VirTool:Win32/Obfuscator.XZ, HackTool:Win32/Keygen, Spyware.Zbot [Sol

Symptoms include; system freezing sometimes when I boot, I see the desktop and some taskbar notification icons then the system freezes.
Songs being added to Windows Media Player playlist, Windows media playlist stating that I have 949 items and 167,849,324 hours of music,
Unrecognized users listed in many file and folder properties security tab,
when I click Start and use search, it only lists programs or control panel items and the "see more results" link is missing,
system was not recognizing when digital camera was connected but made system sound when disconnected (this was fixed by uninstalling portable devices in device manager and then checking computer for hardware changes.
I tried to fix myself (like a fool would.) Please forgive my ignorance
MBaM Quarantined and deleted successfully Spyware.Zbot
Microsoft Security Scanner found VirTool:Win32/Obfuscator.XZ and did nothing and also found HackTool:Win32/Keygen and partially removed .I found manual removal instructions for VirTool:Win32/Obfuscator.XZ, but the registry items that I was to delete were not present. I did deleted the files were MSS said the malware was located. Lastest MSS scan revealed nothing.
I accept that I most likely messed my system up bad by not seeking help immediately. If I must do a factory recovery, so be it, but I am hoping to save the files I have on my old hard drive which I installed as a second hard drive after I got my computer.
OLT.txt
OTL logfile created on: 4/24/2013 10:20:51 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Cry Havoc\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

11.78 Gb Total Physical Memory | 9.40 Gb Available Physical Memory | 79.82% Memory free
17.78 Gb Paging File | 15.11 Gb Available in Paging File | 84.98% Paging File free
Paging file location(s): C:\pagefile.sys 6142 6142E:\pagef [Binary data over 200 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 913.88 Gb Total Space | 432.94 Gb Free Space | 47.37% Space Free | Partition Type: NTFS
Drive D: | 17.35 Gb Total Space | 1.26 Gb Free Space | 7.29% Space Free | Partition Type: NTFS
Drive E: | 100.00 Mb Total Space | 31.84 Mb Free Space | 31.84% Space Free | Partition Type: NTFS
Drive F: | 454.76 Gb Total Space | 5.92 Gb Free Space | 1.30% Space Free | Partition Type: NTFS
Drive G: | 10.90 Gb Total Space | 0.79 Gb Free Space | 7.20% Space Free | Partition Type: NTFS

Computer Name: CRYHAVOC | User Name: Cry Havoc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Cry Havoc\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\EVGA Precision X\EVGAPrecision.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe (Uniblue Systems Ltd)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)
PRC - C:\Windows\SysWOW64\WinMsgBalloonClient.exe (AMD)
PRC - C:\Windows\SysWOW64\WinMsgBalloonServer.exe (AMD)
PRC - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)
PRC - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe (AMD)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Ipswitch\WS_FTP 12\WsftpCOMHelper.exe (Ipswitch)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe ()
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\EVGA Precision X\EVGAPrecision.exe ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTHAL.dll ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTCore.dll ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTUI.dll ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTMUI.dll ()
MOD - C:\Program Files (x86)\EVGA Precision X\RTFC.dll ()
MOD - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\wincfi39.dll ()
MOD - C:\Program Files (x86)\Ipswitch\WS_FTP 12\res0409.dll ()
MOD - C:\Program Files (x86)\Ipswitch\WS_FTP 12\libeay32.dll ()
MOD - C:\Program Files (x86)\Ipswitch\WS_FTP 12\ssleay32.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe ()


========== Services (SafeList) ==========

SRV:64bit: - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
SRV:64bit: - (STacSV) – C:\Program Files\IDT\WDM\stacsv64.exe (IDT, Inc.)
SRV:64bit: - (HPClientSvc) – C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (CISVC) – C:\Windows\SysNative\CISVC.EXE (Microsoft Corporation)
SRV:64bit: - (AESTFilters) – C:\Program Files\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (VideoAcceleratorService) – C:\Program Files (x86)\SpeedBit Video Accelerator\VideoAcceleratorService.exe (SpeedBit Ltd.)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (RealNetworks Downloader Resolver Service) – C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe (Symantec Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (CalendarSynchService) – C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe (Hewlett-Packard)
SRV - (pdfcDispatcher) – C:\Program Files (x86)\PDF Complete\pdfsvc.exe (PDF Complete Inc)
SRV - (AMD_RAIDXpert) – C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)
SRV - (CLKMSVC10_38F51D56) – C:\Program Files (x86)\Cyberlink\PowerDVD10\NavFilter\kmsvc.exe (CyberLink)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (NOBU) – C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\drivers\NISx64\1403010.016\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\NISx64\1403010.016\SymEFA64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\NISx64\1403010.016\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\NISx64\1403010.016\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\NISx64\1403010.016\SymDS64.sys (Symantec Corporation)
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (netr28x) – C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\NISx64\1403010.016\Ironx64.sys (Symantec Corporation)
DRV:64bit: - (ccSet_NIS) – C:\Windows\SysNative\drivers\NISx64\1403010.016\ccSetx64.sys (Symantec Corporation)
DRV:64bit: - (sptd) – C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (CpqDfw) – C:\Windows\SysNative\drivers\cpqdfw.sys (Windows ® Codename Longhorn DDK provider)
DRV:64bit: - (STHDA) – C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (tixhci) – C:\Windows\SysNative\drivers\tixhci.sys (Texas Instruments Incorporated)
DRV:64bit: - (tihub3) – C:\Windows\SysNative\drivers\tihub3.sys (Texas Instruments Incorporated)
DRV:64bit: - (usbfilter) – C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (ahcix64s) – C:\Windows\SysNative\drivers\ahcix64s.sys (Advanced Micro Devices, Inc)
DRV:64bit: - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (dc3d) – C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20130423.021\ex64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\VirusDefs\20130423.021\eng64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20130423.001\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20130412.001\BHDrvx64.sys (Symantec Corporation)
DRV - (RTCore64) – C:\Program Files (x86)\EVGA Precision X\RTCore64.sys ()
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{84A71B6F-DEBF-4205-A9A6-A70A831D2948}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPDTDF
IE:64bit: - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{84A71B6F-DEBF-4205-A9A6-A70A831D2948}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPDTDF
IE - HKLM\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.onthestart.com/auto2.asp?pageid=6078
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.onthestart.com/auto2.asp?pageid=6078
IE - HKCU\..\URLSearchHook: {b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{84A71B6F-DEBF-4205-A9A6-A70A831D2948}: "URL" = http://www.amazon.com/s/ref=azs_osd_iea?ie…s={searchTerms}
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = http://search.yahoo.com/search?p={searchTe…amp;type=HPDTDF
IE - HKCU\..\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}: "URL" = http://en.wikipedia.org/wiki/Special:Searc…h={searchTerms}
IE - HKCU\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/711-30572-11…w={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Ixquick HTTPS"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.onthestart.com/auto2.asp?pageid=6078"
FF - prefs.js..extensions.enabledAddons: %7B902D2C4A-457A-4EF9-AD43-7014562929FF%7D:0.4.6
FF - prefs.js..extensions.enabledAddons: %7B197573FA-9BF9-11DF-9D68-A441DFD72085%7D:1.2.0
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: %7Be968fc70-8f95-4ab9-9e79-304de2a71ee1%7D:0.7.3
FF - prefs.js..extensions.enabledAddons: personas%40christopher.beard:1.7.2
FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:[removed]%20-%204
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.1.18: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.1.18: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2013/04/14 18:08:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{DAC3F861-B30D-40dd-9166-F4E75327FAC7}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/03/18 12:04:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/03/18 12:04:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013/03/23 13:10:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFFPlgn\ [2013/04/15 22:48:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn\ [2013/04/24 09:37:36 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/14 18:32:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/04/14 18:08:42 | 000,000,000 | —D | M]

[2012/03/09 17:30:37 | 000,000,000 | —D | M] (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Extensions
[2013/04/22 08:29:18 | 000,000,000 | —D | M] (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions
[2013/02/23 11:52:44 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/11/22 10:32:55 | 000,183,536 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\[removed]
[2012/11/22 10:33:15 | 000,085,537 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\[removed]
[2013/01/19 11:57:20 | 000,363,736 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\[removed]
[2013/04/22 08:19:13 | 000,340,614 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\[removed]
[2012/11/22 10:31:52 | 000,021,681 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{197573FA-9BF9-11DF-9D68-A441DFD72085}.xpi
[2012/11/22 10:31:00 | 000,008,640 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{902D2C4A-457A-4EF9-AD43-7014562929FF}.xpi
[2013/02/13 23:08:07 | 000,817,280 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/14 10:44:29 | 000,042,336 | —- | M] () (No name found) – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi
[2012/11/20 23:32:40 | 000,002,066 | —- | M] () – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\searchplugins\dogpile.xml
[2013/04/24 08:56:10 | 000,001,635 | —- | M] () – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\searchplugins\ixquick-https.xml
[2012/11/20 23:38:43 | 000,002,152 | —- | M] () – C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\searchplugins\startpage.xml
[2013/04/14 18:32:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/03/23 13:10:23 | 000,000,000 | —D | M] (No name found) – C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2013/04/15 22:48:59 | 000,000,000 | —D | M] (Norton Vulnerability Protection) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFFPLGN
[2013/04/10 02:58:33 | 000,263,064 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013/03/18 12:02:55 | 000,124,504 | —- | M] (RealPlayer) – C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll
[2013/04/10 02:57:54 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013/04/10 02:57:54 | 000,002,086 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/04/24 09:46:42 | 000,447,287 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.123fporn.info
O1 - Hosts: 15357 more lines…
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [BeatsOSDApp] C:\Program Files\IDT\WDM\beats64.exe (Hewlett-Packard )
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKCU..\Run: [Device Detection] C:\Program Files (x86)\FUJIFILM\MyFinePix Studio\dd.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 157
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionAction = http://hp.digitalriver.com/DRHM/store?Acti…amp;keywords=%w
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionName = Find Software on HP Download Store (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll (SPEEDbit)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A906977C-CC5A-4A07-B0DD-CE4CE9B5084D}: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BF6CC7F2-6D0F-4034-B242-0EB922660AEC}: DhcpNameServer = 192.168.1.1 192.168.33.1
O18:64bit: - Protocol\Handler\belarc - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{7120f145-6a25-11e1-9de2-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{7120f145-6a25-11e1-9de2-806e6f6e6963}\Shell\AutoRun\command - "" = H:\SETUP.EXE
O33 - MountPoints2\{ea6855c0-0341-11e2-870e-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ea6855c0-0341-11e2-870e-806e6f6e6963}\Shell\AutoRun\command - "" = N:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWow64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/04/24 10:14:02 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Cry Havoc\Desktop\OTL.exe
[2013/04/24 09:27:49 | 000,311,200 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\javaws.exe
[2013/04/24 09:27:43 | 000,188,832 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\javaw.exe
[2013/04/24 09:27:43 | 000,188,320 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\java.exe
[2013/04/24 09:27:43 | 000,108,448 | —- | C] (Oracle Corporation) – C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013/04/24 09:26:57 | 000,000,000 | —D | C] – C:\Program Files\Java
[2013/04/24 09:24:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/04/24 09:24:15 | 000,263,584 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/04/24 09:24:03 | 000,174,496 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/04/24 09:24:03 | 000,174,496 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/04/24 09:24:03 | 000,095,648 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/04/24 09:23:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2013/04/21 17:10:26 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\Nero_AG
[2013/04/21 16:32:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FUJIFILM
[2013/04/21 16:32:06 | 000,000,000 | —D | C] – C:\ProgramData\FUJIFILM
[2013/04/21 16:31:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\FUJIFILM
[2013/04/21 14:21:48 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
[2013/04/21 14:21:47 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Uniblue
[2013/04/21 14:21:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2013/04/21 13:19:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FinePixViewer S
[2013/04/21 10:54:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\InstallShield
[2013/04/21 07:42:55 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\InstallShield
[2013/04/19 11:28:54 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\{A719C78C-2BBD-446E-8BE2-793250B8EEDE}
[2013/04/19 10:48:48 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2013/04/19 10:48:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2013/04/16 09:33:39 | 000,000,000 | —D | C] – C:\ProgramData\Stardock
[2013/04/16 09:33:39 | 000,000,000 | —D | C] – C:\ProgramData\Ironclad Games
[2013/04/15 23:44:43 | 000,487,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msvcp70.dll
[2013/04/15 23:44:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\AML Products
[2013/04/15 23:31:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Symantec Shared
[2013/04/15 22:47:08 | 000,177,312 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2013/04/15 22:46:06 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
[2013/04/15 22:46:06 | 000,000,000 | —D | C] – C:\Program Files (x86)\Norton Internet Security
[2013/04/15 22:39:48 | 000,000,000 | —D | C] – C:\ProgramData\PCSettings
[2013/04/14 19:58:51 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\Zeromus Browser
[2013/04/14 19:58:42 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zeromus Browser
[2013/04/14 19:58:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\Zeromus Browser
[2013/04/14 19:30:54 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/04/14 19:30:53 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/04/14 19:30:53 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013/04/14 19:30:53 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013/04/14 19:30:52 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013/04/14 19:30:52 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013/04/14 19:30:52 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013/04/14 19:30:51 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/04/14 19:30:51 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013/04/14 19:30:51 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013/04/14 19:30:51 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/04/14 19:30:51 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/04/14 19:30:49 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/04/14 19:30:49 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/04/14 19:30:48 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/04/14 19:29:12 | 003,717,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mstscax.dll
[2013/04/14 19:29:12 | 003,217,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2013/04/14 19:29:12 | 000,158,720 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\aaclient.dll
[2013/04/14 19:29:12 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\aaclient.dll
[2013/04/14 19:29:12 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tsgqec.dll
[2013/04/14 19:29:05 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tsgqec.dll
[2013/04/14 19:27:20 | 005,550,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2013/04/14 19:27:19 | 003,968,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2013/04/14 19:27:19 | 003,913,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2013/04/14 19:27:19 | 000,112,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\smss.exe
[2013/04/14 19:27:19 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\csrsrv.dll
[2013/04/14 19:27:18 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\apisetschema.dll
[2013/04/14 18:53:45 | 026,956,576 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvoglv64.dll
[2013/04/14 18:53:45 | 020,542,752 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvoglv32.dll
[2013/04/14 18:53:45 | 013,088,000 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvwgf2um.dll
[2013/04/14 18:53:45 | 007,573,816 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvopencl.dll
[2013/04/14 18:53:45 | 006,271,872 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvopencl.dll
[2013/04/14 18:53:45 | 001,807,136 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispco6431422.dll
[2013/04/14 18:53:45 | 001,510,176 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvdispgenco6431422.dll
[2013/04/14 18:53:45 | 000,968,408 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvumdshim.dll
[2013/04/14 18:53:45 | 000,250,504 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvinitx.dll
[2013/04/14 18:53:45 | 000,205,184 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvinit.dll
[2013/04/14 18:53:43 | 025,256,736 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcompiler.dll
[2013/04/14 18:53:43 | 017,560,352 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcompiler.dll
[2013/04/14 18:53:43 | 009,414,456 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuda.dll
[2013/04/14 18:53:43 | 007,959,000 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuda.dll
[2013/04/14 18:53:43 | 002,913,056 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvid.dll
[2013/04/14 18:53:43 | 002,728,736 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvid.dll
[2013/04/14 18:53:43 | 002,539,128 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvapi.dll
[2013/04/14 18:53:43 | 002,355,488 | —- | C] (NVIDIA Corporation) – C:\Windows\SysNative\nvcuvenc.dll
[2013/04/14 18:53:43 | 001,995,552 | —- | C] (NVIDIA Corporation) – C:\Windows\SysWow64\nvcuvenc.dll
[2013/04/11 17:48:56 | 000,000,000 | —D | C] – C:\ProgramData\NVIDIA Corporation
[2013/04/11 16:31:56 | 000,000,000 | -HSD | C] – C:\ProgramData\SecuROM
[2013/04/11 15:27:22 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\{CBCB3BA5-4E1C-4B76-9C50-9DADEBF80899}
[2013/04/09 19:49:22 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\{7029A524-789D-4055-A618-ED49AB5FB62F}
[2013/04/08 11:28:01 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\{F46FD271-CEF8-43C8-A629-C6DBE01F1E98}
[2013/04/06 19:11:06 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\{558ED9A3-FDF5-4A47-9447-CAA72045BD98}
[2013/04/05 14:24:16 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\Documents\Bioshock
[2013/04/05 14:24:16 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Bioshock
[2013/04/05 14:24:12 | 000,000,000 | RH-D | C] – C:\Users\Cry Havoc\AppData\Roaming\SecuROM
[2013/04/02 18:45:19 | 000,000,000 | —D | C] – C:\ProgramData\RELOADED
[2013/04/02 18:14:38 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\Documents\Bioshock2
[2013/04/02 18:14:38 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Bioshock2
[2013/04/01 20:34:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cyberlink PowerDVD
[2013/04/01 08:24:14 | 000,000,000 | R–D | C] – C:\Users\Cry Havoc\Desktop\stamp stuff
[2013/03/31 19:39:59 | 000,000,000 | —D | C] – C:\ProgramData\VirtualizedApplications
[2013/03/31 12:21:03 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Local\SoftGrid Client
[2013/03/31 12:21:01 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\SoftGrid Client
[2013/03/31 12:19:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2013/03/31 12:19:23 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\TP
[2013/03/29 12:32:36 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\BOXEE
[2013/03/27 09:43:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ipswitch WS_FTP 12
[2013/03/27 09:43:45 | 000,000,000 | —D | C] – C:\Users\Cry Havoc\AppData\Roaming\Ipswitch
[2013/03/27 09:43:26 | 000,000,000 | —D | C] – C:\ProgramData\Ipswitch
[2013/03/27 09:43:25 | 000,000,000 | —D | C] – C:\Program Files\Ipswitch
[2013/03/27 09:43:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\Ipswitch
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/04/24 10:20:46 | 000,024,608 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/04/24 10:20:46 | 000,024,608 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/04/24 10:14:07 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Cry Havoc\Desktop\OTL.exe
[2013/04/24 09:56:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/04/24 09:52:34 | 000,016,308 | —- | M] () – C:\Users\Cry Havoc\AppData\Roaming\wklnhst.dat
[2013/04/24 09:46:42 | 000,447,287 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/04/24 09:39:18 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/04/24 09:38:19 | 000,000,344 | —- | M] () – C:\Windows\tasks\spmonitor.job
[2013/04/24 09:37:00 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/04/24 09:36:47 | 896,708,606 | -HS- | M] () – C:\hiberfil.sys
[2013/04/24 09:31:27 | 001,882,595 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1403010.016\Cat.DB
[2013/04/24 09:27:07 | 000,108,448 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013/04/24 09:27:03 | 001,092,512 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\npDeployJava1.dll
[2013/04/24 09:27:03 | 000,971,680 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\deployJava1.dll
[2013/04/24 09:27:03 | 000,311,200 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\javaws.exe
[2013/04/24 09:27:03 | 000,188,832 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\javaw.exe
[2013/04/24 09:27:03 | 000,188,320 | —- | M] (Oracle Corporation) – C:\Windows\SysNative\java.exe
[2013/04/24 09:23:19 | 000,095,648 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/04/24 09:23:18 | 000,263,584 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/04/24 09:23:18 | 000,174,496 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/04/24 09:23:18 | 000,174,496 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/04/24 09:23:17 | 000,866,720 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npdeployJava1.dll
[2013/04/24 09:23:17 | 000,788,896 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2013/04/23 20:19:03 | 000,000,348 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForCry Havoc.job
[2013/04/23 10:11:19 | 000,160,168 | —- | M] () – C:\Users\Cry Havoc\Desktop\speedupmypc-quickstart-en.pdf
[2013/04/21 16:32:12 | 000,001,184 | —- | M] () – C:\Users\Public\Desktop\MyFinePix Studio.lnk
[2013/04/21 14:21:52 | 000,001,176 | —- | M] () – C:\Users\Cry Havoc\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk
[2013/04/21 14:21:52 | 000,001,128 | —- | M] () – C:\Users\Public\Desktop\SpeedUpMyPC.lnk
[2013/04/20 14:49:17 | 000,447,228 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130424-094642.backup
[2013/04/20 08:59:08 | 000,002,052 | —- | M] () – C:\Windows\epplauncher.mif
[2013/04/19 20:24:39 | 000,814,728 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/04/19 20:24:39 | 000,684,378 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/04/19 20:24:39 | 000,131,024 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/04/19 10:48:48 | 000,002,955 | —- | M] () – C:\Users\Cry Havoc\Desktop\HiJackThis.lnk
[2013/04/18 17:34:28 | 000,000,989 | —- | M] () – C:\Users\Cry Havoc\Application Data\Microsoft\Internet Explorer\Quick Launch\BitTorrent.lnk
[2013/04/17 06:22:06 | 000,447,228 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130420-144917.backup
[2013/04/15 22:47:08 | 000,177,312 | —- | M] (Symantec Corporation) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2013/04/15 22:47:08 | 000,007,466 | —- | M] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2013/04/15 22:47:08 | 000,000,855 | —- | M] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2013/04/15 22:08:09 | 000,014,818 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1403010.016\VT20130115.021
[2013/04/14 19:37:09 | 000,420,216 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/14 19:17:09 | 000,446,676 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130417-062206.backup
[2013/04/14 18:36:04 | 000,691,592 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/04/14 18:36:04 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/04/14 18:13:54 | 000,000,632 | RHS- | M] () – C:\Users\Cry Havoc\ntuser.pol
[2013/04/03 04:18:54 | 000,000,172 | —- | M] () – C:\Windows\SysNative\drivers\NISx64\1403010.016\isolate.ini
[2013/04/01 20:29:10 | 000,029,480 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msxml3a.dll
[2013/03/31 12:19:58 | 000,831,822 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2013/03/27 09:16:01 | 000,446,308 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.20130414-191708.backup
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/23 10:11:18 | 000,160,168 | —- | C] () – C:\Users\Cry Havoc\Desktop\speedupmypc-quickstart-en.pdf
[2013/04/21 16:32:12 | 000,001,184 | —- | C] () – C:\Users\Public\Desktop\MyFinePix Studio.lnk
[2013/04/21 14:21:55 | 000,000,344 | —- | C] () – C:\Windows\tasks\spmonitor.job
[2013/04/21 14:21:52 | 000,001,128 | —- | C] () – C:\Users\Public\Desktop\SpeedUpMyPC.lnk
[2013/04/21 14:21:51 | 000,001,176 | —- | C] () – C:\Users\Cry Havoc\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedUpMyPC.lnk
[2013/04/20 08:59:08 | 000,002,052 | —- | C] () – C:\Windows\epplauncher.mif
[2013/04/19 10:48:48 | 000,002,955 | —- | C] () – C:\Users\Cry Havoc\Desktop\HiJackThis.lnk
[2013/04/18 17:34:28 | 000,000,989 | —- | C] () – C:\Users\Cry Havoc\Application Data\Microsoft\Internet Explorer\Quick Launch\BitTorrent.lnk
[2013/04/15 22:47:08 | 000,007,466 | —- | C] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2013/04/15 22:47:08 | 000,000,855 | —- | C] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/12/22 11:53:18 | 000,010,752 | —- | C] () – C:\Users\Cry Havoc\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/19 21:47:27 | 000,079,872 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2012/06/06 16:57:01 | 000,007,599 | —- | C] () – C:\Users\Cry Havoc\AppData\Local\resmon.resmoncfg
[2012/04/14 16:25:00 | 000,000,116 | —- | C] () – C:\Windows\NeroDigital.ini
[2012/03/10 16:01:33 | 000,000,632 | RHS- | C] () – C:\Users\Cry Havoc\ntuser.pol
[2012/03/10 00:11:29 | 000,016,308 | —- | C] () – C:\Users\Cry Havoc\AppData\Roaming\wklnhst.dat
[2012/03/09 23:21:47 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2012/02/29 17:16:59 | 000,023,040 | —- | C] () – C:\Windows\SysWow64\BeepApp.exe
[2011/10/12 19:33:22 | 000,007,736 | —- | C] () – C:\Windows\hpDSTRES.DLL
[2011/09/28 18:44:14 | 000,179,271 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 01:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 00:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 21:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 23:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 21:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013/04/14 18:08:29 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Bioshock
[2013/04/14 18:08:49 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Bioshock2
[2013/04/18 20:49:31 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\BitTorrent
[2013/03/29 12:32:36 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\BOXEE
[2012/05/17 21:28:53 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.
1
[2013/03/18 08:52:16 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\DAEMON Tools Lite
[2013/04/21 16:04:21 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\FUJIFILM
[2013/04/14 18:08:49 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\IrfanView
[2013/03/18 18:03:35 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Nullsoft
[2012/03/29 12:53:40 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\OpenOffice.org
[2012/08/19 14:25:53 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Opera
[2013/03/14 10:14:25 | 000,000,000 | -H-D | M] – C:\Users\Cry Havoc\AppData\Roaming\RPPrivate
[2012/07/15 10:44:33 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\SanDisk
[2013/04/01 12:09:45 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\SoftGrid Client
[2012/03/10 11:13:56 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\SystemRequirementsLab
[2013/03/31 12:21:22 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\TP
[2013/02/03 22:35:02 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\TuneUp Software
[2013/04/22 18:41:08 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\Uniblue
[2013/04/14 18:08:49 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\WebApp
[2012/03/11 18:15:48 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\WinBatch
[2012/11/11 13:37:53 | 000,000,000 | —D | M] – C:\Users\Cry Havoc\AppData\Roaming\ZinioReader4

