9C1EEE5-72B7-40C6-BC7C-64E9DF7DEB39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{003C7A18-60D9-4C89-94D8-DE42C1AA1D76}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{02A4D600-582A-4C14-ADFE-C125CF0CB18F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1473D86F-6F04-46A3-9153-CD04272511DC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{1AFFA2E4-92E7-4090-9473-1191E3A99B74}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{23019BDE-6B87-4A83-A0C4-BFC9DE325B9E}" = protocol=17 | dir=in | app=d:\starcraft ii\starcraft ii public test.exe |
"{3B818B9F-35C3-4465-B654-53E1D98B577A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{3F05DD2E-229C-4FBD-8F93-D70A687DA1A7}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{4849799C-D8E9-4360-8F9A-6B5F2BCC7EA4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{4A1CDBA6-491A-4656-BB92-C9EF0332D445}" = protocol=17 | dir=in | app=c:\users\mike\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{56E808A1-BFD0-4B79-B567-B9FA848D697F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{61FB8AD2-C831-45AB-9DFB-D685C3A8300D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{62F27534-2769-4D2F-B42F-E96E62F64F44}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{650D7B68-3844-48A8-BF00-407FCC04A445}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{65901CFC-D156-4C8F-90EA-C26D256CA195}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{65B935CB-F1BB-41B8-8BC3-61CAC02B8553}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{68F6992D-6E9D-4F14-88EC-3E0B8BEC7EFF}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{79E08FA1-907E-4792-861C-1574F9944187}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8642AF85-31DC-4BB3-8E9D-1E478C224084}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{89A123F7-2D1E-431A-A6E6-AAC0A46976DB}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{9D36FEE5-8AA6-472D-9330-5E6B0FED364D}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{A203E9A4-DDBC-4F10-ACD6-DA5B5F3F4048}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{A5589677-56C4-46C1-A86B-1F0B5425786F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AB3FBA72-52C3-4476-9A38-230DBE05659B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B8A089B1-B64E-4311-92F1-A330768F9999}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{BC6DF2ED-5F40-46FA-88CA-A632366DF3B6}" = protocol=6 | dir=in | app=d:\starcraft ii\starcraft ii public test.exe |
"{BC7833D1-AE4B-4CAB-BDD5-6EA587E5C763}" = protocol=6 | dir=out | app=system |
"{BEBA7333-6359-4BB2-947E-2D6830E3EBF7}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{CDCFB721-5120-4F61-AAD0-0A64B5443C6D}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{CE504808-152F-4073-8BB9-0F8E7C4D30C6}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D3648D1D-2BA3-4973-9B7E-EDC907B6E342}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E8715BB0-E132-4617-B344-62E03BFE2C1C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E926E57D-011D-4F63-BCC5-FFCFDC28D091}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EC669489-C90C-4407-A8B9-1D13DC78F8CA}" = protocol=6 | dir=in | app=c:\users\mike\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{EFA98652-B437-42AA-B7D3-EFFD71ED4ECD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F7DCF881-DB9D-4779-8D1C-CCCBAC7C73FF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{3354DAEF-9F00-47F3-823C-185C7B5134CC}D:\guild wars 2\gw2.exe" = protocol=6 | dir=in | app=d:\guild wars 2\gw2.exe |
"TCP Query User{575A04E2-0517-49AB-980E-7B27CCBDD64B}C:\program files (x86)\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"TCP Query User{7DFC56C6-0F21-40E0-B102-5594EEFCC426}D:\starcraft ii\versions\base23260\sc2.exe" = protocol=6 | dir=in | app=d:\starcraft ii\versions\base23260\sc2.exe |
"TCP Query User{830033FC-A04F-4C35-B368-92759695BCC7}D:\starcraft ii\versions\base22612\sc2.exe" = protocol=6 | dir=in | app=d:\starcraft ii\versions\base22612\sc2.exe |
"TCP Query User{BAAD1355-C020-4FBC-A402-4255045F64C4}C:\program files (x86)\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"TCP Query User{C0B9F722-FD29-4302-9482-786222DC57F5}C:\program files (x86)\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"TCP Query User{D390C89D-1CB9-4925-9B42-82BCB960EA62}D:\starcraft ii\starcraft ii.exe" = protocol=6 | dir=in | app=d:\starcraft ii\starcraft ii.exe |
"TCP Query User{DD44DE60-CBD8-42BD-90E2-351BD4334D80}C:\users\mike\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\mike\appdata\local\akamai\netsession_win.exe |
"TCP Query User{DDEF59A5-0B00-4A9B-8EDD-A9F6BB908102}C:\users\mike\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\mike\appdata\roaming\spotify\spotify.exe |
"TCP Query User{DEAA04B2-B437-44CF-B40D-23113741CC4D}C:\users\mike\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\mike\appdata\local\akamai\netsession_win.exe |
"UDP Query User{1770F461-7173-4701-95A9-94839CB8C6F9}C:\program files (x86)\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"UDP Query User{4546C611-A1BC-42A0-9227-D5638086F114}C:\users\mike\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\mike\appdata\roaming\spotify\spotify.exe |
"UDP Query User{6A867515-6E22-4050-A851-3F7C1C1FED7B}D:\guild wars 2\gw2.exe" = protocol=17 | dir=in | app=d:\guild wars 2\gw2.exe |
"UDP Query User{81770B72-7F38-4237-92DB-A5C4E614AD03}D:\starcraft ii\versions\base23260\sc2.exe" = protocol=17 | dir=in | app=d:\starcraft ii\versions\base23260\sc2.exe |
"UDP Query User{8CDFB362-C8F4-4AEE-AD22-F7F387CD9AC7}C:\users\mike\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\mike\appdata\local\akamai\netsession_win.exe |
"UDP Query User{91C1CB2F-DBCC-4886-BE93-09485EB0D795}D:\starcraft ii\versions\base22612\sc2.exe" = protocol=17 | dir=in | app=d:\starcraft ii\versions\base22612\sc2.exe |
"UDP Query User{A1A12196-CF31-4632-8FAE-15CB9DA0DACD}D:\starcraft ii\starcraft ii.exe" = protocol=17 | dir=in | app=d:\starcraft ii\starcraft ii.exe |
"UDP Query User{D03385D0-F681-46AF-9806-848F64AC747D}C:\program files (x86)\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"UDP Query User{D38FFA69-83A6-450C-928A-714036167751}C:\users\mike\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\mike\appdata\local\akamai\netsession_win.exe |
"UDP Query User{D5BD26C3-31E5-4DA8-918F-4243D9F6A0C9}C:\program files (x86)\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1AAF3A3B-7B32-4DDF-8ABB-438DAEB46EEC}" = Windows Live Family Safety
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{206BD2C5-DE08-4577-A0D7-D441A79D5A3A}" = Windows Live Remote Client Resources
"{26A24AE4-039D-4CA4-87B4-2F86417005FF}" = Java™ 7 Update 5 (64-bit)
"{289809B1-078A-49F3-83D0-7E51715B3915}" = Windows Live Family Safety
"{3946328A-5B3A-434C-A22B-64CF6652FBAD}" = Windows Live Family Safety
"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Intel® Turbo Boost Technology Monitor
"{401C50F6-B443-43EE-8F27-A80DB19B03FD}" = Windows Live Family Safety
"{45C1C61B-9DA9-4B61-8C89-C76B1746C3AA}" = Fresco Logic USB3.0 Host Controller
"{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}" = Windows Live Family Safety
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5E11C972-1E76-45FE-8F92-14E0D1140B1B}" = iTunes
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{64A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java™ SE Development Kit 7 (64-bit)
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{78DC83C7-7E9D-4518-8DFE-C8BBF69173D9}" = AVG 2011
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{90140000-006D-0409-1000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{911519EB-BD75-4B3B-BD17-BA3747C9B854}" = Windows Live Family Safety
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{AE91E0F3-C49A-4EF4-8B98-A07BD409EB90}" = Windows Live Remote Service Resources
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 306.23
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 306.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 306.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF1FFBA0-5851-46D1-90E8-818E4E75CCCF}" = AVG 2011
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"{FE4BE0BD-1EDB-4D24-9614-847B3C472887}" = Windows Live Family Safety
"2AA10AB519DC7432D599A0E860206A7DDCC27764" = Windows Driver Package - Broadcom Bluetooth (07/29/2009 6.1.7100.0)
"3BA80AB4C7E9F8497C115C844953A3D4BEB84D21" = Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)
"6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1" = Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405)
"7341A1B43E7FE58942EB1E820A17C18305DFBCE6" = Windows Driver Package - Broadcom Bluetooth (01/19/2010 6.2.0.1417)
"85CE3A3657FAE5FD305B143E90E6FC89BA53001C" = Windows Driver Package - Broadcom (BTHUSB) Bluetooth (02/25/2010 6.2.0.9419)
"AVG" = AVG 2011
"CCleaner" = CCleaner
"KLiteCodecPack64_is1" = K-Lite Codec Pack 5.5.0 (64-bit)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"MiKTeX 2.9" = MiKTeX 2.9
"Sibelius 7.0.0.23_is1" = Sibelius [removed]
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.20 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000F2A10-9CDF-47BF-9CF2-9AC87567B433}" = Windows Live Photo Common
"{02EE09E7-958A-4E7F-80B6-8BA2D262BD04}" = ASUS AI Recovery
"{03241D8D-2217-42F7-9FCB-6A68D141C14D}" = Windows Live 软件包
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{09F56A49-A7B1-4AAB-95B9-D13094254AD1}" = Windows Live UX Platform Language Pack
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{21B49B4A-BBC3-4A09-9C68-6C3CC0B1EA01}" = Windows Live Messenger
"{23181592-0ECD-4A16-81C6-F0424D2DCABF}" = Windows Live UX Platform Language Pack
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2AD2DD70-27F7-4343-BB4E-DE50A32D854B}" = Windows Live Messenger
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{317D56AC-0DB3-48F5-929A-42032DAC9AD7}" = Windows Live Writer
"{32C01DD0-3260-4D2B-BDB2-36CEC3E5B27A}" = Windows Live UX Platform Language Pack
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{341697D8-9923-445E-B42A-529E5A99CB7A}" = syncables desktop SE
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{3A09ED0F-8DDF-47BB-B53D-841AB9D1D3A7}" = Complemento Messenger
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{43D16DA8-BF42-3C62-89D3-3AD47829DC2E}" = Google Talk Plugin
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{499DED08-6FA8-4749-8E94-8526CC9D1CA8}" = ExpressGate Cloud
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A275FD1-2F24-4274-8C01-813F5AD1A92D}" = Windows Live Messenger
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{588CE0C0-860B-49A8-AFCF-3C69465B345F}" = Windows Live Mesh
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{6057E21C-ABE9-4059-AE3E-3BEB9925E660}" = Windows Live Messenger
"{623C2BD8-1B28-4F98-B578-E9D139827269}" = Sibelius 7 OpenType Fonts
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{62BBB2F0-E220-4821-A564-730807D2C34D}" = Realtek USB 2.0 Reader Driver
"{63AE67AA-1AB1-4565-B4EF-ABBC5C841E8D}" = Windows Live Messenger
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E5324C1-84FC-4F76-9A3A-C65E07F80EE6}" = Complément Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7115EEBC-DA7B-434C-B81C-EA5B26EA9A94}" = Windows Live Writer Resources
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{753F0A72-59C3-41CE-A36A-F2DF2079275C}" = Windows Live Mail
"{76046298-768C-492C-8C93-2983C9E3719E}" = Windows Live UX Platform Language Pack
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{7B982EBD-D017-4527-BF1A-FC489EC6B100}" = Windows Live 照片库
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7F061FA8-5A87-4758-876B-17EE28B358D0}" = Messenger 浏览器插件
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{903EDF14-4E28-4463-AA5E-4AEE71C0263B}" = Windows Live Movie Maker
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{939C80FA-96C9-44A6-B318-8E7D8BD8481B}" = Messenger Companion
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{968ECEB6-5476-4131-B5E0-41D01D621243}" = Sibelius Scorch (all browsers)
"{975EA987-5D79-4A1C-AD71-D27B28347B48}" = Across Lite
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.4)
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{B1914510-38B5-4835-83D8-A188073E542F}" = Cheetah Audio Converter
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C23B8C30-E05E-4CB5-8188-F27CC3B2DD3E}" = Sibelius 5
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF088261-BC81-4FB9-9BA0-7B5B9602D01A}" = Messenger 分享元件
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{ED86C4AB-D1E5-42CF-BFA3-56BAAE617D4E}" = Windows Live UX Platform Language Pack
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F187D064-F101-4E95-8D05-4027809AA0F8}" = Avid License Control
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Asus Vibe2.0" = AsusVibe2.0
"Asus_G73_Screensaver" = Asus_G73_Screensaver
"Diablo III" = Diablo III
"DivX Setup" = DivX Setup
"doubleTwist" = doubleTwist
"ESET Online Scanner" = ESET Online Scanner v3
"Google Chrome" = Google Chrome
"Guild Wars 2" = Guild Wars 2
"InstallShield_{499DED08-6FA8-4749-8E94-8526CC9D1CA8}" = ExpressGate Cloud
"Jarte_is1" = Jarte 4.4
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 8.0.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.1.1000
"MinGW_is1" = MinGW 3.1.0
"Mozilla Firefox 16.0.2 (x86 en-US)" = Mozilla Firefox 16.0.2 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"OpenAL" = OpenAL
"SafeConnect" = SafeConnect
"Sibelius Sounds Essentials" = Sibelius Sounds Essentials
"SpywareBlaster_is1" = SpywareBlaster 4.6
"StarCraft II" = StarCraft II
"TeXnicCenter_is1" = TeXnicCenter Version 1.0 Stable RC1
"The Weather Channel App" = The Weather Channel App
"VLC media player" = VLC media player 2.0.1
"Warcraft III" = Warcraft III
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
"Spotify" = Spotify
"Warcraft III" = Warcraft III: All Products

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/22/2012 6:17:04 PM | Computer Name = Mike-PC | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Faulting module name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Exception code: 0xc0000005 Fault offset: 0x0011e331 Faulting process
id: 0x18c4 Faulting application start time: 0x01cd80b3ab214959 Faulting application
path: C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG10\avgmfapx.exe Report Id: 19f920a1-eca7-11e1-b357-74f06dc29160

Error - 8/22/2012 10:00:38 PM | Computer Name = Mike-PC | Source = Application Hang | ID = 1002
Description = The program Diablo III.exe version 1.0.4.11327 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: a4c Start
Time: 01cd80c2bc7b4deb Termination Time: 210 Application Path: C:\Program Files (x86)\Diablo
III\Diablo III.exe Report Id:

Error - 8/23/2012 11:20:44 AM | Computer Name = Mike-PC | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Faulting module name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Exception code: 0xc0000005 Fault offset: 0x0011e331 Faulting process
id: 0x1a00 Faulting application start time: 0x01cd814292641fdb Faulting application
path: C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG10\avgmfapx.exe Report Id: 1aee19b4-ed36-11e1-abe3-74f06dc29160

Error - 8/23/2012 5:03:32 PM | Computer Name = Mike-PC | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Faulting module name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Exception code: 0xc0000005 Fault offset: 0x0011e331 Faulting process
id: 0x1b90 Faulting application start time: 0x01cd817297013e4a Faulting application
path: C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG10\avgmfapx.exe Report Id: fe6922e1-ed65-11e1-abe3-74f06dc29160

Error - 8/24/2012 11:02:06 AM | Computer Name = Mike-PC | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Faulting module name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Exception code: 0xc0000005 Fault offset: 0x0011e331 Faulting process
id: 0x2bc Faulting application start time: 0x01cd820923cdab4b Faulting application
path: C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG10\avgmfapx.exe Report Id: aad06fec-edfc-11e1-b05f-74f06dc29160

Error - 8/24/2012 5:13:36 PM | Computer Name = Mike-PC | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Faulting module name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Exception code: 0xc0000005 Fault offset: 0x0011e331 Faulting process
id: 0x16ec Faulting application start time: 0x01cd823d4724f577 Faulting application
path: C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG10\avgmfapx.exe Report Id: 90b197a3-ee30-11e1-b05f-74f06dc29160

Error - 8/24/2012 6:06:07 PM | Computer Name = Mike-PC | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "c:\program files (x86)\ESET\eset
online scanner\ESETSmartInstaller.exe".Error in manifest or policy file "" on line
. A component version required by the application conflicts with another component
version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error - 8/25/2012 11:04:02 AM | Computer Name = Mike-PC | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Faulting module name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Exception code: 0xc0000005 Fault offset: 0x0011e331 Faulting process
id: 0x7fc Faulting application start time: 0x01cd82d292a5fd00 Faulting application
path: C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG10\avgmfapx.exe Report Id: 1aae6a6e-eec6-11e1-ab66-74f06dc29160

Error - 8/25/2012 6:47:02 PM | Computer Name = Mike-PC | Source = Application Error | ID = 1000
Description = Faulting application name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Faulting module name: avgmfapx.exe, version: 10.0.0.1420, time
stamp: 0x4f15aa69 Exception code: 0xc0000005 Fault offset: 0x0011e331 Faulting process
id: 0x13fc Faulting application start time: 0x01cd83135dae0e68 Faulting application
path: C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe Faulting module path: C:\Program
Files (x86)\AVG\AVG10\avgmfapx.exe Report Id: c909831e-ef06-11e1-ab66-74f06dc29160

Error - 8/25/2012 11:25:14 PM | Computer Name = Mike-PC | Source = Application Hang | ID = 1002
Description = The program Diablo III.exe version 1.0.4.11327 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 88c Start
Time: 01cd8330493b6b86 Termination Time: 505 Application Path: C:\Program Files (x86)\Diablo
III\Diablo III.exe Report Id:

[ Media Center Events ]
Error - 7/14/2011 3:44:53 PM | Computer Name = Mike-PC | Source = MCUpdate | ID = 0
Description = 3:44:46 PM - Error connecting to the internet. 3:44:46 PM - Unable
to contact server..

