Spyware / Malware / Virus Removal

Downloaded backup files from corrupted computer// Failed to load user

9 min read

Looking for the outcome? Ask AI

birdienic Topic Starter

Post #1March 13, 2013, 7:37 AM UTC

DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by [removed] at 4:57:10.54 on 03/03/2013
Internet Explorer: 9.10.9200.16521 BrowserJavaVersion: 10.9.2
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.1396 [GMT -8:00]
.
SP: ESET Smart Security 6.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k GPSvcGroup
C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe
C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe
C:\windows\system32\conhost.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\system32\svchost.exe -k apphost
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Avatron\Air Display\AVTHelper.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\windows\system32\CISVC.EXE
C:\Users\Nic.Bird\x86\ekrn.exe
C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
C:\windows\system32\svchost.exe -k ftpsvc
C:\windows\System32\svchost.exe -k LPDService
C:\Program Files\CyberLink\Shared files\RichVideo64.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\windows\system32\printfilterpipelinesvc.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Users\Nic.Bird\egui.exe
C:\Program Files (x86)\Stronghold Online Backup\ClientMessenger.exe
C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe
C:\Program Files (x86)\iTunesHelper.exe
C:\windows\system32\SearchIndexer.exe
C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe
C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Microsoft Security Client\msseces.exe
C:\windows\system32\wuauclt.exe
C:\Program Files (x86)\Maxthon3\Bin\Maxthon.exe
C:\Program Files (x86)\Maxthon3\Bin\Maxthon.exe
C:\Program Files (x86)\Maxthon3\Bin\Maxthon.exe
C:\Program Files (x86)\Maxthon3\Bin\Maxthon.exe
C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\sosuploadagent.exe
C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\vsscopy.exe
C:\Program Files (x86)\Maxthon3\Bin\Maxthon.exe
C:\windows\system32\taskhost.exe
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\windows\system32\UI0Detect.exe
C:\windows\System32\svchost.exe -k swprv
C:\windows\system32\msiexec.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\explorer.exe
C:\windows\system32\prevhost.exe
C:\Users\Birdie admin2\Downloads\tdsskiller.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\windows\explorer.exe
C:\windows\system32\SearchFilterHost.exe
C:\Users\Birdie admin2\Downloads\dds.scr
C:\windows\system32\conhost.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uSearch Bar = Preserve
uStart Page = https://www.google.com/
uInternet Settings,ProxyOverride = 192.168.*.*;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: EgisPBIE Class: {7b51ccbe-4af9-44a6-bdab-d7f7e4c4e6f9} - C:\Program Files (x86)\EgisTec BioExcess\EgisPBIE.dll
BHO: {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - No File
TB: {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
uRun: [AdobeBridge]
mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
mRun: [PLTSR] "C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe"
mRun: [VitaKeyTSR] C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe /run
mRun: [SMessaging] C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab
DPF: {82E5DF24-51E8-47CD-864A-F4BD5005AA73} - hxxps://www.icloud.com/system/iCloud.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} -
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs: C:\PROGRA~2\DEFEND~1\DEFEND~1.0\adialhk.dll,C:\PROGRA~2\DEFEND~1\DEFEND~1.0\r3hook.dll
LSA: Notification Packages = scecli EgisPwdFilter EgisDSPwdFilter EgisPLPwdFilter EgisPwdFilter EgisDSPwdFilter EgisPwdFilter EgisDSPwdFilter
mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\windows\system32\cmd.exe /D /C start C:\windows\system32\ie4uinit.exe -ClearIconCache
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.97\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
BHO-X64: EgisPBIE Class: {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\EgisTec BioExcess\x64\EgisPBIE.dll
BHO-X64: EgisPBIE - No File
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB-X64: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
mRun-x64: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
mRun-x64: [egui] "C:\Users\Nic.Bird\egui.exe" /hide /waitservice
AppInit_DLLs-X64: C:\PROGRA~2\DEFEND~1\DEFEND~1.0\x64\adialhk.dll,C:\PROGRA~2\DEFEND~1\DEFEND~1.0\x64\r3hook.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\BIRDIE~2\AppData\Roaming\Mozilla\Firefox\Profiles\ncbiyoia.default\
FF - prefs.js: browser.startup.homepage - hxxp://howtogeek.com/
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
FF - plugin: C:\Program Files (x86)\Mozilla Plugins\npitunes.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll
FF - plugin: C:\windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\windows\SysWOW64\npmproxy.dll
FF - plugin: C:\windows\SysWOW64\npwmsdrm.dll
.
—- FIREFOX POLICIES —-
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-10-15 63328]
R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2012-9-21 225120]
R0 epfwwfp;epfwwfp;C:\Windows\System32\drivers\epfwwfp.sys [2012-12-21 57904]
R0 fbfmon;fbfmon;C:\Windows\System32\drivers\fbfmon.sys [2012-2-24 57952]
R0 LHDmgr;LHDmgr;C:\Windows\System32\drivers\LhdX64.sys [2012-2-24 39008]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2012-8-30 228768]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-12-4 53488]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-9-21 200032]
R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2013-1-5 39768]
R1 BPntDrv;BPntDrv;C:\Windows\System32\drivers\BPntDrv.sys [2012-2-24 13408]
R1 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2012-12-21 213416]
R1 EgisTecFF;EgisTecFF;C:\Windows\System32\drivers\EgisTecFF.sys [2012-2-24 55880]
R1 EpfwLWF;Epfw NDIS LightWeight Filter;C:\Windows\System32\drivers\EpfwLWF.sys [2012-12-21 59440]
R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\System32\drivers\mwlPSDFilter.sys [2012-2-24 22912]
R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\System32\drivers\mwlPSDNserv.sys [2012-2-24 20328]
R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\System32\drivers\mwlPSDVDisk.sys [2012-2-24 62584]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 EgisTec Service Help;EgisTec Service Help;C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-10-22 327024]
R2 EgisTec Service;EgisTec Service;C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe [2010-12-13 703856]
R2 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-12-13 650096]
R2 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2012-10-25 57856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2012-10-29 72216]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\Windows\System32\drivers\AcpiVpc.sys [2010-10-25 29792]
R3 AirDisplay;Air Display Support;C:\Windows\System32\drivers\AVVideoCard.sys [2012-9-24 15808]
R3 AirDisplayMirror;Air Display Mirror Support;C:\Windows\System32\drivers\AVVideoCardMirror.sys [2012-9-24 15808]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2012-11-10 40432]
R3 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);C:\Windows\System32\drivers\FPSensor.sys [2011-9-15 36656]
R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-4-14 317440]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2011-1-10 56344]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\rtsuvstor.sys [2012-2-24 307304]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
R3 S6000KNT;S6000KNT_WebCam Driver;C:\Windows\System32\drivers\S6000KNT.sys [2012-2-24 3293272]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920]
R4 AVTHelper;AVTHelper;C:\Program Files\Avatron\Air Display\AVTHelper.exe [2012-9-24 216000]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-1-6 251248]
S3 Arctosa;Arctosa Keyboard;C:\Windows\System32\drivers\Arctosa.sys [2012-11-23 19840]
S3 cphs;Intel® Content Protection HECI Service;C:\Windows\SysWOW64\IntelCpHeciSvc.exe [2012-12-14 277616]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2012-3-26 22528]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-3-20 128456]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-10-27 19456]
S3 Revoflt;Revoflt;C:\Windows\System32\drivers\revoflt.sys [2013-3-3 31800]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-10-27 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2012-10-27 30208]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-9-28 53760]
S3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-13 14544]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\System32\drivers\WSDPrint.sys [2009-7-13 23040]
S3 WSDScan;WSD Scan Support via UMB;C:\Windows\System32\drivers\WSDScan.sys [2009-7-13 25088]
S3 wsvd;wsvd;C:\Windows\System32\drivers\wsvd.sys [2009-7-21 121840]
S4 ADExchange;ArcSoft Exchange Service;C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [2011-9-16 39528]
S4 avgwd;AVG WatchDog;"C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe" –> C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [?]
S4 BingDesktopUpdate;Bing Desktop Update service;C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [2012-11-22 166424]
.
=============== Created Last 30 ================
.
2013-03-03 11:41:45 76232 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{E13C2272-CB40-42C6-840C-54BB9D8E5059}\offreg.dll
2013-03-03 10:18:06 31800 —-a-w- C:\windows\System32\drivers\revoflt.sys
2013-03-03 10:18:06 ——– d—–w- C:\PROGRA~3\VS Revo Group
2013-03-03 06:14:54 ——– d—–w- C:\Program Files (x86)\ESET
2013-03-03 04:38:26 ——– d—–w- C:\windows\TempCC549D54-1F11-60C7-9C29-9DB2210BB584-Signatures
2013-03-03 04:36:37 ——– d—–w- C:\windows\TempEAA06877-29B0-711F-AEE6-4E5E42587155-Signatures
2013-03-03 04:36:27 ——– dc—-w- C:\097a14aa5f2440b4bdbe
2013-03-03 04:12:50 ——– d—–w- C:\windows\Temp0DC166B0-3CA9-1D2B-C050-EF06B8D4C3B7-Signatures
2013-03-02 01:54:17 9162192 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{E13C2272-CB40-42C6-840C-54BB9D8E5059}\mpengine.dll
2013-03-01 19:41:17 ——– d—–w- C:\Program Files\CCleaner
2013-03-01 05:35:12 ——– d—–w- C:\Program Files (x86)\Common Files\MSSoap
2013-03-01 05:35:09 ——– d—–w- C:\Users\BIRDIE~2\AppData\Local\Stronghold Online Backup
2013-03-01 05:34:55 ——– d-sh–w- C:\windows\SysWow64\AI_RecycleBin
2013-03-01 05:34:53 ——– d—–w- C:\PROGRA~3\Stronghold Online Backup
2013-03-01 05:34:52 ——– d—–w- C:\Program Files (x86)\Stronghold Online Backup
2013-03-01 05:34:44 ——– dcsh–w- C:\AI_RecycleBin
2013-02-28 03:27:56 ——– d—–w- C:\Program Files\Microsoft Games
2013-02-27 20:31:49 ——– d—–w- C:\windows\Temp67669FE4-7C81-C8C4-F5F5-14D7377232F8-Signatures
2013-02-27 12:22:38 ——– d—–w- C:\windows\TempDDB28F23-88B8-96DE-7F64-9C775AF02A2C-Signatures
2013-02-27 12:19:57 ——– d—–w- C:\windows\Temp1328DAA5-70E5-2D92-291F-58EC148C82C9-Signatures
2013-02-27 12:11:17 ——– d—–w- C:\windows\Temp60587645-FDAB-7E96-D127-86FEA122BE9D-Signatures
2013-02-27 11:02:58 2776576 —-a-w- C:\windows\System32\msmpeg2vdec.dll
2013-02-21 19:38:51 ——– d—–w- C:\Users\BIRDIE~2\AppData\Roaming\ESET
2013-02-21 19:38:51 ——– d—–w- C:\Users\BIRDIE~2\AppData\Local\ESET
2013-02-21 18:49:41 ——– d—–w- C:\Program Files (x86)\plugins
2013-02-21 00:57:37 ——– d—–w- C:\PROGRA~3\avg8
2013-02-19 23:39:56 ——– d—–w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-02-18 18:28:22 ——– d—–w- C:\Program Files (x86)\Mozilla Plugins
2013-02-18 18:28:22 ——– d—–w- C:\Program Files (x86)\iTunesHelper.Resources
2013-02-18 18:27:45 ——– d—–w- C:\Program Files\iTunes
2013-02-18 18:27:45 ——– d—–w- C:\Program Files\iPod
2013-02-18 18:27:45 ——– d—–w- C:\Program Files (x86)\iTunes.Resources
2013-02-18 18:27:45 ——– d—–w- C:\Program Files (x86)\CD Configuration
2013-02-18 18:27:45 ——– d—–w- C:\PROGRA~3\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-02-18 16:41:07 ——– d—–w- C:\windows\TempC3C0A661-4D9C-00B2-D00E-3A0E9DE85086-Signatures
2013-02-18 16:37:28 ——– d—–w- C:\windows\TempE9067CC2-DA49-0E71-CA24-6F3F3FBC50C4-Signatures
2013-02-18 15:12:01 ——– d—–w- C:\PROGRA~3\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2013-02-18 15:09:01 ——– d—–w- C:\Users\Birdie admin2\ContactsKit
2013-02-18 14:31:39 ——– d—–r- C:\Users\Birdie admin2\Dropbox
2013-02-18 12:52:14 ——– dc—-w- C:\adobeTemp
2013-02-15 04:29:48 ——– d—–w- C:\windows\Downloaded Program Files
2013-02-15 03:27:43 ——– d—–w- C:\windows\Temp3FF42FEC-73CE-7694-417A-11DDD81E7D48-Signatures
2013-02-15 03:18:14 ——– d—–w- C:\windows\TempF1E3B6D7-A7CE-D992-C872-A53ADB4C5D52-Signatures
2013-02-15 03:13:49 ——– d—–w- C:\Program Files (x86)\NortonInstaller
2013-02-15 03:13:49 ——– d—–w- C:\PROGRA~3\NortonInstaller
2013-02-15 03:07:03 ——– d—–w- C:\PROGRA~3\IObit
2013-02-15 03:01:37 ——– d—–w- C:\windows\TempE7F9EEF1-4659-EFB9-BD6E-7730CB15B233-Signatures
2013-02-15 02:59:44 ——– d—–w- C:\windows\Temp2BD5414D-4963-7583-C161-E6FB8BF08589-Signatures
2013-02-15 02:58:48 ——– d—–w- C:\PROGRA~3\MFAData
2013-02-15 02:58:36 ——– d-sh–w- C:\windows\Installer
2013-02-13 12:18:31 ——– d–h–w- C:\Program Files (x86)\Common Files\EAInstaller
2013-02-13 12:16:57 2475352 —-a-w- C:\windows\System32\D3DX9_42.dll
2013-02-13 12:15:59 403304 —-a-w- C:\windows\System32\xactengine2_7.dll
2013-02-13 01:24:14 5553512 —-a-w- C:\windows\System32\ntoskrnl.exe
2013-02-13 01:24:13 3967848 —-a-w- C:\windows\SysWow64\ntkrnlpa.exe
2013-02-13 01:24:12 3913064 —-a-w- C:\windows\SysWow64\ntoskrnl.exe
2013-02-13 01:23:57 3153408 —-a-w- C:\windows\System32\win32k.sys
2013-02-13 01:23:55 7680 —-a-w- C:\windows\SysWow64\instnm.exe
2013-02-13 01:23:55 5120 —-a-w- C:\windows\SysWow64\wow32.dll
2013-02-13 01:23:55 25600 —-a-w- C:\windows\SysWow64\setup16.exe
2013-02-13 01:23:55 215040 —-a-w- C:\windows\System32\winsrv.dll
2013-02-13 01:23:55 2048 —-a-w- C:\windows\SysWow64\user.exe
2013-02-13 01:23:55 14336 —-a-w- C:\windows\SysWow64\ntvdm64.dll
2013-02-13 01:23:53 1913192 —-a-w- C:\windows\System32\drivers\tcpip.sys
2013-02-13 01:23:52 288088 —-a-w- C:\windows\System32\drivers\FWPKCLNT.SYS
2013-02-11 09:50:06 ——– d—–w- C:\Program Files\Bonjour
2013-02-11 09:50:06 ——– d—–w- C:\Program Files (x86)\Bonjour
.
==================== Find3M ====================
.
2013-02-28 03:26:22 71024 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-28 03:26:22 691568 —-a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2013-02-27 08:49:10 16473456 —-a-w- C:\windows\SysWow64\FlashPlayerInstaller.exe
2013-02-15 02:23:33 39768 —-a-w- C:\windows\System32\drivers\avgtpx64.sys
2013-01-24 14:36:04 2647432 —-a-w- C:\Program Files (x86)\Setup.exe
2013-01-24 14:36:04 1900544 —-a-w- C:\Program Files (x86)\WinBootstrapper.msi
2013-01-17 09:28:58 273840 ——w- C:\windows\System32\MpSigStub.exe
2013-01-13 21:17:03 9728 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-01-13 21:17:02 2560 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-01-13 21:16:42 10752 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-01-13 21:12:46 3584 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-01-13 21:11:21 4096 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-01-13 21:11:08 5632 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-01-13 21:11:07 5632 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-01-13 21:11:07 3072 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-01-13 21:11:07 3072 —ha-w- C:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-01-13 20:35:31 9728 —ha-w- C:\windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-01-13 20:35:31 2560 —ha-w- C:\windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-01-13 20:35:18 10752 —ha-w- C:\windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-01-13 20:32:07 3584 —ha-w- C:\windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-01-13 20:31:48 4096 —ha-w- C:\windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-01-13 20:31:41 5632 —ha-w- C:\windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-01-13 20:31:40 5632 —ha-w- C:\windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-01-13 20:31:40 3072 —ha-w- C:\windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
2013-01-13 20:31:40 3072 —ha-w- C:\windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-01-13 20:31:00 1247744 —-a-w- C:\windows\SysWow64\DWrite.dll
2013-01-13 20:22:22 1988096 —-a-w- C:\windows\SysWow64\d3d10warp.dll
2013-01-13 20:20:31 293376 —-a-w- C:\windows\SysWow64\dxgi.dll
2013-01-13 20:09:00 249856 —-a-w- C:\windows\SysWow64\d3d10_1core.dll
2013-01-13 20:08:43 220160 —-a-w- C:\windows\SysWow64\d3d10core.dll
2013-01-13 20:08:35 1504768 —-a-w- C:\windows\SysWow64\d3d11.dll
2013-01-13 19:59:04 1643520 —-a-w- C:\windows\System32\DWrite.dll
2013-01-13 19:58:28 1175552 —-a-w- C:\windows\System32\FntCache.dll
2013-01-13 19:54:01 604160 —-a-w- C:\windows\SysWow64\d3d10level9.dll
2013-01-13 19:53:58 207872 —-a-w- C:\windows\SysWow64\WindowsCodecsExt.dll
2013-01-13 19:53:14 187392 —-a-w- C:\windows\SysWow64\UIAnimation.dll
2013-01-13 19:51:30 2565120 —-a-w- C:\windows\System32\d3d10warp.dll
2013-01-13 19:49:17 363008 —-a-w- C:\windows\System32\dxgi.dll
2013-01-13 19:48:47 161792 —-a-w- C:\windows\SysWow64\d3d10_1.dll
2013-01-13 19:46:25 1080832 —-a-w- C:\windows\SysWow64\d3d10.dll
2013-01-13 19:43:21 1230336 —-a-w- C:\windows\SysWow64\WindowsCodecs.dll
2013-01-13 19:38:39 333312 —-a-w- C:\windows\System32\d3d10_1core.dll
2013-01-13 19:38:32 1887232 —-a-w- C:\windows\System32\d3d11.dll
2013-01-13 19:38:21 296960 —-a-w- C:\windows\System32\d3d10core.dll
2013-01-13 19:37:57 3419136 —-a-w- C:\windows\SysWow64\d2d1.dll
2013-01-13 19:25:04 245248 —-a-w- C:\windows\System32\WindowsCodecsExt.dll
2013-01-13 19:24:33 648192 —-a-w- C:\windows\System32\d3d10level9.dll
2013-01-13 19:24:30 221184 —-a-w- C:\windows\System32\UIAnimation.dll
2013-01-13 19:20:42 194560 —-a-w- C:\windows\System32\d3d10_1.dll
2013-01-13 19:20:04 1238528 —-a-w- C:\windows\System32\d3d10.dll
2013-01-13 19:15:40 1424384 —-a-w- C:\windows\System32\WindowsCodecs.dll
2013-01-13 19:10:36 3928064 —-a-w- C:\windows\System32\d2d1.dll
2013-01-13 19:02:06 417792 —-a-w- C:\windows\SysWow64\WMPhoto.dll
2013-01-13 18:34:58 364544 —-a-w- C:\windows\SysWow64\XpsGdiConverter.dll
2013-01-13 18:32:43 465920 —-a-w- C:\windows\System32\WMPhoto.dll
2013-01-13 18:09:52 522752 —-a-w- C:\windows\System32\XpsGdiConverter.dll
2013-01-13 17:26:42 1158144 —-a-w- C:\windows\SysWow64\XpsPrint.dll
2013-01-13 17:05:09 1682432 —-a-w- C:\windows\System32\XpsPrint.dll
2013-01-04 06:11:21 2284544 —-a-w- C:\windows\SysWow64\msmpeg2vdec.dll
2013-01-04 04:43:21 44032 —-a-w- C:\windows\apppatch\acwow64.dll
2013-01-02 12:18:00 33808 —-a-w- C:\Users\Birdie admin2\cc_20130102_041756.reg
2013-01-02 12:17:07 90014 —-a-w- C:\Users\Birdie admin2\cc_20130102_041700.reg
2012-12-26 08:46:29 18960 —-a-w- C:\windows\System32\drivers\LNonPnP.sys
2012-12-21 21:09:28 57904 —-a-w- C:\windows\System32\drivers\epfwwfp.sys
2012-12-21 21:09:24 59440 —-a-w- C:\windows\System32\drivers\EpfwLWF.sys
2012-12-21 21:09:24 190232 —-a-w- C:\windows\System32\drivers\epfw.sys
2012-12-21 21:08:54 150616 —-a-w- C:\windows\System32\drivers\ehdrv.sys
2012-12-21 21:08:18 213416 —-a-w- C:\windows\System32\drivers\eamonm.sys
2012-12-16 17:11:22 46080 —-a-w- C:\windows\System32\atmlib.dll
2012-12-16 14:45:03 367616 —-a-w- C:\windows\System32\atmfd.dll
2012-12-16 14:13:28 295424 —-a-w- C:\windows\SysWow64\atmfd.dll
2012-12-16 14:13:20 34304 —-a-w- C:\windows\SysWow64\atmlib.dll
2012-12-13 04:31:03 2560 —-a-w- C:\windows\_MSRSTRT.EXE
2012-12-12 21:57:12 293344 —-a-w- C:\Program Files (x86)\iTunesOutlookAddIn.dll
2012-12-12 21:57:10 405472 —-a-w- C:\Program Files (x86)\iTunesAdmin.dll
2012-12-12 21:57:10 152544 —-a-w- C:\Program Files (x86)\iTunesHelper.exe
2012-12-12 21:57:10 148960 —-a-w- C:\Program Files (x86)\iTunesHelper.dll
2012-12-12 21:57:08 9789408 —-a-w- C:\Program Files (x86)\iTunes.exe
2012-12-12 21:57:02 782840 —-a-w- C:\Program Files (x86)\gnsdk_sdkmanager.dll
2012-12-12 21:57:02 3015160 —-a-w- C:\Program Files (x86)\gnsdk_dsp.dll
2012-12-12 21:57:02 269304 —-a-w- C:\Program Files (x86)\gnsdk_submit.dll
2012-12-12 21:57:02 22747616 —-a-w- C:\Program Files (x86)\iTunes.dll
2012-12-12 21:57:02 226296 —-a-w- C:\Program Files (x86)\gnsdk_musicid.dll
2012-12-12 21:37:56 4472832 —-a-w- C:\windows\SysWow64\GPhotos.scr
2012-12-07 23:54:59 57344 —-a-w- C:\windows\WNMHINDR.EXE
2012-12-07 23:54:59 24576 —-a-w- C:\windows\SysWow64\NMH040A.DLL
2012-12-07 23:51:11 724992 —-a-w- C:\windows\iun6002.exe
2012-12-07 13:20:16 441856 —-a-w- C:\windows\System32\Wpc.dll
2012-12-07 13:15:31 2746368 —-a-w- C:\windows\System32\gameux.dll
2012-12-07 12:26:17 308736 —-a-w- C:\windows\SysWow64\Wpc.dll
2012-12-07 12:20:43 2576384 —-a-w- C:\windows\SysWow64\gameux.dll
2012-12-07 11:20:04 30720 —-a-w- C:\windows\System32\usk.rs
2012-12-07 11:20:03 43520 —-a-w- C:\windows\System32\csrr.rs
2012-12-07 11:20:03 23552 —-a-w- C:\windows\System32\oflc.rs
2012-12-07 11:20:01 45568 —-a-w- C:\windows\System32\oflc-nz.rs
2012-12-07 11:20:01 44544 —-a-w- C:\windows\System32\pegibbfc.rs
2012-12-07 11:20:01 20480 —-a-w- C:\windows\System32\pegi-fi.rs
2012-12-07 11:20:00 20480 —-a-w- C:\windows\System32\pegi-pt.rs
2012-12-07 11:19:59 20480 —-a-w- C:\windows\System32\pegi.rs
2012-12-07 11:19:58 46592 —-a-w- C:\windows\System32\fpb.rs
.
============= FINISH: 4:59:38.49 ===============

Hi,

I hope this in in the right place.

First, thank you for any response, information or help you may offer, it is nice to find a site with genuine help offered with REAL results.

With that being said, I had used a similar site and they failed to give me any sort of useful information. What they did do is miss vital information, as well as give me several corrupt files to download. Which caused my entire system to crash. To this day I am unable to use the computer I had the issue on. So, when I noticed my less than 6 month old laptop acting odd after I foolishly decided to download some backup files from my old pc onto this one I decided to look for another helpful site. And now I am here with my fingers crossed hoping that I am not destined to use my iPad for everything.