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2010/11/21 03:06:30 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/10 16:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2012/02/29 16:58:46 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2012/02/29 16:58:46 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2012/02/29 16:58:46 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2012/02/29 16:58:46 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 23:24:25 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2012/02/29 16:58:46 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2012/02/29 16:58:46 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 23:24:11 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2010/11/21 03:06:17 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\en-US\explorer.exe.mui
[2010/11/21 03:06:17 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2010/11/21 03:06:19 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2010/11/21 03:06:19 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui

< MD5 for: EXPLORER.EXE-A80E4F97.PF >
[2013/04/23 18:35:32 | 000,159,128 | —- | M] () MD5=EA7E1FD1E4B2E27516EEDA684C1D4582 – C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf

< MD5 for: IEXPLORE.EXE >
[2012/06/02 07:47:54 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=004640AB259C1572EBD5FB0A32F63686 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_0dbfc836999db0ca\iexplore.exe
[2013/01/08 21:53:45 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=0100BCF23941C83462E4A70F94C3392E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16464_none_0d2c5bc980874648\iexplore.exe
[2012/05/17 19:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_1798a687b4d6030f\iexplore.exe
[2012/11/13 22:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_178ed6e5b4dd3857\iexplore.exe
[2012/06/29 01:02:52 | 000,754,784 | —- | M] (Microsoft Corporation) MD5=1223ACBFC1093852DFF039E189599BBD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_0d45fcc9807373c2\iexplore.exe
[2012/08/24 03:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_1787d4dfb4e386f6\iexplore.exe
[2012/05/17 18:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_181271f4ce004017\iexplore.exe
[2012/10/08 04:37:24 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=270A1342BD5AF95CA25A586B4C2F1522 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_178cd651b4df05a9\iexplore.exe
[2013/03/16 11:53:02 | 000,770,560 | —- | M] (Microsoft Corporation) MD5=2859EBC065D2E1CCC94161CE28BAC085 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16521_none_20e4a040529a2792\iexplore.exe
[2013/02/24 20:58:09 | 000,775,232 | —- | M] (Microsoft Corporation) MD5=28F93BAFB3EB407E99A7ED3D9DBDE04C – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20644_none_ffb93ba237e760ce\iexplore.exe
[2012/08/24 07:23:44 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=2D53C5F71653EF94E7829846405D4ED2 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_0d332a8d8082c4fb\iexplore.exe
[2012/06/02 05:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_1799a6d1b4d51c66\iexplore.exe
[2012/10/08 08:29:46 | 000,754,848 | —- | M] (Microsoft Corporation) MD5=49442BA6DCE4B4E3C1CB0AB193FE29AD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_0d382bff807e43ae\iexplore.exe
[2012/09/07 17:04:42 | 000,218,696 | —- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2012/05/17 22:51:05 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=4E99F42504A99D5024C2EFA015001937 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_0d43fc3580754114\iexplore.exe
[2012/08/24 06:49:07 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=5A150AFABB25BEA50CEDC8650A7B8A9E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_0dc3c95e999a1626\iexplore.exe
[2012/06/28 22:45:31 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=5D03518409F37D1483C98869D86E23FF – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_0dc0c880999cca21\iexplore.exe
[2012/06/02 08:52:21 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=610F6596921C4BAA8834ADBB9BE272EE – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_0d44fc7f80745a6b\iexplore.exe
[2012/08/24 03:49:25 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=62188720CE27B982B4285C03163C9FB3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_181873b0cdfad821\iexplore.exe
[2013/02/21 08:59:57 | 000,775,216 | —- | M] (Microsoft Corporation) MD5=6554208814632C25C77EE02355EB8E95 – C:\Program Files\Internet Explorer\iexplore.exe
[2013/02/21 08:59:57 | 000,775,216 | —- | M] (Microsoft Corporation) MD5=6554208814632C25C77EE02355EB8E95 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16540_none_16920d4a1e377ea4\iexplore.exe
[2013/03/16 11:53:00 | 000,775,184 | —- | M] (Microsoft Corporation) MD5=681B380492ACB571ED6CCC1F37F53343 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16521_none_168ff5ee1e396597\iexplore.exe
[2013/01/08 18:42:06 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=698EB1E5F8C66344D97C00B5699E871D – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16464_none_1781061bb4e80843\iexplore.exe
[2013/02/02 04:09:12 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=7C2923004FFC497E54F38E835F108EE8 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20580_none_0d9c579499b8b898\iexplore.exe
[2010/11/20 23:24:43 | 000,695,056 | —- | M] (Microsoft Corporation) MD5=86257731DDB311FBC283534CC0091634 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe
[2012/02/29 16:55:05 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_17a944edb4ca4c7a\iexplore.exe
[2012/06/28 21:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_179aa71bb4d435bd\iexplore.exe
[2013/02/24 19:52:40 | 000,770,624 | —- | M] (Microsoft Corporation) MD5=A11C5E3E288256C540B7ED8BE3A04B01 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.20644_none_0a0de5f46c4822c9\iexplore.exe
[2013/02/02 00:19:03 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=A285E1965C115031DA02B777EE9D7689 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20580_none_17f101e6ce197a93\iexplore.exe
[2013/02/02 03:37:58 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=A8EBEBCD9F5C49475194099FCD276992 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16470_none_0d1d8ab58092fcdd\iexplore.exe
[2012/11/15 23:08:58 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=AC4957E154F750DF54F36ADC8E3E040D – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_0db6f8de99a3ff69\iexplore.exe
[2012/06/02 04:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_18147288cdfe72c5\iexplore.exe
[2010/11/20 23:25:08 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[2012/10/08 04:22:05 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=CECB15F834FC2B4B150449717ADE18DD – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_1808a252ce07755f\iexplore.exe
[2013/02/02 00:19:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=DDE5A0DFAF7C6370FB36402D7A746ED3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16470_none_17723507b4f3bed8\iexplore.exe
[2013/02/21 07:28:11 | 000,770,608 | —- | M] (Microsoft Corporation) MD5=E4F6125ED5185F8FA37CC4F449B85526 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2013/02/21 07:28:11 | 000,770,608 | —- | M] (Microsoft Corporation) MD5=E4F6125ED5185F8FA37CC4F449B85526 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.2.9200.16540_none_20e6b79c5298409f\iexplore.exe
[2012/06/28 19:35:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=EB4105348272018D096FEB655CD1608C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_181572d2cdfd8c1c\iexplore.exe
[2013/01/08 20:51:57 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=EF1F6F41FB2C9BBB484B21017F380201 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20573_none_0daa285e99ade8ac\iexplore.exe
[2013/01/08 17:32:42 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F05982E56ABD835AA8DF260EEC873E5B – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20573_none_17fed2b0ce0eaaa7\iexplore.exe
[2012/02/29 16:55:05 | 000,754,480 | —- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_0d549a9b80698a7f\iexplore.exe
[2012/10/08 07:09:10 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=F61714ABCF9BF0CEF0A6249AD4FD490B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_0db3f80099a6b364\iexplore.exe
[2012/11/13 22:19:28 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F691418EE9A6344AEB5C1B0518FBF8AE – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_180ba330ce04c164\iexplore.exe
[2012/05/17 21:37:57 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=F8B2D47ED17C1D087D14EC747E5AC57A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_0dbdc7a2999f7e1c\iexplore.exe
[2012/11/14 03:11:18 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=FD0D2E1FAEBAE5031BE2EB8000D973F1 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_0d3a2c93807c765c\iexplore.exe

< MD5 for: IEXPLORE.EXE.CFG >
[2008/10/09 20:14:56 | 000,000,029 | —- | M] () MD5=14C57B5BD3C8168436AAC8858DCF0FCE – C:\Program Files (x86)\EVGA Precision X\Bundle\OSDServer\ProfileTemplates\IExplore.exe.cfg