Error - 8/31/2011 3:33:30 PM | Computer Name = Mike-PC | Source = MCUpdate | ID = 0
Description = 3:33:29 PM - Error connecting to the internet. 3:33:29 PM - Unable
to contact server..

[ System Events ]
Error - 11/6/2012 1:10:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7031
Description = The System Event Notification Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
120000 milliseconds: Restart the service.

Error - 11/6/2012 1:10:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7031
Description = The Shell Hardware Detection service terminated unexpectedly. It
has done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Restart the service.

Error - 11/6/2012 1:10:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7031
Description = The Themes service terminated unexpectedly. It has done this 1 time(s).
The following corrective action will be taken in 60000 milliseconds: Restart the
service.

Error - 11/6/2012 1:10:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7031
Description = The Windows Management Instrumentation service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
120000 milliseconds: Restart the service.

Error - 11/6/2012 1:11:08 PM | Computer Name = Mike-PC | Source = DCOM | ID = 10016
Description =

Error - 11/6/2012 1:11:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7032
Description = The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the Shell Hardware Detection service,
but this action failed with the following error: %%1056

Error - 11/6/2012 1:11:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7032
Description = The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the Server service, but this action
failed with the following error: %%1056

Error - 11/6/2012 1:12:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7032
Description = The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the Windows Management Instrumentation
service, but this action failed with the following error: %%1056

Error - 11/6/2012 1:12:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7032
Description = The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the User Profile Service service,
but this action failed with the following error: %%1056

Error - 11/6/2012 1:12:37 PM | Computer Name = Mike-PC | Source = Service Control Manager | ID = 7032
Description = The Service Control Manager tried to take a corrective action (Restart
the service) after the unexpected termination of the Multimedia Class Scheduler
service, but this action failed with the following error: %%1056

< End of report >

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-11-06 12:31:44
—————————–
12:31:44.335 OS Version: Windows x64 6.1.7601 Service Pack 1
12:31:44.335 Number of processors: 8 586 0x2A07
12:31:44.335 ComputerName: MIKE-PC UserName: Mike
12:31:45.670 Initialize success
12:33:01.214 AVAST engine defs: 12110601
12:33:24.757 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
12:33:24.762 Disk 0 Vendor: ST950042 0003 Size: 476940MB BusType: 3
12:33:24.782 Disk 0 MBR read successfully
12:33:24.787 Disk 0 MBR scan
12:33:24.797 Disk 0 Windows 7 default MBR code
12:33:24.802 Disk 0 Partition 1 00 1C Hidd FAT32 LBA MSDOS5.0 22003 MB offset 63
12:33:24.817 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 119232 MB offset 45062325
12:33:24.827 Disk 0 Partition - 00 0F Extended LBA 335703 MB offset 289251328
12:33:24.857 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 335702 MB offset 289253376
12:33:24.897 Disk 0 scanning C:\Windows\system32\drivers
12:33:35.989 Service scanning
12:33:56.094 Modules scanning
12:33:56.114 Disk 0 trace - called modules:
12:33:56.134 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
12:33:56.149 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80075f8790]
12:33:56.159 3 CLASSPNP.SYS[fffff880013c043f] -> nt!IofCallDriver -> [0xfffffa80071b1630]
12:33:56.169 5 ACPI.sys[fffff88000eff7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80071b7050]
12:33:57.874 AVAST engine scan C:\Windows
12:33:59.609 AVAST engine scan C:\Windows\system32
12:36:40.246 AVAST engine scan C:\Windows\system32\drivers
12:36:52.943 AVAST engine scan C:\Users\Mike
12:40:12.591 AVAST engine scan C:\ProgramData
12:45:25.712 File: C:\ProgramData\Microsoft\Windows\DRM\D412.tmp **INFECTED** Win32:Malware-gen
12:45:25.742 File: C:\ProgramData\Microsoft\Windows\DRM\D413.tmp **INFECTED** Win32:Malware-gen
12:45:25.817 File: C:\ProgramData\Microsoft\Windows\DRM\F7E5.tmp **INFECTED** Win32:Malware-gen
12:45:25.867 File: C:\ProgramData\Microsoft\Windows\DRM\F7E6.tmp **INFECTED** Win32:Malware-gen
12:45:46.690 Scan finished successfully
12:48:04.393 Disk 0 MBR has been saved successfully to "C:\Users\Mike\Desktop\MBR.dat"
12:48:04.398 The log file has been saved successfully to "C:\Users\Mike\Desktop\aswMBR.txt"

OCD

Post #6November 7, 2012, 5:42 PM UTC

Hi arkm,

Run OTL.exe

Windows Vista and Windows 7 users Right Click and select "Run as Administrator"

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
IE - HKCU\..\SearchScopes\{C025B67B-5A2D-47D2-AB18-D2C0FFDAB88F}: "URL" = http://websearch.ask.com/redirect?client=i…9F-BDE81605E9ED
FF - prefs.js..extensions.enabledAddons: [removed]:0.85.36
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{dfefbe51-ca52-484b-adf0-6b158b05262d}: C:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\FirefoxExtension
[2012/07/16 22:23:55 | 000,000,000 | —D | M] (ShopToWin9) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}
[2012/11/01 16:29:18 | 000,000,000 | —D | M] ("Savings Sidekick") – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]
[2012/11/01 16:29:17 | 000,000,000 | —D | M] (No name found) – C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\chrome\content\extensionCode
O3 - HKLM\..\Toolbar: (no name) - {9E131A93-EED7-4BEB-B015-A0ADB30B5646} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found
O4 - HKLM..\Run: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 File not found
O4 - HKLM..\Run: [ROC_ROC_JULY_P1] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1 File not found

:Services
vToolbarUpdater12.2.6

:Commands
[purity]
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Next

Show Hidden Files & Folders in Windows 7

To show hidden files, just click on the Organize button in any folder, and then select “Folder and Search Options” from the menu.
Click the View tab, and then you should select “Show hidden files and folders” in the list.
Then click OK.

Next

Please go to: VirusTotal

[external image: Posted Image]
Click the Browse button and search for the following file: (one file at a time)
- C:\Program Files (x86)\_Z2
- C:\ProgramData\T2
- C:\Program Files (x86)\STLL Notifier
Click Open
Then click Send File
Please be patient while the file is scanned.
Once the scan results appear, please provide them in your next reply.

If it says already scanned – click "reanalyze now"

In your next post please provide the following:
OTL.txt
VirusTotal scan results
How is your computer running now? Still getting the Google redirects?

arkm

Post #7November 7, 2012, 6:14 PM UTC

It doesn't seem like I'm being redirected anymore. The underlining seems to be gone as well. Thanks for your help (so far). All processes killed ========== OTL ========== Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C025B67B-5A2D-47D2-AB18-D2C0FFDAB88F}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C025B67B-5A2D-47D2-AB18-D2C0FFDAB88F}\ not found. Prefs.js: [removed]:0.85.36 removed from extensions.enabledAddons Registry value HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{dfefbe51-ca52-484b-adf0-6b158b05262d} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dfefbe51-ca52-484b-adf0-6b158b05262d}\ not found. File C:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\FirefoxExtension not found. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\META-INF folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\skin folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\locale folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\modules\core\session folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\modules\core folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\modules folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\voicebox\validators folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\voicebox\actions folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\voicebox folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\utils\crypto folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\utils\compression folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\utils folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\substitution\settings folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\substitution\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\substitution folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\settings folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\session\settings folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\session folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\overlay\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\overlay folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\monitoring folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\externalJS\utils folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\externalJS\providers folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\externalJS\parser folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\externalJS\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\externalJS folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\extensionManager folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\exceptions folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\diagnostic\testclick folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\diagnostic\statistic folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\diagnostic\pingModule folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\diagnostic\eventSending folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\diagnostic folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\utils folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\reporters folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\piirules\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\piirules folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\eventsending folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\epochtime\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\epochtime folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\dispatchers\killswitch folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\dispatchers\deadmen folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\dispatchers folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\dcaservice\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\dcaservice folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\cookies folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\clicksending\processors folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\clicksending\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\clicksending folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\ajax\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca\ajax folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\dca folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\cookies folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\caching\storage folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\caching\providers folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\caching\listeners folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\caching\downloaders folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\caching\dispatchers folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\caching\config folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\caching folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core\bus folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\core folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\xhr folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\windows folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\web folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\utils\compression folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\utils folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\tabs folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\storage\preferences folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\storage\file folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\storage folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\notifications folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\logging\appenders folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\logging folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\cookies folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\content folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces\addon folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\interfaces folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\xhr folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\windows folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\web folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\utils\compression folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\utils folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\tabs folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\storage\session folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\storage\registry folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\storage\preferences folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\storage\file folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\storage folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\notifications folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\logging\appenders folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\logging folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\cookies folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\content folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox\addon folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba\firefox folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca\cba folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content\dca folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome\content folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66}\chrome folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{46d606b0-a645-11df-981c-0800200c9a66} folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\skin folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\locale\en-US folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\locale folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\defaults\preferences folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\defaults folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\chrome\content\lib folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\chrome\content\extensionCode folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\chrome\content folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\chrome folder moved successfully. C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed] folder moved successfully. Folder C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\[removed]\chrome\content\extensionCode\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{9E131A93-EED7-4BEB-B015-A0ADB30B5646} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\vProt deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ROC_roc_dec12 deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ROC_ROC_JULY_P1 deleted successfully. ========== SERVICES/DRIVERS ========== Service vToolbarUpdater12.2.6 stopped successfully! Service vToolbarUpdater12.2.6 deleted successfully! ========== COMMANDS ========== Restore point Set: OTL Restore Point [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Mike ->Temp folder emptied: 122445246 bytes ->Temporary Internet Files folder emptied: 72504445 bytes ->Java cache emptied: 762332 bytes ->FireFox cache emptied: 656283463 bytes ->Flash cache emptied: 16501 bytes User: Public ->Temp folder emptied: 0 bytes User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 604362 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes %systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 666 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 813.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 11072012_125743 Files\Folders moved on Reboot… C:\Users\Mike\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Windows\temp\mavcperf-setup.log moved successfully. PendingFileRenameOperations files… Registry entries deleted on Reboot… <><><><><><><><><><><><><><><><><> SHA256: 41854f2c8e86db709b62f97887bd36738a66d634d1eba8d75ea80a4dfe9d076e File name: _Z2 Detection ratio: 0 / 44 Analysis date: 2012-11-07 18:04:07 UTC ( 0 minutes ago ) Antivirus Result Update Agnitum - 20121107 AhnLab-V3 - 20121107 AntiVir - 20121107 Antiy-AVL - 20121107 Avast - 20121107 AVG - 20121107 BitDefender - 20121107 ByteHero - 20121107 CAT-QuickHeal - 20121107 ClamAV - 20121107 Commtouch - 20121107 Comodo - 20121107 DrWeb - 20121107 Emsisoft - 20121107 eSafe - 20121107 ESET-NOD32 - 20121107 F-Prot - 20121106 F-Secure - 20121107 Fortinet - 20121107 GData - 20121107 Ikarus - 20121107 Jiangmin - 20121107 K7AntiVirus - 20121107 Kaspersky - 20121107 Kingsoft - 20121105 McAfee - 20121107 McAfee-GW-Edition - 20121107 Microsoft - 20121107 MicroWorld-eScan - 20121107 Norman - 20121107 nProtect - 20121107 Panda - 20121107 PCTools - 20121107 Rising - 20121107 Sophos - 20121107 SUPERAntiSpyware - 20121107 Symantec - 20121107 TheHacker - 20121107 TotalDefense - 20121106 TrendMicro - 20121107 TrendMicro-HouseCall - 20121107 VBA32 - 20121107 VIPRE - 20121107 ViRobot - 20121107 SHA256: f6a2507a9171ca4b1c37afbdcd81348ca78af48c0902d3e6a2b445474de32e3e File name: T2 Detection ratio: 0 / 44 Analysis date: 2012-11-07 18:06:35 UTC ( 0 minutes ago ) Antivirus Result Update Agnitum - 20121107 AhnLab-V3 - 20121107 AntiVir - 20121107 Antiy-AVL - 20121107 Avast - 20121107 AVG - 20121107 BitDefender - 20121107 ByteHero - 20121107 CAT-QuickHeal - 20121107 ClamAV - 20121107 Commtouch - 20121107 Comodo - 20121107 DrWeb - 20121107 Emsisoft - 20121107 eSafe - 20121107 ESET-NOD32 - 20121107 F-Prot - 20121106 F-Secure - 20121107 Fortinet - 20121107 GData - 20121107 Ikarus - 20121107 Jiangmin - 20121107 K7AntiVirus - 20121107 Kaspersky - 20121107 Kingsoft - 20121105 McAfee - 20121107 McAfee-GW-Edition - 20121107 Microsoft - 20121107 MicroWorld-eScan - 20121107 Norman - 20121107 nProtect - 20121107 Panda - 20121107 PCTools - 20121107 Rising - 20121107 Sophos - 20121107 SUPERAntiSpyware - 20121107 Symantec - 20121107 TheHacker - 20121107 TotalDefense - 20121106 TrendMicro - 20121107 TrendMicro-HouseCall - 20121107 VBA32 - 20121107 VIPRE - 20121107 ViRobot - 20121107 SHA256: ee0aec2f15dfd91d88b1a2c62f7d1562ff460a5e937ab5ffdc9a3fe33714cdc9 File name: STLL Notifier Detection ratio: 0 / 44 Analysis date: 2012-11-07 18:07:27 UTC ( 0 minutes ago ) Antivirus Result Update Agnitum - 20121107 AhnLab-V3 - 20121107 AntiVir - 20121107 Antiy-AVL - 20121107 Avast - 20121107 AVG - 20121107 BitDefender - 20121107 ByteHero - 20121107 CAT-QuickHeal - 20121107 ClamAV - 20121107 Commtouch - 20121107 Comodo - 20121107 DrWeb - 20121107 Emsisoft - 20121107 eSafe - 20121107 ESET-NOD32 - 20121107 F-Prot - 20121106 F-Secure - 20121107 Fortinet - 20121107 GData - 20121107 Ikarus - 20121107 Jiangmin - 20121107 K7AntiVirus - 20121107 Kaspersky - 20121107 Kingsoft - 20121105 McAfee - 20121107 McAfee-GW-Edition - 20121107 Microsoft - 20121107 MicroWorld-eScan - 20121107 Norman - 20121107 nProtect - 20121107 Panda - 20121107 PCTools - 20121107 Rising - 20121107 Sophos - 20121107 SUPERAntiSpyware - 20121107 Symantec - 20121107 TheHacker - 20121107 TotalDefense - 20121106 TrendMicro - 20121107 TrendMicro-HouseCall - 20121107 VBA32 - 20121107 VIPRE - 20121107 ViRobot - 20121107

arkm

Post #8November 7, 2012, 8:05 PM UTC

Actually, I am still getting redirected from google, but it doesn't seem to be happening as often. The underlined stuff still seems to be gone completely though.