The main issues are this:I have several user profiles and for some reason I am unable to access any of them but the one I am using now. I have gone into registry done everything right (that I know of) Yet, Every time I go to log in it loads as usual then a pop up says unable to load profile/profile settings. More recently programs are failing to uninstall. Sometimes a window pops up asking me to "input disc" , other times it just freezes. The last few days, my browser will lock and my screen will flash black, or, as if it is turning on and off (I have a laptop.) Then there are other small idiosyncrasies. I am hoping if I begin chronologically it will somehow domino and fix some of the random annoyances as well!!'

Sorry I had missed your responses. I couldn't get to your site and kept getting a "404" error. I had to go to my history and click on it from there. Maybe another "symptom" Thank you again. So sorry for the delay. I know you are ALL very busy. And it is awesome the work you do on here! Just got back from another "help forum" only to be treated like a moron, lol. So I think I will just stick with you guys from here on out!!

Robybel

Post #2March 13, 2013, 1:22 PM UTC

Hi Nicole 888

My name is Robybel.

I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

Having said that….Let's get going!!

=============================================

From your log, I see that is an old scan.
Please follow this steps.

Scan with OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true /fp
DRIVES
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

=============================== Next =======================================

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)
Allow it to update where necessary
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

On your next reply please post :
OTL.txt
Extras.txt
aswMBR log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Robybel

Post #3March 16, 2013, 1:47 PM UTC

Still need help?

birdienic

Post #4March 18, 2013, 10:00 AM UTC

YES, Sorry

following instructions as we speak

Robybel

Post #5March 18, 2013, 11:26 AM UTC

birdienic

Post #6March 18, 2013, 10:40 PM UTC

OTL logfile created on: 03/18/2013 03:03:26 PM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Birdie admin2\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: MM/dd/yyyy

3.92 Gb Total Physical Memory | 1.92 Gb Available Physical Memory | 48.93% Memory free
4.32 Gb Paging File | 2.27 Gb Available in Paging File | 52.63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.81 Gb Total Space | 180.07 Gb Free Space | 42.69% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 1.00 Gb Free Space | 3.44% Space Free | Partition Type: NTFS

Computer Name: WNICOLE-PC | User Name: Birdie admin2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Birdie admin2\AppData\Local\Temp\install_flashplayer11x32ax_gtbp_chrd_aih.exe (Solid State Networks)
PRC - C:\Users\Birdie admin2\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
PRC - C:\Users\Nic.Bird\x86\ekrn.exe (ESET)
PRC - C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe (Stronghold Online Backup)
PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe (Egis Technology Inc. )
PRC - C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe (Egis Technology Inc. )
PRC - C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe (Egis Technology Inc. )
PRC - C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe (Egis Technology Inc. )
PRC - C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe (Egis Technology Inc. )

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Microsoft Office 15\root\office15\c2r32.dll ()
MOD - C:\Program Files\Microsoft Office 15\root\office15\appvisvstream32.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\77dfcfed5fd5f67d0d3edc545935bb21\System.Core.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\3e79256ce40faa9682f9e3511ca115ea\System.ServiceModel.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\2ad51da1b752b19c992fcefd56eb7c01\System.Runtime.Serialization.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\219c68f83fa608b496b163fd6782e696\System.IdentityModel.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\eb33bf977e97e97b12e82c18e36fbaee\SMDiagnostics.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\01c6cb58745f397c9b7ccf3ab7bfc9cd\System.EnterpriseServices.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\01c6cb58745f397c9b7ccf3ab7bfc9cd\System.EnterpriseServices.Wrapper.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\536d704e93ffec9b54e4a0312fb5b996\System.Transactions.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\7a1844283caf3216c346c268cb373b5d\System.Data.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()
MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()
MOD - C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll ()
MOD - C:\Windows\SysWOW64\msjetoledb40.dll ()
MOD - C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (OfficeSvc) – C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe (Microsoft Corporation)
SRV:64bit: - (RichVideo64) – C:\Program Files\CyberLink\Shared files\RichVideo64.exe ()
SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (AVTHelper) – C:\Program Files\Avatron\Air Display\AVTHelper.exe (Avatron Software)
SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (ftpsvc) – C:\Windows\SysNative\inetsrv\ftpsvc.dll (Microsoft Corporation)
SRV:64bit: - (IISADMIN) – C:\Windows\SysNative\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (LPDSVC) – C:\Windows\SysNative\lpdsvc.dll (Microsoft Corporation)
SRV:64bit: - (WMSVC) – C:\Windows\SysNative\inetsrv\WMSvc.exe (Microsoft Corporation)
SRV:64bit: - (TlntSvr) – C:\Windows\SysNative\tlntsvr.exe (Microsoft Corporation)
SRV:64bit: - (CISVC) – C:\Windows\SysNative\CISVC.EXE (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater14.2.0) – C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
SRV - (ekrn) – C:\Users\Nic.Bird\x86\ekrn.exe (ESET)
SRV - (cphs) – C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)
SRV - (BingDesktopUpdate) – C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe (Microsoft Corp.)
SRV - (ADExchange) – C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe (ArcSoft Inc.)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (EgisTec Service) – C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe (Egis Technology Inc. )
SRV - (EgisTec Ticket Service) – C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe (Egis Technology Inc. )
SRV - (WAS) – C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) – C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\SysWOW64\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (EgisTec Service Help) – C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe (Egis Technology Inc. )
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (avgtp) – C:\Windows\SysNative\drivers\avgtpx64.sys (AVG Technologies)
DRV:64bit: - (epfwwfp) – C:\Windows\SysNative\drivers\epfwwfp.sys (ESET)
DRV:64bit: - (epfw) – C:\Windows\SysNative\drivers\epfw.sys (ESET)
DRV:64bit: - (EpfwLWF) – C:\Windows\SysNative\drivers\EpfwLWF.sys (ESET)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (eamonm) – C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (LMIRfsClientNP) – C:\windows\SysNative\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV:64bit: - (AVGIDSHA) – C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (AirDisplayMirror) – C:\Windows\SysNative\drivers\AVVideoCardMirror.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (AirDisplay) – C:\Windows\SysNative\drivers\AVVideoCard.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (Avgtdia) – C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgloga) – C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (LUsbFilt) – C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (LMIRfsDriver) – C:\Windows\SysNative\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV:64bit: - (lmimirr) – C:\Windows\SysNative\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (clwvd) – C:\Windows\SysNative\drivers\clwvd.sys (CyberLink Corporation)
DRV:64bit: - (Netaapl) – C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)
DRV:64bit: - (Fs_Rec) – C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (fbfmon) – C:\Windows\SysNative\drivers\fbfmon.sys (Lenovo)
DRV:64bit: - (BPntDrv) – C:\Windows\SysNative\drivers\BPntDrv.sys (Lenovo)
DRV:64bit: - (LHDmgr) – C:\Windows\SysNative\drivers\LhdX64.sys (Lenovo.)
DRV:64bit: - (ACPIVPC) – C:\Windows\SysNative\drivers\AcpiVpc.sys (Lenovo Corporation)
DRV:64bit: - (EgisTecFF) – C:\Windows\SysNative\drivers\EgisTecFF.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDVDisk) – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) – C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) – C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV:64bit: - (tap0901) – C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (FPSensor) – C:\Windows\SysNative\drivers\FPSensor.sys (Egis Technology Inc.)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (S6000KNT) – C:\Windows\SysNative\drivers\S6000KNT.sys (Windows ® Win 7 DDK provider)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (RSUSBVSTOR) – C:\Windows\SysNative\drivers\rtsuvstor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RMCAST) – C:\Windows\SysNative\drivers\rmcast.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (BCM43XX) – C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (Revoflt) – C:\Windows\SysNative\drivers\revoflt.sys (VS Revo Group)
DRV:64bit: - (Arctosa) – C:\Windows\SysNative\drivers\Arctosa.sys (Razer USA Ltd.)
DRV:64bit: - (wsvd) – C:\Windows\SysNative\drivers\wsvd.sys (CyberLink)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (WSDScan) – C:\Windows\SysNative\drivers\WSDScan.sys (Microsoft Corporation)
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (hamachi) – C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV - (WinRing0_1_2_0) – C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys (OpenLibSys.org)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}: "URL" = http://slirsredirect.search.aol.com/redire…mrud=09-11-2012
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Birdie admin2\Desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\SearchScopes,DefaultScope = {61397257-E400-4903-99E8-80A3ACFA2CEE}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\..\SearchScopes\{61397257-E400-4903-99E8-80A3ACFA2CEE}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 192.168.*.*;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://howtogeek.com/"
FF - prefs.js..extensions.enabledAddons: firegloves%40fingerprint.pet-portal.eu:1.2.3
FF - prefs.js..extensions.enabledAddons: firestarter%40getfirebug.com:0.1a6
FF - prefs.js..extensions.enabledAddons: eventbug%40getfirebug.com:0.1b10
FF - prefs.js..extensions.enabledAddons: dojo%40silvergate.ar.ibm.com:1.0.3
FF - prefs.js..extensions.enabledAddons: sroussey%40illumination-for-developers.com:1.1.23
FF - prefs.js..extensions.enabledAddons: %7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:2.5.4.20130221100632
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL File not found
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeExManDetect: C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll File not found
FF - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeExManDetect: C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Birdie admin2\AppData\Local\Facebook\Messenger\2.1.4651.0\npFbDesktopPlugin.dll File not found

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\USERS\NIC.BIRD\MOZILLA THUNDERBIRD [2013/02/21 12:08:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{41ecbc0b-34d5-4cd4-935f-253a30e2cb7e}: C:\Program Files (x86)\EgisTec BioExcess\FFExt [2012/12/06 20:37:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}: C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2012/12/06 20:41:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files (x86)\components [2013/03/03 03:22:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files (x86)\plugins [2013/03/03 03:22:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.1b3\extensions\\Components: G:\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.1b3\extensions\\Plugins: G:\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Users\Nic.Bird\Mozilla Thunderbird [2013/02/21 12:08:56 | 000,000,000 | —D | M]

[2012/07/02 23:45:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\Extensions
[2012/07/03 20:58:35 | 000,000,000 | —D | M] (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\Firefox\Profiles\51wg2cqx.default\extensions
[2012/07/05 19:38:30 | 000,000,000 | —D | M] (Lavasoft Search Plugin) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\Firefox\Profiles\51wg2cqx.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012/12/28 04:53:31 | 000,000,000 | —D | M] (ASPCA App By We-Care.com) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\Firefox\Profiles\51wg2cqx.default\extensions\wecarereminder@bryan
[2013/03/01 12:54:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\Firefox\Profiles\ncbiyoia.default\extensions
[2013/03/01 12:54:40 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\Firefox\Profiles\ncbiyoia.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013/02/28 23:22:14 | 000,000,000 | —D | M] (Ghostery) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\Firefox\Profiles\ncbiyoia.default\extensions\[removed]
[2012/12/25 08:09:06 | 000,000,000 | —D | M] (Yahoo! Axis for Firefox) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\Firefox\Profiles\ncbiyoia.default\extensions\jid1-vfCLiWMJHrGCNw@jetpack
[2012/12/11 22:16:26 | 000,073,989 | —- | M] () (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\firefox\profiles\ncbiyoia.default\extensions\[removed]
[2012/12/11 22:16:26 | 000,011,558 | —- | M] () (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\firefox\profiles\ncbiyoia.default\extensions\[removed]
[2013/02/27 13:12:25 | 002,163,784 | —- | M] () (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\firefox\profiles\ncbiyoia.default\extensions\[removed]
[2012/12/05 03:50:13 | 000,048,128 | —- | M] () (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\firefox\profiles\ncbiyoia.default\extensions\[removed]
[2012/12/09 06:28:27 | 000,007,213 | —- | M] () (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\firefox\profiles\ncbiyoia.default\extensions\[removed]
[2013/02/19 16:52:10 | 000,251,472 | —- | M] () (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\firefox\profiles\ncbiyoia.default\extensions\[removed]
[2013/02/19 16:46:45 | 000,530,982 | —- | M] () (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\firefox\profiles\ncbiyoia.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/02/19 16:46:41 | 000,817,280 | —- | M] () (No name found) – C:\Users\Birdie admin2\AppData\Roaming\mozilla\firefox\profiles\ncbiyoia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/02/19 16:39:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/02/19 16:39:54 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/02/15 17:35:45 | 000,263,064 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2007/04/10 17:21:08 | 000,163,256 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll
[2012/12/18 13:07:11 | 000,106,240 | —- | M] (Adobe Systems Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll
[2012/11/18 12:26:54 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll
[2012/11/18 12:26:54 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll
[2012/11/18 12:26:54 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll
[2012/11/18 12:26:54 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll
[2012/11/18 12:26:54 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll
[2012/11/18 12:26:54 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll
[2012/11/18 12:26:55 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll
[2013/02/15 17:35:09 | 000,001,607 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom.xml
[2013/02/15 17:35:09 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/05/13 08:32:31 | 000,002,064 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bingober5871674.xml
[2013/02/15 17:35:09 | 000,001,453 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\eBay.xml
[2013/02/15 17:35:09 | 000,002,669 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\google.xml
[2013/02/15 17:35:09 | 000,002,086 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
[2013/02/15 17:35:09 | 000,001,391 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia.xml
[2013/02/15 17:35:09 | 000,001,309 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{
google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Disabled) = internal-remoting-viewer
CHR - plugin: Native Client (Disabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Disabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.97\pdf.dll
CHR - plugin: Adobe Create PDF (Enabled) = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\11.0.0.379_0\plugin/npWCChromeExtnStub.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Disabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Disabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Disabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: AdobeAAMDetect (Disabled) = C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
CHR - plugin: Oberon com adapter (Disabled) = C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll
CHR - plugin: Picasa (Disabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Disabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U9 (Disabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Photo Gallery (Disabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Disabled) = C:\Program Files\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Desktop (Disabled) = C:\Users\Birdie admin2\AppData\Local\Facebook\Messenger\2.1.4651.0\npFbDesktopPlugin.dll
CHR - plugin: Shockwave for Director (Disabled) = C:\windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Disabled) = C:\windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Disabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: Awesome Screenshot: Capture & Annotate = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce\3.4.4_0\
CHR - Extension: Google Drive = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Facebook = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0\
CHR - Extension: Google Search = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Ultimate Google Docs Viewer = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\edgbhipncfdgcekflcoelhmnkcfdfjcl\0.8.4.7_0\
CHR - Extension: Pixlr-o-matic = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcibdjmpjlekgjhepbfmenfppliikcj\1.2_0\
CHR - Extension: Photo Zoom for Facebook = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi\1.1208.30.1_0\
CHR - Extension: PDFescape Free PDF Editor = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdefoklganepljiopdnglodohlgfikkl\0.20_0\
CHR - Extension: Click&Clean; = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod\8.0.1_0\
CHR - Extension: LastPass = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\2.0.20_0\
CHR - Extension: Voice Ace: Speak& Do All+Fun Play Music Tweet = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\iejplmgcphogelceofomnffcbioikjfl\1.0.0.240_0\
CHR - Extension: fbQuickLogin for multiple Facebook\u2122 accounts = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihpcdjelcodenkpfkbaficnkgkmljjbf\0.0.2.9_0\
CHR - Extension: PDF to Word Converter App = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jclipofobaadknkadkpgggmjkebddjam\2.1_0\
CHR - Extension: Free Online PDF Tools = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jddfpnmfhodaljeelokfceepbeapgbdn\1.0.1.2_0\
CHR - Extension: Clipular = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmjbgcjbgmcfgbgikmbdioggjlhjegpp\5.8.29.1997_0\
CHR - Extension: Night Time In New York City = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnimonidkipnhnpgkhgliocfnnpgkhek\1.2_0\
CHR - Extension: Grammar and Spell Checker by Ginger = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfieneakcjfaiglcfcgkidlkmlijjnh\0.1.0.253_0\
CHR - Extension: Webcam Toy = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfbgimoladefibpklnfmkpknadbklade\1.4_0\
CHR - Extension: Docs PDF/PowerPoint Viewer (by Google) = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn\3.10_0\
CHR - Extension: Picasa = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\onlgmecjpnejhfeofkgbfgnmdlipdejb\6.2.2_0\
CHR - Extension: Click&Clean; App = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp\8.0_0\
CHR - Extension: Facebook Covers = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pinjeagflheledfiihhbilplepebhhcn\3.888_0\
CHR - Extension: Evernote Web Clipper = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc\5.9.11_0\
CHR - Extension: Gmail = C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