< MD5 for: IEXPLORE.EXE.MUI >
[2012/02/29 16:55:05 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_07013012b816cb66\iexplore.exe.mui
[2012/02/29 16:55:05 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_1155da64ec778d61\iexplore.exe.mui
[2013/03/16 11:53:03 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=8EDDC50FD07326E7DF9C4EEA422F0918 – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2013/03/16 11:53:00 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=8EDDC50FD07326E7DF9C4EEA422F0918 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2013/03/16 11:53:00 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=8EDDC50FD07326E7DF9C4EEA422F0918 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.2.9200.16521_en-us_103c8b6555e6a67e\iexplore.exe.mui
[2013/03/16 11:53:03 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=8EDDC50FD07326E7DF9C4EEA422F0918 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.2.9200.16521_en-us_1a9135b78a476879\iexplore.exe.mui
[2009/07/13 22:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_0b433e7773148b79\iexplore.exe.mui
[2009/07/13 22:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_1597e8c9a7754d74\iexplore.exe.mui

< MD5 for: SERVICES >
[2009/06/10 17:00:26 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210\services

< MD5 for: SERVICES.CFG >
[2012/09/23 21:43:36 | 000,603,848 | R— | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\services.cfg
[2012/12/18 15:08:30 | 000,559,043 | —- | M] () MD5=BA25E8F1460C7453B7488FE4B42F6919 – C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Services\Services.cfg

< MD5 for: SERVICES.EXE >
[2009/07/13 21:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/13 21:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2010/11/21 03:06:16 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\SysNative\en-US\services.exe.mui
[2010/11/21 03:06:16 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5f238be3fa63468\services.exe.mui

< MD5 for: SERVICES.LNK >
[2009/07/14 00:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/14 00:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2009/06/10 16:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2009/06/10 16:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.mof

< MD5 for: SERVICES.MSC >
[2010/11/21 03:06:14 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\en-US\services.msc
[2009/06/10 16:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\services.msc
[2010/11/21 03:06:17 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\en-US\services.msc
[2009/06/10 17:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\services.msc
[2010/11/21 03:06:14 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_003408aa160fce5b\services.msc
[2009/06/10 16:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_2b58d44b5f6beb8a\services.msc
[2010/11/21 03:06:17 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/10 17:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

< MD5 for: SERVICES.PTXML >
[2009/07/13 16:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2009/07/13 16:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\Services.ptxml

< MD5 for: SERVICES.RDB >
[2011/01/17 19:52:22 | 000,237,568 | —- | M] () MD5=507957679AE4579C15D57FA741EA6FFA – C:\Program Files (x86)\OpenOffice.org 3\URE\misc\services.rdb
[2011/01/17 19:51:48 | 005,539,328 | —- | M] () MD5=F2B666905F7FDAA80C86A101A7DE62F9 – C:\Program Files (x86)\OpenOffice.org 3\Basis\program\services.rdb

< MD5 for: SERVICES.SBS >
[2011/03/01 09:58:44 | 000,034,818 | —- | M] () MD5=62AFD4B2025CE6D4706B36F4C4808F9B – C:\Program Files (x86)\Spybot - Search & Destroy\Includes\Services.sbs

< MD5 for: WINLOGON.ADML >
[2010/11/21 03:06:30 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/10 17:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2010/11/20 23:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 23:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2012/09/07 17:04:42 | 000,218,696 | —- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE – C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2010/11/21 03:06:14 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2010/11/21 03:06:14 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_291e96fa1ab5fc7b\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2010/11/21 03:06:15 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2010/11/21 03:06:15 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/13 16:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2009/07/13 16:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof

< %SYSTEMDRIVE%\*.* >
[2013/04/22 12:00:11 | 000,001,402 | —- | M] () – C:\AdwCleaner[R10].txt
[2013/04/22 18:41:44 | 000,001,161 | —- | M] () – C:\AdwCleaner[R11].txt
[2013/04/12 10:15:27 | 000,001,730 | —- | M] () – C:\AdwCleaner[S3].txt
[2013/04/14 12:22:11 | 000,001,696 | —- | M] () – C:\AdwCleaner[S4].txt
[2010/11/20 23:23:51 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2011/02/11 13:00:42 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2013/04/24 09:36:47 | 896,708,606 | -HS- | M] () – C:\hiberfil.sys
[2012/02/29 16:45:07 | 000,000,000 | RHS- | M] () – C:\OS
[2013/04/24 09:36:52 | 2145,386,495 | -HS- | M] () – C:\pagefile.sys
[2013/04/08 07:43:00 | 000,140,230 | —- | M] () – C:\TDSSKiller.2.8.16.0_08.04.2013_07.41.22_log.txt
[2013/04/08 10:56:08 | 000,005,618 | —- | M] () – C:\TDSSKiller.2.8.16.0_08.04.2013_10.55.46_log.txt
[2013/04/12 15:00:29 | 000,005,618 | —- | M] () – C:\TDSSKiller.2.8.16.0_12.04.2013_14.59.44_log.txt
[2013/04/12 15:10:33 | 001,110,714 | —- | M] () – C:\TDSSKiller.2.8.16.0_12.04.2013_15.04.54_log.txt
[2013/03/21 09:44:57 | 000,139,932 | —- | M] () – C:\TDSSKiller.2.8.16.0_21.03.2013_09.43.26_log.txt
[2013/04/22 12:02:24 | 000,140,012 | —- | M] () – C:\TDSSKiller.2.8.16.0_22.04.2013_12.01.40_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/03/08 18:37:20 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/03/10 00:26:17 | 000,000,221 | -HS- | M] () – C:\Users\Cry Havoc\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2013/04/24 10:14:07 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Cry Havoc\Desktop\OTL.exe
[2010/10/18 21:28:23 | 2765,178,025 | —- | M] () – C:\Users\Cry Havoc\Desktop\Requiem-MomentoMori-20100319-1538.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:5C321E34

< End of report >
Extras.txt
OTL Extras logfile created on: 4/24/2013 10:20:51 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Cry Havoc\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

11.78 Gb Total Physical Memory | 9.40 Gb Available Physical Memory | 79.82% Memory free
17.78 Gb Paging File | 15.11 Gb Available in Paging File | 84.98% Paging File free
Paging file location(s): C:\pagefile.sys 6142 6142E:\pagef [Binary data over 200 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 913.88 Gb Total Space | 432.94 Gb Free Space | 47.37% Space Free | Partition Type: NTFS
Drive D: | 17.35 Gb Total Space | 1.26 Gb Free Space | 7.29% Space Free | Partition Type: NTFS
Drive E: | 100.00 Mb Total Space | 31.84 Mb Free Space | 31.84% Space Free | Partition Type: NTFS
Drive F: | 454.76 Gb Total Space | 5.92 Gb Free Space | 1.30% Space Free | Partition Type: NTFS
Drive G: | 10.90 Gb Total Space | 0.79 Gb Free Space | 7.20% Space Free | Partition Type: NTFS

Computer Name: CRYHAVOC | User Name: Cry Havoc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – C:\Program Files\Hewlett-Packard\HP Application Assistant\HPAA.exe %1 (Hewlett Packard Company)
Directory [Browse with &IrfanView] – "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [FinePix] – "C:\Program Files (x86)\FinePixViewer\FinePixViewer.exe" "%1" (FUJIFILM Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – C:\Program Files\Hewlett-Packard\HP Application Assistant\HPAA.exe %1 (Hewlett Packard Company)
Directory [Browse with &IrfanView] – "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [FinePix] – "C:\Program Files (x86)\FinePixViewer\FinePixViewer.exe" "%1" (FUJIFILM Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02A1E570-52D4-41E2-86E3-A6CD99EEF4E9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{06F6CA13-8A1B-4C00-AFAF-68638CB7388A}" = lport=445 | protocol=6 | dir=in | app=system |
"{1A46B381-D8C1-4EB2-9982-F1695B1ABB36}" = rport=445 | protocol=6 | dir=out | app=system |
"{23A250BB-5341-4638-8840-EBCE4DBB8FAA}" = lport=138 | protocol=17 | dir=in | app=system |
"{29B50B80-8545-4986-8AB8-F8E257C732C9}" = rport=138 | protocol=17 | dir=out | app=system |
"{2EABC0A6-04ED-451B-B2E4-0B3BECF4319E}" = lport=10243 | protocol=6 | dir=in | app=system |
"{32E69D79-5431-43EB-98FE-F79725604CAC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{33A1D1AA-005C-44CC-B1E3-5D8991119731}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{59460A3F-62AF-4731-993C-6574FD5836D5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5A32534F-8F5B-4B30-A05A-0DAA96E02CEE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{647B3A2F-D356-42C1-83E5-84A1CE310A54}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{769803D1-C1B8-4AA6-9AD5-BC241C1349B0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{7B2F3347-8C3A-4FFF-BC8D-A569B67AE951}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{855A9BBE-F38F-4166-A817-C93271152F48}" = lport=137 | protocol=17 | dir=in | app=system |
"{88C8A538-6A01-4EF2-A0D9-0FC9BAB25B7B}" = rport=137 | protocol=17 | dir=out | app=system |
"{B3285455-7F0F-4710-89A2-0485D7C14B80}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{C0146463-CC94-4D08-9A30-57F4C0328CB3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C915DF0C-864E-45CF-A624-F83414D1E2DA}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CE98B34F-447B-402B-A3CC-38AAC5E15B66}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D008252D-8EBE-4914-89E5-8AC1E0A3DB0C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{D9C06BEF-801A-4C14-A0E0-16707D4C5B8F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EDFCC532-971E-4B1F-B877-C8F0E549CB8A}" = lport=139 | protocol=6 | dir=in | app=system |
"{EE82995C-315B-4FD3-9039-26A67E0F9C1F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F68F034B-30B5-499C-AEC2-C6C4327588E0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F84FA013-F3B6-48B1-8D41-2FBDB8EB9C17}" = rport=139 | protocol=6 | dir=out | app=system |
"{FA67C7E1-B2A7-444B-8676-55D100F83DB5}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0569BDB9-5624-44E2-AC93-78B19BC9829D}" = protocol=6 | dir=in | app=c:\program files (x86)\nero\nero 12\nero backitup\backitup.exe |
"{100BB3A6-5CFC-4826-AE95-FDA87CEA0EF5}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{12494FD4-FA60-4671-ABCB-8422BEC7BD81}" = protocol=6 | dir=in | app=c:\program files (x86)\nero\nero blu-ray player\blu-rayplayer.exe |
"{1A82EDA7-F671-4523-A446-EEE85F2260E7}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{24CA8E6A-D096-44AC-81E8-F30B41F07A18}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{34BDDC73-C517-41C9-8AE0-366DBDFE871A}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{3734516E-3823-419D-B53D-EFB49FE03A9F}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe |
"{3D7C55D3-13AC-4D23-A5E0-684BECA99CEC}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{451326E4-7D0D-40FF-A924-096D0F0A22F8}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd cinema\powerdvdcinema10.exe |
"{4DE00F8C-F5D9-4C07-898A-258F0566E681}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5E544DD8-B7AB-4A95-B719-213F5C11FEB9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{5E9B2345-68BE-4EB4-8026-8FE08F69E139}" = protocol=17 | dir=in | app=c:\program files (x86)\nero\km\kwikmedia.exe |
"{60B81D8F-BD02-4271-AB3D-9B1BFD3E9908}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{60D786D1-EB8F-4CC3-8902-6DA010F259BA}" = protocol=6 | dir=out | app=system |
"{6B658E56-5727-4C2B-91FF-E7A59B41E0B4}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{7B4B90EE-43E6-474D-8CCC-075E8931F748}" = protocol=17 | dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\roxionow\indivdrm.exe |
"{7B50E364-CFA4-4870-BC94-60C8AD6EDD66}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{83D3886C-2A88-4924-8121-2D30BA9A61BB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{84BC45EC-5BC2-47A8-915D-2160EDA7E03B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{972BB01E-F294-44C6-9227-C24D52215677}" = protocol=17 | dir=in | app=c:\program files (x86)\hewlett-packard\hp support framework\resources\hppsdr\hpdiagnosticcoreui.exe |
"{9FBEC696-1287-4302-A7D5-BC3A71A86E85}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{A0860445-C65B-49FE-AF1C-6137EA107C18}" = protocol=6 | dir=in | app=c:\program files (x86)\sega\universe at war earth assault\uawea.exe |
"{A51BEBA9-E781-4C38-9992-1676C1EF273F}" = protocol=17 | dir=out | app=c:\program files (x86)\hewlett-packard\hp linkup\hp linkup viewer.exe |
"{AC4051D3-CE2A-410E-8C3E-8AB7604EE318}" = protocol=17 | dir=in | app=c:\program files (x86)\nero\nero blu-ray player\blu-rayplayer.exe |
"{AF75608A-7A66-4B8F-A195-B9F0359C81AA}" = protocol=6 | dir=in | app=c:\program files (x86)\nero\km\kwikmedia.exe |
"{B2729277-9510-41AE-A007-C80B08C534F8}" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{B4A8EA67-9B02-4F35-812F-AEF2A26B128E}" = protocol=6 | dir=in | app=c:\program files (x86)\hewlett-packard\touchsmart\roxionow\indivdrm.exe |
"{B67E9C6A-5F66-4240-8483-A99281666687}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B95FA0A3-F9F2-49FC-8F1C-77220FA2EDB5}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd cinema\powerdvdcinema10.exe |
"{BE0A9E33-1E3E-4556-9BFC-2143D6D55EB4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C4C213A3-BDA6-45EB-B947-F5287E37EDF3}" = protocol=6 | dir=in | app=c:\program files (x86)\hewlett-packard\hp support framework\resources\hppsdr\hpdiagnosticcoreui.exe |
"{CA2F428A-2E23-4653-AF8A-24702068C9EE}" = protocol=17 | dir=in | app=c:\program files (x86)\nero\nero 12\nero backitup\backitup.exe |
"{CB8BCD51-D384-4A10-A56A-D0475C3F4027}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{CD163C12-4F2F-44B9-B0F7-A0F57A99FC65}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{D68CC932-8D01-498F-A6CA-F5BF41BB7108}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E4B5DC9E-7416-44D9-8E86-34E5CE3AC18A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E85CA57C-8ECF-406B-90C2-A98395B76782}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{EA5A1918-7E3A-4691-8832-7B4B48AFD07D}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"{F1B36FB8-FF7A-4D26-A03A-05634ED03262}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F3FF178E-A996-4E67-A161-B0D5DC00FA29}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F5725C12-23EF-4876-AEF6-089B89D3F924}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FA87CD23-8278-4811-A2A1-2FB2DACA6D2E}" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{FB14C34E-90C5-47AC-9F85-C132A71A60F7}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe |
"{FB6AAE85-4F82-4016-8DD4-7905C2792508}" = protocol=17 | dir=in | app=c:\program files (x86)\sega\universe at war earth assault\uawea.exe |
"{FF53B488-0D72-4FE2-B48A-9B357C2A66C9}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417021FF}" = Java 7 Update 21 (64-bit)
"{2856A1C2-70C5-4EC3-AFF7-E5B51E5530A2}" = HP Client Services
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{421976B6-DEC6-4CA5-941F-F0663B3A2B74}" = Adobe Flash Player 11 ActiveX (x64)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver [removed]
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B34A07DD-C6F7-414A-AE63-01019482EAF0}" = HP Application Assistant
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D79A02E9-6713-4335-9668-AAC7474C0C0E}" = HP Vision Hardware Diagnostics
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0EEC4E49-D4C2-4E23-87F2-B5641F1A09E4}" = HP Clock
"{120262A6-7A4B-4889-AE85-F5E5688D3683}" = HP MovieStore
"{16FC3056-90C0-4757-8A68-64D8DA846ADA}" = Remote Graphics Receiver
"{17E3A651-12B9-4149-BAE8-E6FB9A5ADC4F}" = Microsoft Works Suite Add-in for Microsoft Word
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YTD Video Downloader 3.9.2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20714B53-FC73-4F9C-9687-49EB237D6FD7}" = HP TouchSmart RecipeBox
"{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.5.5
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2B38E0FA-D8A5-4EBF-A018-E3C1C8E7A2E2}" = HP Calendar
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3677D4D8-E5E0-49FC-B86E-06541CF00BBE}" = opensource
"{369B36BE-3D64-4641-9AEA-808D436FE134}" = Microsoft Digital Image Pro 7.0
"{3D171340-B528-42E0-92E4-BDA7AEEF6F32}_is1" = Spot
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D090F70-6F08-4B60-9357-A1DFD4458F09}" = Microsoft Mathematics
"{4F38594F-2C4A-4C42-B2C4-505E225F6F80}" = HP Product Detection
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5D95AD35-368F-47D5-B63A-A082DDF00116}" = Microsoft Digital Image Standard 2006 Editor
"{6033673D-2530-4587-8AD0-EB059FC263F9}" = Crysis® 2
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65EB09A3-993B-401E-8936-C9708CBFAB26}" = FinePixViewer YTUPL
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{691F4068-81BF-49E3-B32E-FE3E16400112}" = Microsoft Digital Image Standard 2006 Library
"{6A6F8D36-04BA-41E9-9004-1789BD545874}" = HP TouchSmart Background - Beats
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.2.1.1
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{741006D1-7B2B-4E33-B2B0-831F282EEF64}" = Blio
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{7E750542-55BC-4300-8B7B-AC2A762FB435}" = HP LinkUp
"{7FB00B6B-6843-97EC-EED6-78BD6D35370A}" = Zinio Reader 4
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{858FCB65-7C6D-4BA4-AD80-A3CB3744CE09}_is1" = HP Magic Canvas Tutorials
"{86BAB08A-5E66-4C53-82E3-C1E91673C7CA}" = HP Notes
"{88B32652-CAE0-4909-A463-5840D2689D93}" = FUJIFILM FinePixViewer S Ver.2.0
"{8B76B8E9-F773-4B75-A08C-120079EB765E}" = RAIDXpert
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = 802.11n Wireless LAN Card
"{9008D736-35CA-40DB-A2BE-5F32D954E5AA}" = HP MovieStore
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{912CED74-88D3-4C5B-ACB0-132318649765}" = PressReader
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B92288B-5DC5-74A2-5E76-C4DE4864B76E}" = Warner Bros. Digital Copy Manager
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A35E58D6-2A0F-4051-983B-79342081338E}" = HP RSS
"{A393CDFF-BEB8-48EA-990D-2EB35B311D23}_is1" = Tap Tap Bear
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.02)
"{AD88355B-A4E0-4DA1-BAC3-EA4FEA930691}" = Ipswitch WS_FTP 12
"{AE856388-AFAD-4753-81DF-D96B19D0A17C}" = HP Setup Manager
"{B2B7B1C8-7C8B-476C-BE2C-049731C55992}" = HP Support Information
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B40D7926-AE5F-41EA-8AC6-56C0E2F00E9D}" = HP Keyboard
"{B44529FF-501E-47CD-A06D-223C161BE058}" = FinePixViewer Resource
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0661463-50F7-4A1E-83CB-37CC590589AE}_is1" = Metric Converter
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4658131-9D1A-4395-876D-968E38FE8ED5}" = Universe at War Earth Assault
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DDFDC9D6-4220-41F8-BF9A-8E7512C4EF52}" = HP Magic Canvas
"{DE1AF137-C455-494A-A817-EFE44BCCFDEE}" = Works Upgrade
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = SpeedUpMyPC
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EA1FAE0F-2354-4E32-B423-ABAE8E358F91}" = RealDownloader
"{EE202411-2C26-49E8-9784-1BC1DBF7DE96}" = HP Support Assistant
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}" = HP Setup
"{F89BADB0-D319-470E-8024-443EE3A3402B}" = TSHostedAppLauncher
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"7-Zip" = 7-Zip 9.20
"AC3File_is1" = AC3File 0.7b
"AC3Filter_is1" = AC3Filter 2.5b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"Bass Audio Decoder" = Bass Audio Decoder (remove only)
"Belarc Advisor" = Belarc Advisor 8.2
"BG Rules Editor v1.0.0" = BG Rules Editor v1.0.0
"BitTorrent" = BitTorrent
"CD Audio Reader Filter" = CD Audio Reader Filter (remove only)
"Character Control - Baldur's Gate v1.4.7" = Character Control - Baldur's Gate v1.4.7
"com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.
1" = Warner Bros. Digital Copy Manager
"DAEMON Tools Lite" = DAEMON Tools Lite
"dcmsvc_is1" = dcmsvc 1.0
"DCoder Image Source" = DCoder Image Source (remove only)
"Deus Ex" = Deus Ex
"DirectVobSub" = DirectVobSub (remove only)
"DivX Setup" = DivX Setup
"DScaler 5 Mpeg Decoders_is1" = DScaler 5 Mpeg Decoders
"ffdshow_is1" = ffdshow v1.2.4453 [2012-05-21]
"FFMPEG Core Files" = FFMPEG Core Files (remove only)
"Free FLV Converter_is1" = Free FLV Converter
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}" = RAIDXpert
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{D4658131-9D1A-4395-876D-968E38FE8ED5}" = Universe at War Earth Assault
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"IrfanView" = IrfanView (remove only)
"Kobo" = Kobo
"lavfilters_is1" = LAV Filters 0.51.3
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"MadVR" = MadVR (remove only)
"Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.0.1400
"Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MRU-Blaster_is1" = MRU-Blaster v1.5 (Database 3.28.04)
"My Free Mahjong_is1" = My Free Mahjong v.2.0
"MyFinePix Studio_is1" = FUJIFILM MyFinePix Studio 4.2a
"nanoVoice Beta 2.0" = nanoVoice Beta 2.0
"NBRTWizard" = Norton Bootable Recovery Tool Wizard
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NIS" = Norton Internet Security
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenSource AVI Splitter" = OpenSource AVI Splitter (remove only)
"OpenSource DTS/AC3/DD+ Source Filter" = OpenSource DTS/AC3/DD+ Source Filter (remove only)
"OpenSource Flash Video Splitter" = OpenSource Flash Video Splitter (remove only)
"Opera 12.14.1738" = Opera 12.14
"PDF Complete" = PDF Complete Special Edition
"PictureItPrem_v11" = Microsoft Digital Image Standard 2006
"PrecisionX" = EVGA Precision X 4.1.0
"RealPlayer 16.0" = RealPlayer
"SpeedBit Video Accelerator" = SpeedBit Video Accelerator
"SpywareBlaster_is1" = SpywareBlaster 5.0
"SystemRequirementsLab" = System Requirements Lab
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite" = Windows Live Essentials
"Works2006Setup" = Microsoft Works Suite 2006 Setup Launcher
"WTA-01118bc0-b8ea-4374-af62-fca4d23d8e51" = John Deere Drive Green
"WTA-0c2e0507-c4dd-4dd2-8c2d-1ff3a9f6a6da" = Farmscapes
"WTA-12596e0a-3815-44f9-9afd-ad153a0a7650" = Dora's World Adventure
"WTA-15f78cc1-b991-418a-9701-f83ec9d2964c" = FATE
"WTA-2d35be8d-3b35-4994-baad-ec8463977a2c" = Farm Frenzy
"WTA-3c970f1b-f8d1-4708-a1c0-8572c8766e52" = Luxor HD
"WTA-52573ada-aa70-4d61-9178-c8a68c18feb3" = Polar Bowler
"WTA-5ff3506c-94ef-4efe-b408-8fad21e80555" = RollerCoaster Tycoon 3: Platinum
"WTA-61f6f6da-100b-4f18-a56e-d11c40f33603" = Poker Superstars III
"WTA-6534b8ce-e29d-4617-8047-6ab8b2b77ab3" = Penguins!
"WTA-6bb8eaf4-6b33-4f23-80c2-7478a9931712" = Torchlight
"WTA-797eacff-77ff-451c-bee1-5771757f66f2" = Mah Jong Medley
"WTA-7f05140c-403c-483c-ac54-4924b0d0cf40" = Cradle of Rome 2
"WTA-8125ff9f-c110-44da-a675-8eacebe7182f" = Hoyle Card Games
"WTA-91fe40aa-3029-4d5e-b240-fbd6c870a60d" = Chuzzle Deluxe
"WTA-93c4d5b1-bfb4-40b8-86a5-1cc03dae8815" = Jewel Match 3
"WTA-9e895222-2197-4cd0-9f1f-2628a8f483e0" = Bejeweled 3
"WTA-9fba567b-0e4a-43b0-a145-2f7b8e543e21" = Virtual Villagers 4 - The Tree of Life
"WTA-b5560c94-d7a9-4422-a048-4b1b90e7af17" = Final Drive Fury
"WTA-b6fc47ed-ce0f-43a9-8557-314b7a8be014" = Zuma's Revenge
"WTA-bb290a62-a94a-4346-a2a6-c2152a8ea18d" = Polar Golfer
"WTA-c24b167a-b201-4d78-af89-658e12c6c2d6" = The Treasures of Mystery Island: The Ghost Ship
"WTA-cec83954-3f39-45f2-9bf7-8fcb750358ed" = Letters from Nowhere 2
"WTA-e022ceeb-08d7-4037-af40-b9ab4d696de3" = Blackhawk Striker 2
"WTA-e3c9ddd2-5038-4173-bbd0-6b528533ecf8" = Plants vs. Zombies - Game of the Year
"WTA-f44db412-f254-4bfe-ae5d-db1f2510ee3c" = Jewel Quest Mysteries: The Seventh Gate Collector's Edition
"ZinioReader4" = Zinio Reader 4

