Please Assist: trojan.adh2 on Win7 [Closed]

. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Professional Boot Device: \Device\HarddiskVolume1 Install Date: 1/21/2012 10:51:04 AM System Uptime: 3/26/2013 3:19:14 AM (14 hours ago) . Motherboard: ASUSTeK Computer INC. | | M4A78T-E Processor: AMD Athlon™ II X4 635 Processor | AM3 | 2909/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 98 GiB total, 3.415 GiB free. D: is CDROM () E: is FIXED (NTFS) - 834 GiB total, 711.029 GiB free. F: is FIXED (NTFS) - 932 GiB total, 926.785 GiB free. G: is FIXED (NTFS) - 1863 GiB total, 921.136 GiB free. H: is FIXED (NTFS) - 1863 GiB total, 1494.885 GiB free. I: is FIXED (NTFS) - 293 GiB total, 154.81 GiB free. . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64 Device ID: ROOT\NET\0000 Manufacturer: Cisco Systems Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64 PNP Device ID: ROOT\NET\0000 Service: vpnva . ==== System Restore Points =================== . RP129: 3/26/2013 3:00:11 AM - Windows Update . ==== Installed Programs ====================== . Tools for .Net 3.5 Adobe Digital Editions Adobe Flash Player 11 ActiveX Adobe Reader XI (11.0.01) AI Suite AIMI eBook Lite Akamai NetSession Interface Amazon MP3 Downloader 1.0.17 Amazon Unbox Video AMD Accelerated Video Transcoding AMD APP SDK Runtime AMD AVIVO64 Codecs AMD Catalyst Install Manager AMD Drag and Drop Transcoding AMD Fuel AMD Media Foundation Decoders AMD Steady Video Plug-In AMD VISION Engine Control Center Application Profiles ArcSoft TotalMedia 3.5 ASUSUpdate Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver Atheros Ethernet Utility AVG Security Toolbar Belarc Advisor 8.3 Blend for Visual Studio 2012 Blend for Visual Studio 2012 ENU resources Canon iP4200 Canon MP Navigator EX 2.0 Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-utility64 CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CDBurnerXP Cisco AnyConnect VPN Client Code OnTime Generator Cool & Quiet Crystal Reports Basic Runtime for Visual Studio 2008 Crystal Reports for Visual Studio CyberLink Blu-ray Disc Suite CyberLink InstantBurn CyberLink LabelPrint CyberLink PhotoDirector 2011 CyberLink Power2Go CyberLink PowerBackup CyberLink PowerDirector CyberLink PowerDVD 9 CyberLink PowerProducer DAZzle Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition Dotfuscator and Analytics Community Edition Dotfuscator Software Services - Community Edition Dr. Hardware 2011 11.0d DYMO Printable Postage Entity Framework Designer for Visual Studio 2012 - enu EPU ESET Online Scanner v3 FileASSASSIN FileZilla Server Free TV Radio Google Chrome Google Toolbar for Internet Explorer Google Update Helper HD Video Converter Factory Pro Hotfix for Microsoft Team Foundation Server 2010 Object Model - ENU (KB2736182) Hotfix for Microsoft Visual Studio 2010 Professional - ENU (KB2529927) Hotfix for Microsoft Visual Studio 2010 Professional - ENU (KB2542054) Hotfix for Microsoft Visual Studio 2010 Professional - ENU (KB2548139) Hotfix for Microsoft Visual Studio 2010 Professional - ENU (KB2549864) Hotfix for Microsoft Visual Studio 2010 Professional - ENU (KB2635973) Hotfix for Microsoft Visual Studio 2010 Professional - ENU (KB2736182) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2280741) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2284668) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2295689) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2420513) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2452649) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2455033) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2485545) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB982517) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB982721) Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB983233) HydraVision IIS 8.0 Express IIS Express Application Compatibility Database for x64 IIS Express Application Compatibility Database for x86 ImgBurn Java Auto Updater Java™ 6 Update 37 Java™ SE Development Kit 6 Update 26 KWorld ATSC BDA Drivers KWorld RC Utility LightScribe System Software LocalESPC LocalESPCui for en-us Malwarebytes Anti-Malware version 1.70.0.1100 MFP and Storage Server Microsoft .NET Framework 1.1 Microsoft .NET Framework 4 Multi-Targeting Pack Microsoft .NET Framework 4.5 Microsoft .NET Framework 4.5 Multi-Targeting Pack Microsoft .NET Framework 4.5 SDK Microsoft Access database engine 2010 (English) Microsoft Application Error Reporting Microsoft ASP.NET MVC 2 Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools Microsoft ASP.NET MVC 3 Microsoft ASP.NET MVC 3 - Visual Studio 2012 Tools Update Microsoft ASP.NET MVC 4 - Visual Studio 2012 Tools Microsoft ASP.NET MVC 4 Runtime Microsoft ASP.NET Web Pages Microsoft ASP.NET Web Pages - Visual Studio 2012 Tools Microsoft ASP.NET Web Pages 2 - Visual Studio 2012 Tools Microsoft ASP.NET Web Pages 2 Runtime Microsoft Halo Microsoft Help Viewer 1.1 Microsoft Help Viewer 2.0 Microsoft LightSwitch for Visual Studio 2012 Core Microsoft LightSwitch for Visual Studio 2012 CoreRes - ENU Microsoft MapPoint North America 2013 Microsoft NuGet - Visual Studio 2012 Microsoft Office 2010 Primary Interop Assemblies Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access database engine 2007 (English) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office Office 64-bit Components 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared 64-bit MUI (English) 2010 Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Portable Library Multi-Targeting Pack Microsoft Portable Library Multi-Targeting Pack Language Pack - enu Microsoft Report Viewer Add-On for Visual Studio 2012 Microsoft Silverlight Microsoft Silverlight 3 SDK Microsoft Silverlight 4 SDK Microsoft Silverlight 5 SDK Microsoft SQL Server 2008 (64-bit) Microsoft SQL Server 2008 Browser Microsoft SQL Server 2008 Common Files Microsoft SQL Server 2008 Database Engine Services Microsoft SQL Server 2008 Database Engine Shared Microsoft SQL Server 2008 Native Client Microsoft SQL Server 2008 R2 Data-Tier Application Framework Microsoft SQL Server 2008 R2 Data-Tier Application Project Microsoft SQL Server 2008 R2 Management Objects Microsoft SQL Server 2008 R2 Management Objects (x64) Microsoft SQL Server 2008 R2 Transact-SQL Language Service Microsoft SQL Server 2008 RsFx Driver Microsoft SQL Server 2008 Setup Support Files Microsoft SQL Server 2012 Command Line Utilities Microsoft SQL Server 2012 Data-Tier App Framework Microsoft SQL Server 2012 Express LocalDB Microsoft SQL Server 2012 Management Objects Microsoft SQL Server 2012 Management Objects (x64) Microsoft SQL Server 2012 Native Client Microsoft SQL Server 2012 T-SQL Language Service Microsoft SQL Server 2012 Transact-SQL Compiler Service Microsoft SQL Server 2012 Transact-SQL ScriptDom Microsoft SQL Server Compact 3.5 SP2 ENU Microsoft SQL Server Compact 3.5 SP2 x64 ENU Microsoft SQL Server Compact 4.0 SP1 x64 ENU Microsoft SQL Server Data Tools - enu (11.1.20627.00) Microsoft SQL Server Data Tools Build Utilities - enu (11.1.20627.00) Microsoft SQL Server Database Publishing Wizard 1.4 Microsoft SQL Server System CLR Types Microsoft SQL Server System CLR Types (x64) Microsoft SQL Server VSS Writer Microsoft Sync Framework Runtime v1.0 SP1 (x64) Microsoft Sync Framework SDK v1.0 SP1 Microsoft Sync Framework Services v1.0 SP1 (x64) Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) Microsoft System CLR Types for SQL Server 2012 Microsoft System CLR Types for SQL Server 2012 (x64) Microsoft Team Foundation Server 2010 Object Model - ENU Microsoft Visual C++ Compilers 2010 Standard - enu - x64 Microsoft Visual C++ Compilers 2010 Standard - enu - x86 Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Designtime - 10.0.30319 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Visual C++ 2010 x64 Runtime - 10.0.40219 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 Microsoft Visual C++ 2012 x64 Designtime - 11.0.50727 Microsoft Visual C++ 2012 Compilers Microsoft Visual C++ 2012 Compilers - ENU Resources Microsoft Visual C++ 2012 Core Libraries Microsoft Visual C++ 2012 Extended Libraries Microsoft Visual C++ 2012 Microsoft Foundation Class Libraries Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 Microsoft Visual C++ 2012 x64 Debug Runtime - 11.0.50727 Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.50727 Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 Microsoft Visual F# 2.0 Runtime Microsoft Visual J# 2.0 Redistributable Package Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools Microsoft Visual Studio 2010 Office Developer Tools (x64) Microsoft Visual Studio 2010 Professional - ENU Microsoft Visual Studio 2010 Service Pack 1 Microsoft Visual Studio 2010 SharePoint Developer Tools Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Microsoft Visual Studio 2012 Devenv Microsoft Visual Studio 2012 Devenv Resources Microsoft Visual Studio 2012 Performance Collection Tools Microsoft Visual Studio 2012 Performance Collection Tools - ENU Microsoft Visual Studio 2012 Preparation Microsoft Visual Studio 2012 SharePoint Developer Tools Microsoft Visual Studio 2012 SharePoint Developer Tools ENU Language Pack Microsoft Visual Studio 2012 Shell (Minimum) Microsoft Visual Studio 2012 Shell (Minimum) Interop Assemblies Microsoft Visual Studio 2012 Shell (Minimum) Resources Microsoft Visual