Hosts file not found
O2:64bit: - BHO: (EgisPBIE Class) - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\EgisTec BioExcess\x64\EgisPBIE.dll (Egis Technology Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (EgisPBIE Class) - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\EgisTec BioExcess\EgisPBIE.dll (Egis Technology Inc.)
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4:64bit: - HKLM..\Run: [egui] C:\Users\Nic.Bird\egui.exe (ESET)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [PLTSR] C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe (Egis Technology Inc. )
O4 - HKLM..\Run: [SMessaging] C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe (Stronghold Online Backup)
O4 - HKLM..\Run: [VitaKeyTSR] C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe (Egis Technology Inc. )
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - Startup: C:\Users\Birdie admin2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk = C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)
O8:64bit: - Extra context menu item: Se&nd; to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd; to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Windows\SysNative\wshbth.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000013 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysWOW64\wshbth.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} http://support.lenovo.com/Resources/Lenovo…AutoDetect2.cab (IASRunner Class)
O16 - DPF: {82E5DF24-51E8-47CD-864A-F4BD5005AA73} https://www.icloud.com/system/iCloud.cab (iCloud Web App Plugin)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2760BD99-E1D9-4B37-902C-E9F503A9051B}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\osf - No CLSID value found
O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll File not found
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\DEFEND~1\DEFEND~1.0\x64\adialhk.dll) - File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\DEFEND~1\DEFEND~1.0\x64\r3hook.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\DEFEND~1\DEFEND~1.0\adialhk.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\DEFEND~1\DEFEND~1.0\r3hook.dll) - File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - () - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - () - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29:64bit: - HKLM SecurityProviders - (credssp.dll) - C:\windows\SysWow64\credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\windows\SysWow64\credssp.dll (Microsoft Corporation)
O30:64bit: - LSA: Authentication Packages - (msv1_0) - C:\windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (kerberos) - C:\windows\SysNative\kerberos.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (msv1_0) - C:\windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (schannel) - C:\windows\SysNative\schannel.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (wdigest) - C:\windows\SysNative\wdigest.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (tspkg) - C:\windows\SysNative\tspkg.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (pku2u) - C:\windows\SysNative\pku2u.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (livessp) - C:\windows\SysNative\livessp.dll (Microsoft Corp.)
O30 - LSA: Security Packages - (kerberos) - C:\windows\SysWow64\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\windows\SysWow64\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\windows\SysWow64\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\windows\SysWow64\tspkg.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\windows\SysWow64\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\windows\SysWow64\livessp.dll (Microsoft Corp.)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (FbDefrag)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/03/18 15:07:18 | 000,000,000 | —D | C] – C:\windows\Temp617599A6-7124-86F8-D17D-C58CD5631D6C-Signatures
[2013/03/18 02:55:47 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Birdie admin2\Desktop\OTL.exe
[2013/03/13 16:22:19 | 000,000,000 | —D | C] – C:\windows\TempAA09210B-C7F5-2972-F381-4F7108C696B7-Signatures
[2013/03/13 01:31:16 | 023,909,328 | —- | C] (SUPERAntiSpyware.com) – C:\Users\Birdie admin2\Documents\SUPERAntiSpyware.exe
[2013/03/12 05:23:03 | 000,000,000 | —D | C] – C:\windows\Temp68E694A0-9056-6B15-438F-C11906539B45-Signatures
[2013/03/12 04:37:40 | 000,774,616 | —- | C] (Google Inc.) – C:\Users\Birdie admin2\Desktop\GoogleVoiceAndVideoSetup.exe
[2013/03/03 15:06:55 | 000,000,000 | —D | C] – C:\Users\Birdie admin2\Desktop\New stuff
[2013/03/03 14:49:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
[2013/03/03 14:48:09 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office 15
[2013/03/03 06:42:57 | 000,000,000 | —D | C] – C:\windows\Temp6ED22D2D-6DF4-E439-ADDF-45A341E6273F-Signatures
[2013/03/03 06:25:01 | 000,000,000 | —D | C] – C:\Users\Birdie admin2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013/03/03 06:25:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013/03/03 06:21:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Self-Extractor
[2013/03/03 06:21:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinZip Self-Extractor
[2013/03/03 06:11:44 | 000,000,000 | —D | C] – C:\Users\Birdie admin2\AppData\Roaming\WinRAR
[2013/03/03 06:11:35 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2013/03/03 03:18:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
[2013/03/03 03:18:06 | 000,031,800 | —- | C] (VS Revo Group) – C:\windows\SysNative\drivers\revoflt.sys
[2013/03/03 03:18:06 | 000,000,000 | —D | C] – C:\ProgramData\VS Revo Group
[2013/03/03 01:51:42 | 000,000,000 | —D | C] – C:\Users\Birdie admin2\Documents\My Strongvault Backups
[2013/03/02 23:14:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2013/03/02 21:38:26 | 000,000,000 | —D | C] – C:\windows\TempCC549D54-1F11-60C7-9C29-9DB2210BB584-Signatures
[2013/03/02 21:36:37 | 000,000,000 | —D | C] – C:\windows\TempEAA06877-29B0-711F-AEE6-4E5E42587155-Signatures
[2013/03/02 21:12:50 | 000,000,000 | —D | C] – C:\windows\Temp0DC166B0-3CA9-1D2B-C050-EF06B8D4C3B7-Signatures
[2013/03/01 12:41:19 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013/03/01 12:41:17 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2013/02/28 22:35:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\MSSoap
[2013/02/28 22:35:09 | 000,000,000 | —D | C] – C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup
[2013/02/28 22:34:55 | 000,000,000 | -HSD | C] – C:\windows\SysWow64\AI_RecycleBin
[2013/02/28 22:34:53 | 000,000,000 | —D | C] – C:\ProgramData\Stronghold Online Backup
[2013/02/28 22:34:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Stronghold Online Backup
[2013/02/28 22:34:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stronghold Online Backup
[2013/02/28 22:34:44 | 000,000,000 | -HSD | C] – C:\AI_RecycleBin
[2013/02/27 20:27:56 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Games
[2013/02/27 13:31:49 | 000,000,000 | —D | C] – C:\windows\Temp67669FE4-7C81-C8C4-F5F5-14D7377232F8-Signatures
[2013/02/27 05:22:38 | 000,000,000 | —D | C] – C:\windows\TempDDB28F23-88B8-96DE-7F64-9C775AF02A2C-Signatures
[2013/02/27 05:19:57 | 000,000,000 | —D | C] – C:\windows\Temp1328DAA5-70E5-2D92-291F-58EC148C82C9-Signatures
[2013/02/27 05:11:17 | 000,000,000 | —D | C] – C:\windows\Temp60587645-FDAB-7E96-D127-86FEA122BE9D-Signatures
[2013/02/27 04:09:53 | 001,054,720 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\MsSpellCheckingFacility.exe
[2013/02/27 04:09:53 | 000,226,304 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\elshyph.dll
[2013/02/27 04:09:53 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\elshyph.dll
[2013/02/27 04:09:53 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\RegisterIEPKEYs.exe
[2013/02/27 04:09:52 | 000,719,360 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mshtmlmedia.dll
[2013/02/27 04:09:52 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\msrating.dll
[2013/02/27 04:09:52 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\inseng.dll
[2013/02/27 04:09:51 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iexpress.exe
[2013/02/27 04:09:51 | 000,138,752 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\wextract.exe
[2013/02/27 04:09:51 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mshtmled.dll
[2013/02/27 04:09:51 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\pngfilt.dll
[2013/02/27 04:09:49 | 000,137,216 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieUnatt.exe
[2013/02/27 04:09:49 | 000,125,440 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\occache.dll
[2013/02/27 04:09:48 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\jscript.dll
[2013/02/27 04:09:48 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iepeers.dll
[2013/02/27 04:09:48 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\IEAdvpack.dll
[2013/02/27 04:09:48 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesysprep.dll
[2013/02/27 04:09:48 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\SetIEInstalledDate.exe
[2013/02/27 04:09:48 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\mshtmler.dll
[2013/02/27 04:09:48 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\msfeedssync.exe
[2013/02/27 04:09:47 | 000,391,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieui.dll
[2013/02/27 04:09:45 | 000,629,248 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieapfltr.dll
[2013/02/27 04:09:45 | 000,361,984 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\html.iec
[2013/02/27 04:09:45 | 000,232,960 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\url.dll
[2013/02/27 04:09:45 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\tdc.ocx
[2013/02/27 04:09:44 | 001,441,280 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\inetcpl.cpl
[2013/02/27 04:09:44 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\icardie.dll
[2013/02/27 04:09:44 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesetup.dll
[2013/02/27 04:09:44 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iernonce.dll
[2013/02/27 04:09:44 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\licmgr10.dll
[2013/02/27 04:09:43 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msrating.dll
[2013/02/27 04:09:43 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\RegisterIEPKEYs.exe
[2013/02/27 04:09:42 | 000,762,368 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieapfltr.dll
[2013/02/27 04:09:42 | 000,452,096 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\dxtmsft.dll
[2013/02/27 04:09:42 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\html.iec
[2013/02/27 04:09:42 | 000,281,600 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\dxtrans.dll
[2013/02/27 04:09:42 | 000,216,064 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msls31.dll
[2013/02/27 04:09:42 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\icardie.dll
[2013/02/27 04:09:42 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ie4uinit.exe
[2013/02/27 04:09:42 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iernonce.dll
[2013/02/27 04:09:41 | 001,509,376 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\inetcpl.cpl
[2013/02/27 04:09:41 | 000,905,728 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mshtmlmedia.dll
[2013/02/27 04:09:41 | 000,235,008 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\url.dll
[2013/02/27 04:09:41 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesetup.dll
[2013/02/27 04:09:40 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msfeeds.dll
[2013/02/27 04:09:40 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\vbscript.dll
[2013/02/27 04:09:40 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iexpress.exe
[2013/02/27 04:09:40 | 000,144,896 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\wextract.exe
[2013/02/27 04:09:40 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\inseng.dll
[2013/02/27 04:09:40 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mshtmled.dll
[2013/02/27 04:09:40 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\licmgr10.dll
[2013/02/27 04:09:39 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieUnatt.exe
[2013/02/27 04:09:39 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\occache.dll
[2013/02/27 04:09:39 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\pngfilt.dll
[2013/02/27 04:09:39 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mshta.exe
[2013/02/27 04:09:38 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript.dll
[2013/02/27 04:09:38 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iepeers.dll
[2013/02/27 04:09:38 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\IEAdvpack.dll
[2013/02/27 04:09:38 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\imgutil.dll
[2013/02/27 04:09:38 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msfeedssync.exe
[2013/02/27 04:09:37 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript9.dll
[2013/02/27 04:09:37 | 000,526,848 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieui.dll
[2013/02/27 04:09:37 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesysprep.dll
[2013/02/27 04:09:37 | 000,092,160 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\SetIEInstalledDate.exe
[2013/02/27 04:09:37 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\mshtmler.dll
[2013/02/27 04:09:36 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\tdc.ocx
[2013/02/27 04:02:58 | 002,776,576 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msmpeg2vdec.dll
[2013/02/27 04:02:58 | 002,284,544 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\msmpeg2vdec.dll
[2013/02/27 04:02:58 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\UIAnimation.dll
[2013/02/27 04:02:58 | 000,187,392 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\UIAnimation.dll
[2013/02/27 04:02:49 | 000,417,792 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\WMPhoto.dll
[2013/02/27 04:02:48 | 000,465,920 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\WMPhoto.dll
[2013/02/27 04:02:41 | 002,565,120 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10warp.dll
[2013/02/27 04:02:41 | 000,522,752 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\XpsGdiConverter.dll
[2013/02/27 04:02:41 | 000,364,544 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\XpsGdiConverter.dll
[2013/02/27 04:02:41 | 000,194,560 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10_1.dll
[2013/02/27 04:02:41 | 000,010,752 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013/02/27 04:02:41 | 000,010,752 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013/02/27 04:02:41 | 000,009,728 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013/02/27 04:02:41 | 000,009,728 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013/02/27 04:02:41 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013/02/27 04:02:41 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013/02/27 04:02:41 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013/02/27 04:02:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013/02/27 04:02:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013/02/27 04:02:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013/02/27 04:02:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013/02/27 04:02:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013/02/27 04:02:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013/02/27 04:02:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013/02/27 04:02:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013/02/27 04:02:41 | 000,002,560 | -H– | C] (Microsoft Corporation) – C:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013/02/27 04:02:41 | 000,002,560 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013/02/27 04:02:40 | 001,887,232 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d11.dll
[2013/02/27 04:02:40 | 001,682,432 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\XpsPrint.dll
[2013/02/27 04:02:40 | 001,504,768 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\d3d11.dll
[2013/02/27 04:02:40 | 001,238,528 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10.dll
[2013/02/27 04:02:40 | 001,158,144 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\XpsPrint.dll
[2013/02/27 04:02:40 | 000,648,192 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10level9.dll
[2013/02/27 04:02:40 | 000,363,008 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\dxgi.dll
[2013/02/27 04:02:40 | 000,333,312 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10_1core.dll
[2013/02/27 04:02:40 | 000,296,960 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d3d10core.dll
[2013/02/27 04:02:40 | 000,005,632 | -H– | C] (Microsoft Corporation) – C:\windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013/02/27 04:02:39 | 003,928,064 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\d2d1.dll
[2013/02/27 04:02:39 | 001,643,520 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\DWrite.dll
[2013/02/27 04:02:39 | 001,424,384 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\WindowsCodecs.dll
[2013/02/27 04:02:39 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\WindowsCodecsExt.dll
[2013/02/21 12:38:51 | 000,000,000 | —D | C] – C:\Users\Birdie admin2\AppData\Roaming\ESET
[2013/02/21 12:38:51 | 000,000,000 | —D | C] – C:\Users\Birdie admin2\AppData\Local\ESET
[2013/02/21 12:08:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
[2013/02/21 12:08:53 | 000,000,000 | —D | C] – C:\ProgramData\ESET
[2013/02/21 11:49:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\plugins
[2013/02/20 17:57:37 | 000,000,000 | —D | C] – C:\ProgramData\avg8
[2013/02/20 17:51:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Air Display
[2013/02/19 22:22:03 | 000,000,000 | -H-D | C] – C:\Users\Birdie admin2\Desktop\.picasaoriginals
[2013/02/19 16:47:33 | 017,894,296 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\xul.dll
[2013/02/19 16:47:33 | 002,954,136 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\gkmedias.dll
[2013/02/19 16:47:33 | 000,812,440 | —- | C] (sqlite.org) – C:\Program Files (x86)\mozsqlite3.dll
[2013/02/19 16:47:33 | 000,770,384 | —- | C] (Microsoft Corporation) – C:\Program Files (x86)\msvcr100.dll
[2013/02/19 16:47:33 | 000,641,944 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\nss3.dll
[2013/02/19 16:47:33 | 000,478,104 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\libGLESv2.dll
[2013/02/19 16:47:33 | 000,421,200 | —- | C] (Microsoft Corporation) – C:\Program Files (x86)\msvcp100.dll
[2013/02/19 16:47:33 | 000,375,192 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\nssckbi.dll
[2013/02/19 16:47:33 | 000,272,280 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\updater.exe
[2013/02/19 16:47:33 | 000,193,576 | —- | C] (Mozilla Corporation) – C:\Program Files (x86)\maintenanceservice_installer.exe
[2013/02/19 16:47:33 | 000,172,440 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\nspr4.dll
[2013/02/19 16:47:33 | 000,170,232 | —- | C] (Mozilla Corporation) – C:\Program Files (x86)\webapp-uninstaller.exe
[2013/02/19 16:47:33 | 000,155,544 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\ssl3.dll
[2013/02/19 16:47:33 | 000,151,960 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\softokn3.dll
[2013/02/19 16:47:33 | 000,131,480 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\mozglue.dll
[2013/02/19 16:47:33 | 000,115,608 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\maintenanceservice.exe
[2013/02/19 16:47:33 | 000,104,344 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\nssutil3.dll
[2013/02/19 16:47:33 | 000,096,664 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\webapprt-stub.exe
[2013/02/19 16:47:33 | 000,092,056 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\smime3.dll
[2013/02/19 16:47:33 | 000,091,544 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\nssdbm3.dll
[2013/02/19 16:47:33 | 000,059,288 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\libEGL.dll
[2013/02/19 16:47:33 | 000,021,912 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\plc4.dll
[2013/02/19 16:47:33 | 000,021,400 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\plds4.dll
[2013/02/19 16:47:33 | 000,019,352 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\xpcom.dll
[2013/02/19 16:47:33 | 000,017,304 | —- | C] (Mozilla Corporation) – C:\Program Files (x86)\plugin-container.exe
[2013/02/19 16:47:33 | 000,016,280 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\mozalloc.dll
[2013/02/19 16:47:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\webapprt
[2013/02/19 16:47:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\searchplugins
[2013/02/19 16:47:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\modules
[2013/02/19 16:47:32 | 002,106,216 | —- | C] (Microsoft Corporation) – C:\Program Files (x86)\D3DCompiler_43.dll
[2013/02/19 16:47:32 | 001,998,168 | —- | C] (Microsoft Corporation) – C:\Program Files (x86)\d3dx9_43.dll
[2013/02/19 16:47:32 | 000,917,400 | —- | C] (Mozilla Corporation) – C:\Program Files (x86)\firefox.exe
[2013/02/19 16:47:32 | 000,116,120 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\crashreporter.exe
[2013/02/19 16:47:32 | 000,074,136 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\breakpadinjector.dll
[2013/02/19 16:47:32 | 000,019,352 | —- | C] (Mozilla Foundation) – C:\Program Files (x86)\AccessibleMarshal.dll
[2013/02/19 16:47:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\uninstall
[2013/02/19 16:47:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\extensions
[2013/02/19 16:47:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\dictionaries
[2013/02/19 16:47:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\defaults
[2013/02/19 16:47:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\components
[2013/02/19 16:39:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Maintenance Service
[2013/02/18 11:28:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013/02/18 11:28:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Plugins
[2013/02/18 11:28:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunesHelper.Resources
[2013/02/18 11:27:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes.Resources
[2013/02/18 11:27:45 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2013/02/18 11:27:45 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2013/02/18 11:27:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\CD Configuration
[2013/02/18 11:27:45 | 000,000,000 | —D | C] – C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013/02/18 11:26:14 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2013/02/18 09:41:07 | 000,000,000 | —D | C] – C:\windows\TempC3C0A661-4D9C-00B2-D00E-3A0E9DE85086-Signatures
[2013/02/18 09:37:28 | 000,000,000 | —D | C] – C:\windows\TempE9067CC2-DA49-0E71-CA24-6F3F3FBC50C4-Signatures
[2013/02/18 08:12:01 | 000,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2013/02/18 08:12:01 | 000,000,000 | —D | C] – C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2013/02/18 08:09:01 | 000,000,000 | —D | C] – C:\Users\Birdie admin2\ContactsKit
[2013/02/18 07:31:39 | 000,000,000 | R–D | C] – C:\Users\Birdie admin2\Dropbox
[2013/02/18 06:13:45 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2013/02/18 05:52:14 | 000,000,000 | —D | C] – C:\adobeTemp
[2012/12/12 14:57:12 | 000,293,344 | —- | C] (Apple Inc.) – C:\Program Files (x86)\iTunesOutlookAddIn.dll
[2012/12/12 14:57:10 | 000,405,472 | —- | C] (Apple Inc.) – C:\Program Files (x86)\iTunesAdmin.dll
[2012/12/12 14:57:10 | 000,152,544 | —- | C] (Apple Inc.) – C:\Program Files (x86)\iTunesHelper.exe
[2012/12/12 14:57:10 | 000,148,960 | —- | C] (Apple Inc.) – C:\Program Files (x86)\iTunesHelper.dll
[2012/12/12 14:57:08 | 009,789,408 | —- | C] (Apple Inc.) – C:\Program Files (x86)\iTunes.exe
[2012/12/12 14:57:02 | 022,747,616 | —- | C] (Apple Inc.) – C:\Program Files (x86)\iTunes.dll
[2012/12/12 14:57:02 | 003,015,160 | —- | C] (Gracenote, Inc.) – C:\Program Files (x86)\gnsdk_dsp.dll
[2012/12/12 14:57:02 | 000,782,840 | —- | C] (Gracenote, Inc.) – C:\Program Files (x86)\gnsdk_sdkmanager.dll
[2012/12/12 14:57:02 | 000,269,304 | —- | C] (Gracenote, Inc.) – C:\Program Files (x86)\gnsdk_submit.dll
[2012/12/12 14:57:02 | 000,226,296 | —- | C] (Gracenote, Inc.) – C:\Program Files (x86)\gnsdk_musicid.dll
[2012/12/02 09:07:15 | 034,659,248 | —- | C] (Piriform Ltd) – C:\Users\Birdie admin2\CCNPro203_Setup.exe
[2012/10/31 16:53:32 | 000,112,528 | —- | C] (Apple Inc.) – C:\Program Files (x86)\ITDetector.ocx
[2012/08/07 14:24:28 | 007,902,008 | —- | C] (VS Revo Group ) – C:\Users\Birdie admin2\RevoUninProSetup.exe
[2008/09/24 20:59:56 | 002,647,432 | —- | C] (Adobe Systems, Copyright 2005-2007) – C:\Program Files (x86)\Setup.exe
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/03/18 15:07:36 | 000,002,148 | —- | M] () – C:\windows\epplauncher.mif
[2013/03/18 15:01:11 | 000,870,878 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2013/03/18 15:01:11 | 000,726,830 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2013/03/18 15:01:11 | 000,144,672 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2013/03/18 14:58:26 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/03/18 14:58:22 | 000,693,976 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerApp.exe
[2013/03/18 14:58:22 | 000,073,432 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/03/18 14:57:43 | 000,067,584 | —- | M] () – C:\windows\bootstat.dat
[2013/03/18 02:57:24 | 000,021,280 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/03/18 02:57:24 | 000,021,280 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/03/18 02:55:50 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Birdie admin2\Desktop\OTL.exe
[2013/03/18 02:50:17 | 000,198,185 | —- | M] () – C:\windows\SysNative\fastboot.set
[2013/03/18 02:49:08 | 3153,702,912 | -HS- | M] () – C:\hiberfil.sys
[2013/03/13 20:13:32 | 000,028,406 | —- | M] () – C:\Users\Birdie admin2\Desktop\480068_447603845316578_782767854_n.jpg
[2013/03/13 04:20:21 | 000,001,585 | —- | M] () – C:\Users\Birdie admin2\Desktop\SUPERAntiSpyware - Shortcut.lnk
[2013/03/13 01:31:36 | 023,909,328 | —- | M] (SUPERAntiSpyware.com) – C:\Users\Birdie admin2\Documents\SUPERAntiSpyware.exe
[2013/03/13 01:09:05 | 000,587,985 | —- | M] () – C:\Users\Birdie admin2\Documents\dwsup.pdf
[2013/03/13 01:08:28 | 000,805,414 | —- | M] () – C:\Users\Birdie admin2\Documents\PdfFile.pdf
[2013/03/12 05:18:09 | 000,890,798 | —- | M] () – C:\Users\Birdie admin2\Desktop\SecurityCheck(1).exe
[2013/03/12 05:17:12 | 000,001,023 | —- | M] () – C:\Users\Birdie admin2\Desktop\Notepad++.lnk
[2013/03/12 04:37:42 | 000,774,616 | —- | M] (Google Inc.) – C:\Users\Birdie admin2\Desktop\GoogleVoiceAndVideoSetup.exe
[2013/03/12 04:36:28 | 000,049,560 | —- | M] () – C:\Users\Birdie admin2\Desktop\id fb.jpg
[2013/03/12 04:36:14 | 000,049,560 | —- | M] () – C:\Users\Birdie admin2\Desktop\id fucks.jpg
[2013/03/12 04:36:05 | 000,049,560 | —- | M] () – C:\Users\Birdie admin2\Desktop\photo.JPG
[2013/03/12 02:18:41 | 000,000,632 | RHS- | M] () – C:\Users\Birdie admin2\ntuser.pol
[2013/03/12 02:18:06 | 005,078,528 | —- | M] () – C:\windows\SysNative\FNTCACHE.DAT
[2013/03/03 15:51:09 | 000,010,814 | —- | M] () – C:\Users\Birdie admin2\Desktop\Funny-Happy-Birthday-06.jpg
[2013/03/03 15:50:57 | 000,001,626 | —- | M] () – C:\Users\Birdie admin2\Desktop\Funny-Happy-Birthday-05.jpg - Shortcut.lnk
[2013/03/03 15:10:50 | 000,001,105 | —- | M] () – C:\Users\Birdie admin2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk
[2013/03/03 11:33:52 | 000,000,912 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/03/03 11:33:52 | 000,000,908 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/03/03 03:18:11 | 000,001,115 | —- | M] () – C:\Users\Birdie admin2\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2013/03/03 02:31:50 | 000,000,638 | —- | M] () – C:\windows\tasks\Wendee.job
[2013/03/03 00:42:52 | 070,012,681 | —- | M] () – C:\Users\Birdie admin2\Documents\ipad docs.zip
[2013/03/02 22:21:40 | 000,061,865 | —- | M] () – C:\Users\Birdie admin2\Documents\Whois-RWS.pdf
[2013/03/02 21:28:04 | 000,204,800 | —- | M] () – C:\Users\Birdie admin2\Documents\firewall2.wfw
[2013/02/27 08:40:18 | 000,020,992 | —- | M] () – C:\Users\Birdie admin2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/02/27 05:14:28 | 000,204,800 | —- | M] () – C:\Users\Birdie admin2\Documents\windows firewall with advanced security POLICY.wfw
[2013/02/27 04:09:53 | 001,054,720 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\MsSpellCheckingFacility.exe
[2013/02/27 04:09:53 | 000,226,304 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\elshyph.dll
[2013/02/27 04:09:53 | 000,185,344 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\elshyph.dll
[2013/02/27 04:09:53 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\RegisterIEPKEYs.exe
[2013/02/27 04:09:52 | 000,719,360 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\mshtmlmedia.dll
[2013/02/27 04:09:52 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\msrating.dll
[2013/02/27 04:09:52 | 000,082,432 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\inseng.dll
[2013/02/27 04:09:51 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iexpress.exe
[2013/02/27 04:09:51 | 000,138,752 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\wextract.exe
[2013/02/27 04:09:51 | 000,079,872 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\mshtmled.dll
[2013/02/27 04:09:51 | 000,057,344 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\pngfilt.dll
[2013/02/27 04:09:49 | 000,137,216 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\ieUnatt.exe
[2013/02/27 04:09:49 | 000,125,440 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\occache.dll
[2013/02/27 04:09:48 | 000,690,688 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\jscript.dll
[2013/02/27 04:09:48 | 000,117,248 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iepeers.dll
[2013/02/27 04:09:48 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\IEAdvpack.dll
[2013/02/27 04:09:48 | 000,109,056 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iesysprep.dll
[2013/02/27 04:09:48 | 000,073,728 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\SetIEInstalledDate.exe
[2013/02/27 04:09:48 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\mshtmler.dll
[2013/02/27 04:09:48 | 000,011,776 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\msfeedssync.exe
[2013/02/27 04:09:47 | 000,391,680 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\ieui.dll
[2013/02/27 04:09:45 | 000,629,248 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\ieapfltr.dll
[2013/02/27 04:09:45 | 000,361,984 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\html.iec
[2013/02/27 04:09:45 | 000,232,960 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\url.dll
[2013/02/27 04:09:45 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\tdc.ocx
[2013/02/27 04:09:44 | 001,441,280 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\inetcpl.cpl
[2013/02/27 04:09:44 | 000,069,120 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\icardie.dll
[2013/02/27 04:09:44 | 000,061,440 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iesetup.dll
[2013/02/27 04:09:44 | 000,033,280 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\iernonce.dll
[2013/02/27 04:09:44 | 000,023,040 | —- | M] (Microsoft Corporation) – C:\windows\SysWow64\licmgr10.dll
[2013/02/27 04:09:43 | 000,197,120 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\msrating.dll
[2013/02/27 04:09:43 | 000,089,600 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\RegisterIEPKEYs.exe
[2013/02/27 04:09:42 | 000,762,368 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ieapfltr.dll
[2013/02/27 04:09:42 | 000,452,096 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\dxtmsft.dll
[2013/02/27 04:09:42 | 000,441,856 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\html.iec
[2013/02/27 04:09:42 | 000,281,600 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\dxtrans.dll
[2013/02/27 04:09:42 | 000,216,064 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\msls31.dll
[2013/02/27 04:09:42 | 000,081,408 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\icardie.dll
[2013/02/27 04:09:42 | 000,051,712 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ie4uinit.exe
[2013/02/27 04:09:42 | 000,039,936 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iernonce.dll
[2013/02/27 04:09:41 | 001,509,376 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\inetcpl.cpl
[2013/02/27 04:09:41 | 000,905,728 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\mshtmlmedia.dll
[2013/02/27 04:09:41 | 000,235,008 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\url.dll
[2013/02/27 04:09:41 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iesetup.dll
[2013/02/27 04:09:40 | 000,603,136 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\msfeeds.dll
[2013/02/27 04:09:40 | 000,599,552 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\vbscript.dll
[2013/02/27 04:09:40 | 000,167,424 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iexpress.exe
[2013/02/27 04:09:40 | 000,144,896 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\wextract.exe
[2013/02/27 04:09:40 | 000,102,912 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\inseng.dll
[2013/02/27 04:09:40 | 000,097,280 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\mshtmled.dll
[2013/02/27 04:09:40 | 000,027,648 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\licmgr10.dll
[2013/02/27 04:09:39 | 000,173,568 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ieUnatt.exe
[2013/02/27 04:09:39 | 000,149,504 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\occache.dll
[2013/02/27 04:09:39 | 000,062,976 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\pngfilt.dll
[2013/02/27 04:09:39 | 000,013,824 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\mshta.exe
[2013/02/27 04:09:38 | 000,855,552 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\jscript.dll
[2013/02/27 04:09:38 | 000,136,192 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iepeers.dll
[2013/02/27 04:09:38 | 000,135,680 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\IEAdvpack.dll
[2013/02/27 04:09:38 | 000,051,200 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\imgutil.dll
[2013/02/27 04:09:38 | 000,012,800 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\msfeedssync.exe
[2013/02/27 04:09:37 | 003,958,784 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\jscript9.dll
[2013/02/27 04:09:37 | 000,526,848 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\ieui.dll
[2013/02/27 04:09:37 | 000,136,704 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\iesysprep.dll
[2013/02/27 04:09:37 | 000,092,160 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\SetIEInstalledDate.exe
[2013/02/27 04:09:37 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\mshtmler.dll
[2013/02/27 04:09:36 | 000,077,312 | —- | M] (Microsoft Corporation) – C:\windows\SysNative\tdc.ocx
[2013/02/27 01:49:10 | 016,473,456 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerInstaller.exe
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/03/13 20:13:31 | 000,028,406 | —- | C] () – C:\Users\Birdie admin2\Desktop\480068_447603845316578_782767854_n.jpg
[2013/03/13 04:20:21 | 000,001,585 | —- | C] () – C:\Users\Birdie admin2\Desktop\SUPERAntiSpyware - Shortcut.lnk
[2013/03/13 01:09:04 | 000,587,985 | —- | C] () – C:\Users\Birdie admin2\Documents\dwsup.pdf
[2013/03/13 01:08:28 | 000,805,414 | —- | C] () – C:\Users\Birdie admin2\Documents\PdfFile.pdf
[2013/03/12 05:18:07 | 000,890,798 | —- | C] () – C:\Users\Birdie admin2\Desktop\SecurityCheck(1).exe
[2013/03/12 05:17:12 | 000,001,023 | —- | C] () – C:\Users\Birdie admin2\Desktop\Notepad++.lnk
[2013/03/12 04:36:28 | 000,049,560 | —- | C] () – C:\Users\Birdie admin2\Desktop\id fb.jpg
[2013/03/12 04:36:14 | 000,049,560 | —- | C] () – C:\Users\Birdie admin2\Desktop\id fucks.jpg
[2013/03/12 04:33:29 | 000,049,560 | —- | C] () – C:\Users\Birdie admin2\Desktop\photo.JPG
[2013/03/03 15:51:09 | 000,010,814 | —- | C] () – C:\Users\Birdie admin2\Desktop\Funny-Happy-Birthday-06.jpg
[2013/03/03 15:50:57 | 000,001,626 | —- | C] () – C:\Users\Birdie admin2\Desktop\Funny-Happy-Birthday-05.jpg - Shortcut.lnk
[2013/03/03 15:10:50 | 000,001,105 | —- | C] () – C:\Users\Birdie admin2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk
[2013/03/03 13:16:13 | 000,810,496 | —- | C] () – C:\windows\SysNative\xvidcore.dll
[2013/03/03 13:16:13 | 000,183,808 | —- | C] () – C:\windows\SysNative\xvidvfw.dll
[2013/03/03 13:16:13 | 000,080,896 | —- | C] () – C:\windows\SysNative\ff_vfw.dll
[2013/03/03 13:15:41 | 000,389,120 | —- | C] () – C:\windows\SysNative\actskn43.ocx
[2013/03/03 13:15:40 | 000,389,120 | —- | C] () – C:\windows\SysWow64\actskn43.ocx
[2013/03/03 03:18:11 | 000,001,115 | —- | C] () – C:\Users\Birdie admin2\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2013/03/03 01:51:56 | 000,000,638 | —- | C] () – C:\windows\tasks\Wendee.job
[2013/03/02 22:21:40 | 000,061,865 | —- | C] () – C:\Users\Birdie admin2\Documents\Whois-RWS.pdf
[2013/03/02 21:28:04 | 000,204,800 | —- | C] () – C:\Users\Birdie admin2\Documents\firewall2.wfw
[2013/02/27 05:14:28 | 000,204,800 | —- | C] () – C:\Users\Birdie admin2\Documents\windows firewall with advanced security POLICY.wfw
[2013/02/19 16:47:33 | 009,644,082 | —- | C] () – C:\Program Files (x86)\omni.ja
[2013/02/19 16:47:33 | 003,067,288 | —- | C] () – C:\Program Files (x86)\mozjs.dll
[2013/02/19 16:47:33 | 000,036,107 | —- | C] () – C:\Program Files (x86)\removed-files
[2013/02/19 16:47:33 | 000,002,844 | —- | C] () – C:\Program Files (x86)\precomplete
[2013/02/19 16:47:33 | 000,001,245 | —- | C] () – C:\Program Files (x86)\updater.ini
[2013/02/19 16:47:33 | 000,000,899 | —- | C] () – C:\Program Files (x86)\softokn3.chk
[2013/02/19 16:47:33 | 000,000,899 | —- | C] () – C:\Program Files (x86)\nssdbm3.chk
[2013/02/19 16:47:33 | 000,000,899 | —- | C] () – C:\Program Files (x86)\freebl3.chk
[2013/02/19 16:47:33 | 000,000,140 | —- | C] () – C:\Program Files (x86)\platform.ini
[2013/02/19 16:47:33 | 000,000,132 | —- | C] () – C:\Program Files (x86)\update-settings.ini
[2013/02/19 16:47:32 | 000,049,537 | —- | C] () – C:\Program Files (x86)\blocklist.xml
[2013/02/19 16:47:32 | 000,004,003 | —- | C] () – C:\Program Files (x86)\crashreporter.ini
[2013/02/19 16:47:32 | 000,000,783 | —- | C] () – C:\Program Files (x86)\crashreporter-override.ini
[2013/02/19 16:47:32 | 000,000,455 | —- | C] () – C:\Program Files (x86)\application.ini
[2013/02/19 16:47:32 | 000,000,183 | —- | C] () – C:\Program Files (x86)\dependentlibs.list
[2013/02/18 06:49:17 | 000,001,095 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2013/02/18 06:31:10 | 000,001,181 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2013/02/18 06:14:00 | 000,001,053 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2013/02/18 06:05:46 | 000,001,141 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2013/01/02 05:17:59 | 000,033,808 | —- | C] () – C:\Users\Birdie admin2\cc_20130102_041756.reg
[2013/01/02 05:17:05 | 000,090,014 | —- | C] () – C:\Users\Birdie admin2\cc_20130102_041700.reg
[2012/12/14 07:04:14 | 000,015,030 | —- | C] () – C:\Users\Birdie admin2\LG1031.dat
[2012/12/14 06:52:02 | 000,146,076 | —- | C] () – C:\Users\Birdie admin2\perfc009.dat
[2012/12/14 03:42:30 | 000,064,512 | —- | C] () – C:\windows\SysWow64\igdde32.dll
[2012/12/13 21:20:13 | 000,018,904 | —- | C] () – C:\Users\Birdie admin2\WinPatrolLog.csv
[2012/12/12 21:31:03 | 000,002,560 | —- | C] () – C:\windows\_MSRSTRT.EXE
[2012/12/09 06:25:59 | 000,045,056 | —- | C] () – C:\windows\SysWow64\PostMsg.exe
[2012/12/09 06:25:59 | 000,032,768 | —- | C] () – C:\windows\SysWow64\CapSrces.dll
[2012/12/09 06:24:38 | 000,000,196 | —- | C] () – C:\windows\ODBCINST.INI
[2012/12/07 16:54:59 | 000,057,344 | —- | C] () – C:\windows\WNMHINDR.EXE
[2012/12/07 16:54:59 | 000,024,576 | —- | C] () – C:\windows\SysWow64\NMH040A.DLL
[2012/12/07 15:03:43 | 000,000,010 | —- | C] () – C:\windows\GSetup.ini
[2012/12/03 18:48:35 | 000,001,256 | —- | C] () – C:\Users\Birdie admin2\My LastPass Vault.lnk
[2012/12/02 17:04:20 | 000,001,028 | —- | C] () – C:\Users\Birdie admin2\cc_20121202_160418.reg
[2012/12/02 17:03:46 | 000,014,812 | —- | C] () – C:\Users\Birdie admin2\cc_20121202_160343.reg
[2012/12/02 08:34:09 | 000,220,060 | —- | C] () – C:\Users\Birdie admin2\photo.php
[2012/11/30 03:29:06 | 000,060,720 | —- | C] () – C:\Users\Birdie admin2\Sonja_Mays-e27cd454eb6a293.pdf
[2012/11/22 08:18:32 | 002,581,831 | —- | C] () – C:\Users\Birdie admin2\Manual.pdf
[2012/11/10 16:08:12 | 081,186,894 | —- | C] () – C:\Users\Birdie admin2\PowerDirector_11_Enu.pdf
[2012/11/10 05:26:40 | 000,002,249 | —- | C] () – C:\Users\Birdie admin2\Welcome to the Awesomium Wiki.lnk
[2012/11/08 05:36:04 | 000,000,105 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2012/11/07 16:43:24 | 000,000,053 | —- | C] () – C:\Users\Birdie admin2\AppData\Roaming\mbam.context.scan
[2012/10/31 16:53:12 | 000,122,375 | —- | C] () – C:\Program Files (x86)\Acknowledgements.rtf
[2012/10/30 04:25:03 | 000,000,040 | —- | C] () – C:\windows\iltwain.ini
[2012/10/10 02:22:28 | 000,272,928 | —- | C] () – C:\windows\SysWow64\igvpkrng600.bin
[2012/10/10 02:22:20 | 000,963,452 | —- | C] () – C:\windows\SysWow64\igcodeckrng600.bin
[2012/09/03 19:08:26 | 000,020,992 | —- | C] () – C:\Users\Birdie admin2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/29 21:38:35 | 000,193,372 | —- | C] () – C:\windows\SysWow64\mlfcache.dat
[2012/08/20 20:40:48 | 000,017,408 | —- | C] () – C:\Users\Birdie admin2\AppData\Local\WebpageIcons.db
[2012/08/07 18:00:06 | 000,007,657 | —- | C] () – C:\Users\Birdie admin2\AppData\Local\resmon.resmoncfg
[2012/07/02 02:20:49 | 000,000,017 | —- | C] () – C:\windows\SysWow64\shortcut_ex.dat
[2012/06/29 14:25:29 | 000,000,632 | RHS- | C] () – C:\Users\Birdie admin2\ntuser.pol
[2012/05/31 12:12:10 | 000,000,089 | —- | C] () – C:\windows\EWF520.ini
[2012/05/31 01:29:20 | 000,000,331 | —- | C] () – C:\windows\game.ini
[2012/05/14 18:03:49 | 000,000,155 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
[2012/05/13 00:08:54 | 000,871,102 | —- | C] () – C:\windows\SysWow64\PerfStringBackup.INI
[2012/05/11 08:32:04 | 1218,736,453 | —- | C] () – C:\ProgramData\Microsoft .vff
[2012/03/19 23:31:16 | 000,963,912 | —- | C] () – C:\windows\SysWow64\igkrng600.bin
[2012/03/19 23:31:16 | 000,261,208 | —- | C] () – C:\windows\SysWow64\igfcg600m.bin
[2012/02/24 18:45:26 | 000,300,328 | —- | C] () – C:\windows\it50.dll
[2012/02/24 18:45:26 | 000,003,443 | —- | C] () – C:\windows\UTILITYDRV.SYS
[2012/02/24 18:45:25 | 000,259,368 | —- | C] () – C:\windows\FastBR.dll
[2012/02/24 18:45:25 | 000,259,368 | —- | C] () – C:\windows\CopyFile.dll
[2012/02/24 18:45:25 | 000,218,408 | —- | C] () – C:\windows\Image.dll
[2012/02/24 18:45:25 | 000,202,024 | —- | C] () – C:\windows\HardDisk.dll
[2012/02/24 18:45:25 | 000,177,448 | —- | C] () – C:\windows\disk.dll
[2012/02/24 18:45:25 | 000,110,592 | —- | C] () – C:\windows\BootseqwWmi.exe
[2012/02/24 18:45:25 | 000,081,920 | —- | C] () – C:\windows\Bootseqw32.exe
[2012/02/24 18:45:25 | 000,049,152 | —- | C] () – C:\windows\CHGBOOTW.EXE
[2012/02/24 18:45:25 | 000,010,068 | —- | C] () – C:\windows\GT.EXE
[2012/02/24 18:45:25 | 000,008,704 | —- | C] () – C:\windows\Access32.sys
[2012/02/24 10:00:45 | 002,086,240 | —- | C] () – C:\windows\SysWow64\LenovoVeriface.Interface.dll
[2012/02/24 10:00:45 | 001,500,512 | —- | C] () – C:\windows\SysWow64\Apblend.dll
[2012/02/24 10:00:45 | 001,171,456 | —- | C] () – C:\windows\SysWow64\PicNotify.dll
[2012/02/24 10:00:45 | 000,472,416 | —- | C] () – C:\windows\SysWow64\Lenovo.VerifaceStub.dll
[2012/02/24 10:00:39 | 001,044,480 | —- | C] () – C:\windows\SysWow64\3DImageRenderer.dll
[2012/02/24 09:47:10 | 000,015,190 | —- | C] () – C:\windows\S6000Twn.ini
[2011/04/14 22:29:01 | 000,066,856 | —- | C] () – C:\windows\SysWow64\SynTPEnhPS.dll
[2011/04/14 22:28:13 | 000,145,804 | —- | C] () – C:\windows\SysWow64\igcompkrng600.bin
[2008/09/24 20:56:14 | 001,900,544 | —- | C] () – C:\Program Files (x86)\WinBootstrapper.msi
[2008/09/24 20:47:36 | 000,511,676 | —- | C] () – C:\Program Files (x86)\WinBootstrapper1.cab