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Sansa Updater" = Sansa Updater
"Screencast-O-Matic" = Screencast-O-Matic

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 3/10/2013 6:52:54 PM | Computer Name = CryHavoc | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 19.0.2.4814 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1278 Start
Time: 01ce1dd2ad10b7cb Termination Time: 110 Application Path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Report Id: ebc6f080-89d4-11e2-a80f-50e549d9f42e

Error - 3/11/2013 5:23:10 PM | Computer Name = CryHavoc | Source = Application Error | ID = 1000
Description = Faulting application name: RecordingManager.exe, version: 15.0.6.14,
time stamp: 0x501308ab Faulting module name: ole32.dll, version: 6.1.7601.17514,
time stamp: 0x4ce7b96f Exception code: 0xc0000005 Fault offset: 0x0004ba3d Faulting
process id: 0x108c Faulting application start time: 0x01ce1e93f4502f28 Faulting application
path: c:\program files (x86)\real\realplayer\RecordingManager.exe Faulting module
path: C:\Windows\syswow64\ole32.dll Report Id: df2654c7-8a91-11e2-9e10-50e549d9f42e

Error - 3/11/2013 9:13:19 PM | Computer Name = CryHavoc | Source = Application Error | ID = 1000
Description = Faulting application name: wmplayer.exe, version: 12.0.7601.17514,
time stamp: 0x4ce7a485 Faulting module name: ac3filter.ax_unloaded, version: 0.0.0.0,
time stamp: 0x4fde1df8 Exception code: 0xc0000005 Fault offset: 0x66d5d3a0 Faulting
process id: 0x182c Faulting application start time: 0x01ce1eb7b01a8bf1 Faulting application
path: C:\Program Files (x86)\Windows Media Player\wmplayer.exe Faulting module path:
ac3filter.ax Report Id: 0650b25d-8ab2-11e2-9e10-50e549d9f42e

Error - 3/12/2013 9:35:23 AM | Computer Name = CryHavoc | Source = Application Hang | ID = 1002
Description = The program wmplayer.exe version 12.0.7601.17514 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 368 Start
Time: 01ce1f263aae4d9a Termination Time: 10 Application Path: C:\Program Files (x86)\Windows
Media Player\wmplayer.exe Report Id: adbbc815-8b19-11e2-9ced-a49f1ec9bca9

Error - 3/12/2013 9:35:47 AM | Computer Name = CryHavoc | Source = Application Error | ID = 1000
Description = Faulting application name: wmpnetwk.exe, version: 12.0.7601.17514,
time stamp: 0x4ce7ae7f Faulting module name: KERNELBASE.dll, version: 6.1.7601.18015,
time stamp: 0x50b8479b Exception code: 0x0000046b Fault offset: 0x0000000000009e5d
Faulting
process id: 0xd10 Faulting application start time: 0x01ce1f26448ba2e4 Faulting application
path: C:\Program Files\Windows Media Player\wmpnetwk.exe Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report
Id: bebb9823-8b19-11e2-9ced-a49f1ec9bca9

Error - 3/14/2013 2:10:44 PM | Computer Name = CryHavoc | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 19.0.2.4814 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 132c Start
Time: 01ce20ddf17e4573 Termination Time: 40 Application Path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Report Id:

Error - 3/15/2013 3:48:47 PM | Computer Name = CryHavoc | Source = Application Error | ID = 1000
Description = Faulting application name: v2d.exe, version: 3.3.0.226, time stamp:
0x4d6c6fb2 Faulting module name: v2d.exe, version: 3.3.0.226, time stamp: 0x4d6c6fb2
Exception
code: 0xc0000005 Fault offset: 0x00032d4b Faulting process id: 0x1218 Faulting application
start time: 0x01ce21b57621889c Faulting application path: C:\Program Files (x86)\Free
MKV Video2Dvd\v2d.exe Faulting module path: C:\Program Files (x86)\Free MKV Video2Dvd\v2d.exe
Report
Id: 5969a48d-8da9-11e2-882e-50e549d9f42e

Error - 3/15/2013 3:50:52 PM | Computer Name = CryHavoc | Source = Application Error | ID = 1000
Description = Faulting application name: v2d.exe, version: 3.3.0.226, time stamp:
0x4d6c6fb2 Faulting module name: v2d.exe, version: 3.3.0.226, time stamp: 0x4d6c6fb2
Exception
code: 0xc0000005 Fault offset: 0x00032d4b Faulting process id: 0x1340 Faulting application
start time: 0x01ce21b62277260e Faulting application path: C:\Program Files (x86)\Free
MKV Video2Dvd\v2d.exe Faulting module path: C:\Program Files (x86)\Free MKV Video2Dvd\v2d.exe
Report
Id: a4162f7a-8da9-11e2-882e-50e549d9f42e

Error - 3/15/2013 7:36:02 PM | Computer Name = CryHavoc | Source = Application Error | ID = 1000
Description = Faulting application name: MovieMaker.exe, version: 15.4.3555.308,
time stamp: 0x4f596bb7 Faulting module name: unknown, version: 0.0.0.0, time stamp:
0x00000000 Exception code: 0xc0000005 Fault offset: 0x110ab5ed Faulting process id:
0x174c Faulting application start time: 0x01ce21d5b98fb216 Faulting application path:
C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exe Faulting module
path: unknown Report Id: 1874f318-8dc9-11e2-882e-50e549d9f42e

Error - 3/16/2013 12:03:49 PM | Computer Name = CryHavoc | Source = Application Error | ID = 1000
Description = Faulting application name: SpybotSD.exe, version: 1.6.2.46, time stamp:
0x2a425e19 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception
code: 0xc0000005 Fault offset: 0x71356800 Faulting process id: 0xcc0 Faulting application
start time: 0x01ce225fcb699569 Faulting application path: C:\Program Files (x86)\Spybot
- Search & Destroy\SpybotSD.exe Faulting module path: unknown Report Id: 16517ee5-8e53-11e2-8b13-50e549d9f42e

[ Hewlett-Packard Events ]
Error - 3/25/2012 7:02:41 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 3/25/2012 7:02:41 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262HPSF.exe at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 4/1/2012 6:32:23 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 4/1/2012 6:32:24 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262HPSF.exe at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 5/6/2012 7:19:44 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 5/13/2012 6:51:57 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 5/20/2012 6:52:07 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 30 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 5/27/2012 6:49:32 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 6/3/2012 7:00:24 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

Error - 6/4/2012 3:40:04 PM | Computer Name = CryHavoc-HP | Source = HPSF.exe | ID = 2000
Description = HP Error ID: -2147467262 at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Message: Unable to cast object
of type 'System.DBNull' to type 'System.String'. StackTrace: at HP.SupportAssistant.Common.CustomerExperience.HPSFReporting.SaveSessionInfo(Data
Row
dr, Boolean bOnlyDetected, HPSASession SFSession) Source: HP.SupportAssistant.Common

Name:
HPSF.exe Version: 06.00.01.01 Path: C:\Program Files (x86)\Hewlett-Packard\HP Support
Framework\HPSF.exe Format: en-US RAM: 12062 Ram Utilization: 20 TargetSite: Void SaveSessionInfo(System.Data.DataRow,
Boolean, HP.SupportAssistant.Common.CustomerExperience.HPSASession)

[ System Events ]
Error - 4/24/2013 9:09:31 AM | Computer Name = CryHavoc | Source = Service Control Manager | ID = 7003
Description = The Net.Tcp Listener Adapter service depends the following service:
was. This service might not be installed.

Error - 4/24/2013 9:10:47 AM | Computer Name = CryHavoc | Source = RemoteAccess | ID = 20152
Description = The currently configured authentication provider failed to load and
initialize successfully. The requested name is valid, but no data of the requested
type was found.

Error - 4/24/2013 9:10:49 AM | Computer Name = CryHavoc | Source = Service Control Manager | ID = 7024
Description = The Routing and Remote Access service terminated with service-specific
error %%11004.

Error - 4/24/2013 9:11:51 AM | Computer Name = CryHavoc | Source = Service Control Manager | ID = 7034
Description = The VideoAcceleratorService service terminated unexpectedly. It has
done this 1 time(s).

Error - 4/24/2013 9:37:19 AM | Computer Name = CryHavoc | Source = Service Control Manager | ID = 7003
Description = The Net.Msmq Listener Adapter service depends the following service:
msmq. This service might not be installed.