Studio 2012 Tools for SQL Server Compact 4.0 SP1 ENU Microsoft Visual Studio Macro Tools Microsoft Visual Studio Professional 2012 Microsoft Visual Studio Professional 2012 - ENU Microsoft Visual Studio ProjectAggregator2 Microsoft Visual Studio Team Foundation Server 2012 Object Model Microsoft Visual Studio Team Foundation Server 2012 Object Model Language Pack - ENU Microsoft Visual Studio Team Foundation Server 2012 Team Explorer Microsoft Visual Studio Team Foundation Server 2012 Team Explorer Language Pack - ENU Microsoft Visual Studio Ultimate 2012 XAML UI Designer Core Microsoft Visual Studio Ultimate 2012 XAML UI Designer enu Resources Microsoft Web Deploy 3.0 Microsoft Web Deploy dbSqlPackage Provider - enu Microsoft Web Developer Tools - Visual Studio 2012 Microsoft Web Platform Installer 4.0 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK No-IP DUC Norton 360 Norton Bootable Recovery Tool Wizard NovaBACKUP ophcrack 3.4.0 PC Probe II Platform PlayReady PC Runtime amd64 PreEmptive Analytics Visual Studio Components Prerequisites for SSDT RealDownloader RealNetworks - Microsoft Visual C++ 2008 Runtime RealNetworks - Microsoft Visual C++ 2010 Runtime RealPlayer RealUpgrade 1.1 RoboForm 7-8-3-5 (All Users) Security Update for Microsoft .NET Framework 4.5 (KB2729460) Security Update for Microsoft .NET Framework 4.5 (KB2737083) Security Update for Microsoft .NET Framework 4.5 (KB2742613) Security Update for Microsoft .NET Framework 4.5 (KB2789648) Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition Security Update for Microsoft Filter Pack 2.0 (KB2553501) 32-Bit Edition Security Update for Microsoft InfoPath 2010 (KB2687417) 32-Bit Edition Security Update for Microsoft InfoPath 2010 (KB2687436) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2687501) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition Security Update for Microsoft OneNote 2010 (KB2760600) 32-Bit Edition Security Update for Microsoft Visio 2010 (KB2760762) 32-Bit Edition Security Update for Microsoft Visio Viewer 2010 (KB2687505) 32-Bit Edition Security Update for Microsoft Visual Studio 2010 Professional - ENU (KB2644980) Security Update for Microsoft Visual Studio 2010 Professional - ENU (KB2645410) Security Update for Microsoft Visual Studio Macro Tools (KB2669970) Security Update for Microsoft Word 2010 (KB2760410) 32-Bit Edition Service Pack 3 for SQL Server 2008 (KB2546951) (64-bit) Shared Add-in Extensibility Update for Microsoft .NET Framework 2.0 (KB908002) Sql Server Customer Experience Improvement Program Sybase PowerDesigner 16.0 Sybase PowerDesigner Portal 16.0 The Lord of the Rings Online™ v03.05.01.8027 TreeSize Free V2.7 TurboV Update for Microsoft .NET Framework 4.5 (KB2750147) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition Update for Microsoft Visual Studio 2012 (KB2781514) VIA Platform Device Manager Visual Studio 2010 Prerequisites - English Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU Visual Studio 2012 Prerequisites Visual Studio 2012 Prerequisites - ENU Language Pack Visual Studio Extensions for Windows Library for JavaScript VisualVision HP Work1 WCF Data Services 5.0 (for OData v3) Primary Components WCF Data Services Tools for Microsoft Visual Studio 2012 WCF RIA Services V1.0 SP2 Web Deployment Tool Windows App Certification Kit Native Components Windows App Certification Kit x64 Windows Runtime Intellisense Content - en-us Windows Software Development Kit Windows Software Development Kit DirectX x64 Remote Windows Software Development Kit DirectX x86 Remote Windows Software Development Kit for Windows Store Apps Windows Software Development Kit for Windows Store Apps DirectX x64 Remote Windows Software Development Kit for Windows Store Apps DirectX x86 Remote WinZip 16.5 . ==== Event Viewer Messages From Past Week ======== . 3/26/2013 5:32:36 PM, Error: Microsoft-Windows-TerminalServices-Printers [1111] - Driver Send To Microsoft OneNote Driver required for printer Send To OneNote 2007 is unknown. Contact the administrator to install the driver before you log in again. 3/26/2013 5:32:33 PM, Error: Microsoft-Windows-TerminalServices-Printers [1111] - Driver HP Universal Printing PS required for printer HP Universal Printing PS is unknown. Contact the administrator to install the driver before you log in again. 3/26/2013 5:32:31 PM, Error: Microsoft-Windows-TerminalServices-Printers [1111] - Driver HP Universal Printing PCL 5 required for printer HP Universal Printing PCL 5 is unknown. Contact the administrator to install the driver before you log in again. 3/26/2013 5:32:31 PM, Error: Microsoft-Windows-TerminalServices-Printers [1111] - Driver HP Universal Printing PCL 5 required for printer HP LaserJet 3055 (192.168.0.112) is unknown. Contact the administrator to install the driver before you log in again. 3/26/2013 5:32:30 PM, Error: Microsoft-Windows-TerminalServices-Printers [1111] - Driver HP LaserJet 3050_3055_3390_3392 Fax required for printer HP LaserJet 3050_3055_3390_3392 Fax is unknown. Contact the administrator to install the driver before you log in again. 3/26/2013 5:32:30 PM, Error: Microsoft-Windows-TerminalServices-Printers [1111] - Driver hp LaserJet 1012 required for printer hp 1012 is unknown. Contact the administrator to install the driver before you log in again. 3/26/2013 5:32:26 PM, Error: Microsoft-Windows-TerminalServices-Printers [1111] - Driver Adobe PDF Converter required for printer Adobe PDF is unknown. Contact the administrator to install the driver before you log in again. 3/26/2013 5:32:01 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk4\DR4. 3/26/2013 3:23:26 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the No-IP DUC Service service to connect. 3/26/2013 3:20:15 AM, Error: Service Control Manager [7000] - The AODDriver4.2 service failed to start due to the following error: The system cannot find the file specified. 3/24/2013 6:31:52 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 3/24/2013 6:02:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F} 3/24/2013 6:02:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 3/24/2013 6:01:53 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start. 3/24/2013 6:01:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 3/24/2013 6:01:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 3/24/2013 6:01:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 3/24/2013 6:01:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 3/24/2013 6:01:19 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AsIO BHDrvx64 ccSet_N360 discache eeCtrl IDSVia64 spldr SRTSPX SymIRON SymNetS Wanarpv6 3/24/2013 6:01:19 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B} 3/24/2013 5:33:21 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly. 3/24/2013 5:27:05 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the vToolbarUpdater14.2.0 service. 3/24/2013 5:25:46 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the UmRdpService service. 3/24/2013 4:55:08 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user Freddie7\sadair SID (S-1-5-21-3496914623-1557097719-4188195215-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 3/24/2013 4:55:08 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user Freddie7\sadair SID (S-1-5-21-3496914623-1557097719-4188195215-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 3/24/2013 11:10:38 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. . ==== End Of File =========================== DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16470 Run by [removed] at 17:39:29 on 2013-03-26 #Option Extended Search is enabled. Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.16382.12172 [GMT -5:00] . AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\LogonUI.exe C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Windows\SysWOW64\aimibackupl.exe C:\Windows\SysWOW64\aimiwatchl.exe C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\System32\vds.exe C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\DR\x64\drdiag.exe C:\Windows\System32\vdsldr.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\atieclxx.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\ehome\ehRecvr.exe C:\Windows\ehome\mcGlidHost.exe C:\Windows\SysWOW64\aiminetl.exe C:\Windows\SysWOW64\aimiservicel.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe C:\Windows\system32\rdpclip.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Users\sadair\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe C:\Windows\system32\taskeng.exe C:\Windows\Windows7\AsusSetup.exe C:\Windows\Windows7\AsusSetup.exe C:\Windows\Windows7\AsusSetup.exe C:\Windows\Windows7\AsusSetup.exe C:\Windows\Windows7\AsusSetup.exe C:\Windows\DAODx.exe C:\Program Files (x86)\ASUS\EPU\EPU.exe C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files (x86)\RC_Bridge\RC_Bridge.exe C:\Windows\system32\AUDIODG.EXE C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe C:\Program Files (x86)\TP-LINK\MFP and Storage Server\MFP and Storage Server.exe C:\Users\sadair\AppData\Local\Akamai\netsession_win.exe C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe C:\Users\sadair\AppData\Local\Akamai\netsession_win.exe C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe C:\Program Files (x86)\No-IP\DUC30.exe C:\Program Files (x86)\KWorld MultiMedia\RC Utility\KWRCtl.