========== ZeroAccess Check ==========

[2009/07/13 21:55:00 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/08 22:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 21:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012/08/21 06:11:31 | 000,857,088 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012/08/21 06:37:44 | 000,636,928 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012/08/21 06:08:38 | 000,453,120 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/07/24 16:51:08 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Ad-Aware Antivirus
[2012/07/03 13:33:54 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\CBS Interactive
[2012/11/09 03:19:18 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012/11/10 02:45:59 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\com.adobe.WidgetBrowser
[2013/02/27 05:45:28 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Dropbox
[2012/11/08 00:57:16 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Epson
[2013/02/21 12:38:51 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\ESET
[2013/01/02 06:37:08 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\EurekaLog
[2012/12/07 14:14:32 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\GetRightToGo
[2012/12/13 15:28:16 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\IObit
[2012/10/29 12:52:00 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Leadertech
[2012/09/04 00:41:28 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\LSC
[2012/10/25 06:48:35 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Maxthon3
[2010/12/03 16:46:42 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Notepad++
[2012/11/07 07:24:11 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\OpenCandy
[2012/11/10 19:53:28 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Opera
[2013/02/11 04:14:14 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Origin
[2012/11/10 11:13:46 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\PACE Anti-Piracy
[2012/11/10 00:06:56 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\PDAppFlex
[2012/11/08 05:38:35 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Photobucket
[2012/09/22 00:14:41 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\QuickScan
[2012/11/23 07:41:03 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Razer
[2012/08/20 20:06:28 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\redsn0w
[2012/12/02 17:12:29 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\S.A.D
[2012/12/02 02:35:45 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\SingularLabs
[2012/10/24 23:46:15 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\SoftGrid Client
[2012/12/04 23:54:32 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\SolidDocuments
[2012/11/21 14:45:04 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Spotify
[2012/11/10 05:15:37 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/12/02 01:39:49 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Strongvault
[2013/01/05 09:16:01 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\TuneUp Software
[2012/10/25 00:12:41 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Windows Live Writer
[2012/12/13 21:08:07 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\WinPatrol
[2012/10/29 09:05:36 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\WinZip
[2012/11/08 00:23:48 | 000,000,000 | —D | M] – C:\Users\Birdie admin2\AppData\Roaming\Zoner

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2012/02/24 17:12:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2012/02/24 17:12:21 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2012/02/24 17:12:21 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2012/02/24 17:12:21 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 20:24:25 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2012/02/24 17:12:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2012/02/24 17:12:21 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 20:24:11 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/13 18:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\windows\SysNative\services.exe
[2009/07/13 18:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 18:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/13 18:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 18:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\windows\SysNative\svchost.exe
[2009/07/13 18:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 20:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 20:23:55 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 20:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\windows\SysNative\userinit.exe
[2010/11/20 20:24:28 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 20:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\windows\SysNative\winlogon.exe
[2010/11/20 20:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

< %systemroot%\*. /rp /s >

< %systemdrive%\$Recycle.Bin|@;true;true;true /fp >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: HITACHI HTS547550A9E384 ATA Device
Partitions: 4
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 200.00MB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 422.00GB
Starting Offset: 210763776
Hidden sectors: 0

DeviceID: Disk #0, Partition #2
PartitionType: Extended w/Extended Int 13
Bootable: False
BootPartition: False
PrimaryPartition: False
Size: 29.00GB
Starting Offset: 453130584064
Hidden sectors: 0

DeviceID: Disk #0, Partition #3
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 15.00GB
Starting Offset: 484264902656
Hidden sectors: 0

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\windows\System32\config\systemprofile\AppData\Local\Application Data] -> C:\windows\system32\config\systemprofile\AppData\Local -> Junction
[C:\windows\System32\config\systemprofile\AppData\Local\History] -> C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction
[C:\windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files] -> C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction
[C:\windows\System32\config\systemprofile\Application Data] -> C:\windows\system32\config\systemprofile\AppData\Roaming -> Junction
[C:\windows\System32\config\systemprofile\Cookies] -> C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies -> Junction
[C:\windows\System32\config\systemprofile\Local Settings] -> C:\windows\system32\config\systemprofile\AppData\Local -> Junction
[C:\windows\System32\config\systemprofile\Templates] -> C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates -> Junction
[C:\windows\SysWOW64\config\systemprofile\AppData\Local\Application Data] -> C:\windows\system32\config\systemprofile\AppData\Local -> Junction
[C:\windows\SysWOW64\config\systemprofile\AppData\Local\History] -> C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction
[C:\windows\SysWOW64\config\systemprofile\AppData\Local\Temporary Internet Files] -> C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction
[C:\windows\SysWOW64\config\systemprofile\Application Data] -> C:\windows\system32\config\systemprofile\AppData\Roaming -> Junction
[C:\windows\SysWOW64\config\systemprofile\Cookies] -> C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies -> Junction
[C:\windows\SysWOW64\config\systemprofile\Local Settings] -> C:\windows\system32\config\systemprofile\AppData\Local -> Junction
[C:\windows\SysWOW64\config\systemprofile\Templates] -> C:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates -> Junction

< End of report >

birdienic

Post #7March 18, 2013, 10:49 PM UTC

I apologize, for not adding it all to one reply. LOL, my dog ran across the keyboard right as I had it tabbed out "reply" and before I could paste the rest. Then the "extra" file saved in a completely different area!

OTL Extras logfile created on: 02/14/2013 09:12:15 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Birdie admin2\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16438)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: MM/dd/yyyy

3.92 Gb Total Physical Memory | 2.13 Gb Available Physical Memory | 54.28% Memory free
4.53 Gb Paging File | 2.69 Gb Available in Paging File | 59.45% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 421.81 Gb Total Space | 114.41 Gb Free Space | 27.12% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 1.00 Gb Free Space | 3.45% Space Free | Partition Type: NTFS

Computer Name: WNICOLE-PC | User Name: Birdie admin2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] – C:\windows\SysNative\rundll32.exe (Microsoft Corporation)
.js[@ = jsfile] – Reg Error: Value error. File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.js [@ = jsfile] – Reg Error: Value error. File not found

[HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [open] – Reg Error: Value error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\Easy Media Player\emp.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – Reg Error: Key error.
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\Easy Media Player\emp.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [open] – Reg Error: Value error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\Easy Media Player\emp.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – Reg Error: Key error.
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\Easy Media Player\emp.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D5387B3-75A4-4B29-A6C9-9212E47737BB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{0FA44E73-6F57-46FA-8E47-0ECF04615B8C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{11617971-6D42-4F88-BC57-ED4E0E5EA4FB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{25B928A2-B7FA-4FA6-88CE-A25C2E06BB0B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2B28BE20-9448-4ADB-B617-8BDD83DE6AAE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{30D8C08A-1C0B-4F59-8722-1393793CE065}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{321E7D94-4993-48FD-8986-2271940CA1DD}" = rport=445 | protocol=6 | dir=out | app=system |
"{427A8FE6-B402-4147-8E39-14D8C98414EF}" = rport=139 | protocol=6 | dir=out | app=system |
"{494F965E-0577-4DD2-BD82-8C59EBF13440}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4C8EE8C2-0EC3-4B65-91CE-DF01BC832865}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{55719795-7949-4DE8-9ECD-831BC7ECB4D2}" = lport=10243 | protocol=6 | dir=in | app=system |
"{623DB63D-A0D0-4938-A781-22B5DAC2CFF1}" = rport=138 | protocol=17 | dir=out | app=system |
"{668C8286-1BEA-4E83-983D-D2E1F98E2799}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6A5BFBFA-6C7C-4F93-92F4-AA4709A3D821}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{73ABEE52-3CD6-4ED2-A386-528095413307}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7C07F447-BDC4-445A-B8AA-F83085E76849}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8798A9B7-4C33-41EE-9986-CC1297E21C6F}" = rport=137 | protocol=17 | dir=out | app=system |
"{8B21B9E7-0C62-4FE8-BDCD-2C43BAC4280B}" = lport=137 | protocol=17 | dir=in | app=system |
"{8E929898-36E3-4D78-8229-AC40E9897A51}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9597F2E3-DCCF-4C55-982C-06FC4805C537}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{95C931AA-2EFE-451A-AB29-56BE489C7EDC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9D27AAED-8607-4313-8CAD-F0CC0A7A0AD3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A0877644-9F9A-42E4-BF9B-DC398CD438C9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A46CCD65-083F-43B1-BCCC-D9D711F555DF}" = lport=138 | protocol=17 | dir=in | app=system |
"{B6961691-B07F-4827-AFEA-500AD10FF00A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C3C65446-FAF7-4B91-AD4E-50D2DFDF839A}" = lport=139 | protocol=6 | dir=in | app=system |
"{C5198904-0C9A-4ED2-9556-0D8528142734}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CA295AB7-1A42-499D-A2AE-38A835F6B7A9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{D49C28A0-A9F5-4861-B7AC-888004E8AF82}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D637C2C4-9B4D-4B20-A735-0F2F11F4FD99}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=%systemroot%\microsoft.net\framework64\v3.0\windows communication foundation\smsvchost.exe |
"{DBF081B3-58BC-4D84-9C03-B76F5FBF56B5}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{DEEEAF65-F88A-480B-B8EE-6720D233C96D}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{F0A5B348-2AE8-4CE2-8C7E-6722BCF7510E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{F2DD6B29-5089-43DC-81C0-157B573CBA5A}" = lport=445 | protocol=6 | dir=in | app=system |
"{FB4A0B92-1A7C-41F0-8FA4-CE04C44403C5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06DB1576-743B-45D5-8BDD-6C2FAEB392C6}" = protocol=6 | dir=in | app=c:\users\birdie admin2\appdata\local\apps\2.0\234pb4wv.o7b\r3m84zz0.791\curs..tion_9e9e83ddf3ed3ead_0005.0001_dafeadaaa30c70ac\curseclient.exe |
"{0C98C004-2A7D-4318-824B-42E9A00E7AB3}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0D89952E-21A9-4FEC-A680-C3EB46435597}" = protocol=17 | dir=in | app=c:\users\birdie admin2\appdata\local\apps\2.0\234pb4wv.o7b\r3m84zz0.791\curs..tion_9e9e83ddf3ed3ead_0005.0001_dafeadaaa30c70ac\curseclient.exe |
"{12A3B98B-9969-44AC-8803-F1C7C6826547}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{17E7D4BE-B3BC-4193-ACFD-99AB8C640FD3}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{2647EF84-CDAA-49AE-81D3-F1DFCC4D9D95}" = protocol=6 | dir=in | app=c:\program files (x86)\maxthon3\bin\maxthon.exe |
"{28A53309-3D3A-4F04-8B4E-2D81C8D01220}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{2CBD0DB8-AB8D-470B-8745-940AAAD8B503}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{31A4B0B1-D5C9-4C73-AF83-703E9EEB7121}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{3377991E-8D00-4932-8BDA-44B40169FE65}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{33BD6CB8-8147-401A-A61A-A2120C93624A}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{34C75FC3-EB57-49D3-9094-78873F4A7026}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{35AECEDB-1EF0-4DB5-813E-97A8DFE3CFB4}" = protocol=17 | dir=in | app=c:\program files (x86)\maxthon3\bin\mxup.exe |
"{360EC93F-CF1E-4A93-B118-E4B6BEE3E275}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{387E25A3-D311-4AA2-A011-12904A0A2655}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{39BCEFC2-EFBD-4FAF-B57E-09DBEAFC2319}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{3A3F1C42-418E-4C98-B674-92B9A75FD963}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{3B55360B-C5B8-42B6-9A12-86C0342FDCBE}" = protocol=17 | dir=in | app=c:\program files (x86)\opera next\opera.exe |
"{3BE57B33-F993-4F1C-895B-0E58D4C69444}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4024DB3C-BA07-4A91-A0DF-C16E87EC65F5}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{42DB26EC-6450-4E79-9E84-6EF0D654170F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{481BD3CB-EFA8-4BB7-8336-117D72214138}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{48933F4F-E6D9-4231-A56B-C6B577A2F444}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{49002776-6F5A-4B4A-A88F-A32A87DAAAEC}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{4B0FD99F-7ED4-4DBE-A20F-678A3AC2A65F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{4F471584-198A-460C-B99C-74D98A637976}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{543C6486-D08D-480A-A7B0-CF1842545D15}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{55723510-BE6E-4ABB-9647-31DB18807794}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{59DB09BF-7765-4CD8-92AB-3E7720237F5A}" = protocol=6 | dir=in | app=c:\program files (x86)\maxthon3\bin\mxup.exe |
"{5ABF610F-749E-4720-A8C3-0ED07D74F41A}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{5E11BFFA-5BD2-4C0D-A73D-CAAA882BF4D0}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\the sims 3 teaser\game\bin\ts3teaser.exe |
"{5F17ADBB-F1BB-45FD-9359-35F733119440}" = protocol=6 | dir=out | app=system |
"{64886BB0-18E4-4ECA-910F-69460A4004BE}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{66A3AACB-5E47-42CD-BD69-595578512F8E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6F92E607-3A18-4859-B7B8-5257D32210D3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7CBB3BC1-E1BE-4DC7-B570-D900680B3DD1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{852531F2-7F3E-45A5-B328-B544DE3A93B7}" = protocol=6 | dir=in | app=c:\users\birdie admin2\appdata\roaming\dropbox\bin\dropbox.exe |
"{8B9D7050-0A38-4673-8636-43644EAD4A49}" = protocol=17 | dir=in | app=c:\program files (x86)\maxthon3\bin\maxthon.exe |
"{8D11AC3E-C9E6-4AD2-BE1D-7D971565F4E7}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{8E3997C6-FF7B-4154-AA2F-0463BF92D282}" = protocol=6 | dir=in | app=c:\program files (x86)\opera next\opera.exe |
"{8E3D8D7C-1F95-4017-8730-1AC1042801B0}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8F6E0980-AAB1-4BE2-B51B-138E64C094CE}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{9ED6098E-D9F9-480F-8581-1F05ACE0F082}" = protocol=17 | dir=in | app=c:\users\birdie admin2\appdata\roaming\dropbox\bin\dropbox.exe |
"{A31E41AA-9CB3-4CC4-9E2E-C9F36E8B0D68}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{B415F256-B77D-4357-867A-75609619179F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BAA21A1E-2410-4D9F-AB35-393775911C42}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{C184F58E-AB22-4468-BAD5-EFE56337421E}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{CBC8EF9E-D091-4DB6-B193-5FDE788BBEA4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CBD88A63-EFBD-48CD-A395-9EDDE2E05AC7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{CBF34D2E-46C4-4FDD-A857-7907F18D2001}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{CD25E214-BC98-474E-8699-476D6EF0747A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{CD6B0041-BACE-4CB7-9865-40626DF35E52}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{CD9CE117-7045-4094-85C1-8CB75A72DBAC}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{CFB900DD-DD71-45E4-8888-C36C414550B7}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{D074B0E1-51BA-420D-ACA4-F531A7B08FA9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FEFC6AF6-4E10-48F2-BE8D-1241FB15A8FA}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\the sims 3 teaser\game\bin\ts3teaser.exe |
"TCP Query User{338D7E86-0BF0-41D4-ADDA-8958C8C7198C}C:\program files (x86)\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |
"TCP Query User{ED542B2C-7A22-4778-9ECD-B9DBAD1480DB}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{95051047-1269-4B62-A81F-27622FA97C00}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{AA63B556-1DF7-451D-8F6C-13E010C24958}C:\program files (x86)\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1F494B8A-D6E6-4540-9A74-F773B63164A6}" = Port Locker
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{551F492A-01B0-4DC4-866F-875EC4EDC0A8}" = CyberLink PowerDirector 11
"{5F611ADA-B98C-4DBB-ADDE-414F08457ECF}" = Windows Live Family Safety
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{73105254-4936-47AC-ACDE-08D11D25E3DB}" = AVG 2013
"{89BDAE1A-7B8E-4A0E-A169-02F7F366451D}" = iCloud
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-1000-0000000FF1CE}_Office14.SingleImage_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-1000-0000000FF1CE}_Office14.SingleImage_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-1000-0000000FF1CE}_Office14.SingleImage_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-1000-0000000FF1CE}_Office14.SingleImage_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-1000-0000000FF1CE}_Office14.SingleImage_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-1000-0000000FF1CE}_Office14.SingleImage_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.SingleImage_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.SingleImage_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-1000-0000000FF1CE}_Office14.SingleImage_{1779650B-2E44-4A19-8DF6-3866D645764A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-1000-0000000FF1CE}_Office14.SingleImage_{270CA0B9-9881-44DB-BC3B-37C7E66A044A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-1000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.SingleImage_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010
"{90140000-0043-0409-1000-0000000FF1CE}_Office14.SingleImage_{FCD1C311-8B02-4DBD-BA46-1079C629577E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-1000-0000000FF1CE}_Office14.SingleImage_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-1000-0000000FF1CE}_Office14.SingleImage_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-1000-0000000FF1CE}_Office14.SingleImage_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-1000-0000000FF1CE}_Office14.SingleImage_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A000F75A-A246-44A7-8079-9E9E7F9054B2}" = BioExcess
"{A62F9CD0-B2E0-4F2A-88F2-79254A3C8539}" = WinPatrol
"{B9D80BD8-C6F4-467C-9717-0ABA9684DA29}" = AVG 2013
"{C78D3032-9DFD-41D0-9DE9-58EAE750CBA4}" = Microsoft Security Client
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6822EFD-3F7D-4B35-8845-757A26AEC8E2}" = Windows Live MIME IFilter
"{FBBC4667-2521-4E78-B1BD-8706F774549B}" = Best Buy pc app
"CCleaner" = CCleaner
"EA12B1FB53CE4E387C31A85236C41EF559B5E392" = Windows Driver Package - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1)
"EPSON WorkForce 520 Series" = EPSON WorkForce 520 Series Printer Uninstall
"Lenovo EE Boot Optimizer" = Lenovo EE Boot Optimizer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Office14.SingleImage" = Microsoft Office Professional 2010
"sp6" = Logitech SetPoint 6.51
"Speccy" = Speccy
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ZonerPhotoStudio15_EN_is1" = Zoner Photo Studio 15