Error - 4/24/2013 9:37:19 AM | Computer Name = CryHavoc | Source = Service Control Manager | ID = 7003
Description = The Net.Pipe Listener Adapter service depends the following service:
was. This service might not be installed.

Error - 4/24/2013 9:37:19 AM | Computer Name = CryHavoc | Source = Service Control Manager | ID = 7003
Description = The Net.Tcp Listener Adapter service depends the following service:
was. This service might not be installed.

Error - 4/24/2013 9:37:54 AM | Computer Name = CryHavoc | Source = RemoteAccess | ID = 20106
Description = Unable to add the interface {BF6CC7F2-6D0F-4034-B242-0EB922660AEC}
with the Router Manager for the IP protocol. The following error occurred: Cannot
complete this function.

Error - 4/24/2013 9:37:54 AM | Computer Name = CryHavoc | Source = RemoteAccess | ID = 20106
Description = Unable to add the interface {BF6CC7F2-6D0F-4034-B242-0EB922660AEC}
with the Router Manager for the IPV6 protocol. The following error occurred: Cannot
complete this function.

Error - 4/24/2013 9:38:33 AM | Computer Name = CryHavoc | Source = Service Control Manager | ID = 7034
Description = The VideoAcceleratorService service terminated unexpectedly. It has
done this 1 time(s).


< End of report >

Thank you so much for your time Jeff.
DDS does not run right away after double-clicking. An options window opens. I did not change anything. When finished a window opens and tells me to zip the Attach.txt file and attach it to my post, but you did not tell me to do that so I included the contents in my post. There is also an MBR.DAT file that was saved by aswMBR but you did not say to include it. I am so excited and nervous to have help, I hope I did everything right. Thank you again for your help. Here are all of the files you asked for;

DDS.txt
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.21.2
Run by [removed] at 19:17:06 on 2013-04-25
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12063.10091 [GMT -4:00]
.
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
C:\Windows\system32\CISVC.EXE
C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe
C:\Program Files (x86)\EVGA Precision X\EVGAPrecision.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Program Files\IDT\WDM\beats64.exe
C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe
C:\Program Files (x86)\PDF Complete\pdfsvc.exe
C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\UI0Detect.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Windows\System32\vds.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\Windows\SysWOW64\WinMsgBalloonServer.exe
C:\Windows\SysWOW64\WinMsgBalloonClient.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Program Files (x86)\Ipswitch\WS_FTP 12\WsftpCOMHelper.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.onthestart.com/auto2.asp?pageid=6078
uWindow Title = Microsoft Internet Explorer Sucks
uDefault_Page_URL = hxxp://www.onthestart.com/auto2.asp?pageid=6078
uURLSearchHooks: {b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} -
mWinlogon: Userinit = userinit.exe,
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
BHO: DivX Plus Web Player HTML5 : {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\CoIEPlg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\IPS\IPSBHO.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\CoIEPlg.dll
uPolicies-Explorer: NoDriveTypeAutoRun = dword:157
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
LSP: C:\Program Files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
TCP: NameServer = 204.186.110.76 204.186.80.251 216.144.187.199
TCP: Interfaces\{A906977C-CC5A-4A07-B0DD-CE4CE9B5084D} : DHCPNameServer = [removed] [removed] [removed]
TCP: Interfaces\{BF6CC7F2-6D0F-4034-B242-0EB922660AEC} : DHCPNameServer = 192.168.1.1 192.168.33.1
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck -
mASetup: {F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} - msiexec /fu {F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} /qn
x64-BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [BeatsOSDApp] C:\Program Files\IDT\WDM\beats64.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
.
INFO: x64-HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} -
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -
x64-SSODL: WebCheck -
x64-mASetup: {B34A07DD-C6F7-414A-AE63-01019482EAF0} - msiexec /fu {B34A07DD-C6F7-414A-AE63-01019482EAF0} /qn
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\
FF - prefs.js: browser.search.selectedEngine - Ixquick HTTPS
FF - prefs.js: browser.startup.homepage - hxxp://www.onthestart.com/auto2.asp?pageid=6078
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\nprpplugin.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: 2013-04-14 10:44; {e968fc70-8f95-4ab9-9e79-304de2a71ee1}; C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi
.
============= SERVICES / DRIVERS ===============
.
R0 ahcix64s;ahcix64s;C:\Windows\System32\drivers\ahcix64s.sys [2012-2-29 280656]
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1403010.016\SymDS64.sys [2013-4-15 493656]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1403010.016\SymEFA64.sys [2013-4-15 1139800]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-4-12 1390680]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\System32\drivers\NISx64\1403010.016\ccSetx64.sys [2013-4-15 168096]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20130424.001\IDSviA64.sys [2013-4-24 513184]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1403010.016\Ironx64.sys [2013-4-15 224416]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NISx64\1403010.016\symnets.sys [2013-4-15 432800]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-8-11 140672]
R2 AMD_RAIDXpert;AMD RAIDXpert;C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [2011-5-13 128904]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-14 399432]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe [2013-4-15 144520]
R2 pdfcDispatcher;PDF Document Manager;C:\Program Files (x86)\PDF Complete\pdfsvc.exe [2012-2-29 1128952]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-3-6 39056]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2012-3-9 1153368]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-3-14 383264]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-4-15 138912]
R3 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2012-9-27 86528]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-8-31 25928]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\System32\drivers\netr28x.sys [2012-12-6 2350176]
R3 RTCore64;RTCore64;C:\Program Files (x86)\EVGA Precision X\RTCore64.sys [2013-4-5 15176]
R3 tihub3;TI USB3 Hub Service;C:\Windows\System32\drivers\tihub3.sys [2012-2-29 136000]
R3 tixhci;TI XHCI Service;C:\Windows\System32\drivers\tixhci.sys [2012-2-29 409408]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2012-2-29 47232]
S2 CLKMSVC10_38F51D56;CyberLink Product - 2013/04/01 20:34:46;C:\Program Files (x86)\Cyberlink\PowerDVD10\NavFilter\kmsvc.exe [2011-2-24 241648]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-14 676936]
S2 VideoAcceleratorService;VideoAcceleratorService;C:\PROGRA~2\SPEEDB~1\VideoAcceleratorService.exe -start -scm –> C:\PROGRA~2\SPEEDB~1\VideoAcceleratorService.exe -start -scm [?]
S3 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S3 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-4-12 708200]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-3-9 1255736]
S4 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2012-10-5 89600]
S4 CalendarSynchService;CalendarSynchService;C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [2011-8-16 16384]
S4 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=C:\Windows\System32\NOTEPAD.EXE %1 [UserChoice]
ShellExec: pi11.exe: Open="C:\Program Files (x86)\Microsoft Digital Image 2006\pi.exe" "%1"
.
=============== Created Last 30 ================
.
2013-04-24 13:32:43 9317456 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C9E7AE99-C0C3-44F0-B427-0F53D0C276D4}\mpengine.dll
2013-04-24 13:31:56 1656680 —-a-w- C:\Windows\System32\drivers\ntfs.sys
2013-04-24 13:27:43 108448 —-a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2013-04-24 13:24:03 95648 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-21 21:10:26 ——– d—–w- C:\Users\Cry Havoc\AppData\Local\Nero_AG
2013-04-21 20:32:06 ——– d—–w- C:\ProgramData\FUJIFILM
2013-04-21 20:31:57 ——– d—–w- C:\Program Files (x86)\FUJIFILM
2013-04-21 18:21:47 ——– d—–w- C:\Users\Cry Havoc\AppData\Roaming\Uniblue
2013-04-21 14:54:23 32768 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2013-04-21 14:54:23 225280 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
2013-04-21 14:54:23 176128 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2013-04-21 14:54:22 77824 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2013-04-19 15:28:54 ——– d—–w- C:\Users\Cry Havoc\AppData\Local\{A719C78C-2BBD-446E-8BE2-793250B8EEDE}
2013-04-19 14:48:47 388096 —-a-r- C:\Users\Cry Havoc\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-04-19 14:48:47 ——– d—–w- C:\Program Files (x86)\Trend Micro
2013-04-16 13:33:39 ——– d—–w- C:\ProgramData\Stardock
2013-04-16 13:33:39 ——– d—–w- C:\ProgramData\Ironclad Games
2013-04-16 03:44:43 487424 —-a-w- C:\Windows\SysWow64\msvcp70.dll
2013-04-16 03:44:43 ——– d—–w- C:\Program Files (x86)\AML Products
2013-04-16 03:31:28 ——– d—–w- C:\Program Files (x86)\Common Files\Symantec Shared
2013-04-16 02:47:08 177312 —-a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2013-04-16 02:46:25 796248 —-a-r- C:\Windows\System32\drivers\NISx64\1403010.016\srtsp64.sys
2013-04-16 02:46:25 493656 —-a-r- C:\Windows\System32\drivers\NISx64\1403010.016\SymDS64.sys
2013-04-16 02:46:25 432800 —-a-r- C:\Windows\System32\drivers\NISx64\1403010.016\symnets.sys
2013-04-16 02:46:25 36952 —-a-r- C:\Windows\System32\drivers\NISx64\1403010.016\srtspx64.sys
2013-04-16 02:46:25 23448 —-a-r- C:\Windows\System32\drivers\NISx64\1403010.016\SymELAM.sys
2013-04-16 02:46:25 224416 —-a-r- C:\Windows\System32\drivers\NISx64\1403010.016\Ironx64.sys
2013-04-16 02:46:25 168096 —-a-r- C:\Windows\System32\drivers\NISx64\1403010.016\ccSetx64.sys
2013-04-16 02:46:25 1139800 —-a-r- C:\Windows\System32\drivers\NISx64\1403010.016\SymEFA64.sys
2013-04-16 02:46:06 ——– d—–w- C:\Program Files (x86)\Norton Internet Security
2013-04-16 02:39:48 ——– d—–w- C:\ProgramData\PCSettings
2013-04-16 02:04:48 ——– d—–w- C:\Windows\System32\drivers\NISx64\1403010.016
2013-04-14 23:58:51 ——– d—–w- C:\Users\Cry Havoc\AppData\Local\Zeromus Browser
2013-04-14 23:58:39 ——– d—–w- C:\Program Files (x86)\Zeromus Browser
2013-04-14 23:29:12 44032 —-a-w- C:\Windows\System32\tsgqec.dll
2013-04-14 23:29:12 3717632 —-a-w- C:\Windows\System32\mstscax.dll
2013-04-14 23:29:12 3217408 —-a-w- C:\Windows\SysWow64\mstscax.dll
2013-04-14 23:29:12 158720 —-a-w- C:\Windows\System32\aaclient.dll
2013-04-14 23:29:12 131584 —-a-w- C:\Windows\SysWow64\aaclient.dll
2013-04-14 23:29:05 36864 —-a-w- C:\Windows\SysWow64\tsgqec.dll
2013-04-14 23:27:51 3153408 —-a-w- C:\Windows\System32\win32k.sys
2013-04-14 23:27:27 223752 —-a-w- C:\Windows\System32\drivers\fvevol.sys
2013-04-14 23:27:20 5550424 —-a-w- C:\Windows\System32\ntoskrnl.exe
2013-04-14 23:27:19 43520 —-a-w- C:\Windows\System32\csrsrv.dll
2013-04-14 23:27:19 3968856 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2013-04-14 23:27:19 3913560 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe
2013-04-14 23:27:19 112640 —-a-w- C:\Windows\System32\smss.exe
2013-04-14 23:27:18 6656 —-a-w- C:\Windows\SysWow64\apisetschema.dll
2013-04-14 22:32:28 263064 —-a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll
2013-04-14 22:32:26 26520 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugin-hang-ui.exe
2013-04-11 21:48:56 ——– d—–w- C:\ProgramData\NVIDIA Corporation
2013-04-11 20:31:56 ——– d-sh–w- C:\ProgramData\SecuROM
2013-04-11 19:27:22 ——– d—–w- C:\Users\Cry Havoc\AppData\Local\{CBCB3BA5-4E1C-4B76-9C50-9DADEBF80899}
2013-04-09 23:49:22 ——– d—–w- C:\Users\Cry Havoc\AppData\Local\{7029A524-789D-4055-A618-ED49AB5FB62F}
2013-04-08 15:28:01 ——– d—–w- C:\Users\Cry Havoc\AppData\Local\{F46FD271-CEF8-43C8-A629-C6DBE01F1E98}
2013-04-06 23:11:06 ——– d—–w- C:\Users\Cry Havoc\AppData\Local\{558ED9A3-FDF5-4A47-9447-CAA72045BD98}
2013-04-02 22:45:19 ——– d—–w- C:\ProgramData\RELOADED
2013-04-02 22:14:38 ——– d—–w- C:\Users\Cry Havoc\AppData\Roaming\Bioshock2
2013-03-31 23:39:59 ——– d—–w- C:\ProgramData\VirtualizedApplications
2013-03-31 16:21:03 ——– d—–w- C:\Users\Cry Havoc\AppData\Local\SoftGrid Client
2013-03-31 16:21:01 ——– d—–w- C:\Users\Cry Havoc\AppData\Roaming\SoftGrid Client
2013-03-31 16:19:23 ——– d—–w- C:\Users\Cry Havoc\AppData\Roaming\TP
2013-03-29 16:32:36 ——– d—–w- C:\Users\Cry Havoc\AppData\Roaming\BOXEE
2013-03-27 13:43:25 ——– d—–w- C:\Program Files\Ipswitch
2013-03-27 13:43:24 ——– d—–w- C:\Program Files (x86)\Ipswitch
.
==================== Find3M ====================
.
2013-04-24 13:27:03 971680 —-a-w- C:\Windows\System32\deployJava1.dll
2013-04-24 13:27:03 1092512 —-a-w- C:\Windows\System32\npDeployJava1.dll
2013-04-24 13:23:17 866720 —-a-w- C:\Windows\SysWow64\npdeployJava1.dll
2013-04-24 13:23:17 788896 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2013-04-14 22:36:04 71048 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-14 22:36:04 691592 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-04-02 00:29:10 29480 —-a-w- C:\Windows\SysWow64\msxml3a.dll
2013-04-02 00:29:09 505128 —-a-w- C:\Windows\SysWow64\msvcp71.dll
2013-03-23 01:09:28 354656 —-a-w- C:\Windows\SysWow64\DivXControlPanelApplet.cpl
2013-03-18 16:20:08 172032 —-a-w- C:\Windows\SysWow64\AniGIF.ocx
2013-03-16 15:52:59 599552 —-a-w- C:\Windows\System32\vbscript.dll
2013-03-16 15:52:58 92160 —-a-w- C:\Windows\System32\SetIEInstalledDate.exe
2013-03-16 15:52:58 77312 —-a-w- C:\Windows\System32\tdc.ocx
2013-03-16 15:52:58 51200 —-a-w- C:\Windows\System32\imgutil.dll
2013-03-16 15:52:58 48640 —-a-w- C:\Windows\System32\mshtmler.dll
2013-03-16 15:52:58 173568 —-a-w- C:\Windows\System32\ieUnatt.exe
2013-03-16 15:52:58 13824 —-a-w- C:\Windows\System32\mshta.exe
2013-03-16 15:52:58 135680 —-a-w- C:\Windows\System32\IEAdvpack.dll
2013-03-15 04:16:18 3477280 —-a-w- C:\Windows\System32\nvsvc64.dll
2013-03-15 04:16:17 6398240 —-a-w- C:\Windows\System32\nvcpl.dll
2013-03-15 04:16:10 877856 —-a-w- C:\Windows\System32\nvvsvc.exe
2013-03-15 04:16:10 63776 —-a-w- C:\Windows\System32\nvshext.dll
2013-03-15 04:16:10 237856 —-a-w- C:\Windows\System32\nvmctray.dll
2013-03-15 02:07:52 559904 —-a-w- C:\Windows\SysWow64\nvStreaming.exe
2013-03-13 16:24:01 3065455 —-a-w- C:\Windows\System32\nvcoproc.bin
2013-03-12 05:10:56 282744 ——w- C:\Windows\System32\MpSigStub.exe
2013-02-21 10:30:16 1766912 —-a-w- C:\Windows\SysWow64\wininet.dll
2013-02-21 10:29:39 2877440 —-a-w- C:\Windows\SysWow64\jscript9.dll
2013-02-21 10:29:37 61440 —-a-w- C:\Windows\SysWow64\iesetup.dll
2013-02-21 10:29:37 109056 —-a-w- C:\Windows\SysWow64\iesysprep.dll
2013-02-21 10:15:07 2240512 —-a-w- C:\Windows\System32\wininet.dll
2013-02-21 10:14:09 3958784 —-a-w- C:\Windows\System32\jscript9.dll
2013-02-21 10:14:05 67072 —-a-w- C:\Windows\System32\iesetup.dll
2013-02-21 10:14:05 136704 —-a-w- C:\Windows\System32\iesysprep.dll
2013-02-19 12:01:03 2706432 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2013-02-19 11:42:14 2706432 —-a-w- C:\Windows\System32\mshtml.tlb
2013-02-19 11:10:53 71680 —-a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-02-19 10:51:18 89600 —-a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-02-12 05:45:24 135168 —-a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45:22 350208 —-a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45:22 308736 —-a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45:22 111104 —-a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48:31 474112 —-a-w- C:\Windows\apppatch\AcSpecfc.dll
2013-02-12 04:48:26 2176512 —-a-w- C:\Windows\apppatch\AcGenral.dll
2013-02-12 04:12:05 19968 —-a-w- C:\Windows\System32\drivers\usb8023.sys
2013-02-10 03:25:27 1807136 —-a-w- C:\Windows\System32\nvdispco6420294.dll
2013-02-10 03:25:27 1510176 —-a-w- C:\Windows\System32\nvdispgenco6420162.dll
.
============= FINISH: 19:17:33.25 ===============