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\ASUS\TurboV\TurboV.exe C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe C:\Program Files (x86)\ASUS\AI Suite\Q-Button\QButton.exe C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe C:\Program Files (x86)\CyberLink\Shared files\brs.exe C:\Windows\system32\UI0Detect.exe C:\Windows\SysWOW64\ictnotel.exe C:\Windows\SysWOW64\aimiksl.exe C:\Program Files (x86)\AVG Secure Search\vprot.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uProxyOverride = mWinlogon: Userinit = userinit.exe, BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coieplg.dll BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ips\ipsbho.dll BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coieplg.dll TB: &RoboForm Toolbar: {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\coieplg.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden uRun: [BlazeServoTool] "C:\Program Files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe" uRun: [AuviBridge] C:\Program Files (x86)\RC_Bridge\RC_Bridge.exe uRun: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" uRun: [MFP and Storage Server] "C:\Program Files (x86)\TP-LINK\MFP and Storage Server\MFP and Storage Server.exe" /h uRun: [Akamai NetSession Interface] "C:\Users\sadair\AppData\Local\Akamai\netsession_win.exe" mRun: [TurboV] "C:\Program Files (x86)\ASUS\TurboV\TurboV.exe" mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun: [Ai Nap] "C:\Program Files (x86)\ASUS\AI Suite\Q-Button\QButton.exe" mRun: [QFan Help] "C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe" mRun: [Cpu Level Up help] "C:\Program Files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe" mRun: [InstantBurn] C:\PROGRA~2\CYBERL~1\INSTAN~1\Win2K\IBurn.exe mRun: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" mRun: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" mRun: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe mRun: [UpdatePPShortCut] "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" mRun: [UpdatePSTShortCut] "C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" mRun: [Incoming Transfer Lite] C:\Windows\SysWOW64\ictnotel.exe mRun: [eKiosk Status Lite] C:\Windows\SysWOW64\aimiksl.exe mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun StartupFolder: C:\Users\sadair\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\NO-IPD~1.LNK - C:\Program Files (x86)\No-IP\DUC30.exe StartupFolder: C:\Users\sadair\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\REMOTE~1.LNK - C:\Program Files (x86)\KWorld MultiMedia\RC Utility\KWRCtl.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\AMAZON~1.LNK - C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NOVABA~1.LNK - C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\TMMONI~1.LNK - C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll Trusted Zone: google-analytics.com Trusted Zone: novastor.com Trusted Zone: novastor.com DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} - hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.2.cab DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxps://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CC679CB8-DC4B-458B-B817-D447B3B6AC31} - hxxps://199.120.249.116/CACHE/stc/1/binaries/vpnweb.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: Interfaces\{BA643584-2629-4A59-8DFA-B551F4A2F424} : NameServer = 8.8.8.8,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.15 4.71.1 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll SSODL: WebCheck - SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome x64-BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll x64-BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL x64-TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-Run: [Logitech Download Assistant] C:\Windows\System32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll x64-IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll x64-IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll x64-IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL x64-Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll x64-Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - x64-SSODL: WebCheck - x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-12-21 56336] R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\1403000.024\symds64.sys [2013-2-27 493656] R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\1403000.024\symefa64.sys [2013-2-27 1139800] R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2012-9-17 39768] R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\BASHDefs\20130301.001\BHDrvx64.sys [2013-3-5 1388120] R1 ccSet_N360;Norton 360 Settings Manager;C:\Windows\System32\drivers\N360x64\1403000.024\ccsetx64.sys [2013-2-27 168096] R1 CLBStor;InstantBurn Storage Helper Driver;C:\Windows\System32\drivers\CLBStor.sys [2012-3-4 24560] R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\IPSDefs\20130323.001\IDSviA64.sys [2013-3-25 513184] R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\1403000.024\ironx64.sys [2013-2-27 224416] R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\N360x64\1403000.024\symnets.sys [2013-2-27 432800] R2 AIMI eBOOK Lite Backup;AIMI eBOOK Lite Backup;C:\Windows\SysWOW64\aimibackupl.exe [2012-4-20 19456] R2 AIMI eBOOK Lite Net Service;AIMI eBOOK Lite Net Service;C:\Windows\SysWOW64\aiminetl.exe [2012-7-7 43008] R2 AIMI eBook Lite Service Watch;AIMI eBook Lite Service Watch;C:\Windows\SysWOW64\aimiwatchl.exe [2011-9-21 6656] R2 AIMI eBOOK Lite Service;AIMI eBOOK Lite Service;C:\Windows\SysWOW64\aimiservicel.exe [2012-1-26 20480] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-12-19 240640] R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-12-19 361984] R2 AODDriver4.01;AODDriver4.01;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-4-9 57472] R2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2012-1-21 90112] R2 CLBUDF;CyberLink InstantBurn UDF Filesystem;C:\Windows\System32\drivers\CLBUDF.sys [2012-3-4 376816] R2 CXIR;Conexant Polaris IR Transceiver;C:\Windows\System32\drivers\cxcir64.sys [2012-12-5 44032] R2 Disaster Recovery Imaging;Disaster Recovery Imaging;C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\DR\x64\drdiag.exe [2012-10-22 6141952] R2 DRHARD64;DRHARD64;C:\Windows\System32\drivers\DRHARD64.sys [2012-3-9 22216] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-3-24 398184] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-3-24 682344] R2 N360;Norton 360;C:\Program Files (x86)\Norton 360\Engine\20.3.0.36\ccsvchst.exe [2013-2-27 144520] R2 nsService;NovaStor NovaBACKUP Backup/Copy Engine;C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe [2012-12-8 518288] R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2012-11-29 38608] R2 vpnagent;Cisco AnyConnect VPN Agent;C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2011-8-3 645048] R2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [2013-2-18 968880] R3 amdiox64;AMD IO Driver;C:\Windows\System32\drivers\amdiox64.sys [2012-3-4 46136] R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-11-6 96256] R3 CXPOLARIS;Conexant Polaris Video Capture;C:\Windows\System32\drivers\cxpolar64.sys [2012-12-5 428288] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-9-13 138912] R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-3-24 24176] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2012-1-21 1196032] S2 AODDriver4.2;AODDriver4.2;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-4-9 57472] S2 CLKMSVC10_9EC60124;CyberLink Product - 2013/03/11 08:38:20;C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [2010-11-23 240112] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-7-9 104912] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-7-9 123856] S2 NoIPDUCService3;No-IP DUC Service;C:\Program Files (x86)\No-IP\DUC30.exe -service –> C:\Program Files (x86)\No-IP\DUC30.exe -service [?] S3 AuviUADFilter;Microtune USB Audio Filter Driver;C:\Windows\System32\drivers\AuviUADFilter64.sys [2012-3-11 31448] S3 AuviUATV;AuviUATV NTSC Capture Device;C:\Windows\System32\drivers\AuviUATV64.sys [2012-3-11 2024792] S3 AuviUDTV;AuviUDTV ATSC Capture Device;C:\Windows\System32\drivers\AuviUDTV64.sys [2012-3-11 2018008] S3 Backup Client Agent Service;Backup Client Agent Service;C:\Program Files (x86)\NovaStor\NovaStor NovaBACKUP\ManagementServer.Agent.Service.exe [2012-12-8 387440] S3 EST_BusEnum;Network USB Device Bus;C:\Windows\System32\drivers\GenBus.sys [2009-10-6 29696] S3 EST_Server;Network USB Device;C:\Windows\System32\drivers\GenHC.sys [2009-10-6 199168] S3 PortalServer16;Sybase PowerDesigner Portal Server 16;E:\Program Files (x86)\Sybase\PowerDesigner Portal 16\Tomcat\bin\tomcat6.exe [2012-3-17 74240] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-12-24 19456] S3 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-9-22 431464] S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136] S3 Te.Service;Te.Service;C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [2012-7-25 126976] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-12-24 57856] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-23 1255736] S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2009-7-22 61976] S4 RsFx0105;RsFx0105 Driver;C:\Windows\System32\drivers\RsFx0105.sys [2011-9-22 311144] . =============== File Associations =============== . FileExt: .inf: inffile=C:\Windows\System32\NOTEPAD.EXE %1 [UserChoice] FileExt: .vbe: VBEFile=C:\Windows\SysWow64\CScript.exe "%1" %* FileExt: .vbs: VBSFile=C:\Windows\SysWow64\CScript.exe "%1" %* FileExt: .js: JSFile=C:\Windows\SysWow64\CScript.exe "%1" %* FileExt: .jse: JSEFile=C:\Windows\SysWow64\CScript.exe "%1" %* FileExt: .wsf: WSFFile=C:\Windows\SysWow64\CScript.exe "%1" %* . =============== Created Last 60 ================ . 