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0034859F-8E01-4C1D-BE77-F891C4786FBC}" = Lenovo Security Suite
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam 5
"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0A5D6971-7347-4914-A090-0EA445B28917}" = The Sims 3 Teaser
"{17D26CDD-B87C-412B-92F0-2D5DD4313522}" = Facebook Messenger 2.1.4651.0
"{18272881-CFC0-434D-A975-E5BE44206AA0}" = Windows Live UX Platform Language Pack
"{1EA7C505-E6DA-4B85-9432-EBD3C70D510D}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{23A3E560-069F-4CFC-8F6C-1B526EC735FC}" = Windows Live Writer Resources
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{28ABE740-47F3-441B-9437-852F6A64EFF8}" = Lenovo_Wireless_Driver
"{2D9C81F2-CF30-47F9-860E-58DACF92ABC9}" = Razer Arctosa
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{30F99474-EBE3-4134-A02B-F6CD38CFE243}" = Photo Gallery
"{33286280-8617-11E1-8FF6-B8AC6F97B88E}" = Google Earth Plug-in
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{3E31400D-274E-4647-916C-2CACC3741799}" = EpsonNet Print
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{400C31E4-796F-4E86-8FDC-C3C4FACC6847}" = Junk Mail filter update
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{44510C84-AE2A-4079-A75B-D44E68D73B9A}" = CyberLink PhotoDirector 4
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform
"{5168EF57-AB2E-4360-8D2F-3F09F4E71EC1}" = ArcSoft MediaImpression HD Edition
"{553C904F-57A2-4113-888E-BA0C3D1C69C0}" = Microsoft VC9 runtime libraries
"{5B21BB9A-E23E-472b-AD2A-FB9B06A4727C}" = Network Console
"{5BABDA39-61CF-41EE-992D-4054B6649A9B}" = Movie Maker
"{5D6D605B-E4B7-490B-A794-9284BC3D2A8B}" = Driver Detective
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{62BBB2F0-E220-4821-A564-730807D2C34D}" = Realtek USB 2.0 Reader Driver
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform
"{70854FE6-3BF1-4C69-94D0-BEB821102E34}" = Windows Live Mail
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = The Sims™ 3 High-End Loft Stuff
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{74826218-7227-8465-6255-422027337377}" = PokeTALK Desktop Phone
"{7555C7EA-B332-4248-ABAD-C5D4E6D77416}" = CyberLink Autumn Romance_16_9
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B0C5EF6-DE4C-4E20-8889-C17604FFE5CD}" = Windows Live Family Safety
"{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}" = Bing Desktop
"{86C40513-B5A4-476E-9EAB-EC118DCF4502}" = Windows Live Writer
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{88F0F4FF-B514-4E32-9C17-CAF96D60EAFC}" = Razer Game Booster
"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{8E482334-8D43-42ED-82B8-1846B5A9ABAB}" = CyberLink Raindow Delights_4_3
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{97C79BEC-43F7-4BD8-A6A7-85C0257E488A}" = Windows Live Writer
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A4ED5E53-7AA0-11E1-BF04-B2D4D4A5360E}" = Adobe Dreamweaver CS6
"{A6FEE06D-C7E1-48CB-A9DF-1E317CF83CA4}" = Port Locker
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.3
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}" = The Sims™ 3 Supernatural
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B80D3EA9-A252-4AE5-AC51-81729F5C586F}" = Windows Live Mail
"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = The Sims™ 3 World Adventures
"{C034A6F9-6569-491B-B3BF-F5D15221A708}" = Windows Live Essentials
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{C8773FDB-D0DB-BE52-D536-F48F9886B57B}" = Adobe Download Assistant
"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common
"{D0916F1D-236D-4B9A-BCEA-F535444DCA41}" = Photobucket Desktop
"{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D2C146B1-948D-47EF-8387-5D1C6B980F7C}" = Windows Live Writer
"{D888F114-7537-4D48-AF03-5DA9C82D7540}" = Photo Common
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6CB67CC-71D2-46b9-8D43-A4641A9EECB2}" = BioExcess
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{ED6C77F9-4D7E-447C-9EC0-9A212D075535}" = Movie Maker
"{EE08A266-D46C-4945-9718-B21D31DD2048}" = CyberLink Eternal Love_4_3
"{EFBE6DD5-B224-96E5-72B9-68D328CB12A6}" = Adobe Widget Browser
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics
"{F2235E5E-7881-4293-9B6F-04B2609FBFF0}" = Windows Live Messenger
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FBBC4667-2521-4E78-B1BD-8706F774549B}" = Best Buy pc app
"{FC6C7107-7D72-41A1-A031-3CE751159BAB}" = Photo Gallery
"{FC9B811E-39BC-4813-9E29-B83CCF700010}" =
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.adobe.WidgetBrowser" = Adobe Widget Browser
"Easy Media Player" = Easy Media Player 1.1.12
"Google Chrome" = Google Chrome
"InstallShield_{0034859F-8E01-4C1D-BE77-F891C4786FBC}" = Lenovo Security Suite
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam 5
"InstallShield_{44510C84-AE2A-4079-A75B-D44E68D73B9A}" = CyberLink PhotoDirector 4
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{551F492A-01B0-4DC4-866F-875EC4EDC0A8}" = CyberLink PowerDirector 11
"InstallShield_{7555C7EA-B332-4248-ABAD-C5D4E6D77416}" = CyberLink Autumn Romance_16_9
"InstallShield_{8E482334-8D43-42ED-82B8-1846B5A9ABAB}" = CyberLink Raindow Delights_4_3
"InstallShield_{A6FEE06D-C7E1-48CB-A9DF-1E317CF83CA4}" = Port Locker
"InstallShield_{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = EgisTec Shredder
"InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"InstallShield_{E6CB67CC-71D2-46b9-8D43-A4641A9EECB2}" = BioExcess
"InstallShield_{EE08A266-D46C-4945-9718-B21D31DD2048}" = CyberLink Eternal Love_4_3
"Maxthon3" = Maxthon 3
"Mozilla Firefox 17.0.1 (x86 en-US)" = Mozilla Firefox 17.0.1 (x86 en-US)
"Notepad++" = Notepad++
"Opera 12.10.1652" = Opera 12.10
"Opera 12.11.1659" = Opera Next 12.11 beta RC build 1659
"Origin" = Origin
"Picasa 3" = Picasa 3
"SugarSync" = SugarSync Manager
"VeriFace" = VeriFace
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"101a9f93b8f0bb6f" = Curse Client
"Dropbox" = Dropbox

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 11/10/2012 06:25:44 AM | Computer Name = wnicole-PC | Source = Microsoft-Windows-User Profiles Service | ID = 1515
Description = Windows has backed up this user profile. Windows will automatically
try to use the backup profile the next time this user logs on.

Error - 11/10/2012 06:25:44 AM | Computer Name = wnicole-PC | Source = Microsoft-Windows-User Profiles Service | ID = 1511
Description = Windows cannot find the local profile and is logging you on with a
temporary profile. Changes you make to this profile will be lost when you log off.

Error - 11/10/2012 06:25:44 AM | Computer Name = wnicole-PC | Source = Microsoft-Windows-User Profiles Service | ID = 1500
Description = Windows cannot log you on because your profile cannot be loaded. Check
that you are connected to the network, and that your network is functioning correctly.
DETAIL - Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

Error - 11/10/2012 07:28:26 AM | Computer Name = wnicole-PC | Source = Application Error | ID = 1000
Description = Faulting application name: VulcanMessageCmd.exe, version: 3.0.0.783,
time stamp: 0x4f5b28fe Faulting module name: MSVCR100.dll, version: 10.0.40219.325,
time stamp: 0x4df2be1e Exception code: 0x40000015 Fault offset: 0x0008d6fd Faulting
process id: 0x1854 Faulting application start time: 0x01cdbf3634e7bde8 Faulting application
path: C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\VulcanMessageCmd.exe
Faulting
module path: C:\windows\system32\MSVCR100.dll Report Id: bdc222df-2b29-11e2-b879-f5158bd54096

Error - 11/10/2012 07:45:13 AM | Computer Name = wnicole-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Acrobat.exe, version: 11.0.0.379, time
stamp: 0x505fd1ce Faulting module name: ntdll.dll, version: 6.1.7601.17725, time
stamp: 0x4ec49b8f Exception code: 0xc0000374 Fault offset: 0x000ce6c3 Faulting process
id: 0x20e4 Faulting application start time: 0x01cdbf36e29adab2 Faulting application
path: C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrobat.exe Faulting module
path: C:\windows\SysWOW64\ntdll.dll Report Id: 15e5f016-2b2c-11e2-b879-f5158bd54096

Error - 11/10/2012 09:22:45 AM | Computer Name = wnicole-PC | Source = Application Error | ID = 1000
Description = Faulting application name: dreamweaver.exe, version: 12.0.1.5842,
time stamp: 0x4ffc7da3 Faulting module name: mfc100u.dll, version: 10.0.40219.325,
time stamp: 0x4df2e0e6 Exception code: 0xc0000005 Fault offset: 0x0005894a Faulting
process id: 0x2394 Faulting application start time: 0x01cdbf45035128ce Faulting application
path: C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS6\dreamweaver.exe Faulting
module path: C:\windows\system32\mfc100u.dll Report Id: b66aa95b-2b39-11e2-b879-f5158bd54096

Error - 11/10/2012 09:22:50 AM | Computer Name = wnicole-PC | Source = Application Error | ID = 1000
Description = Faulting application name: dreamweaver.exe, version: 12.0.1.5842,
time stamp: 0x4ffc7da3 Faulting module name: ntdll.dll, version: 6.1.7601.17725,
time stamp: 0x4ec49b8f Exception code: 0xc0150010 Fault offset: 0x000847db Faulting
process id: 0x2394 Faulting application start time: 0x01cdbf45035128ce Faulting application
path: C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS6\dreamweaver.exe Faulting
module path: C:\windows\SysWOW64\ntdll.dll Report Id: b93bfc5b-2b39-11e2-b879-f5158bd54096

Error - 11/10/2012 11:56:05 AM | Computer Name = wnicole-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Zps.exe, version: 15.0.1.2, time stamp:
0x5072ff91 Faulting module name: Zxl.dll, version: 15.0.1.2, time stamp: 0x5072f9d9
Exception
code: 0xc0000005 Fault offset: 0x00000000006595b8 Faulting process id: 0x3158 Faulting
application start time: 0x01cdbf5a83497332 Faulting application path: C:\Program
Files\Zoner\Photo Studio 15\Program64\Zps.exe Faulting module path: C:\Program Files\Zoner\Photo
Studio 15\Program64\Zxl.dll Report Id: 21f5021a-2b4f-11e2-b879-f5158bd54096

Error - 11/10/2012 11:56:11 AM | Computer Name = wnicole-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Zps.exe, version: 15.0.1.2, time stamp:
0x5072ff91 Faulting module name: Zxl.dll, version: 15.0.1.2, time stamp: 0x5072f9d9
Exception
code: 0xc000041d Fault offset: 0x00000000006595b8 Faulting process id: 0x3158 Faulting
application start time: 0x01cdbf5a83497332 Faulting application path: C:\Program
Files\Zoner\Photo Studio 15\Program64\Zps.exe Faulting module path: C:\Program Files\Zoner\Photo
Studio 15\Program64\Zxl.dll Report Id: 25727620-2b4f-11e2-b879-f5158bd54096

Error - 11/10/2012 12:57:47 PM | Computer Name = wnicole-PC | Source = SendoriService | ID = 99
Description = Retrieving the COM class factory for component with CLSID {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}
failed due to the following error: 80070424.

[ System Events ]
Error - 02/15/2013 12:24:40 AM | Computer Name = wnicole-PC | Source = Service Control Manager | ID = 7001
Description = The World Wide Web Publishing Service service depends on the Windows
Process Activation Service service which failed to start because of the following
error: %%2

Error - 02/15/2013 12:24:51 AM | Computer Name = wnicole-PC | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
kl1 KLIF KLIM6 SBRE

Error - 02/15/2013 12:25:00 AM | Computer Name = wnicole-PC | Source = DCOM | ID = 10005
Description =

Error - 02/15/2013 12:25:00 AM | Computer Name = wnicole-PC | Source = Service Control Manager | ID = 7000
Description = The IIS Admin Service service failed to start due to the following
error: %%5

Error - 02/15/2013 12:25:00 AM | Computer Name = wnicole-PC | Source = Service Control Manager | ID = 7000
Description = The WinHTTP Web Proxy Auto-Discovery Service service failed to start
due to the following error: %%1079

Error - 02/15/2013 12:25:00 AM | Computer Name = wnicole-PC | Source = Service Control Manager | ID = 7000
Description = The IIS Admin Service service failed to start due to the following
error: %%5

Error - 02/15/2013 12:25:00 AM | Computer Name = wnicole-PC | Source = Service Control Manager | ID = 7000
Description = The WinHTTP Web Proxy Auto-Discovery Service service failed to start
due to the following error: %%1079

Error - 02/15/2013 12:27:12 AM | Computer Name = wnicole-PC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = There was an error while attempting to read the local hosts file.

Error - 02/15/2013 12:27:12 AM | Computer Name = wnicole-PC | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = There was an error while attempting to read the local hosts file.

Error - 02/15/2013 12:28:03 AM | Computer Name = wnicole-PC | Source = Service Control Manager | ID = 7000
Description = The WinHTTP Web Proxy Auto-Discovery Service service failed to start
due to the following error: %%1079

< End of report >

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-03-18 15:43:09
—————————–
15:43:09.601 OS Version: Windows x64 6.1.7601 Service Pack 1
15:43:09.601 Number of processors: 4 586 0x2A07
15:43:09.601 ComputerName: WNICOLE-PC UserName:
15:43:10.781 Initialze error C000010E - driver not loaded
15:43:10.874 write error "aswCmnB.dll". The process cannot access the file because it is being used by another process.
15:44:16.560 AVAST engine defs: 13031800
15:48:29.058 The log file has been saved successfully to "C:\Users\Birdie admin2\Desktop\aswMBR.txt"

Robybel

Post #8March 19, 2013, 8:05 AM UTC last edited March 19, 2013, 8:06 AM UTC

Hi Nicole888

Multiple AntiVirus Running

I see you have more than one Anti-Virus program installed, ( AVG 2013 ) and ( Microsoft Security Essentials ).

While this may seem like greater protection, it can cause problems including slowdowns, system hangs or even crashes. This can happen if both AntiVirus applications attempt to access the same file at the same time. This may cause the applications to interfere with each other, or cause the system to lock up. It can also be a drain on system resources, making a machine run slower than it should.

I suggest removing one of them via Programs and Features

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKCU..\Run: [AdobeBridge] File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\DEFEND~1\DEFEND~1.0\x64\adialhk.dll) - File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\DEFEND~1\DEFEND~1.0\x64\r3hook.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\DEFEND~1\DEFEND~1.0\adialhk.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\DEFEND~1\DEFEND~1.0\r3hook.dll) - File not found

:Files
ipconfig /flushdns /c


:Commands
[EMPTYFLASH]
[REBOOT]
[RESETHOSTS]
[CREATERESTOREPOINT]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post Fix OTL log as well as a new OTL log by rerunning it after reboot without custom scans script.

============ Next ==============

AdwCleaner

Please download AdwCleaner by Xplode onto your desktop.
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

============ Next ==============

Download RogueKiller and save it to your desktop.
Quit all other programs
Start RogueKiller.exe
Wait until the Prescan has finished …
Click on Scan
[external image: Posted Image]
Wait for the end of the scan
A report will be created on your desktop.
Click on the Delete button
[external image: Posted Image]
Next click on the ShortcutsFix
[external image: Posted Image]
another report will be created on your desktop.

Please post: All RKreport.txt text files located on your desktop.

On your next reply please post :
New OTL log after fix
AdwCleaner report
All RKreport.txt

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

birdienic

Post #9March 23, 2013, 6:49 AM UTC last edited March 23, 2013, 10:04 AM UTC

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~2\DEFEND~1\DEFEND~1.0\x64\adialhk.dll deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~2\DEFEND~1\DEFEND~1.0\x64\r3hook.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~2\DEFEND~1\DEFEND~1.0\adialhk.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~2\DEFEND~1\DEFEND~1.0\r3hook.dll deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Birdie admin2\Desktop\cmd.bat deleted successfully.
C:\Users\Birdie admin2\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Birdie admin2
->Flash cache emptied: 54456 bytes

User: Birdie admin2.WNICOLE-PC
->Flash cache emptied: 0 bytes

User: BirdiesNew
->Flash cache emptied: 53637 bytes

User: Default
->Flash cache emptied: 53632 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Nic.Bird

User: Public

User: Test
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Error: Unble to create default HOSTS file!
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 03222013_235046

# AdwCleaner v2.115 - Logfile created 03/23/2013 at 02:03:37
# Updated 17/03/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Birdie admin2 - WNICOLE-PC
# Boot Mode : Normal
# Running from : C:\Users\Birdie admin2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MR87VFT9\AdwCleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search
Deleted on reboot : C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Deleted on reboot : C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajgghejjpgkmpgbchgjieahoefimdle
File Deleted : C:\END
File Deleted : C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
File Deleted : C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal
File Deleted : C:\Users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\pv3ep85u.default-1363649470618\searchplugins\Conduit.xml
File Deleted : C:\Users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\pv3ep85u.default-1363649470618\searchplugins\softonic.xml
Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\Users\Birdie admin2\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Birdie admin2\AppData\Local\Conduit
Folder Deleted : C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Folder Deleted : C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajgghejjpgkmpgbchgjieahoefimdle
Folder Deleted : C:\Users\Birdie admin2\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\Birdie admin2\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Birdie admin2\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Birdie admin2\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Birdie admin2\AppData\LocalLow\Softonic
Folder Deleted : C:\Users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\51wg2cqx.default\extensions\wecarereminder@bryan
Folder Deleted : C:\Users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\pv3ep85u.default-1363649470618\extensions\{739df940-c5ee-4bab-9d7e-270894ae687a}
Folder Deleted : C:\Users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\pv3ep85u.default-1363649470618\extensions\{e4c3a8b6-7724-45d1-a629-17b69118ebcd}
Folder Deleted : C:\Users\Birdie admin2\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\BIRDIE~2\AppData\Local\Temp\CT3287822
Folder Deleted : C:\Users\BIRDIE~2\AppData\Local\Temp\CT3289847

***** [Registry] *****

Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\Software\dlQUE
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16521

[OK] Registry is clean.

-\\ Mozilla Firefox v19.0 (en-US)

File : C:\Users\BirdiesNew\AppData\Roaming\Mozilla\Firefox\Profiles\jrsfvlmu.default\prefs.js

[OK] File is clean.

File : C:\Users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\ncbiyoia.default\prefs.js

C:\Users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\ncbiyoia.default\user.js … Deleted !