Attach.txt
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 3/9/2012 2:28:40 AM
System Uptime: 4/25/2013 6:57:23 PM (1 hours ago)
.
Motherboard: Gigabyte | | 2AC8
Processor: AMD FX™-8120 Eight-Core Processor | CPU 1 | 3100/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 914 GiB total, 431.527 GiB free.
D: is FIXED (NTFS) - 17 GiB total, 1.265 GiB free.
E: is FIXED (NTFS) - 0 GiB total, 0.031 GiB free.
F: is FIXED (NTFS) - 455 GiB total, 5.8 GiB free.
G: is FIXED (NTFS) - 11 GiB total, 0.793 GiB free.
H: is CDROM ()
I: is CDROM ()
J: is Removable
K: is Removable
L: is Removable
M: is Removable
N: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Realtek PCIe GBE Family Controller
Device ID: PCI\VEN_10EC&DEV_8168&SUBSYS_2AC8103C&REV_06\4&693E52D&0&00AB
Manufacturer: Realtek
Name: Realtek PCIe GBE Family Controller
PNP Device ID: PCI\VEN_10EC&DEV_8168&SUBSYS_2AC8103C&REV_06\4&693E52D&0&00AB
Service: RTL8167
.
==== System Restore Points ===================
.
RP249: 4/22/2013 6:04:28 PM - Removed Nero 12.
RP250: 4/22/2013 6:10:23 PM - Removed Nero 12 Content Pack.
RP251: 4/24/2013 9:04:32 AM - Removed Java 7 Update 17
RP252: 4/24/2013 9:22:48 AM - Installed Java 7 Update 21
RP253: 4/24/2013 9:26:28 AM - Installed Java 7 Update 21 (64-bit)
RP254: 4/24/2013 9:31:59 AM - Windows Update
RP255: 4/24/2013 10:22:49 AM - OTL Restore Point - 4/24/2013 10:22:38 AM
.
==== Installed Programs ======================
.
7-Zip 9.20
7-Zip 9.20 (x64 edition)
802.11n Wireless LAN Card
AC3File 0.7b
AC3Filter 2.5b
Adobe AIR
Adobe Flash Player 11 ActiveX (x64)
Adobe Flash Player 11 Plugin
Adobe Reader XI (11.0.02)
Adobe Shockwave Player 12.0
Bass Audio Decoder (remove only)
Bejeweled 3
Belarc Advisor 8.2
BG Rules Editor v1.0.0
BitTorrent
Blackhawk Striker 2
Blio
CD Audio Reader Filter (remove only)
Character Control - Baldur's Gate v1.4.7
Chuzzle Deluxe
Compatibility Pack for the 2007 Office system
ConvertHelper 2.2
Cradle of Rome 2
Crysis® 2
CyberLink PowerDVD 10
D3DX10
DAEMON Tools Lite
dcmsvc 1.0
DCoder Image Source (remove only)
Deus Ex
DirectVobSub (remove only)
DirectX for Managed Code Update (Summer 2004)
DivX Setup
Dora's World Adventure
DScaler 5 Mpeg Decoders
EVGA Precision X 4.1.0
Farm Frenzy
Farmscapes
FATE
ffdshow v1.2.4453 [2012-05-21]
FFMPEG Core Files (remove only)
Final Drive Fury
FinePixViewer Resource
FinePixViewer Ver.5.5
FinePixViewer YTUPL
Free FLV Converter
FUJIFILM FinePixViewer S Ver.2.0
FUJIFILM MyFinePix Studio 4.2a
Google Update Helper
Hewlett-Packard ACLM.NET v1.2.1.1
HiJackThis
Hoyle Card Games
HP Application Assistant
HP Auto
HP Calendar
HP Client Services
HP Clock
HP Customer Experience Enhancements
HP Games
HP Keyboard
HP LinkUp
HP Magic Canvas
HP Magic Canvas Tutorials
HP MovieStore
HP Notes
HP Odometer
HP Product Detection
HP RSS
HP Setup
HP Setup Manager
HP Support Assistant
HP Support Information
HP TouchSmart Background - Beats
HP TouchSmart RecipeBox
HP Update
HP Vision Hardware Diagnostics
IDT Audio
Ipswitch WS_FTP 12
IrfanView (remove only)
Java 7 Update 21
Java 7 Update 21 (64-bit)
Java Auto Updater
Jewel Match 3
Jewel Quest Mysteries: The Seventh Gate Collector's Edition
John Deere Drive Green
Junk Mail filter update
Kobo
LabelPrint
LAV Filters 0.51.3
Letters from Nowhere 2
Luxor HD
Macromedia Shockwave Player
MadVR (remove only)
Magic ISO Maker v5.5 (build 0281)
Mah Jong Medley
Malwarebytes Anti-Malware version 1.65.0.1400
Mesh Runtime
Metric Converter
Microsoft .NET Framework 1.1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Digital Image Library 9 - Blocker
Microsoft Digital Image Pro 7.0
Microsoft Digital Image Standard 2006
Microsoft Digital Image Standard 2006 Editor
Microsoft Digital Image Standard 2006 Library
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft IntelliPoint 8.2
Microsoft Mathematics
Microsoft Office 2010
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Word 2002
Microsoft Works
Microsoft Works Suite 2006 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
Microsoft WSE 3.0 Runtime
Mozilla Firefox 20.0.1 (x86 en-US)
Mozilla Maintenance Service
MRU-Blaster v1.5 (Database 3.28.04)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
My Free Mahjong v.2.0
nanoVoice Beta 2.0
Nero Suite
neroxml
Norton Bootable Recovery Tool Wizard
Norton Internet Security
Norton Online Backup
NVIDIA 3D Vision Controller Driver 314.22
NVIDIA 3D Vision Driver 314.22
NVIDIA Control Panel 314.22
NVIDIA Graphics Driver 314.22
NVIDIA HD Audio Driver [removed]
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.1031
NVIDIA Stereoscopic 3D Driver
OpenOffice.org 3.3
opensource
OpenSource AVI Splitter (remove only)
OpenSource DTS/AC3/DD+ Source Filter (remove only)
OpenSource Flash Video Splitter (remove only)
Opera 12.14
PDF Complete Special Edition
PeerBlock 1.1 (r518)
Penguins!
Plants vs. Zombies - Game of the Year
PlayReady PC Runtime amd64
PlayReady PC Runtime x86
Poker Superstars III
Polar Bowler
Polar Golfer
Power2Go
PressReader
RAIDXpert
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
RealUpgrade 1.1
Recovery Manager
Remote Graphics Receiver
RollerCoaster Tycoon 3: Platinum
Sansa Updater
Screencast-O-Matic
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
SpeedBit Video Accelerator
Spot
Spybot - Search & Destroy
SpywareBlaster 5.0
SUPERAntiSpyware
swMSM
System Requirements Lab
Tap Tap Bear
The Treasures of Mystery Island: The Ghost Ship
Torchlight
TSHostedAppLauncher
Universe at War Earth Assault
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update Installer for WildTangent Games App
VC80CRTRedist - 8.0.50727.6195
Virtual Villagers 4 - The Tree of Life
Visual Studio 2010 x64 Redistributables
Warner Bros. Digital Copy Manager
WildTangent Games App (HP Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Works Upgrade
YTD Video Downloader 3.9.2
Zinio Reader 4
Zuma's Revenge
.
==== Event Viewer Messages From Past Week ========
.
4/25/2013 6:59:03 PM, Error: Service Control Manager [7034] - The VideoAcceleratorService service terminated unexpectedly. It has done this 1 time(s).
4/25/2013 6:58:23 PM, Error: Service Control Manager [7003] - The Net.Tcp Listener Adapter service depends the following service: was. This service might not be installed.
4/25/2013 6:58:23 PM, Error: Service Control Manager [7003] - The Net.Pipe Listener Adapter service depends the following service: was. This service might not be installed.
4/25/2013 6:58:23 PM, Error: Service Control Manager [7003] - The Net.Msmq Listener Adapter service depends the following service: msmq. This service might not be installed.
4/24/2013 9:37:54 AM, Error: RemoteAccess [20106] - Unable to add the interface {BF6CC7F2-6D0F-4034-B242-0EB922660AEC} with the Router Manager for the IPV6 protocol. The following error occurred: Cannot complete this function.
4/24/2013 9:37:54 AM, Error: RemoteAccess [20106] - Unable to add the interface {BF6CC7F2-6D0F-4034-B242-0EB922660AEC} with the Router Manager for the IP protocol. The following error occurred: Cannot complete this function.
4/24/2013 9:10:49 AM, Error: Service Control Manager [7024] - The Routing and Remote Access service terminated with service-specific error The requested name is valid, but no data of the requested type was found..
4/24/2013 9:10:47 AM, Error: RemoteAccess [20152] - The currently configured authentication provider failed to load and initialize successfully. The requested name is valid, but no data of the requested type was found.
4/23/2013 9:15:04 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SBSD Security Center Service service to connect.
4/23/2013 9:15:04 AM, Error: Service Control Manager [7000] - The SBSD Security Center Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/22/2013 6:52:55 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
4/22/2013 6:47:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
4/22/2013 6:47:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
4/22/2013 6:47:35 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
4/22/2013 6:47:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
4/22/2013 6:47:26 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BHDrvx64 ccSet_NIS discache eeCtrl IDSVia64 SASDIFSV SASKUTIL spldr SRTSP SRTSPX SymIRON SymNetS Wanarpv6
4/22/2013 6:47:20 PM, Error: Service Control Manager [7001] - The Application Identity service depends on the AppID Driver service which failed to start because of the following error: The dependency service or group failed to start.
4/22/2013 6:47:20 PM, Error: Service Control Manager [7001] - The AppID Driver service depends on the System Attribute Cache service which failed to start because of the following error: A device attached to the system is not functioning.
4/22/2013 6:46:56 PM, Error: sptd [4] - Driver detected an internal error in its data structures for .
4/22/2013 6:41:33 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
4/22/2013 6:23:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
4/22/2013 6:23:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
4/22/2013 6:23:44 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD BHDrvx64 ccSet_NIS DfsC discache eeCtrl IDSVia64 NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr SRTSP SRTSPX SymIRON SymNetS tdx vwififlt Wanarpv6 WfpLwf ws2ifsl
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/22/2013 6:23:40 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
4/22/2013 12:30:55 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
4/22/2013 12:30:49 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
4/21/2013 7:53:41 AM, Error: Microsoft-Windows-HAL [12] - The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system.
4/21/2013 6:35:55 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
4/20/2013 2:04:30 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004
4/20/2013 1:27:22 PM, Error: volsnap [25] - The shadow copies of volume F: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
4/19/2013 11:19:04 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk6\DR6.
4/19/2013 1:13:52 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the RealNetworks Downloader Resolver Service service to connect.
4/18/2013 7:05:43 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SMR322
4/18/2013 6:57:28 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Norton Internet Security service to connect.
4/18/2013 6:57:28 PM, Error: Service Control Manager [7000] - The Norton Internet Security service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/18/2013 6:33:16 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
4/18/2013 6:32:53 PM, Error: Service Control Manager [7001] - The HomeGroup Listener service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
4/18/2013 6:01:22 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
.
==== End Of File ===========================

aswMBR.txt

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-04-25 19:26:39
—————————–
19:26:39.341 OS Version: Windows x64 6.1.7601 Service Pack 1
19:26:39.341 Number of processors: 8 586 0x102
19:26:39.341 ComputerName: CRYHAVOC UserName:
19:26:41.801 Initialize success
19:32:54.666 AVAST engine defs: 13042501
19:34:25.296 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000071
19:34:25.296 Disk 0 Vendor: Hitachi JP4OA41A Size: 953674MB BusType: 8
19:34:25.306 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000072
19:34:25.306 Disk 1 Vendor: Hitachi GM4OA57A Size: 476940MB BusType: 8
19:34:25.376 Disk 0 MBR read successfully
19:34:25.386 Disk 0 MBR scan
19:34:25.396 Disk 0 Windows 7 default MBR code
19:34:25.396 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
19:34:25.406 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 935809 MB offset 206848
19:34:25.446 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 17763 MB offset 1916743680
19:34:25.496 Disk 0 scanning C:\Windows\system32\drivers
19:34:32.866 Service scanning
19:34:51.776 Modules scanning
19:34:51.786 Disk 0 trace - called modules:
19:34:51.856 ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll ahcix64s.sys
19:34:51.866 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800b757790]
19:34:51.876 3 CLASSPNP.SYS[fffff8800123b43f] -> nt!IofCallDriver -> \Device\00000071[0xfffffa800a95e9c0]
19:34:53.866 AVAST engine scan C:\Windows
19:34:57.186 AVAST engine scan C:\Windows\system32
19:37:06.766 AVAST engine scan C:\Windows\system32\drivers
19:37:19.936 AVAST engine scan C:\Users\Cry Havoc
19:48:41.177 AVAST engine scan C:\ProgramData
19:51:34.107 Scan finished successfully
19:52:17.877 Disk 0 MBR has been saved successfully to "C:\Users\Cry Havoc\Desktop\Jeff's Stuff\MBR.dat"
19:52:17.877 The log file has been saved successfully to "C:\Users\Cry Havoc\Desktop\Jeff's Stuff\aswMBR.txt"

ckfiles.txt

CKScanner 2.2 - Additional Security Risks - These are not necessarily bad
c:\users\cry havoc\music\hootie & the blowfish\cracked rear view\desktop.ini
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\crysis2patch19.exe
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\fairlight.nfo
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.001
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.002
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.003
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.004
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.005
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.006
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.007
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.008
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.009
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.010
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.011
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.012
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\flt-cry2u19p.sfv
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\fairlight\crysis2.exe
c:\users\cry havoc\my projects\crysis 2\crysis_2_v1.9_cracked_proper-fltdox\fairlight\fairlight.nfo
scanner sequence 3.II.11.CVAPFE
—– EOF —–

I am sorry that it took so long. I can not access most of my programs including all internet browsers. I keep receiving the message "Illegal operation attempted on a registry key that has been marked for deletion." I was lucky enough to have my friends old computer and I am using a different computer. I was able to copy the log.txt to a thumb drive and I am transferring it here. I want to thank you again. Even if I have to do a factory recovery and lose everything, I really appreciate all that you have done for me.