OCD

Post #9November 8, 2012, 1:09 AM UTC

Hi arkm,

Download and run ComboFix (select one of the following locations)

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
(remember to re-enable them when we're done)
Windows Vista and Windows 7 users Right Click and select "Run as Administrator"
To run ComboFix.exe, Right click and select "Run as Administrator" & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

In your next post please provide the following:
ComboFix.txt

arkm

Post #10November 8, 2012, 2:57 AM UTC

ComboFix 12-11-06.03 - Mike 11/07/2012 21:48:58.3.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8169.6230 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Microsoft\Windows\DRM\D412.tmp c:\programdata\Microsoft\Windows\DRM\D413.tmp c:\programdata\Microsoft\Windows\DRM\F7E5.tmp c:\programdata\Microsoft\Windows\DRM\F7E6.tmp . . ((((((((((((((((((((((((( Files Created from 2012-10-08 to 2012-11-08 ))))))))))))))))))))))))))))))) . . 2012-11-07 17:57 . 2012-11-07 17:57 ——– d—–w- C:\_OTL 2012-11-04 21:53 . 2012-11-04 21:53 ——– d—–w- c:\users\Mike\AppData\Roaming\Leadertech 2012-11-04 21:51 . 2012-11-04 21:51 ——– d—–w- c:\programdata\Pinnacle 2012-11-04 20:35 . 2012-11-08 02:53 ——– d—–w- c:\users\Mike\AppData\Local\PMB Files 2012-11-04 20:35 . 2012-11-04 22:08 ——– d—–w- c:\programdata\PMB Files 2012-11-04 20:35 . 2012-11-04 20:35 ——– d—–w- c:\program files (x86)\Pando Networks 2012-11-04 20:28 . 2012-11-04 20:28 ——– d—–w- c:\users\Mike\AppData\Local\Downloaded Installations 2012-11-04 20:28 . 2012-11-04 20:28 ——– d—–w- c:\program files\Common Files\Propellerhead Software 2012-11-04 20:28 . 2012-11-04 20:28 ——– d—–w- c:\program files (x86)\Common Files\Propellerhead Software 2012-11-04 20:27 . 2012-11-04 20:27 ——– d—–w- c:\program files (x86)\Common Files\Avid 2012-11-04 20:26 . 2012-11-04 21:53 ——– d—–w- c:\users\Mike\AppData\Roaming\Avid 2012-11-04 20:26 . 2012-11-04 21:51 ——– d—–w- c:\programdata\Avid 2012-11-04 20:26 . 2012-11-04 20:28 ——– d—–w- c:\program files (x86)\Avid 2012-11-04 20:26 . 2012-11-04 20:26 ——– d—–w- c:\program files\Avid 2012-11-01 22:10 . 2012-11-01 22:10 ——– d—–w- c:\program files\WinRAR 2012-11-01 21:46 . 2012-11-03 16:35 ——– d—–w- c:\program files (x86)\Project64 1.6 2012-10-30 18:34 . 2012-09-25 03:16 95208 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-10-10 12:33 . 2012-06-02 05:41 1464320 —-a-w- c:\windows\system32\crypt32.dll 2012-10-10 12:33 . 2012-06-02 05:41 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-10-10 12:33 . 2012-06-02 05:41 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-10-10 12:33 . 2012-06-02 04:36 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-10-10 12:33 . 2012-06-02 04:36 1159680 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-10-10 12:33 . 2012-06-02 04:36 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-07 17:59 . 2011-05-15 15:27 45056 —-a-w- c:\windows\system32\acovcnt.exe 2012-10-11 04:54 . 2011-06-29 20:12 65309168 —-a-w- c:\windows\system32\MRT.exe 2012-10-08 22:10 . 2012-03-30 13:22 696760 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-08 22:10 . 2011-07-19 17:45 73656 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-29 23:54 . 2011-11-14 15:53 25928 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-09-04 00:25 . 2012-09-04 00:25 31080 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2012-09-01 05:24 . 2012-08-28 22:58 821736 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-09-01 05:24 . 2011-06-28 17:31 746984 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-08-30 19:14 . 2012-09-16 03:55 9066344 —-a-w- c:\windows\system32\nvcuda.dll 2012-08-30 19:14 . 2012-09-16 03:55 7626088 —-a-w- c:\windows\SysWow64\nvcuda.dll 2012-08-30 19:14 . 2012-09-16 03:55 7397736 —-a-w- c:\windows\system32\nvopencl.dll 2012-08-30 19:14 . 2012-09-16 03:55 6109032 —-a-w- c:\windows\SysWow64\nvopencl.dll 2012-08-30 19:14 . 2012-09-16 03:55 2745192 —-a-w- c:\windows\system32\nvcuvid.dll 2012-08-30 19:14 . 2012-09-16 03:55 26228072 —-a-w- c:\windows\system32\nvoglv64.dll 2012-08-30 19:14 . 2012-09-16 03:55 2573672 —-a-w- c:\windows\SysWow64\nvcuvid.dll 2012-08-30 19:14 . 2012-09-16 03:55 25256296 —-a-w- c:\windows\system32\nvcompiler.dll 2012-08-30 19:14 . 2012-09-16 03:55 2216808 —-a-w- c:\windows\system32\nvcuvenc.dll 2012-08-30 19:14 . 2012-09-16 03:55 19828584 —-a-w- c:\windows\SysWow64\nvoglv32.dll 2012-08-30 19:14 . 2012-09-16 03:55 1866088 —-a-w- c:\windows\SysWow64\nvcuvenc.dll 2012-08-30 19:14 . 2012-09-16 03:55 1760104 —-a-w- c:\windows\system32\nvdispco64.dll 2012-08-30 19:14 . 2012-09-16 03:55 17559912 —-a-w- c:\windows\SysWow64\nvcompiler.dll 2012-08-30 19:14 . 2012-09-16 03:55 1482600 —-a-w- c:\windows\system32\nvdispgenco64.dll 2012-08-30 19:14 . 2012-09-16 03:55 13391720 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys 2012-08-30 19:14 . 2012-05-15 21:46 2422120 —-a-w- c:\windows\SysWow64\nvapi.dll 2012-08-30 19:14 . 2012-05-15 21:46 18229096 —-a-w- c:\windows\system32\nvd3dumx.dll 2012-08-30 19:14 . 2010-10-29 07:54 2725224 —-a-w- c:\windows\system32\nvapi64.dll 2012-08-30 19:14 . 2010-10-29 07:54 15291752 —-a-w- c:\windows\SysWow64\nvd3dum.dll 2012-08-30 19:14 . 2010-10-29 07:54 14879080 —-a-w- c:\windows\system32\nvwgf2umx.dll 2012-08-30 19:14 . 2010-10-29 07:54 12465512 —-a-w- c:\windows\SysWow64\nvwgf2um.dll 2012-08-30 16:18 . 2011-03-06 10:45 891240 —-a-w- c:\windows\system32\nvvsvc.exe 2012-08-30 16:18 . 2011-03-06 10:45 2557800 —-a-w- c:\windows\system32\nvsvcr.dll 2012-08-30 16:18 . 2011-03-06 10:45 118120 —-a-w- c:\windows\system32\nvmctray.dll 2012-08-30 16:18 . 2010-10-29 11:38 63336 —-a-w- c:\windows\system32\nvshext.dll 2012-08-30 16:18 . 2011-03-06 10:44 3266920 —-a-w- c:\windows\system32\nvsvc64.dll 2012-08-30 16:17 . 2011-03-06 10:44 6198120 —-a-w- c:\windows\system32\nvcpl.dll 2012-08-30 14:40 . 2012-08-30 14:40 429416 —-a-w- c:\windows\SysWow64\nvStreaming.exe 2012-08-24 11:15 . 2012-09-23 06:22 17810944 —-a-w- c:\windows\system32\mshtml.dll 2012-08-24 10:39 . 2012-09-23 06:22 10925568 —-a-w- c:\windows\system32\ieframe.dll 2012-08-24 10:31 . 2012-09-23 06:23 2312704 —-a-w- c:\windows\system32\jscript9.dll 2012-08-24 10:22 . 2012-09-23 06:23 1346048 —-a-w- c:\windows\system32\urlmon.dll 2012-08-24 10:21 . 2012-09-23 06:22 1392128 —-a-w- c:\windows\system32\wininet.dll 2012-08-24 10:20 . 2012-09-23 06:23 1494528 —-a-w- c:\windows\system32\inetcpl.cpl 2012-08-24 10:18 . 2012-09-23 06:23 237056 —-a-w- c:\windows\system32\url.dll 2012-08-24 10:17 . 2012-09-23 06:22 85504 —-a-w- c:\windows\system32\jsproxy.dll 2012-08-24 10:14 . 2012-09-23 06:23 173056 —-a-w- c:\windows\system32\ieUnatt.exe 2012-08-24 10:14 . 2012-09-23 06:22 816640 —-a-w- c:\windows\system32\jscript.dll 2012-08-24 10:13 . 2012-09-23 06:22 599040 —-a-w- c:\windows\system32\vbscript.dll 2012-08-24 10:12 . 2012-09-23 06:22 2144768 —-a-w- c:\windows\system32\iertutil.dll 2012-08-24 10:11 . 2012-09-23 06:22 729088 —-a-w- c:\windows\system32\msfeeds.dll 2012-08-24 10:10 . 2012-09-23 06:23 96768 —-a-w- c:\windows\system32\mshtmled.dll 2012-08-24 10:09 . 2012-09-23 06:23 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2012-08-24 10:04 . 2012-09-23 06:23 248320 —-a-w- c:\windows\system32\ieui.dll 2012-08-24 06:59 . 2012-09-23 06:22 1800704 —-a-w- c:\windows\SysWow64\jscript9.dll 2012-08-24 06:51 . 2012-09-23 06:22 1129472 —-a-w- c:\windows\SysWow64\wininet.dll 2012-08-24 06:51 . 2012-09-23 06:23 1427968 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2012-08-24 06:47 . 2012-09-23 06:23 142848 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2012-08-24 06:47 . 2012-09-23 06:23 420864 —-a-w- c:\windows\SysWow64\vbscript.dll 2012-08-24 06:43 . 2012-09-23 06:23 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb 2012-08-22 18:12 . 2012-09-12 19:42 1913200 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-08-22 18:12 . 2012-09-12 19:42 950128 —-a-w- c:\windows\system32\drivers\ndis.sys 2012-08-22 18:12 . 2012-09-12 19:42 376688 —-a-w- c:\windows\system32\drivers\netio.sys 2012-08-22 18:12 . 2012-09-12 19:42 288624 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-08-21 21:01 . 2012-09-26 15:19 245760 —-a-w- c:\windows\system32\OxpsConverter.exe 2012-08-20 17:38 . 2012-10-10 12:34 44032 —-a-w- c:\windows\apppatch\acwow64.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 94208 —-a-w- c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Akamai NetSession Interface"="c:\users\Mike\AppData\Local\Akamai\netsession_win.exe" [2012-10-09 4441920] "Spotify Web Helper"="c:\users\Mike\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-10-13 1193176] "Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2012-11-04 3093624] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624] "HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016] "Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536] "ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2011-05-15 3058304] "VAWinAgent"="c:\expressgateutil\VAWinAgent.exe" [2010-08-13 21504] "FLxHCIm"="c:\program files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2010-11-19 37888] "AVG_TRAY"="c:\program files (x86)\AVG\AVG10\avgtray.exe" [2011-04-18 2334560] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Mike\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-5-15 548528] Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-11 1083680] SafeConnect.lnk - c:\program files (x86)\SafeConnect\scClient.exe [2011-5-16 298368] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart . R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2011-04-18 7398752] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R2 VideAceWindowsService;VideAceWindowsService;c:\expressgateutil\VAWinService.exe [2010-08-21 77312] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-11-10 167264] R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-12-14 53800] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104] R3 cpuz130;cpuz130;c:\users\Mike\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-05-15 79360] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928] R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416] R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-08-03 290920] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-06-19 1255736] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 26704] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2011-03-16 37456] S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2011-01-07 304720] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-03-01 41552] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2011-04-05 377936] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2012-09-04 31080] S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [2011-07-27 14952] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432] S2 SCManager;SafeConnect Manager;c:\program files (x86)\SafeConnect\scManager.sys servicestart [x] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-08-30 382312] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-04-16 13832] S2 TurboBoost;Intel® Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-04-16 134928] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-10-06 2655768] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-04-15 118864] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 29264] S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [2010-11-19 210944] S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys [2010-11-19 49664] S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-17 32344] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-06-23 333928] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] . . Contents of the 'Scheduled Tasks' folder . 2012-11-08 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 22:10] . 2012-06-12 c:\windows\Tasks\ASUS SmartLogon Console Sensor.job - c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31 14:38] . 2012-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-15 14:47] . 2012-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-15 14:47] . 2012-11-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1998286848-2347478098-3866965016-1001Core.job - c:\users\Mike\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-01 15:08] . 2012-11-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1998286848-2347478098-3866965016-1001UA.job - c:\users\Mike\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-01 15:08] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2011-02-18 05:12 97792 —-a-w- c:\users\Mike\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelTBRunOnce"="wscript.exe" [2009-07-14 168960] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://asus.msn.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local; TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxps://mail.google.com/mail/?shva=1#inbox FF - ExtSQL: 2012-10-20 14:57; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\q2eu0gqv.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-SynAsusAcpi - c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-11-07 21:55:30 ComboFix-quarantined-files.txt 2012-11-08 02:55 . Pre-Run: 48,046,514,176 bytes free Post-Run: 47,972,478,976 bytes free . - - End Of File - - 63EFC44EC398B09534BA9A44022E277F

OCD

Post #11November 8, 2012, 5:11 PM UTC

Please download TDSSKiller.zip

Extract it to your desktop
TDSSKiller.exe - Right click and select "Run as Administrator".
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