2013-03-25 23:50:39 19968 —-a-w- C:\Windows\System32\drivers\usb8023.sys 2013-03-25 01:25:26 ——– d—–w- C:\Program Files (x86)\FileASSASSIN 2013-03-24 23:03:40 24176 —-a-w- C:\Windows\System32\drivers\mbam.sys 2013-03-24 23:03:40 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-02-27 07:35:35 796248 —-a-w- C:\Windows\System32\drivers\N360x64\1403000.024\srtsp64.sys 2013-02-27 07:35:35 493656 —-a-w- C:\Windows\System32\drivers\N360x64\1403000.024\symds64.sys 2013-02-27 07:35:35 432800 —-a-w- C:\Windows\System32\drivers\N360x64\1403000.024\symnets.sys 2013-02-27 07:35:35 36952 —-a-w- C:\Windows\System32\drivers\N360x64\1403000.024\srtspx64.sys 2013-02-27 07:35:35 23448 —-a-r- C:\Windows\System32\drivers\N360x64\1403000.024\symelam.sys 2013-02-27 07:35:35 1139800 —-a-w- C:\Windows\System32\drivers\N360x64\1403000.024\symefa64.sys 2013-02-27 07:35:34 224416 —-a-w- C:\Windows\System32\drivers\N360x64\1403000.024\ironx64.sys 2013-02-27 07:35:34 168096 —-a-w- C:\Windows\System32\drivers\N360x64\1403000.024\ccsetx64.sys 2013-02-27 07:35:18 ——– d—–w- C:\Windows\System32\drivers\N360x64\1403000.024 2013-02-22 15:31:06 ——– d—–w- C:\ProgramData\Amazon 2013-02-22 15:30:47 ——– d—–w- C:\Program Files (x86)\Amazon 2013-02-13 09:03:02 996352 ——w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll 2013-02-13 09:03:02 768000 ——w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll 2013-02-13 08:40:20 5553512 ——w- C:\Windows\System32\ntoskrnl.exe 2013-02-13 08:40:20 3967848 ——w- C:\Windows\SysWow64\ntkrnlpa.exe 2013-02-13 08:40:19 3913064 ——w- C:\Windows\SysWow64\ntoskrnl.exe 2013-02-13 08:40:11 3153408 ——w- C:\Windows\System32\win32k.sys 2013-02-13 08:40:10 215040 ——w- C:\Windows\System32\winsrv.dll 2013-02-13 08:40:09 7680 ——w- C:\Windows\SysWow64\instnm.exe 2013-02-13 08:40:09 5120 ——w- C:\Windows\SysWow64\wow32.dll 2013-02-13 08:40:09 25600 ——w- C:\Windows\SysWow64\setup16.exe 2013-02-13 08:40:09 2048 ——w- C:\Windows\SysWow64\user.exe 2013-02-13 08:40:09 14336 ——w- C:\Windows\SysWow64\ntvdm64.dll 2013-02-13 08:40:07 1913192 ——w- C:\Windows\System32\drivers\tcpip.sys 2013-02-13 08:40:06 288088 ——w- C:\Windows\System32\drivers\FWPKCLNT.SYS . ==================== Find6M ==================== . 2013-03-12 19:14:34 73432 ——w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-03-12 19:14:34 693976 ——w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-03-11 13:35:56 353576 ——w- C:\Windows\SysWow64\msvcr71.dll 2013-03-11 13:35:56 29480 ——w- C:\Windows\SysWow64\msxml3a.dll 2013-03-11 13:35:55 505128 ——w- C:\Windows\SysWow64\msvcp71.dll 2013-02-18 18:24:37 39768 —-a-w- C:\Windows\System32\drivers\avgtpx64.sys 2013-02-12 05:45:24 135168 ——w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45:22 350208 ——w- C:\Windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45:22 308736 ——w- C:\Windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45:22 111104 ——w- C:\Windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48:31 474112 ——w- C:\Windows\apppatch\AcSpecfc.dll 2013-02-12 04:48:26 2176512 ——w- C:\Windows\apppatch\AcGenral.dll 2013-02-02 06:57:02 2312704 ——w- C:\Windows\System32\jscript9.dll 2013-02-02 06:47:24 1494528 ——w- C:\Windows\System32\inetcpl.cpl 2013-02-02 06:47:19 1392128 ——w- C:\Windows\System32\wininet.dll 2013-02-02 06:42:18 173056 ——w- C:\Windows\System32\ieUnatt.exe 2013-02-02 06:41:51 599040 ——w- C:\Windows\System32\vbscript.dll 2013-02-02 06:38:01 2382848 ——w- C:\Windows\System32\mshtml.tlb 2013-02-02 03:38:35 1800704 ——w- C:\Windows\SysWow64\jscript9.dll 2013-02-02 03:30:32 1427968 ——w- C:\Windows\SysWow64\inetcpl.cpl 2013-02-02 03:30:21 1129472 ——w- C:\Windows\SysWow64\wininet.dll 2013-02-02 03:26:47 142848 ——w- C:\Windows\SysWow64\ieUnatt.exe 2013-02-02 03:26:21 420864 ——w- C:\Windows\SysWow64\vbscript.dll 2013-02-02 03:23:28 2382848 ——w- C:\Windows\SysWow64\mshtml.tlb 2013-01-04 04:43:21 44032 ——w- C:\Windows\apppatch\acwow64.dll 2013-01-02 03:58:58 4729224 ——w- C:\Windows\uninst.exe 2012-12-25 05:52:53 56016 —-a-w- C:\Windows\System32\drivers\fsbts.sys 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\VBAJET32.DLL 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\olepro32.dll 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\expsrv.dll 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\atiuxpag.dll 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\atiumdva.dll 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\atiumdag.dll 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\atiu9pag.dll 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\atidxx32.dll 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\aticfx32.dll 2012-12-24 02:39:15 0 —-a-w- C:\Windows\System32\AsIo.dll 2012-12-19 21:45:12 222720 —-a-w- C:\Windows\System32\clinfo.exe 2012-12-19 21:44:48 76288 —-a-w- C:\Windows\System32\OpenVideo64.dll 2012-12-19 21:44:42 65536 ——w- C:\Windows\SysWow64\OpenVideo.dll 2012-12-19 21:44:36 64000 —-a-w- C:\Windows\System32\OVDecode64.dll 2012-12-19 21:44:32 56320 ——w- C:\Windows\SysWow64\OVDecode.dll 2012-12-19 21:44:20 34518016 —-a-w- C:\Windows\System32\amdocl64.dll 2012-12-19 21:38:48 28732928 ——w- C:\Windows\SysWow64\amdocl.dll 2012-12-19 21:34:40 54784 —-a-w- C:\Windows\System32\OpenCL.dll 2012-12-19 21:34:38 50176 ——w- C:\Windows\SysWow64\OpenCL.dll 2012-12-19 20:50:14 5630200 ——w- C:\Windows\SysWow64\atiumdag.dll 2012-12-19 20:48:48 11278336 —-a-w- C:\Windows\System32\drivers\atikmdag.sys 2012-12-19 20:29:36 23461376 —-a-w- C:\Windows\System32\atio6axx.dll 2012-12-19 20:22:50 70144 —-a-w- C:\Windows\System32\coinst_9.012.dll 2012-12-19 20:19:46 163840 —-a-w- C:\Windows\System32\atiapfxx.exe 2012-12-19 20:18:04 51200 —-a-w- C:\Windows\System32\aticalrt64.dll 2012-12-19 20:18:02 46080 ——w- C:\Windows\SysWow64\aticalrt.dll 2012-12-19 20:17:54 44544 —-a-w- C:\Windows\System32\aticalcl64.dll 2012-12-19 20:17:52 44032 ——w- C:\Windows\SysWow64\aticalcl.dll 2012-12-19 20:17:40 16082944 —-a-w- C:\Windows\System32\aticaldd64.dll 2012-12-19 20:13:24 13703168 ——w- C:\Windows\SysWow64\aticaldd.dll 2012-12-19 20:12:44 18982400 ——w- C:\Windows\SysWow64\atioglxx.dll 2012-12-19 20:09:52 960512 ——w- C:\Windows\SysWow64\aticfx32.dll 2012-12-19 20:08:04 1151488 —-a-w- C:\Windows\System32\aticfx64.dll 2012-12-19 20:06:00 6681088 ——w- C:\Windows\SysWow64\atidxx32.dll 2012-12-19 19:59:44 5087744 —-a-w- C:\Windows\System32\atiumd6a.dll 2012-12-19 19:57:00 442368 —-a-w- C:\Windows\System32\atidemgy.dll 2012-12-19 19:56:46 550912 —-a-w- C:\Windows\System32\atieclxx.exe 2012-12-19 19:56:00 240640 —-a-w- C:\Windows\System32\atiesrxx.exe 2012-12-19 19:54:38 120320 —-a-w- C:\Windows\System32\atitmm64.dll 2012-12-19 19:54:22 21504 —-a-w- C:\Windows\System32\atimuixx.dll 2012-12-19 19:54:18 59392 —-a-w- C:\Windows\System32\atiedu64.dll 2012-12-19 19:54:12 43520 ——w- C:\Windows\SysWow64\ati2edxx.dll 2012-12-19 19:49:00 7370752 —-a-w- C:\Windows\System32\atidxx64.dll 2012-12-19 19:44:28 4162048 ——w- C:\Windows\SysWow64\atiumdva.dll 2012-12-19 19:44:12 6786560 —-a-w- C:\Windows\System32\atiumd64.dll 2012-12-19 19:33:50 56320 —-a-w- C:\Windows\System32\atimpc64.dll 2012-12-19 19:33:50 56320 —-a-w- C:\Windows\System32\amdpcom64.dll 2012-12-19 19:33:42 619008 —-a-w- C:\Windows\System32\atiadlxx.dll 2012-12-19 19:33:40 56832 ——w- C:\Windows\SysWow64\atimpc32.dll 2012-12-19 19:33:40 56832 ——w- C:\Windows\SysWow64\amdpcom32.dll 2012-12-19 19:33:32 421888 ——w- C:\Windows\SysWow64\atiadlxy.dll 2012-12-19 19:33:18 17920 —-a-w- C:\Windows\System32\atig6pxx.dll 2012-12-19 19:33:14 14848 —-a-w- C:\Windows\System32\atiglpxx.dll 2012-12-19 19:33:14 14848 ——w- C:\Windows\SysWow64\atiglpxx.dll 2012-12-19 19:33:10 41984 —-a-w- C:\Windows\System32\atig6txx.dll 2012-12-19 19:33:04 33280 ——w- C:\Windows\SysWow64\atigktxx.dll 2012-12-19 19:32:54 552960 —-a-w- C:\Windows\System32\drivers\atikmpag.sys 2012-12-19 19:31:14 130048 —-a-w- C:\Windows\System32\atiuxp64.dll 2012-12-19 19:31:08 109568 ——w- C:\Windows\SysWow64\atiuxpag.dll 2012-12-19 19:31:00 104448 —-a-w- C:\Windows\System32\atiu9p64.dll 2012-12-19 19:30:52 83968 ——w- C:\Windows\SysWow64\atiu9pag.dll 2012-12-19 19:30:16 53248 —-a-w- C:\Windows\System32\drivers\ati2erec.dll 2012-12-16 17:11:22 46080 ——w- C:\Windows\System32\atmlib.dll 2012-12-16 14:45:03 367616 ——w- C:\Windows\System32\atmfd.dll 2012-12-16 14:13:28 295424 ——w- C:\Windows\SysWow64\atmfd.dll 2012-12-16 14:13:20 34304 ——w- C:\Windows\SysWow64\atmlib.dll 2012-12-07 13:20:16 441856 ——w- C:\Windows\System32\Wpc.dll 2012-12-07 13:15:31 2746368 ——w- C:\Windows\System32\gameux.dll 2012-12-07 12:26:17 308736 ——w- C:\Windows\SysWow64\Wpc.dll 2012-12-07 12:20:43 2576384 ——w- C:\Windows\SysWow64\gameux.dll 2012-12-07 11:20:04 30720 ——w- C:\Windows\System32\usk.rs 2012-12-07 11:20:03 43520 ——w- C:\Windows\System32\csrr.rs 2012-12-07 11:20:03 23552 ——w- C:\Windows\System32\oflc.rs . ============= FINISH: 17:40:19.26 ===============