log.txt

ComboFix 13-04-26.01 - Cry Havoc 04/26/2013 12:20:47.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12063.9278 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Cry Havoc\AppData\Local\Spot
c:\users\Cry Havoc\AppData\Local\Spot\score.xml
c:\users\Cry Havoc\AppData\Roaming\Microsoft\Windows\Recent\SuprB.URL
c:\users\Cry Havoc\AppData\Roaming\Microsoft\Windows\Recent\TPB.URL
c:\users\Public\invokesi.exe
c:\windows\SysWow64\SET658E.tmp
c:\windows\SysWow64\SETCA39.tmp
c:\windows\SysWow64\URTTemp
c:\windows\SysWow64\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-03-26 to 2013-04-26 )))))))))))))))))))))))))))))))
.
.
2013-04-24 13:32 . 2013-04-10 03:46 9317456 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C9E7AE99-C0C3-44F0-B427-0F53D0C276D4}\mpengine.dll
2013-04-24 13:31 . 2013-04-12 14:45 1656680 —-a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-24 13:27 . 2013-04-24 13:27 311200 —-a-w- c:\windows\system32\javaws.exe
2013-04-24 13:27 . 2013-04-24 13:27 108448 —-a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-04-24 13:27 . 2013-04-24 13:27 188832 —-a-w- c:\windows\system32\javaw.exe
2013-04-24 13:27 . 2013-04-24 13:27 188320 —-a-w- c:\windows\system32\java.exe
2013-04-24 13:26 . 2013-04-24 13:26 ——– d—–w- c:\program files\Java
2013-04-24 13:24 . 2013-04-24 13:24 ——– d—–w- c:\program files (x86)\Common Files\Java
2013-04-24 13:24 . 2013-04-24 13:23 95648 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-24 13:23 . 2013-04-24 13:23 ——– d—–w- c:\program files (x86)\Java
2013-04-21 21:10 . 2013-04-21 21:10 ——– d—–w- c:\users\Cry Havoc\AppData\Local\Nero_AG
2013-04-21 20:32 . 2013-04-21 20:32 ——– d—–w- c:\programdata\FUJIFILM
2013-04-21 20:31 . 2013-04-21 20:31 ——– d—–w- c:\program files (x86)\FUJIFILM
2013-04-21 18:21 . 2013-04-22 22:41 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\Uniblue
2013-04-21 14:54 . 2013-04-21 14:54 ——– d—–w- c:\program files (x86)\Common Files\InstallShield
2013-04-21 11:42 . 2013-04-21 11:42 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\InstallShield
2013-04-19 14:48 . 2013-04-19 14:48 388096 —-a-r- c:\users\Cry Havoc\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-04-19 14:48 . 2013-04-19 14:48 ——– d—–w- c:\program files (x86)\Trend Micro
2013-04-16 13:33 . 2013-04-16 13:33 ——– d—–w- c:\programdata\Stardock
2013-04-16 13:33 . 2013-04-16 13:33 ——– d—–w- c:\programdata\Ironclad Games
2013-04-16 03:44 . 2013-04-16 03:44 ——– d—–w- c:\program files (x86)\AML Products
2013-04-16 03:44 . 2002-01-05 09:40 487424 —-a-w- c:\windows\SysWow64\msvcp70.dll
2013-04-16 03:31 . 2013-04-16 03:31 ——– d—–w- c:\program files (x86)\Common Files\Symantec Shared
2013-04-16 02:47 . 2013-04-16 02:47 177312 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2013-04-16 02:46 . 2013-04-16 02:46 ——– d—–w- c:\program files (x86)\Norton Internet Security
2013-04-16 02:39 . 2013-04-16 02:39 ——– d—–w- c:\programdata\PCSettings
2013-04-16 02:04 . 2013-04-16 02:46 ——– d—–w- c:\windows\system32\drivers\NISx64\1403010.016
2013-04-14 23:58 . 2013-04-17 20:15 ——– d—–w- c:\users\Cry Havoc\AppData\Local\Zeromus Browser
2013-04-14 23:58 . 2013-04-14 23:58 ——– d—–w- c:\program files (x86)\Zeromus Browser
2013-04-14 23:29 . 2013-02-15 06:08 44032 —-a-w- c:\windows\system32\tsgqec.dll
2013-04-14 23:29 . 2013-02-15 06:06 3717632 —-a-w- c:\windows\system32\mstscax.dll
2013-04-14 23:29 . 2013-02-15 06:02 158720 —-a-w- c:\windows\system32\aaclient.dll
2013-04-14 23:29 . 2013-02-15 04:37 3217408 —-a-w- c:\windows\SysWow64\mstscax.dll
2013-04-14 23:29 . 2013-02-15 04:34 131584 —-a-w- c:\windows\SysWow64\aaclient.dll
2013-04-14 23:29 . 2013-02-15 03:25 36864 —-a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-14 23:27 . 2013-03-01 03:36 3153408 —-a-w- c:\windows\system32\win32k.sys
2013-04-14 23:27 . 2013-01-24 06:01 223752 —-a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-14 23:27 . 2013-03-19 06:04 5550424 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-04-14 23:27 . 2013-03-19 05:46 43520 —-a-w- c:\windows\system32\csrsrv.dll
2013-04-14 23:27 . 2013-03-19 05:04 3968856 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-14 23:27 . 2013-03-19 05:04 3913560 —-a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-14 23:27 . 2013-03-19 03:06 112640 —-a-w- c:\windows\system32\smss.exe
2013-04-14 23:27 . 2013-03-19 04:47 6656 —-a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-14 22:32 . 2013-04-10 06:58 263064 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2013-04-14 22:32 . 2013-04-10 06:58 26520 —-a-w- c:\program files (x86)\Mozilla Firefox\plugin-hang-ui.exe
2013-04-11 21:48 . 2013-04-11 21:48 ——– d—–w- c:\programdata\NVIDIA Corporation
2013-04-11 20:31 . 2013-04-11 20:31 ——– d-sh–w- c:\programdata\SecuROM
2013-04-05 18:24 . 2013-04-14 22:08 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\Bioshock
2013-04-05 18:24 . 2013-04-05 18:24 ——– d–h–r- c:\users\Cry Havoc\AppData\Roaming\SecuROM
2013-04-02 22:45 . 2013-04-02 22:45 ——– d—–w- c:\programdata\RELOADED
2013-03-31 23:39 . 2013-03-31 23:39 ——– d—–w- c:\programdata\VirtualizedApplications
2013-03-31 16:21 . 2013-03-31 16:21 ——– d—–w- c:\users\Cry Havoc\AppData\Local\SoftGrid Client
2013-03-31 16:21 . 2013-04-01 16:09 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\SoftGrid Client
2013-03-31 16:19 . 2013-03-31 16:21 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\TP
2013-03-29 16:32 . 2013-03-29 16:32 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\BOXEE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-24 13:27 . 2012-06-27 14:25 1092512 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-04-24 13:27 . 2012-04-18 14:00 971680 —-a-w- c:\windows\system32\deployJava1.dll
2013-04-24 13:23 . 2012-06-11 19:42 866720 —-a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-04-24 13:23 . 2012-03-10 01:31 788896 —-a-w- c:\windows\SysWow64\deployJava1.dll
2013-04-14 23:32 . 2012-03-09 20:32 72702784 —-a-w- c:\windows\system32\MRT.exe
2013-04-14 22:36 . 2012-04-05 20:59 691592 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-14 22:36 . 2012-02-29 21:28 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-02 00:29 . 2012-02-29 21:30 29480 —-a-w- c:\windows\SysWow64\msxml3a.dll
2013-04-02 00:29 . 2013-03-18 16:02 505128 —-a-w- c:\windows\SysWow64\msvcp71.dll
2013-03-23 01:09 . 2013-03-23 01:09 354656 —-a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2013-03-18 16:20 . 2013-03-18 16:20 172032 —-a-w- c:\windows\SysWow64\AniGIF.ocx
2013-03-16 15:53 . 2013-03-16 15:53 1054720 —-a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-16 15:53 . 2013-03-16 15:53 719360 —-a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-03-16 15:53 . 2013-03-16 15:53 226304 —-a-w- c:\windows\system32\elshyph.dll
2013-03-16 15:53 . 2013-03-16 15:53 185344 —-a-w- c:\windows\SysWow64\elshyph.dll
2013-03-16 15:53 . 2013-03-16 15:53 158720 —-a-w- c:\windows\SysWow64\msls31.dll
2013-03-16 15:53 . 2013-03-16 15:53 150528 —-a-w- c:\windows\SysWow64\iexpress.exe
2013-03-16 15:53 . 2013-03-16 15:53 138752 —-a-w- c:\windows\SysWow64\wextract.exe
2013-03-16 15:53 . 2013-03-16 15:53 73728 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-16 15:53 . 2013-03-16 15:53 61952 —-a-w- c:\windows\SysWow64\tdc.ocx
2013-03-16 15:53 . 2013-03-16 15:53 523264 —-a-w- c:\windows\SysWow64\vbscript.dll
2013-03-16 15:53 . 2013-03-16 15:53 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll
2013-03-16 15:53 . 2013-03-16 15:53 38400 —-a-w- c:\windows\SysWow64\imgutil.dll
2013-03-16 15:53 . 2013-03-16 15:53 361984 —-a-w- c:\windows\SysWow64\html.iec
2013-03-16 15:53 . 2013-03-16 15:53 1441280 —-a-w- c:\windows\SysWow64\inetcpl.cpl
2013-03-16 15:53 . 2013-03-16 15:53 137216 —-a-w- c:\windows\SysWow64\ieUnatt.exe
2013-03-16 15:53 . 2013-03-16 15:53 12800 —-a-w- c:\windows\SysWow64\mshta.exe
2013-03-16 15:53 . 2013-03-16 15:53 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-03-16 15:53 . 2013-03-16 15:53 97280 —-a-w- c:\windows\system32\mshtmled.dll
2013-03-16 15:53 . 2013-03-16 15:53 905728 —-a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-16 15:53 . 2013-03-16 15:53 81408 —-a-w- c:\windows\system32\icardie.dll
2013-03-16 15:53 . 2013-03-16 15:53 762368 —-a-w- c:\windows\system32\ieapfltr.dll
2013-03-16 15:53 . 2013-03-16 15:53 452096 —-a-w- c:\windows\system32\dxtmsft.dll
2013-03-16 15:53 . 2013-03-16 15:53 441856 —-a-w- c:\windows\system32\html.iec
2013-03-16 15:53 . 2013-03-16 15:53 281600 —-a-w- c:\windows\system32\dxtrans.dll
2013-03-16 15:53 . 2013-03-16 15:53 27648 —-a-w- c:\windows\system32\licmgr10.dll
2013-03-16 15:53 . 2013-03-16 15:53 270848 —-a-w- c:\windows\system32\iedkcs32.dll
2013-03-16 15:53 . 2013-03-16 15:53 247296 —-a-w- c:\windows\system32\webcheck.dll
2013-03-16 15:53 . 2013-03-16 15:53 235008 —-a-w- c:\windows\system32\url.dll
2013-03-16 15:53 . 2013-03-16 15:53 23040 —-a-w- c:\windows\SysWow64\licmgr10.dll
2013-03-16 15:53 . 2013-03-16 15:53 216064 —-a-w- c:\windows\system32\msls31.dll
2013-03-16 15:53 . 2013-03-16 15:53 197120 —-a-w- c:\windows\system32\msrating.dll
2013-03-16 15:53 . 2013-03-16 15:53 167424 —-a-w- c:\windows\system32\iexpress.exe
2013-03-16 15:53 . 2013-03-16 15:53 1509376 —-a-w- c:\windows\system32\inetcpl.cpl
2013-03-16 15:53 . 2013-03-16 15:53 144896 —-a-w- c:\windows\system32\wextract.exe
2013-03-16 15:53 . 2013-03-16 15:53 1400416 —-a-w- c:\windows\system32\ieapfltr.dat
2013-03-16 15:53 . 2013-03-16 15:53 102912 —-a-w- c:\windows\system32\inseng.dll
2013-03-16 15:52 . 2013-03-16 15:52 599552 —-a-w- c:\windows\system32\vbscript.dll
2013-03-16 15:52 . 2013-03-16 15:52 92160 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-16 15:52 . 2013-03-16 15:52 77312 —-a-w- c:\windows\system32\tdc.ocx
2013-03-16 15:52 . 2013-03-16 15:52 62976 —-a-w- c:\windows\system32\pngfilt.dll
2013-03-16 15:52 . 2013-03-16 15:52 52224 —-a-w- c:\windows\system32\msfeedsbs.dll
2013-03-16 15:52 . 2013-03-16 15:52 51200 —-a-w- c:\windows\system32\imgutil.dll
2013-03-16 15:52 . 2013-03-16 15:52 48640 —-a-w- c:\windows\system32\mshtmler.dll
2013-03-16 15:52 . 2013-03-16 15:52 173568 —-a-w- c:\windows\system32\ieUnatt.exe
2013-03-16 15:52 . 2013-03-16 15:52 149504 —-a-w- c:\windows\system32\occache.dll
2013-03-16 15:52 . 2013-03-16 15:52 13824 —-a-w- c:\windows\system32\mshta.exe
2013-03-16 15:52 . 2013-03-16 15:52 136192 —-a-w- c:\windows\system32\iepeers.dll
2013-03-16 15:52 . 2013-03-16 15:52 135680 —-a-w- c:\windows\system32\IEAdvpack.dll
2013-03-16 15:52 . 2013-03-16 15:52 12800 —-a-w- c:\windows\system32\msfeedssync.exe
2013-03-15 05:53 . 2013-02-24 02:03 15508512 —-a-w- c:\windows\system32\nvwgf2umx.dll
2013-03-15 05:53 . 2013-02-24 02:03 1118776 —-a-w- c:\windows\system32\nvumdshimx.dll
2013-03-15 05:53 . 2013-02-24 02:03 17990800 —-a-w- c:\windows\system32\nvd3dumx.dll
2013-03-15 05:53 . 2013-02-24 02:03 15042928 —-a-w- c:\windows\SysWow64\nvd3dum.dll
2013-03-15 05:53 . 2013-02-24 02:03 2864144 —-a-w- c:\windows\system32\nvapi64.dll
2013-03-15 04:16 . 2013-02-24 02:04 3477280 —-a-w- c:\windows\system32\nvsvc64.dll
2013-03-15 04:16 . 2013-02-24 02:04 6398240 —-a-w- c:\windows\system32\nvcpl.dll
2013-03-15 04:16 . 2013-02-24 02:04 877856 —-a-w- c:\windows\system32\nvvsvc.exe
2013-03-15 04:16 . 2013-02-24 02:04 63776 —-a-w- c:\windows\system32\nvshext.dll
2013-03-15 04:16 . 2013-02-24 02:04 237856 —-a-w- c:\windows\system32\nvmctray.dll
2013-03-15 02:07 . 2013-03-15 02:07 559904 —-a-w- c:\windows\SysWow64\nvStreaming.exe
2013-03-13 16:24 . 2013-02-24 02:04 3065455 —-a-w- c:\windows\system32\nvcoproc.bin
2013-03-12 05:10 . 2010-11-21 03:27 282744 ——w- c:\windows\system32\MpSigStub.exe
2013-02-12 05:45 . 2013-03-16 15:12 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-16 15:12 308736 —-a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-16 15:12 111104 —-a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-03-16 15:12 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-03-16 15:12 474112 —-a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-16 15:12 2176512 —-a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-03-16 15:49 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-10 03:25 . 2013-02-24 02:03 1807136 —-a-w- c:\windows\system32\nvdispco6420294.dll
2013-02-10 03:25 . 2013-02-24 02:03 1510176 —-a-w- c:\windows\system32\nvdispgenco6420162.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE" [2012-11-06 5629312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Norton Online Backup"=c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
""=
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
"PDF Complete"=c:\program files (x86)\PDF Complete\pdfsty.exe
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"dcmsvc"=c:\program files (x86)\dcmsvc\dcmsvc.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"DivXMediaServer"=c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"amd_dc_opt"=c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
"LaunchHPOSIAPP"=c:\program files (x86)\Hewlett-Packard\HP Keyboard\LaunchApp.exe
"AML Registry Cleaner"=c:\program files (x86)\AML Products\Registry Cleaner\regclean.exe /min
.
R2 CLKMSVC10_38F51D56;CyberLink Product - 2013/04/01 20:34;c:\program files (x86)\Cyberlink\PowerDVD10\NavFilter\kmsvc.exe [2011-02-25 241648]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-07 676936]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~2\SPEEDB~1\VideoAcceleratorService.exe [2013-03-18 277744]
R3 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]
R3 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R3 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-07-09 708200]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-09 1255736]
R4 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-02 89600]
R4 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [2011-08-16 16384]
R4 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 ahcix64s;ahcix64s;c:\windows\system32\drivers\ahcix64s.sys [2011-08-16 280656]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1403010.016\SYMDS64.SYS [2013-01-22 493656]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1403010.016\SYMEFA64.SYS [2013-01-31 1139800]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-04-12 1390680]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1403010.016\ccSetx64.sys [2012-11-16 168096]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20130425.001\IDSvia64.sys [2013-04-13 513184]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1403010.016\Ironx64.SYS [2012-11-16 224416]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1403010.016\SYMNETS.SYS [2013-01-31 432800]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-09-07 140672]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [2011-05-13 128904]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-07 399432]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe [2012-12-24 144520]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-08-12 1128952]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-03-06 39056]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-03-15 383264]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 47616]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-04-15 138912]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-07 25928]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2012-12-06 2350176]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2013-01-05 50800]
S3 RTCore64;RTCore64;c:\program files (x86)\EVGA Precision X\RTCore64.sys [2013-04-05 15176]
S3 tihub3;TI USB3 Hub Service;c:\windows\system32\drivers\tihub3.sys [2011-12-29 136000]
S3 tixhci;TI XHCI Service;c:\windows\system32\drivers\tixhci.sys [2011-12-29 409408]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2011-08-16 47232]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - CLKMDRV10_38F51D56
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23 16:33]
.
2013-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23 16:33]
.
2013-04-26 c:\windows\Tasks\HPCeeScheduleForCry Havoc.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 12:43]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BeatsOSDApp"="c:\program files\IDT\WDM\beats64.exe" [2011-12-23 37888]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-04-25 1425408]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.onthestart.com/auto2.asp?pageid=6078
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
LSP: c:\program files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll
TCP: DhcpNameServer = [removed] [removed] [removed]
FF - ProfilePath - c:\users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\
FF - prefs.js: browser.search.selectedEngine - Ixquick HTTPS
FF - prefs.js: browser.startup.homepage - hxxp://www.onthestart.com/auto2.asp?pageid=6078
FF - ExtSQL: 2013-04-14 10:44; {e968fc70-8f95-4ab9-9e79-304de2a71ee1}; c:\users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} - msiexec
AddRemove-Macromedia Shockwave Player - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\20.3.1.22\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,38,12,8d,ec,f8,
7b,2b,25,27,06,e7,c4,bc,f0,98,15,0d,de
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,38,12,87,c0,5a,
34,53,fa,ab,0e,f7,66,0f,49,11,3f,d6,de
"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,
36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0
"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,
57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b
"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,38,12,60,d8,39,
64,cd,04,79,07,f5,b7,d6,9a,c1,81,e0,1c
"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,
69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:68,0e,84,80,03,d0,cd,01
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
c:\program files (x86)\EVGA Precision X\EVGAPrecision.exe
c:\program files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe
.
**************************************************************************
.
Completion time: 2013-04-26 12:35:26 - machine was rebooted
ComboFix-quarantined-files.txt 2013-04-26 16:35
.
Pre-Run: 587,289,559,040 bytes free
Post-Run: 586,913,021,952 bytes free
.
- - End Of File - - A67E88D44EDC940D380DEC1E2108A63B

Hello justgussy,

My good friend Jeffce has asked if I could look after you, he is having some connection issues.