In your next post please provide the following:
TDSSKiller log

arkm

Post #12November 8, 2012, 5:46 PM UTC

Nothing was detected. I'm happy to do more tests if you want. I don't think I've been redirected since yesterday, but I will let you know if it happens again. Again, thanks for your help. 12:42:00.0149 8172 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 12:42:00.0667 8172 ============================================================ 12:42:00.0667 8172 Current date / time: 2012/11/08 12:42:00.0667 12:42:00.0667 8172 SystemInfo: 12:42:00.0667 8172 12:42:00.0667 8172 OS Version: 6.1.7601 ServicePack: 1.0 12:42:00.0667 8172 Product type: Workstation 12:42:00.0668 8172 ComputerName: MIKE-PC 12:42:00.0668 8172 UserName: Mike 12:42:00.0668 8172 Windows directory: C:\Windows 12:42:00.0668 8172 System windows directory: C:\Windows 12:42:00.0668 8172 Running under WOW64 12:42:00.0668 8172 Processor architecture: Intel x64 12:42:00.0668 8172 Number of processors: 8 12:42:00.0668 8172 Page size: 0x1000 12:42:00.0668 8172 Boot type: Normal boot 12:42:00.0668 8172 ============================================================ 12:42:01.0106 8172 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 12:42:01.0110 8172 ============================================================ 12:42:01.0110 8172 \Device\Harddisk0\DR0: 12:42:01.0111 8172 MBR partitions: 12:42:01.0111 8172 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2AF98B5, BlocksNum 0xE8E0360 12:42:01.0128 8172 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x113DA800, BlocksNum 0x28FAB000 12:42:01.0128 8172 ============================================================ 12:42:01.0154 8172 C: <-> \Device\Harddisk0\DR0\Partition1 12:42:01.0193 8172 D: <-> \Device\Harddisk0\DR0\Partition2 12:42:01.0193 8172 ============================================================ 12:42:01.0193 8172 Initialize success 12:42:01.0193 8172 ============================================================ 12:42:10.0260 7428 ============================================================ 12:42:10.0260 7428 Scan started 12:42:10.0260 7428 Mode: Manual; 12:42:10.0260 7428 ============================================================ 12:42:11.0135 7428 ================ Scan system memory ======================== 12:42:11.0135 7428 System memory - ok 12:42:11.0136 7428 ================ Scan services ============================= 12:42:11.0244 7428 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys 12:42:11.0254 7428 1394ohci - ok 12:42:11.0279 7428 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys 12:42:11.0287 7428 ACPI - ok 12:42:11.0306 7428 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys 12:42:11.0310 7428 AcpiPmi - ok 12:42:11.0500 7428 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 12:42:11.0505 7428 AdobeARMservice - ok 12:42:11.0654 7428 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 12:42:11.0659 7428 AdobeFlashPlayerUpdateSvc - ok 12:42:11.0713 7428 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys 12:42:11.0739 7428 adp94xx - ok 12:42:11.0777 7428 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys 12:42:11.0797 7428 adpahci - ok 12:42:11.0804 7428 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys 12:42:11.0810 7428 adpu320 - ok 12:42:11.0838 7428 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 12:42:11.0840 7428 AeLookupSvc - ok 12:42:11.0879 7428 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys 12:42:11.0896 7428 AFD - ok 12:42:11.0924 7428 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys 12:42:11.0927 7428 agp440 - ok 12:42:11.0937 7428 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe 12:42:11.0942 7428 ALG - ok 12:42:11.0952 7428 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys 12:42:11.0955 7428 aliide - ok 12:42:11.0967 7428 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys 12:42:11.0971 7428 amdide - ok 12:42:11.0986 7428 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys 12:42:11.0990 7428 AmdK8 - ok 12:42:12.0002 7428 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys 12:42:12.0005 7428 AmdPPM - ok 12:42:12.0037 7428 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys 12:42:12.0041 7428 amdsata - ok 12:42:12.0061 7428 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys 12:42:12.0068 7428 amdsbs - ok 12:42:12.0085 7428 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys 12:42:12.0087 7428 amdxata - ok 12:42:12.0117 7428 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys 12:42:12.0121 7428 AppID - ok 12:42:12.0132 7428 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll 12:42:12.0135 7428 AppIDSvc - ok 12:42:12.0154 7428 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll 12:42:12.0157 7428 Appinfo - ok 12:42:12.0210 7428 [ 3DEBBECF665DCDDE3A95D9B902010817 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 12:42:12.0214 7428 Apple Mobile Device - ok 12:42:12.0252 7428 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys 12:42:12.0257 7428 arc - ok 12:42:12.0273 7428 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys 12:42:12.0278 7428 arcsas - ok 12:42:12.0323 7428 [ 18E5C2F937F9DEB8C282DF66A3761925 ] ASLDRService C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe 12:42:12.0327 7428 ASLDRService - ok 12:42:12.0365 7428 [ 4C016FD76ED5C05E84CA8CAB77993961 ] ASMMAP64 C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys 12:42:12.0367 7428 ASMMAP64 - ok 12:42:12.0456 7428 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 12:42:12.0458 7428 aspnet_state - ok 12:42:12.0485 7428 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 12:42:12.0489 7428 AsyncMac - ok 12:42:12.0526 7428 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys 12:42:12.0528 7428 atapi - ok 12:42:12.0616 7428 [ A5E770426D18F8EF332A593F3289DA91 ] athr C:\Windows\system32\DRIVERS\athrx.sys 12:42:12.0692 7428 athr - ok 12:42:12.0709 7428 [ 7910158929571214A959D5A6D16DD9C0 ] ATKGFNEXSrv C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe 12:42:12.0713 7428 ATKGFNEXSrv - ok 12:42:12.0754 7428 [ 1F7238A37389ED92E9D8EEE975CABD54 ] ATKWMIACPIIO C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys 12:42:12.0757 7428 ATKWMIACPIIO - ok 12:42:12.0803 7428 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 12:42:12.0829 7428 AudioEndpointBuilder - ok 12:42:12.0858 7428 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll 12:42:12.0866 7428 AudioSrv - ok 12:42:12.0972 7428 [ D45B7995761253A92AB071D576114F28 ] AVG Security Toolbar Service C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe 12:42:12.0975 7428 AVG Security Toolbar Service - ok 12:42:13.0155 7428 [ 37DFF4CEE590B6D081EFE18FB2C377DB ] AVGIDSAgent C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe 12:42:13.0189 7428 AVGIDSAgent - ok 12:42:13.0213 7428 [ EEE718457F24F2154F23A7FAD1A0CEA3 ] AVGIDSDriver C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys 12:42:13.0215 7428 AVGIDSDriver - ok 12:42:13.0230 7428 [ 1553B388E0F0462C25AD8F30C3C29E83 ] AVGIDSEH C:\Windows\system32\DRIVERS\AVGIDSEH.Sys 12:42:13.0233 7428 AVGIDSEH - ok 12:42:13.0250 7428 [ DCA426A66739E75F51A72160DFB945AD ] AVGIDSFilter C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys 12:42:13.0253 7428 AVGIDSFilter - ok 12:42:13.0279 7428 [ FF7383388A7D2283DAE5831ABC2B0720 ] Avgldx64 C:\Windows\system32\DRIVERS\avgldx64.sys 12:42:13.0282 7428 Avgldx64 - ok 12:42:13.0291 7428 [ 997D002827D3E3DCBBB25BF46DB161AB ] Avgmfx64 C:\Windows\system32\DRIVERS\avgmfx64.sys 12:42:13.0293 7428 Avgmfx64 - ok 12:42:13.0327 7428 [ BCCFE3374C887075CDE2AC8FDB1CB2F8 ] Avgrkx64 C:\Windows\system32\DRIVERS\avgrkx64.sys 12:42:13.0328 7428 Avgrkx64 - ok 12:42:13.0347 7428 [ 0D49ADCEBE243B79366EA523B647519A ] Avgtdia C:\Windows\system32\DRIVERS\avgtdia.sys 12:42:13.0352 7428 Avgtdia - ok 12:42:13.0380 7428 [ A313C4AE276E3C975A1BC27170AA23C6 ] avgtp C:\Windows\system32\drivers\avgtpx64.sys 12:42:13.0382 7428 avgtp - ok 12:42:13.0409 7428 [ FC2BC51120A945F7C70376495E4E7737 ] avgwd C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe 12:42:13.0412 7428 avgwd - ok 12:42:13.0463 7428 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll 12:42:13.0467 7428 AxInstSV - ok 12:42:13.0501 7428 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys 12:42:13.0511 7428 b06bdrv - ok 12:42:13.0539 7428 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys 12:42:13.0546 7428 b57nd60a - ok 12:42:13.0571 7428 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll 12:42:13.0576 7428 BDESVC - ok 12:42:13.0589 7428 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys 12:42:13.0591 7428 Beep - ok 12:42:13.0639 7428 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll 12:42:13.0661 7428 BFE - ok 12:42:13.0693 7428 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\system32\qmgr.dll 12:42:13.0718 7428 BITS - ok 12:42:13.0739 7428 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys 12:42:13.0743 7428 blbdrive - ok 12:42:13.0844 7428 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 12:42:13.0867 7428 Bonjour Service - ok 12:42:13.0898 7428 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 12:42:13.0904 7428 bowser - ok 12:42:13.0920 7428 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys 12:42:13.0924 7428 BrFiltLo - ok 12:42:13.0939 7428 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys 12:42:13.0943 7428 BrFiltUp - ok 12:42:13.0980 7428 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys 12:42:13.0985 7428 BridgeMP - ok 12:42:14.0018 7428 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll 12:42:14.0025 7428 Browser - ok 12:42:14.0046 7428 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys 12:42:14.0056 7428 Brserid - ok 12:42:14.0071 7428 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys 12:42:14.0074 7428 BrSerWdm - ok 12:42:14.0090 7428 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys 12:42:14.0094 7428 BrUsbMdm - ok 12:42:14.0102 7428 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys 12:42:14.0105 7428 BrUsbSer - ok 12:42:14.0135 7428 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys 12:42:14.0138 7428 BthEnum - ok 12:42:14.0156 7428 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys 12:42:14.0160 7428 BTHMODEM - ok 12:42:14.0174 7428 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys 12:42:14.0178 7428 BthPan - ok 12:42:14.0199 7428 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys 12:42:14.0240 7428 BTHPORT - ok 12:42:14.0272 7428 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll 12:42:14.0276 7428 bthserv - ok 12:42:14.0286 7428 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys 12:42:14.0290 7428 BTHUSB - ok 12:42:14.0322 7428 [ D3466F77C2C49C6E393BA5FBA963A33E ] btusbflt C:\Windows\system32\drivers\btusbflt.sys 12:42:14.0325 7428 btusbflt - ok 12:42:14.0351 7428 [ A72A9101F9730DB7332714E566614E4D ] btwaudio C:\Windows\system32\drivers\btwaudio.sys 12:42:14.0354 7428 btwaudio - ok 12:42:14.0365 7428 [ 5CEEC634B617525F2B6AD29F871033F7 ] btwavdt C:\Windows\system32\drivers\btwavdt.sys 12:42:14.0368 7428 btwavdt - ok 12:42:14.0431 7428 [ 4E63C48E7328A11ED0E9075C18FCE782 ] btwdins C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe 12:42:14.0439 7428 btwdins - ok 12:42:14.0493 7428 [ 6149301DC3F81D6F9667A3FBAC410975 ] btwl2cap C:\Windows\system32\DRIVERS\btwl2cap.sys 12:42:14.0497 7428 btwl2cap - ok 12:42:14.0518 7428 [ 2AF5604D28BEF77B7CF4B9D232FE7CD3 ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys 12:42:14.0520 7428 btwrchid - ok 12:42:14.0553 7428 catchme - ok 12:42:14.0573 7428 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 12:42:14.0577 7428 cdfs - ok 12:42:14.0612 7428 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys 12:42:14.0617 7428 cdrom - ok 12:42:14.0654 7428 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll 12:42:14.0657 7428 CertPropSvc - ok 12:42:14.0677 7428 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys 12:42:14.0681 7428 circlass - ok 12:42:14.0713 7428 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys 12:42:14.0730 7428 CLFS - ok 12:42:14.0772 7428 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 12:42:14.0773 7428 clr_optimization_v2.0.50727_32 - ok 12:42:14.0809 7428 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 12:42:14.0811 7428 clr_optimization_v2.0.50727_64 - ok 12:42:14.0861 7428 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 12:42:14.0866 7428 clr_optimization_v4.0.30319_32 - ok 12:42:14.0883 7428 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 12:42:14.0888 7428 clr_optimization_v4.0.30319_64 - ok 12:42:14.0913 7428 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys 12:42:14.0917 7428 CmBatt - ok 12:42:14.0941 7428 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys 12:42:14.0945 7428 cmdide - ok 12:42:14.0978 7428 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys 12:42:14.0987 7428 CNG - ok 12:42:15.0002 7428 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys 12:42:15.0003 7428 Compbatt - ok 12:42:15.0034 7428 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys 12:42:15.0036 7428 CompositeBus - ok 12:42:15.0051 7428 COMSysApp - ok 12:42:15.0112 7428 cpuz130 - ok 12:42:15.0141 7428 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys 12:42:15.0146 7428 crcdisk - ok 12:42:15.0186 7428 [ C0EAD9F8AB83D41FF07303C75589C2B8 ] Creative Audio Engine Licensing Service C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe 12:42:15.0187 7428 Creative Audio Engine Licensing Service - ok 12:42:15.0231 7428 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll 12:42:15.0239 7428 CryptSvc - ok 12:42:15.0332 7428 [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE 12:42:15.0342 7428 cvhsvc - ok 12:42:15.0388 7428 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll 12:42:15.0398 7428 DcomLaunch - ok 12:42:15.0417 7428 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll 12:42:15.0424 7428 defragsvc - ok 12:42:15.0444 7428 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 12:42:15.0448 7428 DfsC - ok 12:42:15.0465 7428 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll 12:42:15.0472 7428 Dhcp - ok 12:42:15.0504 7428 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys 12:42:15.0506 7428 discache - ok 12:42:15.0518 7428 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys 12:42:15.0521 7428 Disk - ok 12:42:15.0544 7428 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll 12:42:15.0549 7428 Dnscache - ok 12:42:15.0575 7428 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll 12:42:15.0582 7428 dot3svc - ok 12:42:15.0602 7428 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll 12:42:15.0607 7428 DPS - ok 12:42:15.0624 7428 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 12:42:15.0627 7428 drmkaud - ok 12:42:15.0660 7428 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 12:42:15.0669 7428 DXGKrnl - ok 12:42:15.0704 7428 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll 12:42:15.0708 7428 EapHost - ok 12:42:15.0802 7428 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys 12:42:15.0905 7428 ebdrv - ok 12:42:15.0929 7428 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe 12:42:15.0932 7428 EFS - ok 12:42:15.0967 7428 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 12:42:15.0974 7428 ehRecvr - ok 12:42:15.0999 7428 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe 12:42:16.0000 7428 ehSched - ok 12:42:16.0041 7428 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys 12:42:16.0062 7428 elxstor - ok 12:42:16.0079 7428 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys 12:42:16.0083 7428 ErrDev - ok 12:42:16.0106 7428 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll 12:42:16.0115 7428 EventSystem - ok 12:42:16.0129 7428 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys 12:42:16.0136 7428 exfat - ok 12:42:16.0150 7428 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys 12:42:16.0157 7428 fastfat - ok 12:42:16.0204 7428 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe 12:42:16.0229 7428 Fax - ok 12:42:16.0241 7428 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys 12:42:16.0245 7428 fdc - ok 12:42:16.0263 7428 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll 12:42:16.0267 7428 fdPHost - ok 12:42:16.0283 7428 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll 12:42:16.0288 7428 FDResPub - ok 12:42:16.0304 7428 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 12:42:16.0308 7428 FileInfo - ok 12:42:16.0318 7428 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys 12:42:16.0321 7428 Filetrace - ok 12:42:16.0333 7428 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys 12:42:16.0336 7428 flpydisk - ok 12:42:16.0368 7428 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 12:42:16.0375 7428 FltMgr - ok 12:42:16.0411 7428 [ D0ADBCF2A5316D23EF67DFAA02D5D544 ] FLxHCIc C:\Windows\system32\DRIVERS\FLxHCIc.sys 12:42:16.0417 7428 FLxHCIc - ok 12:42:16.0439 7428 [ F9B6DB9727AD2F14ECF84E43EB5279F7 ] FLxHCIh C:\Windows\system32\DRIVERS\FLxHCIh.sys 12:42:16.0443 7428 FLxHCIh - ok 12:42:16.0483 7428 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll 12:42:16.0517 7428 FontCache - ok 12:42:16.0553 7428 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 12:42:16.0554 7428 FontCache3.0.0.0 - ok 12:42:16.0575 7428 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys 12:42:16.0580 7428 FsDepends - ok 12:42:16.0605 7428 [ 6C06701BF1DB05405804D7EB610991CE ] fssfltr C:\Windows\system32\DRIVERS\fssfltr.sys 12:42:16.0609 7428 fssfltr - ok 12:42:16.0683 7428 [ 4CE9DAC1518FF7E77BD213E6394B9D77 ] fsssvc C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe 12:42:16.0705 7428 fsssvc - ok 12:42:16.0735 7428 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 12:42:16.0736 7428 Fs_Rec - ok 12:42:16.0774 7428 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys 12:42:16.0782 7428 fvevol - ok 12:42:16.0799 7428 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys 12:42:16.0805 7428 gagp30kx - ok 12:42:16.0846 7428 [ E403AACF8C7BB11375122D2464560311 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 12:42:16.0848 7428 GEARAspiWDM - ok 12:42:16.0886 7428 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll 12:42:16.0910 7428 gpsvc - ok 12:42:16.0968 7428 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 