Yes, I had installed AVG. I have tried just about everything. Steve ComboFix 13-03-27.01 - sadair 03/27/2013 11:39:52.1.4 - x64 Running from: e:\dl\Utilities\AntiTrojan\ComboFix.exe AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton 360 *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton 360 *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\SysWow64\d2d1debug1.dll c:\windows\SysWow64\delete.bat c:\windows\SysWow64\SET464F.tmp c:\windows\SysWow64\SET4806.tmp c:\windows\SysWow64\SET56E8.tmp c:\windows\SysWow64\SET5A2C.tmp c:\windows\SysWow64\URTTemp c:\windows\SysWow64\URTTemp\regtlib.exe c:\windows\SysWow64\zip32.dll c:\windows\Windows7 c:\windows\Windows7\AsusSetup.exe c:\windows\Windows7\AsusSetup.ini c:\windows\Windows7\Driver\AsusSetup.exe c:\windows\Windows7\Driver\AsusSetup.ini c:\windows\Windows7\Driver\AsusSetup_32.ini c:\windows\Windows7\Driver\AsusSetup_64.ini c:\windows\Windows7\Driver\Bin\atidcmxx.sys c:\windows\Windows7\Driver\Bin\ATILog.dll c:\windows\Windows7\Driver\Bin\ATIManifestDLMExt.dll c:\windows\Windows7\Driver\Bin\ATISetup.exe c:\windows\Windows7\Driver\Bin\CompressionDLMExt.dll c:\windows\Windows7\Driver\Bin\ControlCenterActions.dll c:\windows\Windows7\Driver\Bin\CRCVerDLMExt.dll c:\windows\Windows7\Driver\Bin\DetectionManager.dll c:\windows\Windows7\Driver\Bin\difxapi.dll c:\windows\Windows7\Driver\Bin\DLMCom.dll c:\windows\Windows7\Driver\Bin\EncryptionDLMExt.dll c:\windows\Windows7\Driver\Bin\InstallManager.dll c:\windows\Windows7\Driver\Bin\InstallManagerApp.exe c:\windows\Windows7\Driver\Bin\InstallManagerApp.exe.manifest c:\windows\Windows7\Driver\Bin\LanguageMgr.dll c:\windows\Windows7\Driver\Bin\mfc80u.dll c:\windows\Windows7\Driver\Bin\Microsoft.VC80.ATL.manifest c:\windows\Windows7\Driver\Bin\Microsoft.VC80.CRT.manifest c:\windows\Windows7\Driver\Bin\Microsoft.VC80.MFC.manifest c:\windows\Windows7\Driver\Bin\Microsoft.VC80.MFCLOC.manifest c:\windows\Windows7\Driver\Bin\Microsoft.VC80.OpenMP.manifest c:\windows\Windows7\Driver\Bin\msvcp80.dll c:\windows\Windows7\Driver\Bin\msvcr80.dll c:\windows\Windows7\Driver\Bin\PackageManager.dll c:\windows\Windows7\Driver\Bin\Setup.exe c:\windows\Windows7\Driver\Bin\Setup.exe.manifest c:\windows\Windows7\Driver\Bin\xerces-c_2_6.dll c:\windows\Windows7\Driver\Bin\zlibwapi.dll c:\windows\Windows7\Driver\Bin64\atdcm64a.sys c:\windows\Windows7\Driver\Bin64\ATILog.dll c:\windows\Windows7\Driver\Bin64\ATIManifestDLMExt.dll c:\windows\Windows7\Driver\Bin64\ATISetup.exe c:\windows\Windows7\Driver\Bin64\CompressionDLMExt.dll c:\windows\Windows7\Driver\Bin64\ControlCenterActions.dll c:\windows\Windows7\Driver\Bin64\CRCVerDLMExt.dll c:\windows\Windows7\Driver\Bin64\DetectionManager.dll c:\windows\Windows7\Driver\Bin64\difxapi.dll c:\windows\Windows7\Driver\Bin64\DLMCom.dll c:\windows\Windows7\Driver\Bin64\EncryptionDLMExt.dll c:\windows\Windows7\Driver\Bin64\InstallManager.dll c:\windows\Windows7\Driver\Bin64\InstallManagerApp.exe c:\windows\Windows7\Driver\Bin64\InstallManagerApp.exe.manifest c:\windows\Windows7\Driver\Bin64\LanguageMgr.dll c:\windows\Windows7\Driver\Bin64\mfc80u.dll c:\windows\Windows7\Driver\Bin64\Microsoft.VC80.ATL.manifest c:\windows\Windows7\Driver\Bin64\Microsoft.VC80.CRT.manifest c:\windows\Windows7\Driver\Bin64\Microsoft.VC80.MFC.manifest c:\windows\Windows7\Driver\Bin64\Microsoft.VC80.MFCLOC.manifest c:\windows\Windows7\Driver\Bin64\Microsoft.VC80.OpenMP.manifest c:\windows\Windows7\Driver\Bin64\msvcp80.dll c:\windows\Windows7\Driver\Bin64\msvcr80.dll c:\windows\Windows7\Driver\Bin64\PackageManager.dll c:\windows\Windows7\Driver\Bin64\Setup.exe c:\windows\Windows7\Driver\Bin64\Setup.exe.manifest c:\windows\Windows7\Driver\Bin64\xerces-c_2_6.dll c:\windows\Windows7\Driver\Bin64\zlibwapi.dll c:\windows\Windows7\Driver\Config\atiicdxx.msi c:\windows\Windows7\Driver\Config\chipset.MSI c:\windows\Windows7\Driver\Config\DLMServer.cfg c:\windows\Windows7\Driver\Config\eulaCHS.txt c:\windows\Windows7\Driver\Config\eulaCHT.txt c:\windows\Windows7\Driver\Config\eulaCSY.txt c:\windows\Windows7\Driver\Config\eulaDAN.txt c:\windows\Windows7\Driver\Config\eulaDEU.txt c:\windows\Windows7\Driver\Config\eulaENU.txt c:\windows\Windows7\Driver\Config\eulaESP.txt c:\windows\Windows7\Driver\Config\eulaFIN.txt c:\windows\Windows7\Driver\Config\eulaFRA.txt c:\windows\Windows7\Driver\Config\eulaGRK.txt c:\windows\Windows7\Driver\Config\eulaHNG.txt c:\windows\Windows7\Driver\Config\eulaITA.txt c:\windows\Windows7\Driver\Config\eulaJPN.txt c:\windows\Windows7\Driver\Config\eulaKOR.txt c:\windows\Windows7\Driver\Config\eulaNLD.txt c:\windows\Windows7\Driver\Config\eulaNOR.txt c:\windows\Windows7\Driver\Config\eulaPLK.txt c:\windows\Windows7\Driver\Config\eulaPTB.txt c:\windows\Windows7\Driver\Config\eulaRSA.txt c:\windows\Windows7\Driver\Config\eulaSVE.txt c:\windows\Windows7\Driver\Config\eulaTHA.txt c:\windows\Windows7\Driver\Config\eulaTRK.txt c:\windows\Windows7\Driver\Config\InstallManager.cfg c:\windows\Windows7\Driver\Config\Language.Dat c:\windows\Windows7\Driver\Config\licenseCHS.txt c:\windows\Windows7\Driver\Config\licenseCHT.txt c:\windows\Windows7\Driver\Config\licenseCSY.txt c:\windows\Windows7\Driver\Config\licenseDAN.txt c:\windows\Windows7\Driver\Config\licenseDEU.txt c:\windows\Windows7\Driver\Config\licenseENU.txt c:\windows\Windows7\Driver\Config\licenseESP.txt c:\windows\Windows7\Driver\Config\licenseFIN.txt c:\windows\Windows7\Driver\Config\licenseFRA.txt c:\windows\Windows7\Driver\Config\licenseGRK.txt c:\windows\Windows7\Driver\Config\licenseHNG.txt c:\windows\Windows7\Driver\Config\licenseITA.txt c:\windows\Windows7\Driver\Config\licenseJPN.txt c:\windows\Windows7\Driver\Config\licenseKOR.txt c:\windows\Windows7\Driver\Config\licenseNLD.txt c:\windows\Windows7\Driver\Config\licenseNOR.txt c:\windows\Windows7\Driver\Config\licensePLK.txt c:\windows\Windows7\Driver\Config\licensePTB.txt c:\windows\Windows7\Driver\Config\licenseSVE.txt c:\windows\Windows7\Driver\Config\licenseTHA.txt c:\windows\Windows7\Driver\Config\licenseTRK.txt c:\windows\Windows7\Driver\Config\MMTableRev0.MSI c:\windows\Windows7\Driver\Config\MMTableRev1.MSI c:\windows\Windows7\Driver\Config\MMTableRev2.MSI c:\windows\Windows7\Driver\Config\Monet.ini c:\windows\Windows7\Driver\Config\MonetCHS.xml c:\windows\Windows7\Driver\Config\MonetCHT.xml c:\windows\Windows7\Driver\Config\MonetCSY.xml c:\windows\Windows7\Driver\Config\MonetDAN.xml c:\windows\Windows7\Driver\Config\MonetDEU.xml c:\windows\Windows7\Driver\Config\MonetENU.xml c:\windows\Windows7\Driver\Config\MonetESP.xml c:\windows\Windows7\Driver\Config\MonetFIN.xml c:\windows\Windows7\Driver\Config\MonetFRA.xml c:\windows\Windows7\Driver\Config\MonetGRK.xml c:\windows\Windows7\Driver\Config\MonetHNG.xml c:\windows\Windows7\Driver\Config\MonetITA.xml c:\windows\Windows7\Driver\Config\MonetJPN.xml c:\windows\Windows7\Driver\Config\MonetKOR.xml c:\windows\Windows7\Driver\Config\MonetNLD.xml c:\windows\Windows7\Driver\Config\MonetNOR.xml c:\windows\Windows7\Driver\Config\MonetPLK.xml c:\windows\Windows7\Driver\Config\MonetPTB.xml c:\windows\Windows7\Driver\Config\MonetRSA.xml c:\windows\Windows7\Driver\Config\MonetSVE.xml c:\windows\Windows7\Driver\Config\MonetTHA.xml c:\windows\Windows7\Driver\Config\MonetTRK.xml c:\windows\Windows7\Driver\Config\OEM.Dat c:\windows\Windows7\Driver\Config\OS.Dat c:\windows\Windows7\Driver\Config\OSMajorMinor.Dat c:\windows\Windows7\Driver\Config\OSServicePacks.Dat c:\windows\Windows7\Driver\Config\PackageSubType.Dat c:\windows\Windows7\Driver\Config\PackageType.Dat c:\windows\Windows7\Driver\Config\Security.Dat c:\windows\Windows7\Driver\Config\Splash.bmp c:\windows\Windows7\Driver\Config\tvtablerev1.MSI c:\windows\Windows7\Driver\Config\TVW_USB_ID.MSI c:\windows\Windows7\Driver\English.ini c:\windows\Windows7\Driver\French.ini c:\windows\Windows7\Driver\German.ini c:\windows\Windows7\Driver\Images\a.jpg c:\windows\Windows7\Driver\Images\b.jpg c:\windows\Windows7\Driver\Images\c.jpg c:\windows\Windows7\Driver\Images\d.jpg c:\windows\Windows7\Driver\Images\e.jpg c:\windows\Windows7\Driver\Images\f.jpg c:\windows\Windows7\Driver\Japanese.ini c:\windows\Windows7\Driver\mfc80u.dll c:\windows\Windows7\Driver\Microsoft.VC80.ATL.manifest c:\windows\Windows7\Driver\Microsoft.VC80.CRT.manifest c:\windows\Windows7\Driver\Microsoft.VC80.MFC.manifest c:\windows\Windows7\Driver\Microsoft.VC80.MFCLOC.manifest c:\windows\Windows7\Driver\Microsoft.VC80.OpenMP.manifest c:\windows\Windows7\Driver\msvcp80.dll c:\windows\Windows7\Driver\msvcr80.dll c:\windows\Windows7\Driver\Packages\Apps\AVIVO\AVIVO.msi c:\windows\Windows7\Driver\Packages\Apps\AVIVO64\AVIVO64.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Branding\Branding.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Implementation\ccc-core-implementation.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-PreInstall\ccc-core-preinstall.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1028.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1029.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1030.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1031.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1032.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1033.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1034.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1035.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1036.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1038.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1040.