Deleted : user_pref("browser.search.order.1", "Ask.com");

-\\ Google Chrome v25.0.1364.97

File : C:\Users\BirdiesNew\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

File : C:\Users\Test\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

File : C:\Users\Birdie admin2\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.4368] : urls_to_restore_on_startup = [ "hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN"[…]

-\\ Opera v12.10.1652.0

File : C:\Users\BirdiesNew\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

File : C:\Users\Birdie admin2\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [7070 octets] - [23/03/2013 01:58:55]
AdwCleaner[S1].txt - [6965 octets] - [23/03/2013 02:03:37]

########## EOF - C:\AdwCleaner[S1].txt - [7025 octets] ##########

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Birdie admin2 [Admin rights]
Mode : Scan – Date : 03/23/2013 02:32:45
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] SMessaging.exe – C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe [7] -> KILLED [TermProc]

¤¤¤ Registry Entries : 11 ¤¤¤
[RUN][SUSP PATH] HKLM\[…]\Wow6432Node\Run : SMessaging (C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe) [7] -> FOUND
[RUN][BLACKLISTDLL] HKLM\[…]\Wow6432Node\Run : S6000Mnt (C:\windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt) -> FOUND
[TASK][SUSP PATH] Wendee.job : C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SosLocalBackup.exe "Wendee" "default" "C:\Users\Birdie admin2\Documents\My Strongvault Backups\Wendee.sos" [7] -> FOUND
[TASK][SUSP PATH] Wendee : C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SosLocalBackup.exe "Wendee" "default" "C:\Users\Birdie admin2\Documents\My Strongvault Backups\Wendee.sos" [7] -> FOUND
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Default : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe [x] -> FOUND
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Default User : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe [x] -> FOUND
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Test : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe [x] -> FOUND
[HJ DESK] HKCU\[…]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> FOUND
[HJ DESK] HKCU\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤
[Faked.Drv][FILE] bthenum.sys : C:\windows\system32\drivers\bthenum.sys [-] –> FOUND
[Faked.Drv][FILE] bthport.sys : C:\windows\system32\drivers\bthport.sys [-] –> FOUND
[Faked.Drv][FILE] BTHUSB.SYS : C:\windows\system32\drivers\BTHUSB.SYS [-] –> FOUND

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: HITACHI HTS547550A9E384 ATA Device +++++
— User —
[MBR] 612c29c980af4644b0768c80a082d32e
[BSP] 5c043154e3d3cd71361347ab413a9f39 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 200 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 411648 | Size: 431938 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 885020672 | Size: 29692 Mo
3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 945829888 | Size: 15109 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[1]_S_03232013_02d0232.txt >>
RKreport[1]_S_03232013_02d0232.txt

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Birdie admin2 [Admin rights]
Mode : Remove – Date : 03/23/2013 02:34:53
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] SMessaging.exe – C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe [7] -> KILLED [TermProc]

¤¤¤ Registry Entries : 10 ¤¤¤
[RUN][SUSP PATH] HKLM\[…]\Wow6432Node\Run : SMessaging (C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe) [7] -> DELETED
[RUN][BLACKLISTDLL] HKLM\[…]\Wow6432Node\Run : S6000Mnt (C:\windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt) -> DELETED
[TASK][SUSP PATH] Wendee.job : C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SosLocalBackup.exe "Wendee" "default" "C:\Users\Birdie admin2\Documents\My Strongvault Backups\Wendee.sos" [7] -> DELETED
[TASK][SUSP PATH] Wendee : C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SosLocalBackup.exe "Wendee" "default" "C:\Users\Birdie admin2\Documents\My Strongvault Backups\Wendee.sos" [7] -> DELETED
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Default : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe [x] -> DELETED
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Test : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe [x] -> DELETED
[HJ DESK] HKCU\[…]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REPLACED (0)
[HJ DESK] HKCU\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤
[Faked.Drv][FILE] bthenum.sys : C:\windows\system32\drivers\bthenum.sys [-] –> CANNOT FIX
[Faked.Drv][FILE] bthport.sys : C:\windows\system32\drivers\bthport.sys [-] –> CANNOT FIX
[Faked.Drv][FILE] BTHUSB.SYS : C:\windows\system32\drivers\BTHUSB.SYS [-] –> CANNOT FIX

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: HITACHI HTS547550A9E384 ATA Device +++++
— User —
[MBR] 612c29c980af4644b0768c80a082d32e
[BSP] 5c043154e3d3cd71361347ab413a9f39 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 200 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 411648 | Size: 431938 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 885020672 | Size: 29692 Mo
3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 945829888 | Size: 15109 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[2]_D_03232013_02d0234.txt >>
RKreport[1]_S_03232013_02d0232.txt ; RKreport[2]_D_03232013_02d0234.txt

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Birdie admin2 [Admin rights]
Mode : Shortcuts HJfix – Date : 03/23/2013 02:46:25
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] SMessaging.exe – C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe [7] -> KILLED [TermProc]

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 3 / Fail 0
Quick launch: Success 1 / Fail 0
Programs: Success 41 / Fail 0
Start menu: Success 1 / Fail 0
User folder: Success 171 / Fail 0
My documents: Success 38 / Fail 38
My favorites: Success 7 / Fail 0
My pictures: Success 10 / Fail 0
My music: Success 3 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 216 / Fail 0
Backup: [NOT FOUND]

Drives:
[C:] \Device\HarddiskVolume2 – 0x3 –> Restored
[D:] \Device\HarddiskVolume3 – 0x3 –> Restored
[E:] \Device\CdRom0 – 0x5 –> Skipped

Finished : << RKreport[3]_SC_03232013_02d0246.txt >>
RKreport[1]_S_03232013_02d0232.txt ; RKreport[2]_D_03232013_02d0234.txt ; RKreport[3]_SC_03232013_02d0246.txt

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Birdie admin2 [Admin rights]
Mode : Shortcuts HJfix – Date : 03/23/2013 02:48:32
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] SMessaging.exe – C:\Users\Birdie admin2\AppData\Local\Stronghold Online Backup\SMessaging.exe [7] -> KILLED [TermProc]

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 18 / Fail 0
My documents: Success 0 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 1 / Fail 0
Backup: [NOT FOUND]

Drives:
[C:] \Device\HarddiskVolume2 – 0x3 –> Restored
[D:] \Device\HarddiskVolume3 – 0x3 –> Restored
[E:] \Device\CdRom0 – 0x5 –> Skipped

Finished : << RKreport[4]_SC_03232013_02d0248.txt >>
RKreport[1]_S_03232013_02d0232.txt ; RKreport[2]_D_03232013_02d0234.txt ; RKreport[3]_SC_03232013_02d0246.txt ; RKreport[4]_SC_03232013_02d0248.txt

Robybel

Post #10March 24, 2013, 3:15 PM UTC last edited March 24, 2013, 3:18 PM UTC

Hi Nicole888

Please do not edit the post, otherwise I can not see the notification by email, thanks

===========================

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

============ Next ==============

Please read through these instructions to familarize yourself with what to expect when this tool runs

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

====================================================

Double click on combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

On your next reply please post :
JRT log
Combofix log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

birdienic

Post #11March 25, 2013, 1:59 AM UTC

Thanks, lol sry. I didn't even think about it when I "recycled" that last topic.