12:42:16.0971 7428 gupdate - ok 12:42:17.0021 7428 [ CC839E8D766CC31A7710C9F38CF3E375 ] gusvc C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe 12:42:17.0024 7428 gusvc - ok 12:42:17.0043 7428 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys 12:42:17.0047 7428 hcw85cir - ok 12:42:17.0082 7428 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 12:42:17.0099 7428 HdAudAddService - ok 12:42:17.0124 7428 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys 12:42:17.0128 7428 HDAudBus - ok 12:42:17.0144 7428 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys 12:42:17.0148 7428 HidBatt - ok 12:42:17.0161 7428 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys 12:42:17.0165 7428 HidBth - ok 12:42:17.0175 7428 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys 12:42:17.0179 7428 HidIr - ok 12:42:17.0210 7428 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll 12:42:17.0215 7428 hidserv - ok 12:42:17.0237 7428 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys 12:42:17.0240 7428 HidUsb - ok 12:42:17.0269 7428 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll 12:42:17.0274 7428 hkmsvc - ok 12:42:17.0297 7428 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll 12:42:17.0306 7428 HomeGroupListener - ok 12:42:17.0334 7428 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll 12:42:17.0342 7428 HomeGroupProvider - ok 12:42:17.0356 7428 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys 12:42:17.0361 7428 HpSAMD - ok 12:42:17.0396 7428 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys 12:42:17.0421 7428 HTTP - ok 12:42:17.0437 7428 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys 12:42:17.0439 7428 hwpolicy - ok 12:42:17.0464 7428 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys 12:42:17.0469 7428 i8042prt - ok 12:42:17.0506 7428 [ F7CE9BE72EDAC499B713ECA6DAE5D26F ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys 12:42:17.0511 7428 iaStor - ok 12:42:17.0552 7428 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys 12:42:17.0569 7428 iaStorV - ok 12:42:17.0612 7428 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 12:42:17.0622 7428 idsvc - ok 12:42:17.0657 7428 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys 12:42:17.0661 7428 iirsp - ok 12:42:17.0719 7428 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll 12:42:17.0753 7428 IKEEXT - ok 12:42:17.0852 7428 [ BD9D02F706FCAF28D89F5435F18A4A04 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys 12:42:17.0872 7428 IntcAzAudAddService - ok 12:42:17.0892 7428 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys 12:42:17.0895 7428 intelide - ok 12:42:17.0920 7428 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys 12:42:17.0921 7428 intelppm - ok 12:42:17.0950 7428 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll 12:42:17.0955 7428 IPBusEnum - ok 12:42:17.0971 7428 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 12:42:17.0975 7428 IpFilterDriver - ok 12:42:18.0020 7428 [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 12:42:18.0040 7428 iphlpsvc - ok 12:42:18.0065 7428 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys 12:42:18.0069 7428 IPMIDRV - ok 12:42:18.0081 7428 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys 12:42:18.0085 7428 IPNAT - ok 12:42:18.0218 7428 [ EE4C2A137C7088911A8919EFFC9812E7 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 12:42:18.0234 7428 iPod Service - ok 12:42:18.0270 7428 [ 02DEF37AB75E0032C50724646F708DE8 ] iPodDrv C:\Windows\system32\drivers\iPodDrv.sys 12:42:18.0277 7428 iPodDrv - ok 12:42:18.0301 7428 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys 12:42:18.0304 7428 IRENUM - ok 12:42:18.0313 7428 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys 12:42:18.0315 7428 isapnp - ok 12:42:18.0345 7428 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys 12:42:18.0352 7428 iScsiPrt - ok 12:42:18.0364 7428 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\drivers\kbdclass.sys 12:42:18.0365 7428 kbdclass - ok 12:42:18.0382 7428 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys 12:42:18.0385 7428 kbdhid - ok 12:42:18.0411 7428 [ E63EF8C3271D014F14E2469CE75FECB4 ] kbfiltr C:\Windows\system32\DRIVERS\kbfiltr.sys 12:42:18.0413 7428 kbfiltr - ok 12:42:18.0420 7428 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe 12:42:18.0422 7428 KeyIso - ok 12:42:18.0449 7428 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 12:42:18.0453 7428 KSecDD - ok 12:42:18.0473 7428 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys 12:42:18.0477 7428 KSecPkg - ok 12:42:18.0491 7428 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys 12:42:18.0494 7428 ksthunk - ok 12:42:18.0536 7428 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll 12:42:18.0546 7428 KtmRm - ok 12:42:18.0573 7428 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\System32\srvsvc.dll 12:42:18.0581 7428 LanmanServer - ok 12:42:18.0608 7428 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 12:42:18.0613 7428 LanmanWorkstation - ok 12:42:18.0640 7428 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 12:42:18.0643 7428 lltdio - ok 12:42:18.0672 7428 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll 12:42:18.0680 7428 lltdsvc - ok 12:42:18.0690 7428 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll 12:42:18.0693 7428 lmhosts - ok 12:42:18.0741 7428 [ 0803906D607A9B83184447B75B60ECC2 ] LMS C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe 12:42:18.0745 7428 LMS - ok 12:42:18.0778 7428 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys 12:42:18.0782 7428 LSI_FC - ok 12:42:18.0795 7428 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys 12:42:18.0799 7428 LSI_SAS - ok 12:42:18.0812 7428 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys 12:42:18.0816 7428 LSI_SAS2 - ok 12:42:18.0828 7428 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys 12:42:18.0832 7428 LSI_SCSI - ok 12:42:18.0844 7428 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys 12:42:18.0848 7428 luafv - ok 12:42:18.0913 7428 [ A8FE8F2783B2929B56F5370A89356CE9 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys 12:42:18.0916 7428 MBAMProtector - ok 12:42:18.0952 7428 [ 85B16A92B117A5A800032ECD904B86DB ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe 12:42:18.0958 7428 MBAMScheduler - ok 12:42:19.0002 7428 [ 20E2469DB709FC675E655CEAA11BE312 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe 12:42:19.0010 7428 MBAMService - ok 12:42:19.0050 7428 [ 8FF2D95CBA49B405C5DE27039FF0BF35 ] MBfilt C:\Windows\system32\drivers\MBfilt64.sys 12:42:19.0052 7428 MBfilt - ok 12:42:19.0113 7428 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 12:42:19.0120 7428 Mcx2Svc - ok 12:42:19.0151 7428 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys 12:42:19.0155 7428 megasas - ok 12:42:19.0199 7428 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys 12:42:19.0208 7428 MegaSR - ok 12:42:19.0239 7428 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys 12:42:19.0242 7428 MEIx64 - ok 12:42:19.0266 7428 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll 12:42:19.0270 7428 MMCSS - ok 12:42:19.0284 7428 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys 12:42:19.0289 7428 Modem - ok 12:42:19.0306 7428 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys 12:42:19.0307 7428 monitor - ok 12:42:19.0350 7428 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 12:42:19.0353 7428 mouclass - ok 12:42:19.0368 7428 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys 12:42:19.0372 7428 mouhid - ok 12:42:19.0398 7428 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys 12:42:19.0403 7428 mountmgr - ok 12:42:19.0459 7428 [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 12:42:19.0462 7428 MozillaMaintenance - ok 12:42:19.0478 7428 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys 12:42:19.0484 7428 mpio - ok 12:42:19.0502 7428 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 12:42:19.0506 7428 mpsdrv - ok 12:42:19.0564 7428 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll 12:42:19.0590 7428 MpsSvc - ok 12:42:19.0615 7428 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 12:42:19.0621 7428 MRxDAV - ok 12:42:19.0652 7428 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 12:42:19.0659 7428 mrxsmb - ok 12:42:19.0691 7428 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 12:42:19.0700 7428 mrxsmb10 - ok 12:42:19.0716 7428 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 12:42:19.0722 7428 mrxsmb20 - ok 12:42:19.0751 7428 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys 12:42:19.0753 7428 msahci - ok 12:42:19.0781 7428 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys 12:42:19.0787 7428 msdsm - ok 12:42:19.0802 7428 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe 12:42:19.0810 7428 MSDTC - ok 12:42:19.0840 7428 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys 12:42:19.0843 7428 Msfs - ok 12:42:19.0865 7428 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys 12:42:19.0869 7428 mshidkmdf - ok 12:42:19.0885 7428 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 12:42:19.0887 7428 msisadrv - ok 12:42:19.0914 7428 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 12:42:19.0921 7428 MSiSCSI - ok 12:42:19.0927 7428 msiserver - ok 12:42:19.0949 7428 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 12:42:19.0953 7428 MSKSSRV - ok 12:42:19.0972 7428 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 12:42:19.0977 7428 MSPCLOCK - ok 12:42:19.0989 7428 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 12:42:19.0992 7428 MSPQM - ok 12:42:20.0026 7428 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 12:42:20.0035 7428 MsRPC - ok 12:42:20.0054 7428 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys 12:42:20.0056 7428 mssmbios - ok 12:42:20.0068 7428 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 12:42:20.0072 7428 MSTEE - ok 12:42:20.0088 7428 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys 12:42:20.0091 7428 MTConfig - ok 12:42:20.0106 7428 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys 12:42:20.0109 7428 Mup - ok 12:42:20.0131 7428 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll 12:42:20.0153 7428 napagent - ok 12:42:20.0187 7428 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 12:42:20.0196 7428 NativeWifiP - ok 12:42:20.0280 7428 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys 12:42:20.0307 7428 NDIS - ok 12:42:20.0330 7428 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys 12:42:20.0334 7428 NdisCap - ok 12:42:20.0357 7428 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 12:42:20.0361 7428 NdisTapi - ok 12:42:20.0381 7428 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 12:42:20.0386 7428 Ndisuio - ok 12:42:20.0408 7428 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 12:42:20.0415 7428 NdisWan - ok 12:42:20.0434 7428 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 12:42:20.0438 7428 NDProxy - ok 12:42:20.0459 7428 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 12:42:20.0463 7428 NetBIOS - ok 12:42:20.0482 7428 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys 12:42:20.0490 7428 NetBT - ok 12:42:20.0507 7428 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe 12:42:20.0510 7428 Netlogon - ok 12:42:20.0544 7428 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll 12:42:20.0554 7428 Netman - ok 12:42:20.0590 7428 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 12:42:20.0596 7428 NetMsmqActivator - ok 12:42:20.0611 7428 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 12:42:20.0613 7428 NetPipeActivator - ok 12:42:20.0634 7428 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll 12:42:20.0657 7428 netprofm - ok 12:42:20.0682 7428 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 12:42:20.0684 7428 NetTcpActivator - ok 12:42:20.0691 7428 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 12:42:20.0694 7428 NetTcpPortSharing - ok 12:42:20.0712 7428 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys 12:42:20.0717 7428 nfrd960 - ok 12:42:20.0754 7428 [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc C:\Windows\System32\nlasvc.dll 12:42:20.0763 7428 NlaSvc - ok 12:42:20.0775 7428 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys 12:42:20.0780 7428 Npfs - ok 12:42:20.0789 7428 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll 12:42:20.0792 7428 nsi - ok 12:42:20.0800 7428 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 12:42:20.0803 7428 nsiproxy - ok 12:42:20.0919 7428 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 12:42:20.0968 7428 Ntfs - ok 12:42:20.0986 7428 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys 12:42:20.0991 7428 Null - ok 12:42:21.0030 7428 [ 1F07B814C0BB5AABA703ABFF1F31F2E8 ] NVHDA C:\Windows\system32\drivers\nvhda64v.sys 12:42:21.0035 7428 NVHDA - ok 12:42:21.0315 7428 [ BF7A24A71E1932200D864BC1CE15E596 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys 12:42:21.0379 7428 nvlddmkm - ok 12:42:21.0420 7428 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys 12:42:21.0427 7428 nvraid - ok 12:42:21.0444 7428 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys 12:42:21.0451 7428 nvstor - ok 12:42:21.0489 7428 [ 43F91595049DE14C4B61D1E76436164F ] nvsvc C:\Windows\system32\nvvsvc.exe 12:42:21.0513 7428 nvsvc - ok 12:42:21.0612 7428 [ 322B69422836F97B76F4AA59B47507BA ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe 12:42:21.0631 7428 nvUpdatusService - ok 12:42:21.0670 7428 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 12:42:21.0675 7428 nv_agp - ok 12:42:21.0702 7428 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys 12:42:21.0706 7428 ohci1394 - ok 12:42:21.0750 7428 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 12:42:21.0753 7428 ose - ok 12:42:21.0884 7428 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 12:42:21.0911 7428 osppsvc - ok 12:42:21.0990 7428 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll 12:42:22.0007 7428 p2pimsvc - ok 12:42:22.0043 7428 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll 12:42:22.0065 7428 p2psvc - ok 12:42:22.0090 7428 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys 12:42:22.0095 7428 Parport - ok 12:42:22.0112 7428 Partizan - ok 12:42:22.0136 7428 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys 12:42:22.0140 7428 partmgr - ok 12:42:22.0158 7428 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll 12:42:22.0165 7428 PcaSvc - ok 12:42:22.0183 7428 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys 12:42:22.0190 7428 pci - ok 12:42:22.0201 7428 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys 12:42:22.0203 7428 pciide - ok 12:42:22.0227 7428 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys 12:42:22.0234 7428 pcmcia - ok 12:42:22.0252 7428 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys 12:42:22.0255 7428 pcw - ok 12:42:22.0383 7428 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys 12:42:22.0409 7428 PEAUTH - ok 12:42:22.0502 7428 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe 12:42:22.0505 7428 PerfHost - ok 12:42:22.0578 7428 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll 12:42:22.0646 7428 pla - ok 12:42:22.0677 7428 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll 12:42:22.0686 7428 PlugPlay - ok 12:42:22.0706 7428 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll 12:42:22.0711 7428 PNRPAutoReg - ok 12:42:22.0731 7428 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll 12:42:22.0735 7428 PNRPsvc - ok 12:42:22.0753 7428 [ 4F0878FD62D5F7444C5F1C4C66D9D293 ] Point64 C:\Windows\system32\DRIVERS\point64.sys 12:42:22.0756 7428 Point64 - ok 12:42:22.0791 7428 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 12:42:22.0808 7428 PolicyAgent - ok 12:42:22.0836 7428 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll 12:42:22.0842 7428 Power - ok 12:42:22.0865 7428 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 12:42:22.0869 7428 PptpMiniport - ok 12:42:22.0890 7428 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys 12:42:22.0894 7428 Processor - ok 12:42:22.0914 7428 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll 12:42:22.0922 7428 ProfSvc - ok 12:42:22.0933 7428 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe 12:42:22.0935 7428 ProtectedStorage - ok 12:42:22.0963 7428 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys 12:42:22.0966 7428 Psched - ok 12:42:23.0012 7428 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys 12:42:23.0072 7428 ql2300 - ok 12:42:23.0079 7428 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys 12:42:23.0083 7428 ql40xx - ok 12:42:23.0108 7428 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll 12:42:23.0116 7428 QWAVE - ok 12:42:23.0127 7428 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 12:42:23.0131 7428 QWAVEdrv - ok 12:42:23.0144 7428 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 12:42:23.0147 7428 RasAcd - ok 12:42:23.0175 7428 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys 12:42:23.0179 7428 RasAgileVpn - ok 12:42:23.0190 7428 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll 12:42:23.0195 7428 RasAuto - ok 12:42:23.0218 7428 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 12:42:23.0223 7428 Rasl2tp - ok 12:42:23.0249 7428 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll 12:42:23.0258 7428 RasMan - ok 12:42:23.0268 7428 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 12:42:23.0272 7428 RasPppoe - ok 12:42:23.0286 7428 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 12:42:23.0290 7428 RasSstp - ok 12:42:23.0309 7428 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 12:42:23.0317 7428 rdbss - ok 12:42:23.0333 7428 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys 12:42:23.0336 7428 rdpbus - ok 12:42:23.0349 7428 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 12:42:23.0351 7428 RDPCDD - ok 12:42:23.0375 7428 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 12:42:23.0377 7428 RDPENCDD - ok 12:42:23.0387 7428 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys 12:42:23.0389 7428 RDPREFMP - ok 12:42:23.0413 7428 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 12:42:23.0419 7428 RDPWD - ok 12:42:23.0437 7428 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys 12:42:23.0442 7428 rdyboost - ok 12:42:23.0481 7428 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll 12:42:23.0486 7428 RemoteAccess - ok 12:42:23.0511 7428 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll 12:42:23.0520 7428 RemoteRegistry - ok 12:42:23.0545 7428 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys 12:42:23.0551 7428 RFCOMM - ok 12:42:23.0561 7428 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll 12:42:23.0565 7428 RpcEptMapper - ok 12:42:23.0578 7428 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe 12:42:23.0582 7428 RpcLocator - ok 12:42:23.0616 7428 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\System32\rpcss.dll 12:42:23.0623 7428 RpcSs - ok 12:42:23.0633 7428 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 12:42:23.0636 7428 rspndr - ok 12:42:23.0667 7428 [ E57FAC2CDB73F06586ED2ED310B80932 ] RSUSBVSTOR C:\Windows\system32\Drivers\RtsUVStor.sys 12:42:23.0679 7428 RSUSBVSTOR - ok 12:42:23.0711 7428 [ 20A466B9EA2BD828C0EC723F99B8CFE7 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys 12:42:23.0723 7428 RTL8167 - ok 12:42:23.0734 7428 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe 12:42:23.0736 7428 SamSs - ok 12:42:23.0766 7428 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 12:42:23.0770 7428 sbp2port - ok 12:42:23.0787 7428 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll 12:42:23.0795 7428 SCardSvr - ok 12:42:23.0820 7428 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys 12:42:23.0823 7428 scfilter - ok 12:42:23.0853 7428 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll 12:42:23.0888 7428 Schedule - ok 12:42:23.0919 7428 SCManager - ok 12:42:23.0945 7428 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll 12:42:23.0946 7428 SCPolicySvc - ok 12:42:23.0968 7428 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll 12:42:23.0975 7428 SDRSVC - ok 12:42:24.0006 7428 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys 12:42:24.0009 7428 secdrv - ok 12:42:24.0024 7428 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll 12:42:24.0029 7428 seclogon - ok 12:42:24.0051 7428 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\system32\sens.dll 12:42:24.0056 7428 SENS - ok 12:42:24.0066 7428 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll 12:42:24.0071 7428 SensrSvc - ok 12:42:24.0093 7428 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys 12:42:24.0096 7428 Serenum - ok 12:42:24.0104 7428 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys 12:42:24.0108 7428 Serial - ok 12:42:24.0151 7428 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys 12:42:24.0156 7428 sermouse - ok 12:42:24.0224 7428 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll 12:42:24.0232 7428 SessionEnv - ok 12:42:24.0249 7428 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 12:42:24.0254 7428 sffdisk - ok 12:42:24.0266 7428 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 12:42:24.0270 7428 sffp_mmc - ok 12:42:24.0279 7428 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 12:42:24.0282 7428 sffp_sd - ok 12:42:24.0288 7428 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys 12:42:24.0291 7428 sfloppy - ok 12:42:24.0329 7428 [ C6CC9297BD53E5229653303E556AA539 ] Sftfs C:\Windows\system32\DRIVERS\Sftfslh.sys 12:42:24.0337 7428 Sftfs - ok 12:42:24.0369 7428 [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe 12:42:24.0389 7428 sftlist - ok 12:42:24.0403 7428 [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay C:\Windows\system32\DRIVERS\Sftplaylh.sys 12:42:24.0407 7428 Sftplay - ok 12:42:24.0434 7428 [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir C:\Windows\system32\DRIVERS\Sftredirlh.sys 12:42:24.0436 7428 Sftredir - ok 12:42:24.0441 7428 [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol C:\Windows\system32\DRIVERS\Sftvollh.sys 12:42:24.0443 7428 Sftvol - ok 12:42:24.0461 7428 [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe 12:42:24.0465 7428 sftvsa - ok 12:42:24.0528 7428 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll 12:42:24.0543 7428 SharedAccess - ok 12:42:24.0569 7428 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll 12:42:24.0586 7428 ShellHWDetection - ok 12:42:24.0591 7428 [ 1BC348CF6BAA90EC8E533EF6E6A69933 ] SiSGbeLH C:\Windows\system32\DRIVERS\SiSG664.sys 12:42:24.0594 7428 SiSGbeLH - ok 12:42:24.0611 7428 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys 12:42:24.0614 7428 SiSRaid2 - ok 12:42:24.0619 7428 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys 12:42:24.0622 7428 SiSRaid4 - ok 12:42:24.0657 7428 [ A37740568718F245E818D0C5575B9AA9 ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe 12:42:24.0662 7428 SkypeUpdate - ok 12:42:24.0688 7428 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys 12:42:24.0693 7428 Smb - ok 12:42:24.0744 7428 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe 12:42:24.0749 7428 SNMPTRAP - ok 12:42:24.0757 7428 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys 12:42:24.0759 7428 spldr - ok 12:42:24.0793 7428 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe 12:42:24.0819 7428 Spooler - ok 12:42:24.0910 7428 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe 12:42:24.0998 7428 sppsvc - ok 12:42:25.0012 7428 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll 12:42:25.0017 7428 sppuinotify - ok 12:42:25.0042 7428 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys 12:42:25.0051 7428 srv - ok 12:42:25.0065 7428 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 12:42:25.0074 7428 srv2 - ok 12:42:25.0088 7428 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 12:42:25.0093 7428 srvnet - ok 12:42:25.0105 7428 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 12:42:25.0111 7428 SSDPSRV - ok 12:42:25.0126 7428 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll 12:42:25.0135 7428 SstpSvc - ok 12:42:25.0208 7428 [ A766CCAD980235FF34E7F8089D3175A3 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe 12:42:25.0225 7428 Stereo Service - ok 12:42:25.0251 7428 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys 12:42:25.0255 7428 stexstor - ok 12:42:25.0304 7428 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll 12:42:25.0330 7428 stisvc - ok 12:42:25.0353 7428 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys 12:42:25.0356 7428 swenum - ok 12:42:25.0378 7428 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll 12:42:25.0398 7428 swprv - ok 12:42:25.0466 7428 [ BC642D540AEDF9A253C74D10C848EBD2 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys 12:42:25.0476 7428 SynTP - ok 12:42:25.0534 7428 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll 12:42:25.0585 7428 SysMain - ok 12:42:25.0607 7428 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll 12:42:25.0612 7428 TabletInputService - ok 12:42:25.0625 7428 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll 12:42:25.0633 7428 TapiSrv - ok 12:42:25.0642 7428 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll 12:42:25.0644 7428 TBS - ok 12:42:25.0720 7428 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip C:\Windows\system32\drivers\tcpip.sys 12:42:25.0779 7428 Tcpip - ok 12:42:25.0850 7428 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys 12:42:25.0870 7428 TCPIP6 - ok 12:42:25.0906 7428 [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 12:42:25.0910 7428 tcpipreg - ok 12:42:25.0935 7428 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 12:42:25.0939 7428 TDPIPE - ok 12:42:25.0963 7428 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 12:42:25.0966 7428 TDTCP - ok 12:42:25.0986 7428 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 12:42:25.0990 7428 tdx - ok 12:42:26.0007 7428 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys 12:42:26.0009 7428 TermDD - ok 12:42:26.0042 7428 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll 12:42:26.0064 7428 TermService - ok 12:42:26.0075 7428 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll 12:42:26.0080 7428 Themes - ok 12:42:26.0106 7428 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll 12:42:26.0108 7428 THREADORDER - ok 12:42:26.0119 7428 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll 12:42:26.0123 7428 TrkWks - ok 12:42:26.0162 7428 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 12:42:26.0166 7428 TrustedInstaller - ok 12:42:26.0187 7428 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 12:42:26.0190 7428 tssecsrv - ok 12:42:26.0208 7428 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys 12:42:26.0212 7428 TsUsbFlt - ok 12:42:26.0247 7428 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 12:42:26.0253 7428 tunnel - ok 12:42:26.0275 7428 [ B355581A9DA34C92E2DBAFA410D2F829 ] TurboB C:\Windows\system32\DRIVERS\TurboB.sys 12:42:26.0286 7428 TurboB - ok 12:42:26.0316 7428 [ 6564E84B1522C12EA1C3A181ED03276F ] TurboBoost C:\Program Files\Intel\TurboBoost\TurboBoost.exe 12:42:26.0330 7428 TurboBoost - ok 12:42:26.0353 7428 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys 12:42:26.0357 7428 uagp35 - ok 12:42:26.0382 7428 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 12:42:26.0391 7428 udfs - ok 12:42:26.0409 7428 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe 12:42:26.0415 7428 UI0Detect - ok 12:42:26.0448 7428 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 12:42:26.0452 7428 uliagpkx - ok 12:42:26.0478 7428 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys 12:42:26.0482 7428 umbus - ok 12:42:26.0505 7428 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys 12:42:26.0508 7428 UmPass - ok 12:42:26.0597 7428 [ EB79C6C91A99930015EF29AE7FA802D1 ] UNS C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe 12:42:26.0618 7428 UNS - ok 12:42:26.0639 7428 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll 12:42:26.0646 7428 upnphost - ok 12:42:26.0670 7428 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 12:42:26.0674 7428 usbccgp - ok 12:42:26.0691 7428 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys 12:42:26.0695 7428 usbcir - ok 12:42:26.0708 7428 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys 12:42:26.0711 7428 usbehci - ok 12:42:26.0724 7428 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 12:42:26.0731 7428 usbhub - ok 12:42:26.0739 7428 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys 12:42:26.0742 7428 usbohci - ok 12:42:26.0751 7428 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys 12:42:26.0753 7428 usbprint - ok 12:42:26.0766 7428 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 12:42:26.0770 7428 USBSTOR - ok 12:42:26.0783 7428 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys 12:42:26.0786 7428 usbuhci - ok 12:42:26.0802 7428 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys 12:42:26.0807 7428 usbvideo - ok 12:42:26.0826 7428 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll 12:42:26.0829 7428 UxSms - ok 12:42:26.0837 7428 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe 12:42:26.0838 7428 VaultSvc - ok 12:42:26.0849 7428 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys 12:42:26.0850 7428 vdrvroot - ok 12:42:26.0878 7428 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe 12:42:26.0899 7428 vds - ok 12:42:26.0915 7428 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 12:42:26.0918 7428 vga - ok 12:42:26.0928 7428 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys 12:42:26.0931 7428 VgaSave - ok 12:42:26.0949 7428 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys 12:42:26.0954 7428 vhdmp - ok 12:42:26.0983 7428 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys 12:42:26.0986 7428 viaide - ok 12:42:27.0034 7428 [ 0ADF410187B71C9B855721C8D59CEC7A ] VideAceWindowsService C:\ExpressGateUtil\VAWinService.exe 12:42:27.0053 7428 VideAceWindowsService - ok 12:42:27.0084 7428 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys 12:42:27.0088 7428 volmgr - ok 12:42:27.0123 7428 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 12:42:27.0145 7428 volmgrx - ok 12:42:27.0177 7428 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys 12:42:27.0186 7428 volsnap - ok 12:42:27.0222 7428 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys 12:42:27.0229 7428 vsmraid - ok 12:42:27.0292 7428 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe 12:42:27.0367 7428 VSS - ok 12:42:27.0409 7428 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys 12:42:27.0413 7428 vwifibus - ok 12:42:27.0430 7428 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys 12:42:27.0435 7428 vwififlt - ok 12:42:27.0457 7428 [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys 12:42:27.0461 7428 vwifimp - ok 12:42:27.0501 7428 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll 12:42:27.0521 7428 W32Time - ok 12:42:27.0533 7428 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys 12:42:27.0536 7428 WacomPen - ok 12:42:27.0568 7428 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys 12:42:27.0572 7428 WANARP - ok 12:42:27.0577 7428 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 12:42:27.0578 7428 Wanarpv6 - ok 12:42:27.0628 7428 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe 12:42:27.0662 7428 WatAdminSvc - ok 12:42:27.0709 7428 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe 12:42:27.0752 7428 wbengine - ok 12:42:27.0777 7428 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll 12:42:27.0785 7428 WbioSrvc - ok 12:42:27.0819 7428 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll 12:42:27.0828 7428 wcncsvc - ok 12:42:27.0839 7428 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 12:42:27.0845 7428 WcsPlugInService - ok 12:42:27.0850 7428 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys 12:42:27.0853 7428 Wd - ok 12:42:27.0882 7428 [ A3D04EBF5227886029B4532F20D026F7 ] WDC_SAM C:\Windows\system32\DRIVERS\wdcsam64.sys 12:42:27.0885 7428 WDC_SAM - ok 12:42:27.0910 7428 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 12:42:27.0935 7428 Wdf01000 - ok 12:42:27.0951 7428 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll 12:42:27.0957 7428 WdiServiceHost - ok 12:42:27.0961 7428 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll 12:42:27.0965 7428 WdiSystemHost - ok 12:42:27.0985 7428 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll 12:42:27.0994 7428 WebClient - ok 12:42:28.0010 7428 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll 12:42:28.0019 7428 Wecsvc - ok 12:42:28.0025 7428 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll 12:42:28.0029 7428 wercplsupport - ok 12:42:28.0059 7428 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll 12:42:28.0063 7428 WerSvc - ok 12:42:28.0086 7428 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys 12:42:28.0090 7428 WfpLwf - ok 12:42:28.0118 7428 [ 52DED146E4797E6CCF94799E8E22BB2A ] WimFltr C:\Windows\system32\DRIVERS\wimfltr.sys 12:42:28.0124 7428 WimFltr - ok 12:42:28.0139 7428 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys 12:42:28.0142 7428 WIMMount - ok 12:42:28.0182 7428 WinDefend - ok 12:42:28.0190 7428 WinHttpAutoProxySvc - ok 12:42:28.0238 7428 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 12:42:28.0245 7428 Winmgmt - ok 12:42:28.0320 7428 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll 12:42:28.0370 7428 WinRM - ok 12:42:28.0424 7428 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll 12:42:28.0449 7428 Wlansvc - ok 12:42:28.0496 7428 [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe 12:42:28.0497 7428 wlcrasvc - ok 12:42:28.0591 7428 [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 12:42:28.0638 7428 wlidsvc - ok 12:42:28.0665 7428 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 12:42:28.0666 7428 WmiAcpi - ok 12:42:28.0682 7428 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 12:42:28.0686 7428 wmiApSrv - ok 12:42:28.0700 7428 WMPNetworkSvc - ok 12:42:28.0720 7428 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll 12:42:28.0725 7428 WPCSvc - ok 12:42:28.0781 7428 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 12:42:28.0791 7428 WPDBusEnum - ok 12:42:28.0813 7428 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 12:42:28.0818 7428 ws2ifsl - ok 12:42:28.0856 7428 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\system32\wscsvc.dll 12:42:28.0864 7428 wscsvc - ok 12:42:28.0896 7428 [ 8D918B1DB190A4D9B1753A66FA8C96E8 ] WSDPrintDevice C:\Windows\system32\DRIVERS\WSDPrint.sys 12:42:28.0899 7428 WSDPrintDevice - ok 12:42:28.0904 7428 WSearch - ok 12:42:28.0978 7428 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll 12:42:29.0039 7428 wuauserv - ok 12:42:29.0053 7428 [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 12:42:29.0057 7428 WudfPf - ok 12:42:29.0086 7428 [ CF8D590BE3373029D57AF80914190682 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 12:42:29.0091 7428 WUDFRd - ok 12:42:29.0114 7428 [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 12:42:29.0122 7428 wudfsvc - ok 12:42:29.0154 7428 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll 12:42:29.0162 7428 WwanSvc - ok 12:42:29.0196 7428 ================ Scan global =============================== 12:42:29.0216 7428 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll 12:42:29.0247 7428 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll 12:42:29.0258 7428 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll 12:42:29.0282 7428 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll 12:42:29.0308 7428 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe 12:42:29.0317 7428 [Global] - ok 12:42:29.0317 7428 ================ Scan MBR ================================== 12:42:29.0334 7428 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 12:42:29.0561 7428 \Device\Harddisk0\DR0 - ok 12:42:29.0562 7428 ================ Scan VBR ================================== 12:42:29.0568 7428 [ 535ECCD6234D28C8B5A650F881E5EAF5 ] \Device\Harddisk0\DR0\Partition1 12:42:29.0574 7428 \Device\Harddisk0\DR0\Partition1 - ok 12:42:29.0599 7428 [ 26C235F3DBCB37D09129483B41AF0C7F ] \Device\Harddisk0\DR0\Partition2 12:42:29.0602 7428 \Device\Harddisk0\DR0\Partition2 - ok 12:42:29.0603 7428 ============================================================ 12:42:29.0603 7428 Scan finished 12:42:29.0603 7428 ============================================================ 12:42:29.0613 7420 Detected object count: 0 12:42:29.0613 7420 Actual detected object count: 0