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1041.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1042.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1043.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1044.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1045.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1046.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1049.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1053.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1054.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\1055.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\2052.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\2070.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\3084.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Core-Static\ccc-core-static.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Graphics-Full-Existing\ccc-graphics-full-existing.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Graphics-Full-New\ccc-graphics-full-new.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Graphics-Light\ccc-graphics-Light.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Graphics-Previews-Common\ccc-graphics-previews-common.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Graphics-Previews-Vista\ccc-graphics-previews-vista.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\cs\1029.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\cs\1033.mst c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\cs\ccc-help-cs.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\da\ccc-help-da.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\de\ccc-help-de.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\el\ccc-help-el.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\en-us\ccc-help-en-US.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\es\ccc-help-es.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\fi\ccc-help-fi.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\fr\ccc-help-fr.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\hu\ccc-help-hu.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\it\ccc-help-it.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\ja\ccc-help-ja.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\ko\ccc-help-ko.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\nl\ccc-help-nl.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\no\ccc-help-no.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\pl\ccc-help-pl.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\pt-BR\ccc-help-pt-BR.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\ru\ccc-help-ru.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\sv\ccc-help-sv.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\th\ccc-help-th.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\tr\ccc-help-tr.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\zh-CHS\ccc-help-chs.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Help\zh-CHT\ccc-help-cht.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\HydraVision-Full\ccc-hv-full.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Localization\All\ccc-all.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\MOM-InstallProxy\ccc-mom-installproxy.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Skins\ccc-skins.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Utility\ccc-utility.msi c:\windows\Windows7\Driver\Packages\Apps\CCC\Utility64\ccc-utility64.msi c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1028.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1029.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1030.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1031.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1032.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1033.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1034.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1035.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1036.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1040.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1041.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1042.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1043.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1044.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1046.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1049.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1053.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1054.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\1055.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\2052.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win32\ATICatalystInstallManager.msi c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1028.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1029.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1030.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1031.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1032.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1033.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1034.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1035.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1036.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1040.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1041.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1042.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1043.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1044.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1046.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1049.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1053.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1054.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\1055.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\2052.mst c:\windows\Windows7\Driver\Packages\Apps\CIM\Win64\ATICatalystInstallManager.msi c:\windows\Windows7\Driver\Packages\Apps\EnableAero\EnableAero.msi c:\windows\Windows7\Driver\Packages\Apps\HydraVision\HydraVision.msi c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vc864.msi c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\Microsoft.VC80.ATL.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\Microsoft.VC80.CRT.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\Microsoft.VC80.DebugCRT.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\Microsoft.VC80.DebugMFC.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\Microsoft.VC80.DebugOpenMP.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\Microsoft.VC80.MFC.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\Microsoft.VC80.MFCLOC.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\Microsoft.VC80.OpenMP.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\policy.8.00.Microsoft.VC80.ATL.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\policy.8.00.Microsoft.VC80.CRT.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\policy.8.00.Microsoft.VC80.DebugCRT.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\policy.8.00.Microsoft.VC80.DebugMFC.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\policy.8.00.Microsoft.VC80.DebugOpenMP.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\policy.8.00.Microsoft.VC80.MFC.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\policy.8.00.Microsoft.VC80.MFCLOC.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\policy.8.00.Microsoft.VC80.OpenMP.cat c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\vcredis1.cab c:\windows\Windows7\Driver\Packages\Apps\VC8RTx64\vcredist_x64\vcredist.msi c:\windows\Windows7\Driver\Packages\Apps\VC8RTx86\vc832.msi c:\windows\Windows7\Driver\Packages\Apps\VC8RTx86\vcredist_x86\vcredis1.cab c:\windows\Windows7\Driver\Packages\Apps\VC8RTx86\vcredist_x86\vcredist.msi c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\atiiseag.ini c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\ati2edxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\ati2erec.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiadlxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atibtmon.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\aticalcl.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\aticaldd.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\aticalrt.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atidemgx.dll c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atidxx32.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atieclxx.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiesrxx.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiicdxx.da_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atikmdag.sy_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atimpc32.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atimuixx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiodcli.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiode.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiogl.xml c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atioglxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atipdlxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atitmmxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiumdag.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiumdva.ca_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\atiumdva.