ComboFix 13-03-24.03 - Birdie admin2 03/24/2013 18:14:10.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.2148 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Setup.exe c:\programdata\Microsoft .vff c:\users\Birdie admin2\AppData\Local\assembly\tmp c:\users\Birdie admin2\AppData\Local\Microsoft\Windows\Temporary Internet Files\{03F83D23-04DD-4655-AAEF-5FB815251947}.xps c:\users\BirdiesNew\AppData\Local\Microsoft\Windows\Temporary Internet Files\{20A17067-DD13-4B36-94D1-F11CDACB95F8}.xps c:\windows\gt.exe c:\windows\iun6002.exe c:\windows\s.bat c:\windows\SysWow64\DEBUG.log c:\windows\SysWow64\ndisapi.dll c:\windows\version.txt . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Legacy_NPF ——-\Service_npf . . ((((((((((((((((((((((((( Files Created from 2013-02-25 to 2013-03-25 ))))))))))))))))))))))))))))))) . . 2013-03-25 01:36 . 2013-03-25 01:36 ——– d—–w- c:\users\Test\AppData\Local\temp 2013-03-25 01:36 . 2013-03-25 01:36 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-03-25 01:36 . 2013-03-25 01:36 ——– d—–w- c:\users\BirdiesNew\AppData\Local\temp 2013-03-25 00:16 . 2013-03-25 00:16 ——– d—–w- c:\windows\ERUNT 2013-03-25 00:16 . 2013-03-25 00:16 ——– dc—-w- C:\JRT 2013-03-24 23:23 . 2013-03-25 01:18 ——– dc—-r- C:\Temporary Internet Files 2013-03-23 18:09 . 2013-03-23 18:09 ——– d—–w- c:\program files\MioNet 2013-03-23 18:09 . 2013-03-23 18:09 ——– d—–w- c:\users\Birdie admin2\AppData\Local\MioNet 2013-03-23 18:09 . 2013-03-23 18:19 ——– d—–w- c:\program files (x86)\MioNet 2013-03-23 17:02 . 2013-03-23 17:02 ——– d—–w- c:\program files (x86)\Western Digital 2013-03-23 17:02 . 2013-03-23 17:02 ——– d—–w- c:\program files\Western Digital 2013-03-23 16:55 . 2013-03-23 17:20 ——– d—–w- c:\users\Birdie admin2\AppData\Local\Western_Digital 2013-03-23 16:54 . 2013-03-23 16:54 ——– d—–w- c:\users\Birdie admin2\AppData\Roaming\Western Digital 2013-03-23 16:27 . 2013-03-23 16:27 ——– d—–w- c:\users\Birdie admin2\AppData\Local\Western Digital 2013-03-23 16:25 . 2013-03-23 17:53 ——– d—–w- c:\programdata\Western Digital 2013-03-23 13:55 . 2013-03-23 13:56 ——– d—–w- c:\program files\CyberGhost VPN 2013-03-23 13:36 . 2013-03-23 13:36 ——– d—–w- c:\programdata\Roxio 2013-03-23 13:36 . 2013-03-23 13:36 ——– d—–w- c:\users\Birdie admin2\AppData\Roaming\Roxio 2013-03-23 13:35 . 2013-03-23 13:36 ——– d—–w- c:\program files (x86)\Common Files\Sonic Shared 2013-03-23 13:32 . 2013-03-23 13:32 ——– d—–w- c:\programdata\Sonic 2013-03-23 11:11 . 2013-03-23 11:12 ——– d—–w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-03-23 10:35 . 2013-03-23 10:35 ——– d—–w- c:\users\Test\AppData\Local\Apple Computer 2013-03-23 10:13 . 2013-03-23 16:25 428 -c–a-w- C:\FixitRegBackup.reg 2013-03-23 10:09 . 2013-03-23 10:09 ——– d—–w- c:\windows\TempA39CFF2F-B190-4B5B-AC09-6F534E0F8272-Signatures 2013-03-23 10:01 . 2013-03-23 10:01 ——– d—–w- c:\windows\TempB82822AF-AC26-100E-15E4-DE3B06D01E3D-Signatures 2013-03-23 09:57 . 2013-03-23 09:57 ——– d—–w- c:\windows\Temp6346EEF2-05C4-3981-F135-5C5125C69C5D-Signatures 2013-03-23 09:31 . 2013-03-23 09:31 ——– d—–w- c:\windows\snack 2013-03-23 09:19 . 2013-03-23 09:19 ——– d—–w- c:\windows\TempCC295357-A678-E8EB-3141-0885FB52F1D4-Signatures 2013-03-23 09:03 . 2013-03-23 09:04 377 —-a-w- c:\windows\DeleteOnReboot.bat 2013-03-23 07:39 . 2013-03-23 07:39 ——– d—–w- c:\windows\Temp679FDF83-10C0-E10D-DC52-3237489731DD-Signatures 2013-03-23 07:00 . 2013-03-23 07:00 ——– d—–w- c:\windows\Temp0DD360F8-9C68-D87F-010C-21AC7AF037DC-Signatures 2013-03-23 06:34 . 2013-03-23 06:34 ——– d—–w- c:\windows\TempBE59A538-54EF-3669-31B7-813ED0B565C8-Signatures 2013-03-23 01:19 . 2013-03-15 06:28 9311288 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB56C8AE-0DE9-493C-A585-88810BDAD7D7}\mpengine.dll 2013-03-23 01:02 . 2013-03-23 01:02 ——– d—–w- c:\windows\Temp16DF65FF-AE66-8C51-559F-2497C81240CD-Signatures 2013-03-20 14:41 . 2013-03-20 14:41 ——– d—–w- c:\windows\TempA1351E01-3FAE-C53C-0A13-404D86C5E9BC-Signatures 2013-03-20 14:31 . 2013-03-20 14:31 ——– d—–w- c:\windows\Temp89467BA9-968D-C296-ED09-8298A52D29FC-Signatures 2013-03-20 14:30 . 2013-02-12 04:12 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-20 13:45 . 2013-03-20 13:45 ——– d—–w- c:\windows\TempE329C992-174B-1F42-13D3-7AEB0CFED3D9-Signatures 2013-03-20 13:20 . 2013-03-20 13:20 ——– d—–w- c:\program files (x86)\Mozilla Plugins 2013-03-20 13:20 . 2013-03-20 13:20 ——– d—–w- c:\program files (x86)\iTunesHelper.Resources 2013-03-20 13:19 . 2013-03-20 13:20 ——– d—–w- c:\program files (x86)\iTunes.Resources 2013-03-20 13:19 . 2013-03-20 13:19 ——– d—–w- c:\program files\iPod 2013-03-20 13:19 . 2013-03-20 13:20 ——– d—–w- c:\program files\iTunes 2013-03-20 13:19 . 2013-03-20 13:19 ——– d—–w- c:\program files (x86)\CD Configuration 2013-03-20 12:02 . 2013-03-20 12:02 ——– d—–w- c:\program files (x86)\Remote Mouse 2013-03-20 08:10 . 2013-03-20 08:10 ——– d—–w- c:\users\BirdiesNew\AppData\Local\Apple Computer 2013-03-20 08:00 . 2013-03-20 08:00 ——– d—–w- c:\windows\system32\%LocalAppData% 2013-03-20 07:29 . 2013-03-20 07:29 ——– d—–w- c:\windows\Options 2013-03-20 07:14 . 2013-03-20 07:14 ——– dc—-w- C:\_OTL 2013-03-19 13:11 . 2013-03-19 13:11 ——– dc—-w- C:\toolbarImages 2013-03-19 13:09 . 2013-03-20 09:34 ——– d—–w- c:\program files (x86)\Memento 2013-03-19 01:12 . 2013-03-20 09:34 ——– d—–w- c:\program files\TAP-Windows 2013-03-18 23:59 . 2013-03-19 13:10 ——– d—–w- c:\users\Birdie admin2\AppData\Local\CRE 2013-03-18 23:35 . 2013-03-18 23:35 ——– d—–w- c:\programdata\install_clap 2013-03-18 22:07 . 2013-03-20 09:30 ——– d—–w- c:\windows\Temp617599A6-7124-86F8-D17D-C58CD5631D6C-Signatures 2013-03-16 06:30 . 2013-03-16 06:30 4546560 —-a-w- c:\windows\SysWow64\GPhotos.scr 2013-03-13 23:22 . 2013-03-13 23:22 ——– d—–w- c:\windows\TempAA09210B-C7F5-2972-F381-4F7108C696B7-Signatures 2013-03-12 12:23 . 2013-03-12 12:23 ——– d—–w- c:\windows\Temp68E694A0-9056-6B15-438F-C11906539B45-Signatures 2013-03-03 21:52 . 2013-03-03 21:51 563328 —-a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe 2013-03-03 21:48 . 2013-03-03 22:50 ——– d—–w- c:\program files\Microsoft Office 15 2013-03-03 20:16 . 2011-07-21 08:25 810496 —-a-w- c:\windows\system32\xvidcore.dll 2013-03-03 20:16 . 2011-07-21 08:25 80896 —-a-w- c:\windows\system32\ff_vfw.dll 2013-03-03 20:16 . 2011-07-21 08:25 183808 —-a-w- c:\windows\system32\xvidvfw.dll 2013-03-03 20:15 . 2011-07-21 08:26 389120 —-a-w- c:\windows\system32\actskn43.ocx 2013-03-03 20:15 . 2011-07-21 08:26 389120 —-a-w- c:\windows\SysWow64\actskn43.ocx 2013-03-03 13:42 . 2013-03-03 13:43 ——– d—–w- c:\windows\Temp6ED22D2D-6DF4-E439-ADDF-45A341E6273F-Signatures 2013-03-03 13:21 . 2013-03-03 13:21 ——– d—–w- c:\program files (x86)\WinZip Self-Extractor 2013-03-03 13:11 . 2013-03-03 13:11 ——– d—–w- c:\program files\WinRAR 2013-03-03 10:18 . 2013-03-03 10:18 ——– d—–w- c:\programdata\VS Revo Group 2013-03-03 10:18 . 2009-12-30 18:21 31800 —-a-w- c:\windows\system32\drivers\revoflt.sys 2013-03-03 04:38 . 2013-03-20 09:38 ——– d—–w- c:\windows\TempCC549D54-1F11-60C7-9C29-9DB2210BB584-Signatures 2013-03-03 04:36 . 2013-03-03 04:36 ——– d—–w- c:\windows\TempEAA06877-29B0-711F-AEE6-4E5E42587155-Signatures 2013-03-03 04:12 . 2013-03-03 04:12 ——– d—–w- c:\windows\Temp0DC166B0-3CA9-1D2B-C050-EF06B8D4C3B7-Signatures 2013-03-01 19:41 . 2013-03-01 19:41 ——– d—–w- c:\program files\CCleaner 2013-03-01 05:35 . 2013-03-23 09:10 ——– d—–w- c:\users\Birdie admin2\AppData\Local\Stronghold Online Backup 2013-03-01 05:34 . 2013-03-19 13:06 ——– d—–w- c:\programdata\Stronghold Online Backup 2013-03-01 05:34 . 2013-03-01 05:34 ——– d—–w- c:\program files (x86)\Stronghold Online Backup 2013-03-01 05:34 . 2013-03-01 05:34 ——– dc—-w- C:\AI_RecycleBin 2013-02-28 03:27 . 2013-02-28 03:27 ——– d—–w- c:\program files\Microsoft Games 2013-02-27 20:31 . 2013-02-27 20:31 ——– d—–w- c:\windows\Temp67669FE4-7C81-C8C4-F5F5-14D7377232F8-Signatures 2013-02-27 12:22 . 2013-02-27 12:22 ——– d—–w- c:\windows\TempDDB28F23-88B8-96DE-7F64-9C775AF02A2C-Signatures 2013-02-27 12:19 . 2013-02-27 12:20 ——– d—–w- c:\windows\Temp1328DAA5-70E5-2D92-291F-58EC148C82C9-Signatures 2013-02-27 12:11 . 2013-02-27 12:11 ——– d—–w- c:\windows\Temp60587645-FDAB-7E96-D127-86FEA122BE9D-Signatures 2013-02-27 11:02 . 2013-01-13 19:53 187392 —-a-w- c:\windows\SysWow64\UIAnimation.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-24 23:16 . 2013-01-07 07:24 73432 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-03-24 23:16 . 2013-01-07 07:24 693976 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-24 22:49 . 2012-05-11 09:19 782240 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-03-24 22:49 . 2012-05-11 09:19 861088 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-03-20 13:46 . 2012-05-11 05:07 72013344 —-a-w- c:\windows\system32\MRT.exe 2013-02-27 08:49 . 2013-01-24 11:50 16473456 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2013-02-20 20:16 . 2013-02-20 20:16 112968 —-a-w- c:\program files (x86)\ITDetector.ocx 2013-02-20 19:35 . 2013-02-20 19:35 293192 —-a-w- c:\program files (x86)\iTunesOutlookAddIn.dll 2013-02-20 19:35 . 2013-02-20 19:35 152392 —-a-w- c:\program files (x86)\iTunesHelper.exe 2013-02-20 19:35 . 2013-02-20 19:35 412488 —-a-w- c:\program files (x86)\iTunesAdmin.dll 2013-02-20 19:35 . 2013-02-20 19:35 148808 —-a-w- c:\program files (x86)\iTunesHelper.dll 2013-02-20 19:35 . 2013-02-20 19:35 9789256 —-a-w- c:\program files (x86)\iTunes.exe 2013-02-20 19:35 . 2013-02-20 19:35 22970184 —-a-w- c:\program files (x86)\iTunes.dll 2013-02-20 19:35 . 2013-02-20 19:35 782688 —-a-w- c:\program files (x86)\gnsdk_sdkmanager.dll 2013-02-20 19:35 . 2013-02-20 19:35 3015008 —-a-w- c:\program files (x86)\gnsdk_dsp.dll 2013-02-20 19:35 . 2013-02-20 19:35 269152 —-a-w- c:\program files (x86)\gnsdk_submit.dll 2013-02-20 19:35 . 2013-02-20 19:35 226144 —-a-w- c:\program files (x86)\gnsdk_musicid.dll 2013-02-16 00:35 . 2013-02-19 23:47 17894296 —-a-w- c:\program files (x86)\xul.dll 2013-02-16 00:35 . 2013-02-19 23:47 96664 —-a-w- c:\program files (x86)\webapprt-stub.exe 2013-02-16 00:35 . 2013-02-19 23:47 272280 —-a-w- c:\program files (x86)\updater.exe 2013-02-16 00:35 . 2013-02-19 23:47 19352 —-a-w- c:\program files (x86)\xpcom.dll 2013-02-16 00:35 . 2013-02-19 23:47 170232 —-a-w- c:\program files (x86)\webapp-uninstaller.exe 2013-02-16 00:35 . 2013-02-19 23:47 155544 —-a-w- c:\program files (x86)\ssl3.dll 2013-02-16 00:35 . 2013-02-19 23:47 151960 —-a-w- c:\program files (x86)\softokn3.dll 2013-02-16 00:35 . 2013-02-19 23:47 92056 —-a-w- c:\program files (x86)\smime3.dll 2013-02-16 00:35 . 2013-02-19 23:47 91544 —-a-w- c:\program files (x86)\nssdbm3.dll 2013-02-16 00:35 . 2013-02-19 23:47 641944 —-a-w- c:\program files (x86)\nss3.dll 2013-02-16 00:35 . 2013-02-19 23:47 375192 —-a-w- c:\program files (x86)\nssckbi.dll 2013-02-16 00:35 . 2013-02-19 23:47 21912 —-a-w- c:\program files (x86)\plc4.dll 2013-02-16 00:35 . 2013-02-19 23:47 21400 —-a-w- c:\program files (x86)\plds4.dll 2013-02-16 00:35 . 2013-02-19 23:47 17304 —-a-w- c:\program files (x86)\plugin-container.exe 2013-02-16 00:35 . 2013-02-19 23:47 104344 —-a-w- c:\program files (x86)\nssutil3.dll 2013-02-16 00:35 . 2013-02-19 23:47 812440 —-a-w- c:\program files (x86)\mozsqlite3.dll 2013-02-16 00:35 . 2013-02-19 23:47 3067288 —-a-w- c:\program files (x86)\mozjs.dll 2013-02-16 00:35 . 2013-02-19 23:47 172440 —-a-w- c:\program files (x86)\nspr4.dll 2013-02-16 00:35 . 2013-02-19 23:47 478104 —-a-w- c:\program files (x86)\libGLESv2.dll 2013-02-16 00:35 . 2013-02-19 23:47 193576 —-a-w- c:\program files (x86)\maintenanceservice_installer.exe 2013-02-16 00:35 . 2013-02-19 23:47 16280 —-a-w- c:\program files (x86)\mozalloc.dll 2013-02-16 00:35 . 2013-02-19 23:47 131480 —-a-w- c:\program files (x86)\mozglue.dll 2013-02-16 00:35 . 2013-02-19 23:47 115608 —-a-w- c:\program files (x86)\maintenanceservice.exe 2013-02-16 00:35 . 2013-02-19 23:47 59288 —-a-w- c:\program files (x86)\libEGL.dll 2013-02-16 00:35 . 2013-02-19 23:47 2954136 —-a-w- c:\program files (x86)\gkmedias.dll 2013-02-16 00:35 . 2013-02-19 23:47 917400 —-a-w- c:\program files (x86)\firefox.exe 2013-02-16 00:35 . 2013-02-19 23:47 74136 —-a-w- c:\program files (x86)\breakpadinjector.dll 2013-02-16 00:35 . 2013-02-19 23:47 19352 —-a-w- c:\program files (x86)\AccessibleMarshal.dll 2013-02-16 00:35 . 2013-02-19 23:47 116120 —-a-w- c:\program files (x86)\crashreporter.exe 2013-02-16 00:35 . 2013-02-19 23:47 2106216 —-a-w- c:\program files (x86)\D3DCompiler_43.dll 2013-02-16 00:35 . 2013-02-19 23:47 1998168 —-a-w- c:\program files (x86)\d3dx9_43.dll 2013-02-16 00:35 . 2013-02-19 23:47 770384 —-a-w- c:\program files (x86)\msvcr100.dll 2013-02-16 00:35 . 2013-02-19 23:47 421200 —-a-w- c:\program files (x86)\msvcp100.dll 2013-02-15 02:23 . 2013-01-05 16:15 39768 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2013-02-12 05:45 . 2013-03-20 13:43 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-20 13:43 308736 —-a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-20 13:43 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45 . 2013-03-20 13:43 111104 —-a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48 . 2013-03-20 13:43 474112 —-a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-20 13:43 2176512 —-a-w- c:\windows\apppatch\AcGenral.dll 2013-02-07 23:28 . 2013-01-24 12:27 9162192 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll 2013-01-17 08:28 . 2010-11-21 03:27 273840 ——w- c:\windows\system32\MpSigStub.exe 2013-01-05 05:53 . 2013-02-13 01:24 5553512 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-01-05 05:00 . 2013-02-13 01:24 3967848 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-01-05 05:00 . 2013-02-13 01:24 3913064 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-01-04 05:46 . 2013-02-13 01:23 215040 —-a-w- c:\windows\system32\winsrv.dll 2013-01-04 04:51 . 2013-02-13 01:23 5120 —-a-w- c:\windows\SysWow64\wow32.dll 2013-01-04 04:43 . 2013-02-13 01:23 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2013-01-04 03:26 . 2013-02-13 01:23 3153408 —-a-w- c:\windows\system32\win32k.sys 2013-01-04 02:47 . 2013-02-13 01:23 25600 —-a-w- c:\windows\SysWow64\setup16.exe 2013-01-04 02:47 . 2013-02-13 01:23 7680 —-a-w- c:\windows\SysWow64\instnm.exe 2013-01-04 02:47 . 2013-02-13 01:23 2048 —-a-w- c:\windows\SysWow64\user.exe 2013-01-04 02:47 . 2013-02-13 01:23 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll 2013-01-03 06:00 . 2013-02-13 01:23 1913192 —-a-w- c:\windows\system32\drivers\tcpip.sys 2013-01-03 06:00 . 2013-02-13 01:23 288088 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2013-01-02 11:27 . 2013-01-02 11:27 1400416 —-a-w- c:\windows\system32\ieapfltr.dat 2012-12-26 08:46 . 2012-05-31 14:30 18960 —-a-w- c:\windows\system32\drivers\LNonPnP.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2011-06-23 418672] "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2011-06-23 202608] "PLTSR"="c:\program files (x86)\EgisTec Port Locker\EgisPLTSR.exe" [2010-10-22 364400] "VitaKeyTSR"="c:\program files (x86)\EgisTec BioExcess\EgisTSR.exe" [2010-12-13 383344] "iTunesHelper"="c:\program files (x86)\iTunesHelper.exe" [2013-02-20 152392] "WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2012-12-10 363752] "WD Quick View"="c:\program files (x86)\Western Digital\WD Quick View\WDDMStatus.exe" [2012-12-20 5237256] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352] "MioNet"="c:\program files (x86)\MioNet\MioNetLauncher.exe" [2010-02-10 32768] "WD Anywhere Backup Premium"="c:\program files (x86)\WD\WD Anywhere Backup\MemeoLauncher2.exe" [2010-06-30 222432] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\users\Birdie admin2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Send to OneNote.lnk - c:\program files\Microsoft Office 15\root\office15\ONENOTEM.EXE [2013-3-3 158808] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0FbDefrag . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x] R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 LMIInfo;LogMeIn Kernel Information Provider;d:\x64\RaInfo.sys [x] R2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [x] R3 ALSysIO;ALSysIO;c:\users\BIRDIE~1\AppData\Local\Temp\ALSysIO64.sys [x] R3 Arctosa;Arctosa Keyboard;c:\windows\system32\drivers\Arctosa.sys [2009-08-19 19840] R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x] R3 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\CyberGhost VPN\CGVPNCliService.exe [2012-04-26 2438696] R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-03-10 29720] R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x] R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x] R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x] R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x] R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2012-03-26 22528] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-05-11 1255736] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464] R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-14 14544] R3 WMSVC;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe [2009-07-14 10752] R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088] R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840] R4 ADExchange;ArcSoft Exchange Service;c:\program files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [2011-09-17 39528] R4 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x] R4 AVTHelper;AVTHelper;c:\program files\Avatron\Air Display\AVTHelper.exe [2012-09-25 216000] R4 BingDesktopUpdate;Bing Desktop Update service;c:\program files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [2012-11-22 166424] R4 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe [2012-10-24 390672] R4 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-20 2656280] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328] S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120] S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2012-02-24 57952] S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2012-02-24 39008] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2007-11-14 53488] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2013-02-15 39768] S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2012-02-24 13408] S1 EgisTecFF;EgisTecFF;c:\windows\system32\DRIVERS\EgisTecFF.sys [2012-02-24 55880] S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2012-02-24 22912] S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2012-02-24 20328] S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2012-02-24 62584] S2 EgisTec Service Help;EgisTec Service Help;c:\program files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-10-22 327024] S2 EgisTec Service;EgisTec Service;c:\program files (x86)\EgisTec BioExcess\EgisService.exe [2010-12-13 703856] S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-12-13 650096] S2 ftpsvc;Microsoft FTP Service;c:\windows\system32\svchost.exe [2009-07-14 27136] S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\WD\WD Anywhere Backup\MemeoBackgroundService.exe [2010-06-30 25824] S2 MioNet;MioNet;c:\program files (x86)\MioNet\MioNetManager.exe [2010-02-10 139264] S2 OfficeSvc;Microsoft Office Service;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe [2012-12-07 1854056] S2 WDBackup;WD Backup;c:\program files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [2012-12-20 1155088] S2 WDDriveService;WD Drive Manager;c:\program files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [2012-12-20 248840] S2 WDRulesService;WD Rules;c:\program files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe [2012-12-20 1178128] S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2012-02-24 29792] S3 AirDisplay;Air Display Support;c:\windows\system32\DRIVERS\AVVideoCard.sys [2012-09-25 15808] S3 AirDisplayMirror;Air Display Mirror Support;c:\windows\system32\DRIVERS\AVVideoCardMirror.sys [2012-09-25 15808] S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2012-08-03 40432] S3 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2011-09-15 36656] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440] S3 Ndisrd;WinpkFilter Service;c:\windows\system32\DRIVERS\ndisrd.sys [2009-09-14 32096] S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-11-30 307304] S3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [2010-12-23 3293272] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-03-25 01:24 1629648 —-a-w- c:\program files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-03-24 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-07 23:16] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp] @="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}" [HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}] 2012-09-21 17:40 480888 —-a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending] @="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}" [HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}] 2012-09-21 17:40 480888 —-a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot] @="{A759AFF6-5851-457D-A540-F4ECED148351}" [HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}] 2012-09-21 17:40 480888 —-a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared] @="{1574C9EF-7D58-488F-B358-8B78C1538F51}" [HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}] 2012-09-21 17:40 480888 —-a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc] @="{771C7324-DA80-49D3-8017-753B0AF60951}" [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}] 2012-02-24 17:00 1508192 —-a-w- c:\windows\System32\IcnOvrly.dll . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = 192.168.*.*;*.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 IE: E&xport; to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000 IE: Se&nd; to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105 TCP: DhcpNameServer = [removed] [removed] DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab DPF: {82E5DF24-51E8-47CD-864A-F4BD5005AA73} - hxxps://www.icloud.com/system/iCloud.cab FF - ProfilePath - c:\users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\ncbiyoia.default\ FF - prefs.js: browser.startup.homepage - hxxp://howtogeek.com/ . - - - - ORPHANS REMOVED - - - - . AddRemove-{09760D42-E223-42AD-8C3E-55B47D0DDAC3} - c:\programdata\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe . . "ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z [\]^_‘\00\00‘\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~‘\00\00‘\00\00\00\00‚\00\00\00\00\00\00\00\00‘’“" . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Digital River Mso] @Denied: (Full) (RestrictedCode) @Denied: (Full) (LocalSystem) @Denied: (A C 3 4 5 6) (S-1-5-21-2965589367-2178919387-1176447042-1014) @Allowed: (Read) (RestrictedCode) @Allowed: (B D 1 2) (S-1-5-21-2965589367-2178919387-1176447042-1014) "BitSelection"="64" "SaveLocation"="empty" . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar] "Order"=hex:08,00,00,00,02,00,00,00,ec,15,00,00,01,00,00,00,26,00,00,00,b0,00, 00,00,01,00,00,00,a2,00,32,00,27,02,00,00,5f,41,4d,20,20,00,31,30,41,57,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Lenovo] "Order"=hex:08,00,00,00,02,00,00,00,f2,00,00,00,01,00,00,00,02,00,00,00,6a,00, 00,00,01,00,00,00,5c,00,32,00,48,01,00,00,5f,41,4c,20,20,00,4c,65,6e,6f,76,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Links for United States] "Order"=hex:08,00,00,00,02,00,00,00,f8,00,00,00,01,00,00,00,02,00,00,00,7e,00, 00,00,00,00,00,00,70,00,32,00,81,01,00,00,5f,41,4c,20,20,00,47,4f,42,49,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Microsoft Websites] "Order"=hex:08,00,00,00,02,00,00,00,8c,02,00,00,01,00,00,00,05,00,00,00,82,00, 00,00,00,00,00,00,74,00,32,00,75,01,00,00,5f,41,4c,20,20,00,4d,49,43,52,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\MSN Websites] "Order"=hex:08,00,00,00,02,00,00,00,c0,02,00,00,01,00,00,00,06,00,00,00,60,00, 00,00,04,00,00,00,52,00,32,00,82,01,00,00,5f,41,4c,20,20,00,4d,53,4e,2e,75,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\My fun stuff] "Order"=hex:08,00,00,00,02,00,00,00,9a,0d,00,00,01,00,00,00,17,00,00,00,b0,00, 00,00,00,00,00,00,a2,00,32,00,8c,01,00,00,5f,41,4c,20,20,00,41,4e,54,49,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\My fun stuff\Test] "Order"=hex:08,00,00,00,02,00,00,00,fc,00,00,00,01,00,00,00,02,00,00,00,76,00, 00,00,00,00,00,00,68,00,32,00,7d,01,00,00,5f,41,4c,20,20,00,48,4f,57,54,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\stuff ONLY only for MY EYES] "Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0b,00,00,00,6c,00, 00,00,00,00,00,00,5e,00,32,00,af,01,00,00,5f,41,4c,20,20,00,41,6e,73,77,65,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Stuffadooodle] "Order"=hex:08,00,00,00,02,00,00,00,ae,1e,00,00,01,00,00,00,32,00,00,00,94,00, 00,00,00,00,00,00,86,00,32,00,99,03,00,00,5f,41,4d,20,20,00,34,30,38,41,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar] "Order"=hex:08,00,00,00,02,00,00,00,48,15,00,00,01,00,00,00,25,00,00,00,b0,00, 00,00,01,00,00,00,a2,00,32,00,f5,03,00,00,5f,41,63,45,20,00,31,30,41,57,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Lenovo] "Order"=hex:08,00,00,00,02,00,00,00,f2,00,00,00,01,00,00,00,02,00,00,00,6a,00, 00,00,01,00,00,00,5c,00,32,00,c9,02,00,00,5f,41,32,20,20,00,4c,65,6e,6f,76,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Links for United States] "Order"=hex:08,00,00,00,02,00,00,00,f8,00,00,00,01,00,00,00,02,00,00,00,7e,00, 00,00,00,00,00,00,70,00,32,00,02,03,00,00,5f,41,31,20,20,00,47,4f,42,49,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Microsoft Websites] "Order"=hex:08,00,00,00,02,00,00,00,8c,02,00,00,01,00,00,00,05,00,00,00,82,00, 00,00,00,00,00,00,74,00,32,00,f6,02,00,00,5f,41,32,20,20,00,4d,49,43,52,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\MSN Websites] "Order"=hex:08,00,00,00,02,00,00,00,c0,02,00,00,01,00,00,00,06,00,00,00,60,00, 00,00,04,00,00,00,52,00,32,00,03,03,00,00,5f,41,31,20,20,00,4d,53,4e,2e,75,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\My fun stuff] "Order"=hex:08,00,00,00,02,00,00,00,9a,0d,00,00,01,00,00,00,17,00,00,00,b0,00, 00,00,00,00,00,00,a2,00,32,00,0d,03,00,00,5f,41,31,20,20,00,41,4e,54,49,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\My fun stuff\Test] "Order"=hex:08,00,00,00,02,00,00,00,fc,00,00,00,01,00,00,00,02,00,00,00,76,00, 00,00,00,00,00,00,68,00,32,00,38,03,00,00,5f,41,31,20,20,00,48,4f,57,54,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\stuff ONLY only for MY EYES] "Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0b,00,00,00,6c,00, 00,00,00,00,00,00,5e,00,32,00,30,03,00,00,5f,41,30,20,20,00,41,6e,73,77,65,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Stuffadooodle] "Order"=hex:08,00,00,00,02,00,00,00,ae,1e,00,00,01,00,00,00,32,00,00,00,94,00, 00,00,00,00,00,00,86,00,32,00,c5,01,00,00,5f,41,5d,45,20,00,34,30,38,41,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links] "Order"=hex:08,00,00,00,02,00,00,00,ec,15,00,00,01,00,00,00,26,00,00,00,b0,00, 00,00,01,00,00,00,a2,00,32,00,27,02,00,00,5f,41,2e,20,20,00,31,30,41,57,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\Lenovo] "Order"=hex:08,00,00,00,02,00,00,00,f2,00,00,00,01,00,00,00,02,00,00,00,6a,00, 00,00,01,00,00,00,5c,00,32,00,48,01,00,00,5f,41,2e,20,20,00,4c,65,6e,6f,76,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\Links for United States] "Order"=hex:08,00,00,00,02,00,00,00,f8,00,00,00,01,00,00,00,02,00,00,00,7e,00, 00,00,00,00,00,00,70,00,32,00,81,01,00,00,5f,41,2e,20,20,00,47,4f,42,49,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\Microsoft Websites] "Order"=hex:08,00,00,00,02,00,00,00,8c,02,00,00,01,00,00,00,05,00,00,00,82,00, 00,00,00,00,00,00,74,00,32,00,75,01,00,00,5f,41,2e,20,20,00,4d,49,43,52,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\MSN Websites] "Order"=hex:08,00,00,00,02,00,00,00,c0,02,00,00,01,00,00,00,06,00,00,00,60,00, 00,00,04,00,00,00,52,00,32,00,82,01,00,00,5f,41,2e,20,20,00,4d,53,4e,2e,75,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\My fun stuff] "Order"=hex:08,00,00,00,02,00,00,00,9a,0d,00,00,01,00,00,00,17,00,00,00,b0,00, 00,00,00,00,00,00,a2,00,32,00,8c,01,00,00,5f,41,2e,20,20,00,41,4e,54,49,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\My fun stuff\Test] "Order"=hex:08,00,00,00,02,00,00,00,fc,00,00,00,01,00,00,00,02,00,00,00,76,00, 00,00,00,00,00,00,68,00,32,00,7d,01,00,00,5f,41,2e,20,20,00,48,4f,57,54,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\stuff ONLY only for MY EYES] "Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0b,00,00,00,6c,00, 00,00,00,00,00,00,5e,00,32,00,af,01,00,00,5f,41,2e,20,20,00,41,6e,73,77,65,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\Stuffadooodle] "Order"=hex:08,00,00,00,02,00,00,00,ae,1e,00,00,01,00,00,00,32,00,00,00,94,00, 00,00,00,00,00,00,86,00,32,00,c5,01,00,00,5f,41,2e,20,20,00,34,30,38,41,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\SecuROM\License information*] "datasecu"=hex:ac,ae,36,db,46,78,f6,42,3b,dd,29,88,55,76,a2,29,26,a4,bb,d0,72, 07,c0,e8,83,48,22,59,9f,57,4e,7b,f8,7d,6d,2c,4a,04,9a,1d,57,32,1f,be,4b,91,\ "rkeysecu"=hex:60,18,77,73,23,5a,4d,59,7a,7f,a5,3f,41,00,e4,85 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Folder\ShellEx\ContextMenuHandlers\RUShellExt] @Denied: (Read) (Owner) @Denied: (Read) (Administrators) @="{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}" . [HKEY_LOCAL_MACHINE\software\Classes\Folder\ShellEx\ContextMenuHandlers\SugarSync] @Denied: (Read) (LocalSystem) @="[CC]{305BC11B-5175-492B-B569-866547FCDA40}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet003\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\MioNet\jvm\bin\MioNet.exe . ************************************************************************** . Completion time: 2013-03-24 18:49:55 - machine was rebooted ComboFix-quarantined-files.txt 2013-03-25 01:49 . Pre-Run: 198,229,258,240 bytes free Post-Run: 197,326,405,632 bytes free . - - End Of File - - FFDD168157043F0A746E2D1FD458D262 ComboFix 13-03-24.03 - Birdie admin2 03/24/2013 18:14:10.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.2148 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Setup.exe c:\programdata\Microsoft .vff c:\users\Birdie admin2\AppData\Local\assembly\tmp c:\users\Birdie admin2\AppData\Local\Microsoft\Windows\Temporary Internet Files\{03F83D23-04DD-4655-AAEF-5FB815251947}.xps c:\users\BirdiesNew\AppData\Local\Microsoft\Windows\Temporary Internet Files\{20A17067-DD13-4B36-94D1-F11CDACB95F8}.xps c:\windows\gt.exe c:\windows\iun6002.exe c:\windows\s.bat c:\windows\SysWow64\DEBUG.log c:\windows\SysWow64\ndisapi.dll c:\windows\version.txt . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Legacy_NPF ——-\Service_npf . . ((((((((((((((((((((((((( Files Created from 2013-02-25 to 2013-03-25 ))))))))))))))))))))))))))))))) . . 2013-03-25 01:36 . 2013-03-25 01:36 ——– d—–w- c:\users\Test\AppData\Local\temp 2013-03-25 01:36 . 2013-03-25 01:36 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-03-25 01:36 . 2013-03-25 01:36 ——– d—–w- c:\users\BirdiesNew\AppData\Local\temp 2013-03-25 00:16 . 2013-03-25 00:16 ——– d—–w- c:\windows\ERUNT 2013-03-25 00:16 . 2013-03-25 00:16 ——– dc—-w- C:\JRT 2013-03-24 23:23 . 2013-03-25 01:18 ——– dc—-r- C:\Temporary Internet Files 2013-03-23 18:09 . 2013-03-23 18:09 ——– d—–w- c:\program files\MioNet 2013-03-23 18:09 . 2013-03-23 18:09 ——– d—–w- c:\users\Birdie admin2\AppData\Local\MioNet 2013-03-23 18:09 . 2013-03-23 18:19 ——– d—–w- c:\program files (x86)\MioNet 2013-03-23 17:02 . 2013-03-23 17:02 ——– d—–w- c:\program files (x86)\Western Digital 2013-03-23 17:02 . 2013-03-23 17:02 ——– d—–w- c:\program files\Western Digital 2013-03-23 16:55 . 2013-03-23 17:20 ——– d—–w- c:\users\Birdie admin2\AppData\Local\Western_Digital 2013-03-23 16:54 . 2013-03-23 16:54 ——– d—–w- c:\users\Birdie admin2\AppData\Roaming\Western Digital 2013-03-23 16:27 . 2013-03-23 16:27 ——– d—–w- c:\users\Birdie admin2\AppData\Local\Western Digital 2013-03-23 16:25 . 2013-03-23 17:53 ——– d—–w- c:\programdata\Western Digital 2013-03-23 13:55 . 2013-03-23 13:56 ——– d—–w- c:\program files\CyberGhost VPN 2013-03-23 13:36 . 2013-03-23 13:36 ——– d—–w- c:\programdata\Roxio 2013-03-23 13:36 . 2013-03-23 13:36 ——– d—–w- c:\users\Birdie admin2\AppData\Roaming\Roxio 2013-03-23 13:35 . 2013-03-23 13:36 ——– d—–w- c:\program files (x86)\Common Files\Sonic Shared 2013-03-23 13:32 . 2013-03-23 13:32 ——– d—–w- c:\programdata\Sonic 2013-03-23 11:11 . 2013-03-23 11:12 ——– d—–w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-03-23 10:35 . 2013-03-23 10:35 ——– d—–w- c:\users\Test\AppData\Local\Apple Computer 2013-03-23 10:13 . 2013-03-23 16:25 428 -c–a-w- C:\FixitRegBackup.reg 2013-03-23 10:09 . 2013-03-23 10:09 ——– d—–w- c:\windows\TempA39CFF2F-B190-4B5B-AC09-6F534E0F8272-Signatures 2013-03-23 10:01 . 2013-03-23 10:01 ——– d—–w- c:\windows\TempB82822AF-AC26-100E-15E4-DE3B06D01E3D-Signatures 2013-03-23 09:57 . 2013-03-23 09:57 ——– d—–w- c:\windows\Temp6346EEF2-05C4-3981-F135-5C5125C69C5D-Signatures 2013-03-23 09:31 . 2013-03-23 09:31 ——– d—–w- c:\windows\snack 2013-03-23 09:19 . 2013-03-23 09:19 ——– d—–w- c:\windows\TempCC295357-A678-E8EB-3141-0885FB52F1D4-Signatures 2013-03-23 09:03 . 2013-03-23 09:04 377 —-a-w- c:\windows\DeleteOnReboot.bat 2013-03-23 07:39 . 2013-03-23 07:39 ——– d—–w- c:\windows\Temp679FDF83-10C0-E10D-DC52-3237489731DD-Signatures 2013-03-23 07:00 . 2013-03-23 07:00 ——– d—–w- c:\windows\Temp0DD360F8-9C68-D87F-010C-21AC7AF037DC-Signatures 2013-03-23 06:34 . 2013-03-23 06:34 ——– d—–w- c:\windows\TempBE59A538-54EF-3669-31B7-813ED0B565C8-Signatures 2013-03-23 01:19 . 2013-03-15 06:28 9311288 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB56C8AE-0DE9-493C-A585-88810BDAD7D7}\mpengine.dll 2013-03-23 01:02 . 2013-03-23 01:02 ——– d—–w- c:\windows\Temp16DF65FF-AE66-8C51-559F-2497C81240CD-Signatures 2013-03-20 14:41 . 2013-03-20 14:41 ——– d—–w- c:\windows\TempA1351E01-3FAE-C53C-0A13-404D86C5E9BC-Signatures 2013-03-20 14:31 . 2013-03-20 14:31 ——– d—–w- c:\windows\Temp89467BA9-968D-C296-ED09-8298A52D29FC-Signatures 2013-03-20 14:30 . 2013-02-12 04:12 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-20 13:45 . 2013-03-20 13:45 ——– d—–w- c:\windows\TempE329C992-174B-1F42-13D3-7AEB0CFED3D9-Signatures 2013-03-20 13:20 . 2013-03-20 13:20 ——– d—–w- c:\program files (x86)\Mozilla Plugins 2013-03-20 13:20 . 2013-03-20 13:20 ——– d—–w- c:\program files (x86)\iTunesHelper.Resources 2013-03-20 13:19 . 2013-03-20 13:20 ——– d—–w- c:\program files (x86)\iTunes.Resources 2013-03-20 13:19 . 2013-03-20 13:19 ——– d—–w- c:\program files\iPod 2013-03-20 13:19 . 2013-03-20 13:20 ——– d—–w- c:\program files\iTunes 2013-03-20 13:19 . 2013-03-20 13:19 ——– d—–w- c:\program files (x86)\CD Configuration 2013-03-20 12:02 . 2013-03-20 12:02 ——– d—–w- c:\program files (x86)\Remote Mouse 2013-03-20 08:10 . 2013-03-20 08:10 ——– d—–w- c:\users\BirdiesNew\AppData\Local\Apple Computer 2013-03-20 08:00 . 2013-03-20 08:00 ——– d—–w- c:\windows\system32\%LocalAppData% 2013-03-20 07:29 . 2013-03-20 07:29 ——– d—–w- c:\windows\Options 2013-03-20 07:14 . 2013-03-20 07:14 ——– dc—-w- C:\_OTL 2013-03-19 13:11 . 2013-03-19 13:11 ——– dc—-w- C:\toolbarImages 2013-03-19 13:09 . 2013-03-20 09:34 ——– d—–w- c:\program files (x86)\Memento 2013-03-19 01:12 . 2013-03-20 09:34 ——– d—–w- c:\program files\TAP-Windows 2013-03-18 23:59 . 2013-03-19 13:10 ——– d—–w- c:\users\Birdie admin2\AppData\Local\CRE 2013-03-18 23:35 . 2013-03-18 23:35 ——– d—–w- c:\programdata\install_clap 2013-03-18 22:07 . 2013-03-20 09:30 ——– d—–w- c:\windows\Temp617599A6-7124-86F8-D17D-C58CD5631D6C-Signatures 2013-03-16 06:30 . 2013-03-16 06:30 4546560 —-a-w- c:\windows\SysWow64\GPhotos.scr 2013-03-13 23:22 . 2013-03-13 23:22 ——– d—–w- c:\windows\TempAA09210B-C7F5-2972-F381-4F7108C696B7-Signatures 2013-03-12 12:23 . 2013-03-12 12:23 ——– d—–w- c:\windows\Temp68E694A0-9056-6B15-438F-C11906539B45-Signatures 2013-03-03 21:52 . 2013-03-03 21:51 563328 —-a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe 2013-03-03 21:48 . 2013-03-03 22:50 ——– d—–w- c:\program files\Microsoft Office 15 2013-03-03 20:16 . 2011-07-21 08:25 810496 —-a-w- c:\windows\system32\xvidcore.dll 2013-03-03 20:16 . 2011-07-21 08:25 80896 —-a-w- c:\windows\system32\ff_vfw.dll 2013-03-03 20:16 . 2011-07-21 08:25 183808 —-a-w- c:\windows\system32\xvidvfw.dll 2013-03-03 20:15 . 2011-07-21 08:26 389120 —-a-w- c:\windows\system32\actskn43.ocx 2013-03-03 20:15 . 2011-07-21 08:26 389120 —-a-w- c:\windows\SysWow64\actskn43.ocx 2013-03-03 13:42 . 2013-03-03 13:43 ——– d—–w- c:\windows\Temp6ED22D2D-6DF4-E439-ADDF-45A341E6273F-Signatures 2013-03-03 13:21 . 2013-03-03 13:21 ——– d—–w- c:\program files (x86)\WinZip Self-Extractor 2013-03-03 13:11 . 2013-03-03 13:11 ——– d—–w- c:\program files\WinRAR 2013-03-03 10:18 . 2013-03-03 10:18 ——– d—–w- c:\programdata\VS Revo Group 2013-03-03 10:18 . 2009-12-30 18:21 31800 —-a-w- c:\windows\system32\drivers\revoflt.sys 2013-03-03 04:38 . 2013-03-20 09:38 ——– d—–w- c:\windows\TempCC549D54-1F11-60C7-9C29-9DB2210BB584-Signatures 2013-03-03 04:36 . 2013-03-03 04:36 ——– d—–w- c:\windows\TempEAA06877-29B0-711F-AEE6-4E5E42587155-Signatures 2013-03-03 04:12 . 2013-03-03 04:12 ——– d—–w- c:\windows\Temp0DC166B0-3CA9-1D2B-C050-EF06B8D4C3B7-Signatures 2013-03-01 19:41 . 2013-03-01 19:41 ——– d—–w- c:\program files\CCleaner 2013-03-01 05:35 . 2013-03-23 09:10 ——– d—–w- c:\users\Birdie admin2\AppData\Local\Stronghold Online Backup 2013-03-01 05:34 . 2013-03-19 13:06 ——– d—–w- c:\programdata\Stronghold Online Backup 2013-03-01 05:34 . 2013-03-01 05:34 ——– d—–w- c:\program files (x86)\Stronghold Online Backup 2013-03-01 05:34 . 2013-03-01 05:34 ——– dc—-w- C:\AI_RecycleBin 2013-02-28 03:27 . 2013-02-28 03:27 ——– d—–w- c:\program files\Microsoft Games 2013-02-27 20:31 . 2013-02-27 20:31 ——– d—–w- c:\windows\Temp67669FE4-7C81-C8C4-F5F5-14D7377232F8-Signatures 2013-02-27 12:22 . 2013-02-27 12:22 ——– d—–w- c:\windows\TempDDB28F23-88B8-96DE-7F64-9C775AF02A2C-Signatures 2013-02-27 12:19 . 2013-02-27 12:20 ——– d—–w- c:\windows\Temp1328DAA5-70E5-2D92-291F-58EC148C82C9-Signatures 2013-02-27 12:11 . 2013-02-27 12:11 ——– d—–w- c:\windows\Temp60587645-FDAB-7E96-D127-86FEA122BE9D-Signatures 2013-02-27 11:02 . 2013-01-13 19:53 187392 —-a-w- c:\windows\SysWow64\UIAnimation.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-24 23:16 . 2013-01-07 07:24 73432 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-03-24 23:16 . 2013-01-07 07:24 693976 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-24 22:49 . 2012-05-11 09:19 782240 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-03-24 22:49 . 2012-05-11 09:19 861088 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-03-20 13:46 . 2012-05-11 05:07 72013344 —-a-w- c:\windows\system32\MRT.exe 2013-02-27 08:49 . 2013-01-24 11:50 16473456 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2013-02-20 20:16 . 2013-02-20 20:16 112968 —-a-w- c:\program files (x86)\ITDetector.ocx 2013-02-20 19:35 . 2013-02-20 19:35 293192 —-a-w- c:\program files (x86)\iTunesOutlookAddIn.dll 2013-02-20 19:35 . 2013-02-20 19:35 152392 —-a-w- c:\program files (x86)\iTunesHelper.exe 2013-02-20 19:35 . 2013-02-20 19:35 412488 —-a-w- c:\program files (x86)\iTunesAdmin.dll 2013-02-20 19:35 . 2013-02-20 19:35 148808 —-a-w- c:\program files (x86)\iTunesHelper.dll 2013-02-20 19:35 . 2013-02-20 19:35 9789256 —-a-w- c:\program files (x86)\iTunes.exe 2013-02-20 19:35 . 2013-02-20 19:35 22970184 —-a-w- c:\program files (x86)\iTunes.dll 2013-02-20 19:35 . 2013-02-20 19:35 782688 —-a-w- c:\program files (x86)\gnsdk_sdkmanager.dll 2013-02-20 19:35 . 2013-02-20 19:35 3015008 —-a-w- c:\program files (x86)\gnsdk_dsp.dll 2013-02-20 19:35 . 2013-02-20 19:35 269152 —-a-w- c:\program files (x86)\gnsdk_submit.dll 2013-02-20 19:35 . 2013-02-20 19:35 226144 —-a-w- c:\program files (x86)\gnsdk_musicid.dll 2013-02-16 00:35 . 2013-02-19 23:47 17894296 —-a-w- c:\program files (x86)\xul.dll 2013-02-16 00:35 . 2013-02-19 23:47 96664 —-a-w- c:\program files (x86)\webapprt-stub.exe 2013-02-16 00:35 . 2013-02-19 23:47 272280 —-a-w- c:\program files (x86)\updater.exe 2013-02-16 00:35 . 2013-02-19 23:47 19352 —-a-w- c:\program files (x86)\xpcom.dll 2013-02-16 00:35 . 2013-02-19 23:47 170232 —-a-w- c:\program files (x86)\webapp-uninstaller.exe 2013-02-16 00:35 . 2013-02-19 23:47 155544 —-a-w- c:\program files (x86)\ssl3.dll 2013-02-16 00:35 . 2013-02-19 23:47 151960 —-a-w- c:\program files (x86)\softokn3.dll 2013-02-16 00:35 . 2013-02-19 23:47 92056 —-a-w- c:\program files (x86)\smime3.dll 2013-02-16 00:35 . 2013-02-19 23:47 91544 —-a-w- c:\program files (x86)\nssdbm3.dll 2013-02-16 00:35 . 2013-02-19 23:47 641944 —-a-w- c:\program files (x86)\nss3.dll 2013-02-16 00:35 . 2013-02-19 23:47 375192 —-a-w- c:\program files (x86)\nssckbi.dll 2013-02-16 00:35 . 2013-02-19 23:47 21912 —-a-w- c:\program files (x86)\plc4.dll 2013-02-16 00:35 . 2013-02-19 23:47 21400 —-a-w- c:\program files (x86)\plds4.dll 2013-02-16 00:35 . 2013-02-19 23:47 17304 —-a-w- c:\program files (x86)\plugin-container.exe 2013-02-16 00:35 . 2013-02-19 23:47 104344 —-a-w- c:\program files (x86)\nssutil3.dll 2013-02-16 00:35 . 2013-02-19 23:47 812440 —-a-w- c:\program files (x86)\mozsqlite3.dll 2013-02-16 00:35 . 2013-02-19 23:47 3067288 —-a-w- c:\program files (x86)\mozjs.dll 2013-02-16 00:35 . 2013-02-19 23:47 172440 —-a-w- c:\program files (x86)\nspr4.dll 2013-02-16 00:35 . 2013-02-19 23:47 478104 —-a-w- c:\program files (x86)\libGLESv2.dll 2013-02-16 00:35 . 2013-02-19 23:47 193576 —-a-w- c:\program files (x86)\maintenanceservice_installer.exe 2013-02-16 00:35 . 2013-02-19 23:47 16280 —-a-w- c:\program files (x86)\mozalloc.dll 2013-02-16 00:35 . 2013-02-19 23:47 131480 —-a-w- c:\program files (x86)\mozglue.dll 2013-02-16 00:35 . 2013-02-19 23:47 115608 —-a-w- c:\program files (x86)\maintenanceservice.exe 2013-02-16 00:35 . 2013-02-19 23:47 59288 —-a-w- c:\program files (x86)\libEGL.dll 2013-02-16 00:35 . 2013-02-19 23:47 2954136 —-a-w- c:\program files (x86)\gkmedias.dll 2013-02-16 00:35 . 2013-02-19 23:47 917400 —-a-w- c:\program files (x86)\firefox.exe 2013-02-16 00:35 . 2013-02-19 23:47 74136 —-a-w- c:\program files (x86)\breakpadinjector.dll 2013-02-16 00:35 . 2013-02-19 23:47 19352 —-a-w- c:\program files (x86)\AccessibleMarshal.dll 2013-02-16 00:35 . 2013-02-19 23:47 116120 —-a-w- c:\program files (x86)\crashreporter.exe 2013-02-16 00:35 . 2013-02-19 23:47 2106216 —-a-w- c:\program files (x86)\D3DCompiler_43.dll 2013-02-16 00:35 . 2013-02-19 23:47 1998168 —-a-w- c:\program files (x86)\d3dx9_43.dll 2013-02-16 00:35 . 2013-02-19 23:47 770384 —-a-w- c:\program files (x86)\msvcr100.dll 2013-02-16 00:35 . 2013-02-19 23:47 421200 —-a-w- c:\program files (x86)\msvcp100.dll 2013-02-15 02:23 . 2013-01-05 16:15 39768 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2013-02-12 05:45 . 2013-03-20 13:43 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-20 13:43 308736 —-a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-20 13:43 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45 . 2013-03-20 13:43 111104 —-a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48 . 2013-03-20 13:43 474112 —-a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-20 13:43 2176512 —-a-w- c:\windows\apppatch\AcGenral.dll 2013-02-07 23:28 . 2013-01-24 12:27 9162192 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll 2013-01-17 08:28 . 2010-11-21 03:27 273840 ——w- c:\windows\system32\MpSigStub.exe 2013-01-05 05:53 . 2013-02-13 01:24 5553512 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-01-05 05:00 . 2013-02-13 01:24 3967848 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-01-05 05:00 . 2013-02-13 01:24 3913064 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-01-04 05:46 . 2013-02-13 01:23 215040 —-a-w- c:\windows\system32\winsrv.dll 2013-01-04 04:51 . 2013-02-13 01:23 5120 —-a-w- c:\windows\SysWow64\wow32.dll 2013-01-04 04:43 . 2013-02-13 01:23 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2013-01-04 03:26 . 2013-02-13 01:23 3153408 —-a-w- c:\windows\system32\win32k.sys 2013-01-04 02:47 . 2013-02-13 01:23 25600 —-a-w- c:\windows\SysWow64\setup16.exe 2013-01-04 02:47 . 2013-02-13 01:23 7680 —-a-w- c:\windows\SysWow64\instnm.exe 2013-01-04 02:47 . 2013-02-13 01:23 2048 —-a-w- c:\windows\SysWow64\user.exe 2013-01-04 02:47 . 2013-02-13 01:23 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll 2013-01-03 06:00 . 2013-02-13 01:23 1913192 —-a-w- c:\windows\system32\drivers\tcpip.sys 2013-01-03 06:00 . 2013-02-13 01:23 288088 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2013-01-02 11:27 . 2013-01-02 11:27 1400416 —-a-w- c:\windows\system32\ieapfltr.dat 2012-12-26 08:46 . 2012-05-31 14:30 18960 —-a-w- c:\windows\system32\drivers\LNonPnP.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2011-06-23 418672] "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2011-06-23 202608] "PLTSR"="c:\program files (x86)\EgisTec Port Locker\EgisPLTSR.exe" [2010-10-22 364400] "VitaKeyTSR"="c:\program files (x86)\EgisTec BioExcess\EgisTSR.exe" [2010-12-13 383344] "iTunesHelper"="c:\program files (x86)\iTunesHelper.exe" [2013-02-20 152392] "WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2012-12-10 363752] "WD Quick View"="c:\program files (x86)\Western Digital\WD Quick View\WDDMStatus.exe" [2012-12-20 5237256] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352] "MioNet"="c:\program files (x86)\MioNet\MioNetLauncher.exe" [2010-02-10 32768] "WD Anywhere Backup Premium"="c:\program files (x86)\WD\WD Anywhere Backup\MemeoLauncher2.exe" [2010-06-30 222432] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\users\Birdie admin2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Send to OneNote.lnk - c:\program files\Microsoft Office 15\root\office15\ONENOTEM.EXE [2013-3-3 158808] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0FbDefrag . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x] R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 LMIInfo;LogMeIn Kernel Information Provider;d:\x64\RaInfo.sys [x] R2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [x] R3 ALSysIO;ALSysIO;c:\users\BIRDIE~1\AppData\Local\Temp\ALSysIO64.sys [x] R3 Arctosa;Arctosa Keyboard;c:\windows\system32\drivers\Arctosa.sys [2009-08-19 19840] R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x] R3 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\CyberGhost VPN\CGVPNCliService.exe [2012-04-26 2438696] R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-03-10 29720] R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x] R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x] R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x] R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x] R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2012-03-26 22528] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800] R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-05-11 1255736] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464] R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-14 14544] R3 WMSVC;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe [2009-07-14 10752] R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088] R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840] R4 ADExchange;ArcSoft Exchange Service;c:\program files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [2011-09-17 39528] R4 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x] R4 AVTHelper;AVTHelper;c:\program files\Avatron\Air Display\AVTHelper.exe [2012-09-25 216000] R4 BingDesktopUpdate;Bing Desktop Update service;c:\program files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [2012-11-22 166424] R4 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe [2012-10-24 390672] R4 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-20 2656280] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328] S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120] S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2012-02-24 57952] S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2012-02-24 39008] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2007-11-14 53488] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2013-02-15 39768] S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2012-02-24 13408] S1 EgisTecFF;EgisTecFF;c:\windows\system32\DRIVERS\EgisTecFF.sys [2012-02-24 55880] S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2012-02-24 22912] S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2012-02-24 20328] S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2012-02-24 62584] S2 EgisTec Service Help;EgisTec Service Help;c:\program files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-10-22 327024] S2 EgisTec Service;EgisTec Service;c:\program files (x86)\EgisTec BioExcess\EgisService.exe [2010-12-13 703856] S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-12-13 650096] S2 ftpsvc;Microsoft FTP Service;c:\windows\system32\svchost.exe [2009-07-14 27136] S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\WD\WD Anywhere Backup\MemeoBackgroundService.exe [2010-06-30 25824] S2 MioNet;MioNet;c:\program files (x86)\MioNet\MioNetManager.exe [2010-02-10 139264] S2 OfficeSvc;Microsoft Office Service;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe [2012-12-07 1854056] S2 WDBackup;WD Backup;c:\program files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [2012-12-20 1155088] S2 WDDriveService;WD Drive Manager;c:\program files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [2012-12-20 248840] S2 WDRulesService;WD Rules;c:\program files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe [2012-12-20 1178128] S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2012-02-24 29792] S3 AirDisplay;Air Display Support;c:\windows\system32\DRIVERS\AVVideoCard.sys [2012-09-25 15808] S3 AirDisplayMirror;Air Display Mirror Support;c:\windows\system32\DRIVERS\AVVideoCardMirror.sys [2012-09-25 15808] S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2012-08-03 40432] S3 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2011-09-15 36656] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440] S3 Ndisrd;WinpkFilter Service;c:\windows\system32\DRIVERS\ndisrd.sys [2009-09-14 32096] S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-11-30 307304] S3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [2010-12-23 3293272] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-03-25 01:24 1629648 —-a-w- c:\program files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-03-24 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-07 23:16] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 162552 —-a-w- c:\users\Birdie admin2\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp] @="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}" [HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}] 2012-09-21 17:40 480888 —-a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending] @="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}" [HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}] 2012-09-21 17:40 480888 —-a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot] @="{A759AFF6-5851-457D-A540-F4ECED148351}" [HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}] 2012-09-21 17:40 480888 —-a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared] @="{1574C9EF-7D58-488F-B358-8B78C1538F51}" [HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}] 2012-09-21 17:40 480888 —-a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc] @="{771C7324-DA80-49D3-8017-753B0AF60951}" [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}] 2012-02-24 17:00 1508192 —-a-w- c:\windows\System32\IcnOvrly.dll . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = 192.168.*.*;*.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 IE: E&xport; to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000 IE: Se&nd; to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105 TCP: DhcpNameServer = [removed] [removed] DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab DPF: {82E5DF24-51E8-47CD-864A-F4BD5005AA73} - hxxps://www.icloud.com/system/iCloud.cab FF - ProfilePath - c:\users\Birdie admin2\AppData\Roaming\Mozilla\Firefox\Profiles\ncbiyoia.default\ FF - prefs.js: browser.startup.homepage - hxxp://howtogeek.com/ . - - - - ORPHANS REMOVED - - - - . AddRemove-{09760D42-E223-42AD-8C3E-55B47D0DDAC3} - c:\programdata\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe . . "ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z [\]^_‘\00\00‘\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~‘\00\00‘\00\00\00\00‚\00\00\00\00\00\00\00\00‘’“" . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Digital River Mso] @Denied: (Full) (RestrictedCode) @Denied: (Full) (LocalSystem) @Denied: (A C 3 4 5 6) (S-1-5-21-2965589367-2178919387-1176447042-1014) @Allowed: (Read) (RestrictedCode) @Allowed: (B D 1 2) (S-1-5-21-2965589367-2178919387-1176447042-1014) "BitSelection"="64" "SaveLocation"="empty" . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar] "Order"=hex:08,00,00,00,02,00,00,00,ec,15,00,00,01,00,00,00,26,00,00,00,b0,00, 00,00,01,00,00,00,a2,00,32,00,27,02,00,00,5f,41,4d,20,20,00,31,30,41,57,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Lenovo] "Order"=hex:08,00,00,00,02,00,00,00,f2,00,00,00,01,00,00,00,02,00,00,00,6a,00, 00,00,01,00,00,00,5c,00,32,00,48,01,00,00,5f,41,4c,20,20,00,4c,65,6e,6f,76,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Links for United States] "Order"=hex:08,00,00,00,02,00,00,00,f8,00,00,00,01,00,00,00,02,00,00,00,7e,00, 00,00,00,00,00,00,70,00,32,00,81,01,00,00,5f,41,4c,20,20,00,47,4f,42,49,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Microsoft Websites] "Order"=hex:08,00,00,00,02,00,00,00,8c,02,00,00,01,00,00,00,05,00,00,00,82,00, 00,00,00,00,00,00,74,00,32,00,75,01,00,00,5f,41,4c,20,20,00,4d,49,43,52,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\MSN Websites] "Order"=hex:08,00,00,00,02,00,00,00,c0,02,00,00,01,00,00,00,06,00,00,00,60,00, 00,00,04,00,00,00,52,00,32,00,82,01,00,00,5f,41,4c,20,20,00,4d,53,4e,2e,75,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\My fun stuff] "Order"=hex:08,00,00,00,02,00,00,00,9a,0d,00,00,01,00,00,00,17,00,00,00,b0,00, 00,00,00,00,00,00,a2,00,32,00,8c,01,00,00,5f,41,4c,20,20,00,41,4e,54,49,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\My fun stuff\Test] "Order"=hex:08,00,00,00,02,00,00,00,fc,00,00,00,01,00,00,00,02,00,00,00,76,00, 00,00,00,00,00,00,68,00,32,00,7d,01,00,00,5f,41,4c,20,20,00,48,4f,57,54,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\stuff ONLY only for MY EYES] "Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0b,00,00,00,6c,00, 00,00,00,00,00,00,5e,00,32,00,af,01,00,00,5f,41,4c,20,20,00,41,6e,73,77,65,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\boOKmArKS\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Stuffadooodle] "Order"=hex:08,00,00,00,02,00,00,00,ae,1e,00,00,01,00,00,00,32,00,00,00,94,00, 00,00,00,00,00,00,86,00,32,00,99,03,00,00,5f,41,4d,20,20,00,34,30,38,41,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar] "Order"=hex:08,00,00,00,02,00,00,00,48,15,00,00,01,00,00,00,25,00,00,00,b0,00, 00,00,01,00,00,00,a2,00,32,00,f5,03,00,00,5f,41,63,45,20,00,31,30,41,57,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Lenovo] "Order"=hex:08,00,00,00,02,00,00,00,f2,00,00,00,01,00,00,00,02,00,00,00,6a,00, 00,00,01,00,00,00,5c,00,32,00,c9,02,00,00,5f,41,32,20,20,00,4c,65,6e,6f,76,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Links for United States] "Order"=hex:08,00,00,00,02,00,00,00,f8,00,00,00,01,00,00,00,02,00,00,00,7e,00, 00,00,00,00,00,00,70,00,32,00,02,03,00,00,5f,41,31,20,20,00,47,4f,42,49,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Microsoft Websites] "Order"=hex:08,00,00,00,02,00,00,00,8c,02,00,00,01,00,00,00,05,00,00,00,82,00, 00,00,00,00,00,00,74,00,32,00,f6,02,00,00,5f,41,32,20,20,00,4d,49,43,52,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\MSN Websites] "Order"=hex:08,00,00,00,02,00,00,00,c0,02,00,00,01,00,00,00,06,00,00,00,60,00, 00,00,04,00,00,00,52,00,32,00,03,03,00,00,5f,41,31,20,20,00,4d,53,4e,2e,75,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\My fun stuff] "Order"=hex:08,00,00,00,02,00,00,00,9a,0d,00,00,01,00,00,00,17,00,00,00,b0,00, 00,00,00,00,00,00,a2,00,32,00,0d,03,00,00,5f,41,31,20,20,00,41,4e,54,49,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\My fun stuff\Test] "Order"=hex:08,00,00,00,02,00,00,00,fc,00,00,00,01,00,00,00,02,00,00,00,76,00, 00,00,00,00,00,00,68,00,32,00,38,03,00,00,5f,41,31,20,20,00,48,4f,57,54,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\stuff ONLY only for MY EYES] "Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0b,00,00,00,6c,00, 00,00,00,00,00,00,5e,00,32,00,30,03,00,00,5f,41,30,20,20,00,41,6e,73,77,65,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \BookmarksBar\Stuffadooodle] "Order"=hex:08,00,00,00,02,00,00,00,ae,1e,00,00,01,00,00,00,32,00,00,00,94,00, 00,00,00,00,00,00,86,00,32,00,c5,01,00,00,5f,41,5d,45,20,00,34,30,38,41,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links] "Order"=hex:08,00,00,00,02,00,00,00,ec,15,00,00,01,00,00,00,26,00,00,00,b0,00, 00,00,01,00,00,00,a2,00,32,00,27,02,00,00,5f,41,2e,20,20,00,31,30,41,57,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\Lenovo] "Order"=hex:08,00,00,00,02,00,00,00,f2,00,00,00,01,00,00,00,02,00,00,00,6a,00, 00,00,01,00,00,00,5c,00,32,00,48,01,00,00,5f,41,2e,20,20,00,4c,65,6e,6f,76,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\Links for United States] "Order"=hex:08,00,00,00,02,00,00,00,f8,00,00,00,01,00,00,00,02,00,00,00,7e,00, 00,00,00,00,00,00,70,00,32,00,81,01,00,00,5f,41,2e,20,20,00,47,4f,42,49,45,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\Microsoft Websites] "Order"=hex:08,00,00,00,02,00,00,00,8c,02,00,00,01,00,00,00,05,00,00,00,82,00, 00,00,00,00,00,00,74,00,32,00,75,01,00,00,5f,41,2e,20,20,00,4d,49,43,52,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\MSN Websites] "Order"=hex:08,00,00,00,02,00,00,00,c0,02,00,00,01,00,00,00,06,00,00,00,60,00, 00,00,04,00,00,00,52,00,32,00,82,01,00,00,5f,41,2e,20,20,00,4d,53,4e,2e,75,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\My fun stuff] "Order"=hex:08,00,00,00,02,00,00,00,9a,0d,00,00,01,00,00,00,17,00,00,00,b0,00, 00,00,00,00,00,00,a2,00,32,00,8c,01,00,00,5f,41,2e,20,20,00,41,4e,54,49,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\My fun stuff\Test] "Order"=hex:08,00,00,00,02,00,00,00,fc,00,00,00,01,00,00,00,02,00,00,00,76,00, 00,00,00,00,00,00,68,00,32,00,7d,01,00,00,5f,41,2e,20,20,00,48,4f,57,54,4f,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\stuff ONLY only for MY EYES] "Order"=hex:08,00,00,00,02,00,00,00,e4,05,00,00,01,00,00,00,0b,00,00,00,6c,00, 00,00,00,00,00,00,5e,00,32,00,af,01,00,00,5f,41,2e,20,20,00,41,6e,73,77,65,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\L*a*u*n*c*h* *c*o*m*p*u*t*e*r* *m*a*n*a*g*e*m*e*n*t* *f*r*o*m* *R*u*n* *w*i*n*& \Links\Stuffadooodle] "Order"=hex:08,00,00,00,02,00,00,00,ae,1e,00,00,01,00,00,00,32,00,00,00,94,00, 00,00,00,00,00,00,86,00,32,00,c5,01,00,00,5f,41,2e,20,20,00,34,30,38,41,52,\ . [HKEY_USERS\S-1-5-21-2965589367-2178919387-1176447042-1011\Software\SecuROM\License information*] "datasecu"=hex:ac,ae,36,db,46,78,f6,42,3b,dd,29,88,55,76,a2,29,26,a4,bb,d0,72, 07,c0,e8,83,48,22,59,9f,57,4e,7b,f8,7d,6d,2c,4a,04,9a,1d,57,32,1f,be,4b,91,\ "rkeysecu"=hex:60,18,77,73,23,5a,4d,59,7a,7f,a5,3f,41,00,e4,85 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Folder\ShellEx\ContextMenuHandlers\RUShellExt] @Denied: (Read) (Owner) @Denied: (Read) (Administrators) @="{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}" . [HKEY_LOCAL_MACHINE\software\Classes\Folder\ShellEx\ContextMenuHandlers\SugarSync] @Denied: (Read) (LocalSystem) @="[CC]{305BC11B-5175-492B-B569-866547FCDA40}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet003\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\MioNet\jvm\bin\MioNet.exe . ************************************************************************** . Completion time: 2013-03-24 18:49:55 - machine was rebooted ComboFix-quarantined-files.txt 2013-03-25 01:49 . Pre-Run: 198,229,258,240 bytes free Post-Run: 197,326,405,632 bytes free . - - End Of File - - FFDD168157043F0A746E2D1FD458D262