OCD

Post #13November 8, 2012, 10:24 PM UTC

Hi arkm,

Question: Do the Google redirects happen when you click on links or when you type a topic to search into Google?

Please download MiniToolBox, save it to your desktop and run it.
Right click and select "Run as Administrator".

Check-mark the following check-boxes:

Flush DNS
Report IE Proxy Settings
Reset IE Proxy Settings
Report FF Proxy Settings
Reset FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log
List Installed Programs
List Users, Partitions and Memory size.
List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.

Next

Please run Eset Online Scanner

Administrator rights are required to run ESET Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.

In your next post please provide the following:
Answer to the redirection question.
Results.txt
ESET log

arkm

Post #14November 9, 2012, 12:17 AM UTC

I get redirected only when I click a link after doing a Google search. It only happens sometimes, and it seems to happen much less often since I first posted here, but it's still happening. For what it's worth, when I do get redirected, I don't think Google actually recognizes that I've clicked a link since the link doesn't turn purple. ESET found a lot of stuff. Here are the logs: MiniToolBox by Farbar Version: 08-11-2012 Ran by [removed] (administrator) on 08-11-2012 at 17:44:40 Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal *************************************************************************** ========================= Flush DNS: =================================== Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========================= IE Proxy Settings: ============================== Proxy is not enabled. No Proxy Server is set. "Reset IE Proxy Settings": IE Proxy Settings were reset. ========================= FF Proxy Settings: ============================== "Reset FF Proxy Settings": Firefox Proxy settings were reset. ========================= Hosts content: ================================= 127.0.0.1 localhost ========================= IP Configuration: ================================ Atheros AR9285 Wireless Network Adapter = Wireless Network Connection (Connected) Realtek PCIe GBE Family Controller = Local Area Connection (Media disconnected) Microsoft Virtual WiFi Miniport Adapter = Wireless Network Connection 2 (Media disconnected) # ———————————- # IPv4 Configuration # ———————————- pushd interface ipv4 reset set global popd # End of IPv4 configuration Windows IP Configuration Host Name . . . . . . . . . . . . : Mike-PC Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : twcny.rr.com Wireless LAN adapter Wireless Network Connection 2: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter Physical Address. . . . . . . . . : 6A-5D-60-C8-04-19 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Ethernet adapter Local Area Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller Physical Address. . . . . . . . . : F4-6D-04-35-87-86 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Wireless LAN adapter Wireless Network Connection: Connection-specific DNS Suffix . : twcny.rr.com Description . . . . . . . . . . . : Atheros AR9285 Wireless Network Adapter Physical Address. . . . . . . . . : 48-5D-60-C8-04-19 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::6476:6aa1:123c:bf80%10(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.0.101(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Thursday, November 08, 2012 9:22:33 AM Lease Expires . . . . . . . . . . : Thursday, November 15, 2012 9:22:32 AM Default Gateway . . . . . . . . . : 192.168.0.1 DHCP Server . . . . . . . . . . . : 192.168.0.1 DHCPv6 IAID . . . . . . . . . . . : 239623520 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-15-61-9E-4D-48-5D-60-C8-04-19 DNS Servers . . . . . . . . . . . : 192.168.0.1 NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter isatap.twcny.rr.com: Connection-specific DNS Suffix . : twcny.rr.com Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::5efe:192.168.0.101%19(Preferred) Default Gateway . . . . . . . . . : DNS Servers . . . . . . . . . . . : 192.168.0.1 NetBIOS over Tcpip. . . . . . . . : Disabled Tunnel adapter Teredo Tunneling Pseudo-Interface: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:c62:35eb:3f57:ff9a(Preferred) Link-local IPv6 Address . . . . . : fe80::c62:35eb:3f57:ff9a%14(Preferred) Default Gateway . . . . . . . . . : :: NetBIOS over Tcpip. . . . . . . . : Disabled Tunnel adapter 6TO4 Adapter: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft 6to4 Adapter Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes 1.0.168.192.in-addr.arpa primary name server = localhost responsible mail addr = nobody.invalid serial = 1 refresh = 600 (10 mins) retry = 1200 (20 mins) expire = 604800 (7 days) default TTL = 10800 (3 hours) Server: UnKnown Address: 192.168.0.1 Name: google.com.twcny.rr.com Address: 208.69.32.145 Pinging google.com [74.125.225.78] with 32 bytes of data: Reply from 74.125.225.78: bytes=32 time=52ms TTL=54 Reply from 74.125.225.78: bytes=32 time=61ms TTL=54 Ping statistics for 74.125.225.78: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 52ms, Maximum = 61ms, Average = 56ms Server: UnKnown Address: 192.168.0.1 Name: yahoo.com.twcny.rr.com Address: 208.69.32.145 Pinging yahoo.com [72.30.38.140] with 32 bytes of data: Reply from 72.30.38.140: bytes=32 time=102ms TTL=52 Reply from 72.30.38.140: bytes=32 time=144ms TTL=52 Ping statistics for 72.30.38.140: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 102ms, Maximum = 144ms, Average = 123ms Server: UnKnown Address: 192.168.0.1 Name: bleepingcomputer.com.twcny.rr.com Address: 208.69.32.145 Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data: Reply from 208.43.87.2: Destination host unreachable. Reply from 208.43.87.2: Destination host unreachable. Ping statistics for 208.43.87.2: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Pinging 127.0.0.1 with 32 bytes of data: Reply from 127.0.0.1: bytes=32 time=5ms TTL=128 Reply from 127.0.0.1: bytes=32 time=5ms TTL=128 Ping statistics for 127.0.0.1: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 5ms, Maximum = 5ms, Average = 5ms =========================================================================== Interface List 16…6a 5d 60 c8 04 19 ……Microsoft Virtual WiFi Miniport Adapter 13…f4 6d 04 35 87 86 ……Realtek PCIe GBE Family Controller 10…48 5d 60 c8 04 19 ……Atheros AR9285 Wireless Network Adapter 1………………………Software Loopback Interface 1 19…00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4 14…00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface 17…00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.101 25 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.0.0 255.255.255.0 On-link 192.168.0.101 281 192.168.0.101 255.255.255.255 On-link 192.168.0.101 281 192.168.0.255 255.255.255.255 On-link 192.168.0.101 281 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.0.101 281 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.0.101 281 =========================================================================== Persistent Routes: None IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 14 58 ::/0 On-link 1 306 ::1/128 On-link 14 58 2001::/32 On-link 14 306 2001:0:9d38:6ab8:c62:35eb:3f57:ff9a/128 On-link 10 281 fe80::/64 On-link 14 306 fe80::/64 On-link 19 286 fe80::5efe:192.168.0.101/128 On-link 14 306 fe80::c62:35eb:3f57:ff9a/128 On-link 10 281 fe80::6476:6aa1:123c:bf80/128 On-link 1 306 ff00::/8 On-link 14 306 ff00::/8 On-link 10 281 ff00::/8 On-link =========================================================================== Persistent Routes: None ========================= Winsock entries ===================================== Catalog5 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation) Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation) Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation) Catalog5 05 C:\Windows\SysWOW64\wshbth.dll [36352] (Microsoft Corporation) Catalog5 06 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.) Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.) Catalog5 08 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog5 09 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation) Catalog5 10 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) Catalog9 11 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) x64-Catalog5 01 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation) x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation) x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation) x64-Catalog5 05 C:\Windows\System32\wshbth.dll [47104] (Microsoft Corporation) x64-Catalog5 06 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [170880] (Microsoft Corp.) x64-Catalog5 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [170880] (Microsoft Corp.) x64-Catalog5 08 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog5 09 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation) x64-Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.) x64-Catalog9 01 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 02 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 03 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 04 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 05 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 06 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 07 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 08 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 09 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 10 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) x64-Catalog9 11 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation) ========================= Event log errors: =============================== Application errors: ================== Error: (11/08/2012 01:09:40 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. A component version required by the application conflicts with another component version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (11/08/2012 09:28:14 AM) (Source: Application Error) (User: ) Description: Faulting application name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Faulting module name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Exception code: 0xc0000005 Fault offset: 0x0011efb1 Faulting process id: 0x16e4 Faulting application start time: 0xavgmfapx.exe0 Faulting application path: avgmfapx.exe1 Faulting module path: avgmfapx.exe2 Report Id: avgmfapx.exe3 Error: (11/08/2012 09:27:38 AM) (Source: Application Error) (User: ) Description: Faulting application name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Faulting module name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Exception code: 0xc0000005 Fault offset: 0x0011efb1 Faulting process id: 0x140c Faulting application start time: 0xavgmfapx.exe0 Faulting application path: avgmfapx.exe1 Faulting module path: avgmfapx.exe2 Report Id: avgmfapx.exe3 Error: (11/07/2012 09:43:34 AM) (Source: Application Error) (User: ) Description: Faulting application name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Faulting module name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Exception code: 0xc0000005 Fault offset: 0x0011efb1 Faulting process id: 0x1b54 Faulting application start time: 0xavgmfapx.exe0 Faulting application path: avgmfapx.exe1 Faulting module path: avgmfapx.exe2 Report Id: avgmfapx.exe3 Error: (11/06/2012 06:11:11 PM) (Source: Application Error) (User: ) Description: Faulting application name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Faulting module name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Exception code: 0xc0000005 Fault offset: 0x0011efb1 Faulting process id: 0x310 Faulting application start time: 0xavgmfapx.exe0 Faulting application path: avgmfapx.exe1 Faulting module path: avgmfapx.exe2 Report Id: avgmfapx.exe3 Error: (11/06/2012 02:46:44 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. A component version required by the application conflicts with another component version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (11/06/2012 09:56:38 AM) (Source: Application Error) (User: ) Description: Faulting application name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Faulting module name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Exception code: 0xc0000005 Fault offset: 0x0011efb1 Faulting process id: 0xa9c Faulting application start time: 0xavgmfapx.exe0 Faulting application path: avgmfapx.exe1 Faulting module path: avgmfapx.exe2 Report Id: avgmfapx.exe3 Error: (11/05/2012 07:26:40 PM) (Source: Application Error) (User: ) Description: Faulting application name: svchost.exe_LanmanServer, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1 Faulting module name: SSCORE.DLL, version: 6.1.7601.17514, time stamp: 0x4ce7c9ec Exception code: 0xc0000005 Fault offset: 0x000000000000146d Faulting process id: 0x4b8 Faulting application start time: 0xsvchost.exe_LanmanServer0 Faulting application path: svchost.exe_LanmanServer1 Faulting module path: svchost.exe_LanmanServer2 Report Id: svchost.exe_LanmanServer3 Error: (11/05/2012 05:19:06 PM) (Source: Application Error) (User: ) Description: Faulting application name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Faulting module name: avgmfapx.exe, version: 10.0.0.1426, time stamp: 0x504d3e90 Exception code: 0xc0000005 Fault offset: 0x0011efb1 Faulting process id: 0x19f8 Faulting application start time: 0xavgmfapx.exe0 Faulting application path: avgmfapx.exe1 Faulting module path: avgmfapx.exe2 Report Id: avgmfapx.exe3 Error: (11/05/2012 05:11:08 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3. A component version required by the application conflicts with another component version already active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. System errors: ============= Error: (11/08/2012 09:25:05 AM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Multimedia Class Scheduler service, but this action failed with the following error: %%1056 Error: (11/08/2012 09:25:05 AM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the User Profile Service service, but this action failed with the following error: %%1056 Error: (11/08/2012 09:25:05 AM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: %%1056 Error: (11/08/2012 09:24:05 AM) (Source: Service Control Manager) (User: ) Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Server service, but this action failed with the following error: %%1056 Error: (11/08/2012 09:23:35 AM) (Source: DCOM) (User: NT AUTHORITY) Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC) Error: (11/08/2012 09:23:05 AM) (Source: Service Control Manager) (User: ) Description: The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. Error: (11/08/2012 09:23:05 AM) (Source: Service Control Manager) (User: ) Description: The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (11/08/2012 09:23:05 AM) (Source: Service Control Manager) (User: ) Description: The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (11/08/2012 09:23:05 AM) (Source: Service Control Manager) (User: ) Description: The System Event Notification Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. Error: (11/08/2012 09:23:05 AM) (Source: Service Control Manager) (User: ) Description: The Secondary Logon service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. Microsoft Office Sessions: ========================= Error: (11/08/2012 01:09:40 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe Error: (11/08/2012 09:28:14 AM) (Source: Application Error)(User: ) Description: avgmfapx.exe10.0.0.1426504d3e90avgmfapx.exe10.0.0.1426504d3e90c00000050011efb116 e401cdbdbd3c1cdaf9C:\Program Files (x86)\AVG\AVG10\avgmfapx.exeC:\Program Files (x86)\AVG\AVG10\avgmfapx.exe870167c1-29b0-11e2-abef-74f06dc29160 Error: (11/08/2012 09:27:38 AM) (Source: Application Error)(User: ) Description: avgmfapx.exe10.0.0.1426504d3e90avgmfapx.exe10.0.0.1426504d3e90c00000050011efb114 0c01cdbdbcf4b9fd03C:\Program Files (x86)\AVG\AVG10\avgmfapx.exeC:\Program Files (x86)\AVG\AVG10\avgmfapx.exe71931997-29b0-11e2-abef-74f06dc29160 Error: (11/07/2012 09:43:34 AM) (Source: Application Error)(User: ) Description: avgmfapx.exe10.0.0.1426504d3e90avgmfapx.exe10.0.0.1426504d3e90c00000050011efb11b 5401cdbcf5fa8f4e1cC:\Program