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\B_83386\oemdspif.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\CW_83675.cat c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\CW_83675.inf c:\windows\Windows7\Driver\Packages\Drivers\Display\W7_INF\CW_83675.msi c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\atiiseag.ini c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\ati2edxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\ati2erec.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiadlxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiadlxy.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atibtmon.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\aticalcl.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\aticalcl64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\aticaldd.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\aticaldd64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\aticalrt.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\aticalrt64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atidemgx.dll c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atidxx32.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atidxx64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atieclxx.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiedu64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiesrxx.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiicdxx.da_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atikmdag.sy_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atimpc32.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atimpc64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atimuixx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atio6axx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiodcli.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiode.ex_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiogl.xml c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atioglxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atipdl64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atipdlxx.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atitmm64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiumd64.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiumd6a.ca_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiumd6a.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiumdag.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiumdva.ca_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\atiumdva.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\B_83386\oemdspif.dl_ c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\C7_83675.cat c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\C7_83675.inf c:\windows\Windows7\Driver\Packages\Drivers\Display\W76A_INF\C7_83675.msi c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB-SB\LH\atipcie.cat c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB-SB\LH\ATiPCIE.inf c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB-SB\LH\AtiPcie.sys c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB-SB\LH64A\atipcie.cat c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB-SB\LH64A\ATiPCIE.inf c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB-SB\LH64A\AtiPcie.sys c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB\W7\atipcie.cat c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB\W7\ATiPCIE.inf c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB\W7\ATiPCIE.msi c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB\W7\AtiPcie.sys c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB\W764A\atipcie.cat c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB\W764A\ATiPCIE.inf c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB\W764A\ATiPCIE.msi c:\windows\Windows7\Driver\Packages\Drivers\SBDrv\Filter\NB\W764A\AtiPcie.sys c:\windows\Windows7\Driver\Packages\Drivers\WDM\HDMI\W7\atihdaud.cat c:\windows\Windows7\Driver\Packages\Drivers\WDM\HDMI\W7\AtiHDAud.inf c:\windows\Windows7\Driver\Packages\Drivers\WDM\HDMI\W7\AtiHDAud.msi c:\windows\Windows7\Driver\Packages\Drivers\WDM\HDMI\W7\AtiHdmi.SY_ c:\windows\Windows7\Driver\Packages\Drivers\WDM\HDMI\W764a\atihdaud.cat c:\windows\Windows7\Driver\Packages\Drivers\WDM\HDMI\W764a\AtiHDAud.inf c:\windows\Windows7\Driver\Packages\Drivers\WDM\HDMI\W764a\AtiHDAud.msi c:\windows\Windows7\Driver\Packages\Drivers\WDM\HDMI\W764a\AtiHdmi.SY_ c:\windows\Windows7\Driver\SChinese.ini c:\windows\Windows7\Driver\Setup.exe c:\windows\Windows7\Driver\Setup.exe.manifest c:\windows\Windows7\Driver\TChinese.ini c:\windows\Windows7\wait\AsusSetup.exe c:\windows\Windows7\wait\AsusSetup.ini c:\windows\Windows7\wait\sleep.exe c:\windows\Windows7\wait\wait.bat H:\Autorun.inf H:\Setup.exe . . ((((((((((((((((((((((((( Files Created from 2013-02-27 to 2013-03-27 ))))))))))))))))))))))))))))))) . . 2013-03-27 16:56 . 2013-03-27 16:56 ——– d—–w- c:\users\nnickerson\AppData\Local\temp 2013-03-27 16:56 . 2013-03-27 16:56 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-03-27 16:56 . 2013-03-27 16:56 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2013-03-25 23:50 . 2013-02-12 04:12 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys 2013-03-25 01:25 . 2013-03-25 01:25 ——– d—–w- c:\program files (x86)\FileASSASSIN 2013-03-24 23:03 . 2013-03-25 01:06 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2013-03-24 23:03 . 2012-12-14 21:49 24176 —-a-w- c:\windows\system32\drivers\mbam.sys 2013-03-12 20:10 . 2013-03-12 20:10 ——– d—–w- c:\users\sadair\AppData\Roaming\Amazon 2013-03-09 04:53 . 2013-03-09 04:53 ——– d—–w- c:\users\Administrator\AppData\Local\AMD 2013-02-27 07:35 . 2013-03-14 08:25 ——– d—–w- c:\windows\system32\drivers\N360x64\1403000.024 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-14 08:05 . 2012-01-22 14:31 72013344 —-a-w- c:\windows\system32\MRT.exe 2013-03-14 04:35 . 2012-10-29 04:31 737072 ——w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll 2013-03-14 04:34 . 2012-10-29 04:30 2876528 ——w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2013-03-14 04:34 . 2012-10-29 04:30 42776 ——w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2013-03-14 04:34 . 2012-10-31 16:54 539984 ——w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2013-03-12 19:14 . 2012-04-22 21:26 693976 ——w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-12 19:14 . 2012-01-25 20:18 73432 ——w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-03-11 13:35 . 2012-12-21 00:07 353576 ——w- c:\windows\SysWow64\msvcr71.dll 2013-03-11 13:35 . 2012-03-05 00:08 29480 ——w- c:\windows\SysWow64\msxml3a.dll 2013-03-11 13:35 . 2012-12-21 00:07 505128 ——w- c:\windows\SysWow64\msvcp71.dll 2013-02-25 04:17 . 2012-09-23 17:46 737072 ——w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2013-02-25 04:17 . 2012-09-23 17:46 2876528 ——w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2013-02-25 04:16 . 2012-09-23 17:45 42776 ——w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2013-02-18 18:24 . 2012-09-18 02:12 39768 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2013-02-12 05:45 . 2013-03-13 18:40 135168 ——w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-13 18:40 350208 ——w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45 . 2013-03-13 18:40 308736 ——w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-13 18:40 111104 ——w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48 . 2013-03-13 18:40 474112 ——w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-13 18:40 2176512 ——w- c:\windows\apppatch\AcGenral.dll 2013-02-11 16:18 . 2012-09-23 17:45 539984 ——w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2013-01-05 05:53 . 2013-02-13 08:40 5553512 ——w- c:\windows\system32\ntoskrnl.exe 2013-01-05 05:00 . 2013-02-13 08:40 3967848 ——w- c:\windows\SysWow64\ntkrnlpa.exe 2013-01-05 05:00 . 2013-02-13 08:40 3913064 ——w- c:\windows\SysWow64\ntoskrnl.exe 2013-01-04 05:46 . 2013-02-13 08:40 215040 ——w- c:\windows\system32\winsrv.dll 2013-01-04 04:51 . 2013-02-13 08:40 5120 ——w- c:\windows\SysWow64\wow32.dll 2013-01-04 04:43 . 2013-02-13 08:40 44032 ——w- c:\windows\apppatch\acwow64.dll 2013-01-04 03:26 . 2013-02-13 08:40 3153408 ——w- c:\windows\system32\win32k.sys 2013-01-04 02:47 . 2013-02-13 08:40 25600 ——w- c:\windows\SysWow64\setup16.exe 2013-01-04 02:47 . 2013-02-13 08:40 7680 ——w- c:\windows\SysWow64\instnm.exe 2013-01-04 02:47 . 2013-02-13 08:40 2048 ——w- c:\windows\SysWow64\user.exe 2013-01-04 02:47 . 2013-02-13 08:40 14336 ——w- c:\windows\SysWow64\ntvdm64.dll 2013-01-03 06:00 . 2013-02-13 08:40 1913192 ——w- c:\windows\system32\drivers\tcpip.sys 2013-01-03 06:00 . 2013-02-13 08:40 288088 ——w- c:\windows\system32\drivers\FWPKCLNT.SYS 2013-01-02 03:58 . 2013-01-02 03:59 4729224 ——w- c:\windows\uninst.