birdienic

Post #12March 25, 2013, 2:03 AM UTC

as a side note, does anything I have posted so far implicate any sort of tracking, spy, keylogger software?

birdienic

Post #13March 25, 2013, 2:14 AM UTC

After this last post I rebooted my pc again and now EVERY program file has responded with the following error::

" C:\program files(x86)\\PROGRAM NAME illegal operation attempted on registry key that has been marked for deletion. "

Robybel

Post #14March 25, 2013, 3:51 AM UTC

Hi nicole888

After this last post I rebooted my pc again and now EVERY program file has responded with the following error::
" C:\program files(x86)\\PROGRAM NAME illegal operation attempted on registry key that has been marked for deletion. "

Reboot the computer, you may have to do this a couple of times to clear it up,

as a side note, does anything I have posted so far implicate any sort of tracking, spy, keylogger software?

Yes

Please follow this step now

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

ClearJavaCache

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Next

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Next

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as MyEsetScan. Alternatively, look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt. Include the contents of this report in your next reply.
Push the Back button.
Select Uninstall application on close check box and push [external image: Posted Image]

On your next reply please post :
New Combofix log
MBAM log
Eset Report

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Robybel

Post #15April 5, 2013, 3:10 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Downloaded backup files from corrupted computer// Failed to load user

✨ Ask AI

Ask AI