Files (x86)\AVG\AVG10\avgmfapx.exeC:\Program Files (x86)\AVG\AVG10\avgmfapx.exe80f69410-28e9-11e2-9f58-74f06dc29160 Error: (11/06/2012 06:11:11 PM) (Source: Application Error)(User: ) Description: avgmfapx.exe10.0.0.1426504d3e90avgmfapx.exe10.0.0.1426504d3e90c00000050011efb131 001cdbc73ec36bd6bC:\Program Files (x86)\AVG\AVG10\avgmfapx.exeC:\Program Files (x86)\AVG\AVG10\avgmfapx.exe40ac73ed-2867-11e2-a113-74f06dc29160 Error: (11/06/2012 02:46:44 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe Error: (11/06/2012 09:56:38 AM) (Source: Application Error)(User: ) Description: avgmfapx.exe10.0.0.1426504d3e90avgmfapx.exe10.0.0.1426504d3e90c00000050011efb1a9 c01cdbc2ea92bdd9fC:\Program Files (x86)\AVG\AVG10\avgmfapx.exeC:\Program Files (x86)\AVG\AVG10\avgmfapx.exe2a494523-2822-11e2-9dbb-74f06dc29160 Error: (11/05/2012 07:26:40 PM) (Source: Application Error)(User: ) Description: svchost.exe_LanmanServer6.1.7600.163854a5bc3c1SSCORE.DLL6.1.7601.175144ce7c9ecc0 000005000000000000146d4b801cdbbb54e028ae5C:\Windows\system32\svchost.exeC:\Windows\system32\SSCORE.DLLa1f34a44-27a8-11e2-a7ba-74f06dc29160 Error: (11/05/2012 05:19:06 PM) (Source: Application Error)(User: ) Description: avgmfapx.exe10.0.0.1426504d3e90avgmfapx.exe10.0.0.1426504d3e90c00000050011efb119 f801cdbba37a7cf36bC:\Program Files (x86)\AVG\AVG10\avgmfapx.exeC:\Program Files (x86)\AVG\AVG10\avgmfapx.execfcf852a-2796-11e2-902e-74f06dc29160 Error: (11/05/2012 05:11:08 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\Users\Mike\downloads\softonicdownloader_for_tony-hawks-pro-skater-2.exe CodeIntegrity Errors and Warnings: ========================= Date: 2012-11-07T21:53:25.565 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-11-07T21:53:25.503 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-11-04T15:26:44.671 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\Mike\AppData\Local\Temp\ListOpenedFileDrv_64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-11-04T15:26:44.597 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Users\Mike\AppData\Local\Temp\ListOpenedFileDrv_64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-07-27T16:35:54.861 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-07-27T16:35:54.814 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-07-27T16:35:54.752 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-07-27T16:35:54.705 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-07-22T01:12:27.665 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2012-07-22T01:12:27.602 Type: Error Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. =========================== Installed Programs ============================ Across Lite (Version: 2.0.5) Adobe AIR (Version: 3.1.0.4880) Adobe Flash Player 11 ActiveX (Version: 11.4.402.287) Adobe Flash Player 11 Plugin (Version: 11.4.402.287) Adobe Reader X (10.1.4) (Version: 10.1.4) Akamai NetSession Interface Apple Application Support (Version: 2.1.6) Apple Mobile Device Support (Version: 4.0.0.97) Apple Software Update (Version: 2.1.3.127) ASUS AI Recovery (Version: 1.0.12) ASUS Power4Gear Hybrid (Version: 1.1.42) ASUS SmartLogon (Version: 1.0.0009) ASUS Splendid Video Enhancement Technology (Version: 1.02.0031) ASUS Virtual Camera (Version: 1.0.20) Asus_G73_Screensaver (Version: 1.0.0001) AsusVibe2.0 (Version: 2.0.3.585) ATK Package (Version: 1.0.0007) AVG 2011 (Version: 10.0.1388) AVG 2011 (Version: 10.0.1516) Avid License Control (Version: 3.0.0) Bonjour (Version: 3.0.0.10) CCleaner (Version: 3.16) Cheetah Audio Converter Complemento Messenger (Version: 15.4.3502.0922) Complément Messenger (Version: 15.4.3502.0922) D3DX10 (Version: 15.4.2368.0902) Diablo III (Version: 1.0.4.11327) DirectX 9 Runtime (Version: 1.00.0000) DivX Setup (Version: 2.6.1.3) doubleTwist (Version: 3.2.1.14961) Dropbox (Version: 1.4.7) ESET Online Scanner v3 ExpressGate Cloud (Version: 2.1.81.393) Fresco Logic USB3.0 Host Controller (Version: 3.0.110.12) Futuremark SystemInfo (Version: 3.21.2.1) Galeria de Fotografias do Windows Live (Version: 15.4.3502.0922) Galerie de photos Windows Live (Version: 15.4.3502.0922) Galería fotográfica de Windows Live (Version: 15.4.3502.0922) Google Chrome (Version: 12.0.742.112) Google Talk Plugin (Version: 3.10.2.10212) Google Update Helper (Version: 1.2.183.13) Guild Wars 2 Intel® Control Center (Version: 1.2.1.1007) Intel® Management Engine Components (Version: 7.0.0.1118) Intel® Turbo Boost Technology Monitor (Version: 1.0.400.4) iTunes (Version: 10.5.3.3) Jarte 4.4 (Version: 4.4) Java 7 Update 9 (Version: 7.0.90) Java Auto Updater (Version: 2.1.9.0) Java™ 7 Update 5 (64-bit) (Version: 7.0.50) Java™ SE Development Kit 7 (64-bit) (Version: 1.7.0.0) Junk Mail filter update (Version: 15.4.3502.0922) K-Lite Codec Pack 5.5.0 (64-bit) (Version: 5.5.0) K-Lite Mega Codec Pack 8.0.0 (Version: 8.0.0) Malwarebytes Anti-Malware version 1.65.1.1000 (Version: 1.65.1.1000) Mesh Runtime (Version: 15.4.5722.2) Messenger ???? (Version: 15.4.3502.0922) Messenger ????? (Version: 15.4.3502.0922) Messenger Companion (Version: 15.4.3502.0922) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft IntelliPoint 8.2 (Version: 8.20.468.0) Microsoft Office 2010 (Version: 14.0.4763.1000) Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000) Microsoft Office Starter 2010 - English (Version: 14.0.4763.1000) Microsoft Silverlight (Version: 4.1.10329.0) Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) MiKTeX 2.9 (Version: 2.9) MinGW 3.1.0 (Version: 3.1.0) Mozilla Firefox 16.0.2 (x86 en-US) (Version: 16.0.2) Mozilla Maintenance Service (Version: 16.0.2) MSVCRT (Version: 15.4.2862.0708) MSVCRT_amd64 (Version: 15.4.2862.0708) MSXML 4.0 SP3 Parser (KB2721691) (Version: 4.30.2114.0) MSXML 4.0 SP3 Parser (KB973685) (Version: 4.30.2107.0) NVIDIA 3D Vision Driver 306.23 (Version: 306.23) NVIDIA Control Panel 306.23 (Version: 306.23) NVIDIA Graphics Driver 306.23 (Version: 306.23) NVIDIA HD Audio Driver 1.3.18.0 (Version: 1.3.18.0) NVIDIA Install Application (Version: 2.1002.85.551) NVIDIA PhysX (Version: 9.12.0604) NVIDIA PhysX System Software 9.12.0604 (Version: 9.12.0604) NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.0623) NVIDIA Update 1.10.8 (Version: 1.10.8) NVIDIA Update Components (Version: 1.10.8) OpenAL Pando Media Booster (Version: 2.6.0.8) Realtek Ethernet Controller Driver For Windows 7 (Version: 7.21.531.2010) Realtek High Definition Audio Driver (Version: 6.0.1.6162) Realtek USB 2.0 Reader Driver (Version: 6.1.7600.10001) SafeConnect Sibelius 5 (Version: 5.1.0) Sibelius 7 OpenType Fonts (Version: 7.1.3) Sibelius 7.1.3.77 (Version: 7.1.3.77) Sibelius Scorch (all browsers) (Version: 6.2.0) Sibelius Sounds Essentials Skype™ 5.10 (Version: 5.10.116) Spotify (Version: 0.8.4.124.ga3559d86) SpywareBlaster 4.6 (Version: 4.6.0) StarCraft II (Version: 1.5.3.23260) Synaptics Pointing Device Driver (Version: 15.1.18.0) syncables desktop SE (Version: 5.5.746.11492) System Requirements Lab CYRI (Version: 4.5.1.0) TeXnicCenter Version 1.0 Stable RC1 (Version: Version 1.0 Stable RC1) The Weather Channel App Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0) Ventrilo Client for Windows x64 (Version: 3.0.8.0) Visual Studio 2008 x64 Redistributables (Version: 10.0.0.2) VLC media player 2.0.1 (Version: 2.0.1) Warcraft III: All Products WIDCOMM Bluetooth Software (Version: 6.2.5.600) Windows Driver Package - Broadcom (BTHUSB) Bluetooth (02/25/2010 6.2.0.9419) (Version: 02/25/2010 6.2.0.9419) Windows Driver Package - Broadcom Bluetooth (01/19/2010 6.2.0.1417) (Version: 01/19/2010 6.2.0.1417) Windows Driver Package - Broadcom Bluetooth (07/29/2009 6.1.7100.0) (Version: 07/29/2009 6.1.7100.0) Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (Version: 07/30/2009 6.2.0.9405) Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800) Windows Live ??? (Version: 15.4.3502.0922) Windows Live ???? (Version: 15.4.3502.0922) Windows Live Communications Platform (Version: 15.4.3502.0922) Windows Live Essentials (Version: 15.4.3502.0922) Windows Live Family Safety (Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3502.0922) Windows Live Mail (Version: 15.4.3502.0922) Windows Live Mesh (Version: 15.4.3502.0922) Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2) Windows Live Messenger (Version: 15.4.3502.0922) Windows Live Messenger Companion Core (Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (Version: 15.4.3502.0922) Windows Live Photo Common (Version: 15.4.3502.0922) Windows Live Photo Gallery (Version: 15.4.3502.0922) Windows Live PIMT Platform (Version: 15.4.3502.0922) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (Version: 15.4.3502.0922) Windows Live SOXE Definitions (Version: 15.4.3502.0922) Windows Live UX Platform (Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (Version: 15.4.3502.0922) Windows Live Writer (Version: 15.4.3502.0922) Windows Live Writer Resources (Version: 15.4.3502.0922) Windows Media Player Firefox Plugin (Version: 1.0.0.8) WinFlash (Version: 2.31.0) WinRAR 4.20 (64-bit) (Version: 4.20.0) Wireless Console 3 (Version: 3.0.19) ========================= Memory info: =================================== Percentage of memory in use: 30% Total physical RAM: 8169.17 MB Available physical RAM: 5710.17 MB Total Pagefile: 16336.53 MB Available Pagefile: 13644.11 MB Total Virtual: 4095.88 MB Available Virtual: 3955.45 MB ========================= Partitions: ===================================== 1 Drive c: (OS) (Fixed) (Total:116.44 GB) (Free:44 GB) NTFS 2 Drive d: (DATA) (Fixed) (Total:327.83 GB) (Free:236.6 GB) NTFS 3 Drive e: (Sibelius 5.1) (CDROM) (Total:3.9 GB) (Free:0 GB) CDFS ========================= Users: ======================================== User accounts for \\MIKE-PC Administrator Guest Mike UpdatusUser ========================= Minidump Files ================================== No minidump file found **** End of log **** <><><><><><><><><><><><><><><><><><><><><><><><><><><><><> ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=84fbc9ade1482649ac675f5e1023555f # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-11-09 12:11:09 # local_time=2012-11-08 07:11:09 (-0500, Eastern Standard Time) # country="United States" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=1024 16777215 100 0 42948728 42948728 0 0 # compatibility_mode=5893 16776574 100 94 41015749 103958517 0 0 # compatibility_mode=8192 67108863 100 0 7777904 7777904 0 0 # scanned=231890 # found=40 # cleaned=0 # scan_time=4823 C:\Qoobox\Quarantine\C\ProgramData\Microsoft\Windows\DRM\D412.tmp.vir Win64/Olmarik.AD trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\ProgramData\Microsoft\Windows\DRM\D413.tmp.vir Win64/Olmarik.AD trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\ProgramData\Microsoft\Windows\DRM\F7E5.tmp.vir Win64/Olmarik.AD trojan (unable to clean) 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\ProgramData\Microsoft\Windows\DRM\F7E6.tmp.vir Win64/Olmarik.AD trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\10.03.2012_14.26.42\mbr0000\tdlfs0000\tsk0000.dta Win32/Olmarik.AWO trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\10.03.2012_14.26.42\mbr0000\tdlfs0000\tsk0001.dta Win64/Olmarik.AD trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\10.03.2012_14.26.42\mbr0000\tdlfs0000\tsk0002.dta Win32/Olmarik.AYH trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\10.03.2012_14.26.42\mbr0000\tdlfs0000\tsk0003.dta Win64/Olmarik.AG trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\10.03.2012_14.26.42\mbr0000\tdlfs0000\tsk0005.dta Win64/Olmarik.AF trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\10.03.2012_14.26.42\mbr0000\tdlfs0000\tsk0009.dta Win32/Olmarik.AWO trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\10.03.2012_14.26.42\mbr0000\tdlfs0000\tsk0010.dta Win64/Olmarik.X trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\16.03.2012_00.30.44\mbr0000\tdlfs0000\tsk0000.dta Win32/Olmarik.AWO trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\16.03.2012_00.30.44\mbr0000\tdlfs0000\tsk0001.dta Win64/Olmarik.AD trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\16.03.2012_00.30.44\mbr0000\tdlfs0000\tsk0002.dta Win32/Olmarik.AYH trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\16.03.2012_00.30.44\mbr0000\tdlfs0000\tsk0003.dta Win64/Olmarik.AG trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\16.03.2012_00.30.44\mbr0000\tdlfs0000\tsk0005.dta Win64/Olmarik.AF trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\16.03.2012_00.30.44\mbr0000\tdlfs0000\tsk0009.dta Win32/Olmarik.AWO trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\16.03.2012_00.30.44\mbr0000\tdlfs0000\tsk0010.dta Win64/Olmarik.X trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_12.06.42\mbr0000\tdlfs0000\tsk0000.dta Win32/Olmarik.AYI trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_12.06.42\mbr0000\tdlfs0000\tsk0001.dta Win64/Olmarik.AK trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_12.06.42\mbr0000\tdlfs0000\tsk0002.dta Win32/Olmarik.AYH trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_12.06.42\mbr0000\tdlfs0000\tsk0003.dta Win64/Olmarik.AL trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_12.06.42\mbr0000\tdlfs0000\tsk0004.dta a variant of Win32/Rootkit.Kryptik.NH trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_12.06.42\mbr0000\tdlfs0000\tsk0005.dta Win64/Olmarik.AK trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_12.06.42\mbr0000\tdlfs0000\tsk0009.dta Win32/Olmarik.AFK trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_12.06.42\mbr0000\tdlfs0000\tsk0010.dta Win64/Olmarik.AK trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_18.53.58\tdlfs0000\tsk0000.dta Win32/Olmarik.AYI trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_18.53.58\tdlfs0000\tsk0001.dta Win64/Olmarik.AK trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_18.53.58\tdlfs0000\tsk0002.dta Win32/Olmarik.AYH trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_18.53.58\tdlfs0000\tsk0003.dta Win64/Olmarik.AL trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_18.53.58\tdlfs0000\tsk0004.dta a variant of Win32/Rootkit.Kryptik.NH trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_18.53.58\tdlfs0000\tsk0005.dta Win64/Olmarik.AK trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_18.53.58\tdlfs0000\tsk0009.dta Win32/Olmarik.AFK trojan (unable to clean) 00000000000000000000000000000000 I C:\TDSSKiller_Quarantine\27.07.2012_18.53.58\tdlfs0000\tsk0010.dta Win64/Olmarik.AK trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Mike\Downloads\Cheetah_Audio_Converter.exe MSIL/Solimba application (unable to clean) 00000000000000000000000000000000 I C:\Users\Mike\Downloads\ffdshow_784.exe a variant of Win32/InstallIQ application (unable to clean) 00000000000000000000000000000000 I C:\Users\Mike\Downloads\fyzip-setup.exe Win32/DownloadAdmin.A.Gen application (unable to clean) 00000000000000000000000000000000 I C:\Users\Mike\Downloads\SoftonicDownloader_for_tony-hawks-pro-skater-2.exe a variant of Win32/SoftonicDownloader.E application (unable to clean) 00000000000000000000000000000000 I C:\Windows\System32\sysprep\CRYPTSP.dll_ Win32/Sirefef.EY trojan (unable to clean) 00000000000000000000000000000000 I C:\Windows\SysWOW64\sysprep\CRYPTSP.dll_ Win32/Sirefef.EY trojan (unable to clean) 00000000000000000000000000000000 I

OCD

Post #15November 9, 2012, 1:40 AM UTC

Hi arkm,

A majority of the files found by the ESET scan are isolated in quarantine folders and will be removed when we clean up at the end of the process.

= = = = = = = = = =

Click 'Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

Cheetah Audio Converter

Next

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the code-box below into it:

File::
C:\Users\Mike\Downloads\Cheetah_Audio_Converter.exe
C:\Users\Mike\Downloads\ffdshow_784.exe
C:\Users\Mike\Downloads\fyzip-setup.exe
C:\Users\Mike\Downloads\SoftonicDownloader_for_tony-hawks-pro-skater-2.exe
C:\Windows\System32\sysprep\CRYPTSP.dll_
C:\Windows\SysWOW64\sysprep\CRYPTSP.dll_

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, please post the C:\ComboFix.txt for further review.

In your next post please provide the following:
ComboFix.txt
Any change is performance?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Google Redirect and Savings Sidekick [Solved]

✨ Ask AI

Ask AI