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2013-02-18 18:24 1929392 ——w- c:\program files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll" [2013-02-18 1929392] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-04-22 2363392] "AuviBridge"="c:\program files (x86)\RC_Bridge\RC_Bridge.exe" [2011-04-25 352256] "RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-11-03 109336] "MFP and Storage Server"="c:\program files (x86)\TP-LINK\MFP and Storage Server\MFP and Storage Server.exe" [2011-01-10 2039808] "Akamai NetSession Interface"="c:\users\sadair\AppData\Local\Akamai\netsession_win.exe" [2013-01-26 4480768] "HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-12-06 393216] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "TurboV"="c:\program files (x86)\ASUS\TurboV\TurboV.exe" [2009-05-25 5391872] "HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-05-18 2157056] "Ai Nap"="c:\program files (x86)\ASUS\AI Suite\Q-Button\QButton.exe" [2009-06-02 1968640] "QFan Help"="c:\program files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe" [2009-04-30 598528] "Cpu Level Up help"="c:\program files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-12-01 881152] "InstantBurn"="c:\progra~2\CYBERL~1\INSTAN~1\Win2K\IBurn.exe" [2010-04-20 697640] "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720] "RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2010-08-03 87336] "BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-12-24 75048] "UpdatePPShortCut"="c:\program files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504] "UpdatePSTShortCut"="c:\program files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2010-05-28 222504] "Incoming Transfer Lite"="c:\windows\SysWOW64\ictnotel.exe" [2012-01-23 49920] "eKiosk Status Lite"="c:\windows\SysWOW64\aimiksl.exe" [2012-07-08 19312] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2013-02-18 1151152] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2012-12-21 295072] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808] . c:\users\sadair\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ No-IP DUC.lnk - c:\program files (x86)\No-IP\DUC30.exe [2010-6-18 1423520] Remote Control.lnk - c:\program files (x86)\KWorld MultiMedia\RC Utility\KWRCtl.exe [2012-12-5 252928] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Amazon Unbox.lnk - c:\program files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe [2011-11-23 97384] NovaBACKUP Tray Control.lnk - c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\nsCtrl.exe [2012-12-8 361616] TMMonitor.lnk - c:\program files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe [2012-12-5 264768] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-04-09 57472] R2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-04-02 90112] R2 CLKMSVC10_9EC60124;CyberLink Product - 2013/03/11 08:38;c:\program files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [2010-11-23 240112] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-07-09 123856] R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344] R2 NoIPDUCService3;No-IP DUC Service;c:\program files (x86)\No-IP\DUC30.exe [2010-06-18 1423520] R3 AuviUADFilter;Microtune USB Audio Filter Driver;c:\windows\system32\DRIVERS\AuviUADFilter64.sys [2010-01-30 31448] R3 AuviUATV;AuviUATV NTSC Capture Device;c:\windows\system32\DRIVERS\AuviUATV64.sys [2010-01-30 2024792] R3 AuviUDTV;AuviUDTV ATSC Capture Device;c:\windows\system32\DRIVERS\AuviUDTV64.sys [2010-01-30 2018008] R3 Backup Client Agent Service;Backup Client Agent Service;c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\ManagementServer.Agent.Service.exe [2012-12-08 387440] R3 cpuz134;cpuz134;c:\users\sadair\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x] R3 DRHARD;DRHARD;c:\windows\system32\DRIVERS\DRHARD.SYS [x] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] R3 EST_BusEnum;Network USB Device Bus;c:\windows\system32\DRIVERS\GenBus.sys [2009-10-06 29696] R3 EST_Server;Network USB Device;c:\windows\system32\DRIVERS\GenHC.sys [2009-10-06 199168] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176] R3 PortalServer16;Sybase PowerDesigner Portal Server 16;e:\program files (x86)\Sybase\PowerDesigner Portal 16\Tomcat\bin\tomcat6.exe [2011-07-25 74240] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456] R3 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-09-23 431464] R3 Te.Service;Te.Service;c:\program files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [2012-07-26 126976] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-22 1255736] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-22 61976] R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys [2011-09-23 311144] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2012-08-10 56336] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1403000.024\SYMDS64.SYS [2013-01-22 493656] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1403000.024\SYMEFA64.SYS [2013-01-31 1139800] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2013-02-18 39768] S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\BASHDefs\20130301.001\BHDrvx64.sys [2013-01-16 1388120] S1 ccSet_N360;Norton 360 Settings Manager;c:\windows\system32\drivers\N360x64\1403000.024\ccSetx64.sys [2012-11-16 168096] S1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\DRIVERS\CLBStor.sys [2010-04-20 24560] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\IPSDefs\20130326.001\IDSvia64.sys [2012-11-15 513184] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1403000.024\Ironx64.SYS [2012-11-16 224416] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1403000.024\SYMNETS.SYS [2013-01-31 432800] S2 AIMI eBOOK Lite Backup;AIMI eBOOK Lite Backup;c:\windows\SysWOW64\aimibackupl.exe [2012-04-20 19456] S2 AIMI eBOOK Lite Net Service;AIMI eBOOK Lite Net Service;c:\windows\SysWOW64\aiminetl.exe [2012-07-07 43008] S2 AIMI eBook Lite Service Watch;AIMI eBook Lite Service Watch;c:\windows\SysWOW64\aimiwatchl.exe [2011-09-22 6656] S2 AIMI eBOOK Lite Service;AIMI eBOOK Lite Service;c:\windows\SysWOW64\aimiservicel.exe [2012-01-26 20480] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 240640] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-12-19 361984] S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-04-09 57472] S2 CLBUDF;CyberLink InstantBurn UDF Filesystem; [x] S2 CXIR;Conexant Polaris IR Transceiver;c:\windows\system32\drivers\cxcir64.sys [2010-07-13 44032] S2 Disaster Recovery Imaging;Disaster Recovery Imaging;c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\DR\x64\drdiag.exe [2012-10-23 6141952] S2 DRHARD64;DRHARD64;c:\windows\system32\drivers\DRHARD64.sys [2008-08-06 22216] S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe [2012-12-24 144520] S2 nsService;NovaStor NovaBACKUP Backup/Copy Engine;c:\program files (x86)\NovaStor\NovaStor NovaBACKUP\nsService.exe [2012-12-08 518288] S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2012-11-30 38608] S2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2011-08-03 645048] S2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [2013-02-18 968880] S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-11-06 96256] S3 CXPOLARIS;Conexant Polaris Video Capture;c:\windows\system32\drivers\cxpolar64.sys [2010-07-22 428288] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-09-13 138912] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-05-08 1196032] . . — Other Services/Drivers In Memory — . *Deregistered* - CLKMDRV10_9EC60124 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-04-22 19:09 451872 ——w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-03-13 23:54 1629648 ——w- c:\program files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-03-27 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-22 19:14] . 2013-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-13 02:34] . 2013-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-13 02:34] . 2013-03-27 c:\windows\Tasks\ReclaimerUpdateFiles_sadair.job - c:\users\sadair\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe [2013-03-21 00:48] . 2013-03-27 c:\windows\Tasks\ReclaimerUpdateXML_sadair.job - c:\users\sadair\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe [2013-03-21 00:48] . 2013-03-27 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_sadair.job - c:\users\sadair\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe [2013-03-21 00:48] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-04 1580368] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: Show RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html Trusted Zone: cleverreach.com\novastor Trusted Zone: google-analytics.com Trusted Zone: novastor.com TCP: Interfaces\{BA643584-2629-4A59-8DFA-B551F4A2F424}: NameServer = 8.8.8.8,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.15 4.71.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll DPF: {CC679CB8-DC4B-458B-B817-D447B3B6AC31} - hxxps://199.120.249.116/CACHE/stc/1/binaries/vpnweb.cab . . ——- File Associations ——- . JSEFile=%SystemRoot%\SysWow64\CScript.exe "%1" %* . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-BlazeServoTool - c:\program files (x86)\BlazeVideo\BlazeDTV 6.0\MediaDetector.exe Wow6432Node-HKLM-Run-ArcSoft Connection Service - c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe AddRemove-Belarc Advisor - c:\progra~2\Belarc\Advisor\Uninstall.exe AddRemove-RealPlayer 16.0 - c:\program files (x86)\real\realplayer\Update\r1puninst.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360] "ImagePath"="\"c:\program files (x86)\Norton 360\Engine\20.3.0.36\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\20.3.0.36\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*] "Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d, bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-03-27 12:37:07 ComboFix-quarantined-files.txt 2013-03-27 17:36 . Pre-Run: 17,274,028,032 bytes free Post-Run: 16,857,149,440 bytes free . - - End Of File - - BF00D2AA7FC0B9EB37032A85DBB2D6C5