Please run the following:

Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right-mouse click JRT.exe and select Run as administrator
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message

NEXT


Download AdwCleaner from here and save it to your desktop.

• Run AdwCleaner and select Delete
• Once done it will ask to reboot, allow the reboot
• On reboot a log will be produced, please attach the content of the log to your next reply

NEXT

• Please open your MalwareBytes AntiMalware Program
• Click the Update Tab and search for updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activeX control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan completes, press the LIST OF THREATS FOUND button
• Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
• Include the contents of this report in your next reply.
• Press the BACK button.
• Press Finish

Thank you for your help CatByte. Jeffce has been a wonderful help, I hope that his connection issues are resolved soon.
I had some minor problems following your instructions;
JRT.exe went as instructed.
I had already had AdwCleaner in a folder from when I tried to fix this myself. I downloaded from your link, saved to desktop and selected Delete. After the reboot it did not show a log. I found out that when I disabled real-time protection of MBaM I forgot to uncheck start protection with Windows so when it rebooted MBaM started. I corrected my mistake and ran AdwCleaner again and got a log after reboot, I am including that. I also have the logs from before I came to this forum, if you want them
The Malwarebyes scan found nothing, but on April 19 it quarantined and deleted Spyware.Zbot. Today's log is included.
I had problems with the online ESET scan. I received a message that I had to download esetsmartinstaller_enu.exe because I was not using Internet Explorer. I canceled and started Internet Explorer but would only get a blank page when I tried to go to ESET online scanner. I used Firefox and installed the esetsmartinstaller_enu.exe. On the options page it stated that I still had Norton Internet Security running. I had disabled everything on Norton except for Norton Product Tampering Protection. After the scan had been running for about 4 hours I realized I have the Norton Vulnerability Protection add-on enabled on Firefox. The scan finally finished and found 14 items. Log is included.


JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.1 (04.27.2013:1)
OS: Windows 7 Home Premium x64
Ran by [removed] on Sun 04/28/2013 at 11:41:14.96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{84A71B6F-DEBF-4205-A9A6-A70A831D2948}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{84A71B6F-DEBF-4205-A9A6-A70A831D2948}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}
Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{00B6751E-38C4-40CA-AB17-FED0FEA489D7}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{022A5847-C67A-4150-B21B-C01C2020027D}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{05EA3BC2-4090-4652-AB49-E24873D2AA36}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{0604F2D8-8829-4B65-9925-B9E0204102CF}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{0611A117-3AC8-438B-9AAA-8C0EEB092236}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{0A3AC237-FDB1-4576-895D-9A98C7099644}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{0AE8434A-30BE-45A4-862E-DB9C541D050A}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{0BA5B2BE-754C-4A10-8FA9-F90BDC9585E5}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{0C00B1A3-06F2-4415-B79F-801F24A264E8}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{0FC79A95-A1DE-44B6-864E-7BC9AD794E26}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{0FFB44BF-090A-4EE7-9C6A-FE1FD2421A4B}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{11E8686C-E799-4499-83F2-89D16F977610}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{12542130-00FD-4553-AEE6-EC1788F0F50E}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{133524D8-0E62-432F-B46D-30B832C889B0}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{13BECCDB-3FF4-4CEA-BA8F-2493D176032C}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{14859F30-1FCD-4B12-8495-880503F692F4}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{1AD1DDB9-45BF-4332-ABC4-2C296668C76F}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{1C7625BF-E345-4282-AA1E-2E09981D7A26}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{1CD6BB7B-DD1D-48BC-BBB1-6A83BFB879A7}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{22A2F88B-A063-4F9E-AE5B-6C2C463D4F41}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{22BC657A-F392-493A-8FA2-B97E672E329F}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{257CB9F5-70C9-4265-8550-66929CF66D24}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{28C8D74F-660C-4612-93EA-799874C22887}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{2AEDBBB5-38E4-4B2F-B5AC-852D77A83220}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{2C16BCEB-0B21-42DE-BA39-428C71EDC985}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{2C241AF9-FF78-4073-92AD-63FB17B5E7BE}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{2D9DCD00-84D1-42E7-90F9-5C73BB7BD186}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{31547657-1D13-4E5D-857F-48852CE6DC91}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{361748DB-AE5A-494F-98B5-DD2EA65E1E74}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{372712F8-85D0-4343-9F08-F200954096B7}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{392FC4CB-5516-4D60-8458-7315A823F4DE}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{3A62CDC5-1C99-4F1A-A67A-C69D5E3C9C45}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{3FC29EEA-260D-41E2-9C22-01C10E88669F}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{405CB663-4F71-4819-8E32-83C9A7E7CC77}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{42624AB6-41F7-4F92-AA5E-8C3559D684C7}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{44889097-F39E-4465-9DF2-ECA1F0EED951}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{4515B7BD-6C18-4D27-9EE8-4E98365C7C6D}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{4553979A-9772-4143-9838-C2F1305A9B0D}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{4801BE01-0704-45EA-AB6F-C54961E140BC}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{4A07388B-2B19-41C1-9551-B25011E1F608}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{4A1465FD-78C8-4F5C-A946-E19D0D55DC27}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{4D97FAD0-D3FC-4659-BF72-45D7FEE34B8E}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{4F735748-B02E-49DC-9534-78F58341F70E}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{4FE20270-C959-4B27-9E71-EC5E1CB703AC}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{505447BA-0579-4AD4-BDCE-C7EF8988DE09}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{558ED9A3-FDF5-4A47-9447-CAA72045BD98}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{55B0C285-1801-4955-98E0-8530BD1A66B7}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{57819560-84F3-48F7-9A95-DC68F0B4D28F}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{5A2F585E-0282-4F0D-88C6-BA6EAC31D371}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{63B27F24-7CAB-4A35-BE62-16191A4FAF64}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{63D8156D-54B1-4231-A2BA-4E2F6E35982E}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{65307851-B4AD-4B5D-B1BC-DD20246C9A02}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{6633781D-B4F9-4501-98FA-3FD4F207BC87}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{666A01B1-CF5C-4441-AC5F-7951FDA81C4C}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{6E71E686-6F10-4608-ADE5-448665491BFF}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{7029A524-789D-4055-A618-ED49AB5FB62F}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{731368BA-1750-4A1D-9C93-4FD534487202}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{7368B35A-44FC-4F73-BE5C-C3C6C18DEFE0}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{770617EB-4BFF-4E49-A4EA-7513ABE36AED}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{772C9409-60BE-4DF3-B2DE-6AB481674747}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{77BEB6A2-14AD-4F9D-B12F-DF05F81471F7}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{79A83E65-E382-45D7-8343-6FDF5B477145}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{7B161525-6FE2-49DE-80F2-C66997D9F3A4}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{7D9EE4A4-13CB-4BFC-AEFB-797FF1556FB3}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{7EF69A16-439B-4579-945F-2F8FFCF2FA81}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{7F966166-B486-4F89-8B99-64FF7A4C2CC1}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{83FC640F-5668-43E7-AB1E-15A8249D9B5B}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{8716095B-825B-43D5-8555-4DA799AA5547}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{87FB9E8A-7B63-45C3-9E03-2D90A929067D}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{89DBF9C9-7607-4A43-B1CB-A10E58BF6786}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{8C81E438-B701-49E7-9A53-EBB05402456F}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{8CF386C1-1F76-4384-B330-2D622BC1B6F4}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{8DA59F84-AE0C-4080-9856-DFE7DF1688AA}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{905366C7-6A7E-4E0A-9292-7A489A7AA058}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{9073F8B3-DCDD-498D-BC79-E917640AA95B}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{91C4362C-A2C3-4CEC-9887-F35F1B9E8535}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{A1C4CD5A-9F8E-438A-A945-AF12313AFE04}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{A29C1E83-F5CE-47AE-8950-2F2CEE7CAD14}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{A719C78C-2BBD-446E-8BE2-793250B8EEDE}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{AD2D1A8A-C5F0-4963-8946-3D9DF2DE9598}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{AEE3A8E7-7641-4839-8F6B-401354B6CDF7}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{AFDE0993-CF2C-44FA-B123-1D5F3F6F30DD}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{AFFB1398-E140-4936-8515-359B5E709746}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{B1BD9391-3FCA-412D-B086-72C43639C828}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{B2F1E558-450F-4CB7-AEC4-6812B27F5987}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{B3A8B857-C4EE-4FE2-9268-A33C9E1450E5}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{B4AF6992-BF5F-484D-A7B0-D9F5A861E864}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{B50C8B9D-B66C-420E-B343-D8E746A96EEE}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{BCC890C4-C197-4E75-8B18-C41F6064B97A}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{C1F4AF98-E68B-45E1-9D45-0F75851EEFA7}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{C370F4E0-4B84-495A-9EF5-86BD812F798E}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{C3B0C1BC-19D9-44CE-BDCD-CF9B7064A4F3}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{C4DB79C4-76EA-4D62-B17C-80E4224D327F}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{CBC12F9C-04D0-4CC1-9970-CA5F5B28E1D6}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{CBCB3BA5-4E1C-4B76-9C50-9DADEBF80899}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{CC845078-70DC-4BC4-8B27-593FF976803D}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{CDB29C8E-8311-4D9F-84C3-4BAC0AA44FDF}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{CE4C369F-EEB8-4806-A7E4-3DE5E563E411}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{CF20CDFC-7ECB-4091-85EA-E39B975F998F}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{CFF4E947-DAA1-48E4-8134-3A9D03728FF6}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{D06542B8-AAD8-4F52-BB07-670F933B1ACD}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{D297FF89-AD20-415A-AD0A-8BA1B7E734A5}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{D8E0DCF7-D007-4B48-BBB6-34ADD8EC0EE6}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{DCAB6D07-A6F0-44DD-9AF1-7EFFBECC563E}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{DEBA5E6A-7BA7-4AB3-A08C-94435295C74C}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{DEBCE300-4E87-45B1-96D0-BC884B1A89B9}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{E395DBD6-B24E-4812-AFD0-1560D92BF7A6}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{E45B7D9C-0C6F-4E9F-BF75-F68EDBD86EAE}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{EAD80F57-7876-4978-9872-A928CFF93845}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{EEA27DF6-4D2D-444E-9FF2-E3A72A700319}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{F00AC9E9-4FE5-4A6A-8A95-3BED07AB2977}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{F039FA8C-5263-4077-B70C-0B76A3122042}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{F277EE9B-276E-4180-8AF5-26BB0E6C5486}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{F46FD271-CEF8-43C8-A629-C6DBE01F1E98}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{F7D728EB-60FD-4BCE-A8D0-9E4A1E28F31E}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{FBB6FFE2-6EFE-45B0-B3AA-47C391D269F1}
Successfully deleted: [Empty Folder] C:\Users\Cry Havoc\appdata\local\{FF363C2F-90CF-415D-837E-536FE1955038}



~~~ FireFox

Successfully deleted the following from C:\Users\Cry Havoc\AppData\Roaming\mozilla\firefox\profiles\e5zgtxr7.default-1353468220625\prefs.js

user_pref("browser.search.selectedEngine", "Ixquick HTTPS");
Emptied folder: C:\Users\Cry Havoc\AppData\Roaming\mozilla\firefox\profiles\e5zgtxr7.default-1353468220625\minidumps [522 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 04/28/2013 at 11:44:36.31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



AdwCleaner[S5].txt

# AdwCleaner v2.300 - Logfile created 04/28/2013 at 12:24:08
# Updated 28/04/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Cry Havoc - CRYHAVOC
# Boot Mode : Normal
# Running from : C:\Users\Cry Havoc\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\prefs.js

[OK] File is clean.

-\\ Opera v12.15.1748.0

File : C:\Users\Cry Havoc\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R10].txt - [1402 octets] - [22/04/2013 12:00:06]
AdwCleaner[R11].txt - [1161 octets] - [22/04/2013 18:41:37]
AdwCleaner[R12].txt - [1130 octets] - [28/04/2013 11:57:45]
AdwCleaner[R13].txt - [1132 octets] - [28/04/2013 12:23:47]
AdwCleaner[S5].txt - [1062 octets] - [28/04/2013 12:24:08]

########## EOF - C:\AdwCleaner[S5].txt - [1122 octets] ##########


mbam-log-2013-04-28 (12-34-01).txt

Malwarebytes Anti-Malware (PRO) 1.65.0.1400
www.malwarebytes.org

Database version: v2013.04.28.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.10.9200.16540
Cry Havoc :: CRYHAVOC [administrator]

Protection: Disabled

4/28/2013 12:34:01 PM
mbam-log-2013-04-28 (12-34-01).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 251966
Time elapsed: 4 minute(s), 8 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)




ESETSCAN.txt

C:\Users\Cry Havoc\Desktop\Setup Files\speedupmypc.exe Win32/SpeedUpMyPC application
C:\Users\Cry Havoc\Desktop\Setup Files\zp816free.exe Win32/OpenCandy application
C:\Users\Cry Havoc\Desktop\Setup Files\DAEMOM Tools\DAEMONToolsPro510-0333.exe Win32/OpenCandy application
C:\Users\Cry Havoc\Desktop\Setup Files\DAEMOM Tools\DTLite4454-0316.exe Win32/OpenCandy application
C:\Users\Cry Havoc\Documents\Documents\Themes\Themes Updates\The 60's\1968.zip BAT/KillFiles.NCS trojan
C:\Users\Cry Havoc\Documents\Documents\Themes\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat BAT/KillFiles.NCS trojan
C:\Users\Cry Havoc\Documents\Documents\ThemesA\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat BAT/KillFiles.NCS trojan
F:\ProgramData\YouTube Downloader\ytd_installer.exe Win32/Toolbar.Widgi application
F:\Users\John David\Documents\Themes\Themes Updates\The 60's\1968.zip BAT/KillFiles.NCS trojan
F:\Users\John David\Documents\Themes\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat BAT/KillFiles.NCS trojan
F:\Users\John David\Documents\ThemesA\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat BAT/KillFiles.NCS trojan
G:\Setup Files\zp816free.exe Win32/OpenCandy application
G:\Setup Files\DAEMOM Tools\DAEMONToolsPro510-0333.exe Win32/OpenCandy application
G:\Setup Files\DAEMOM Tools\DTLite4454-0316.exe Win32/OpenCandy application


Thank you very much.

Hi Jeff,
I am glad that you got your networking problems resolved. Thank you for asking CatByte to assist.
Thank you CatByte for helping.

ComboFix ran fine. I received the message about illegal operation; registry key marked for deletion so I rebooted.
I am still having the following issues but I do not know if they are all caused by malware.
I rebooted several times and it takes about 02:20 to shut down after I see the screen that says "shutting down." This seems very long.
The playlist that I normally listen to has 933 songs with 72.3 hours of music. It is still stating that I have 233 million hours of music, or 168 million hours or 98 million hours, it changes every time that I start Windows Media Player after I reboot.
Right now my Firefox browser window is scrolling up and down by itself while I am typing. This has been happening since shortly after I got my computer. Even long text files or word documents will scroll up and down by themselves sometimes, but only when I am connected to the internet.
I still have the problem with searching. When I click start and search it only lists results that are program files or control panel items. The link to click to "show more results" is still missing. I do not seem to have any problems when I search folders.



ComboFix.txt

ComboFix 13-04-28.01 - Cry Havoc 04/29/2013 10:02:35.2.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12063.10110 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Cry Havoc\Desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Cry Havoc\Desktop\Setup Files\DAEMOM Tools\DAEMONToolsPro510-0333.exe"
"c:\users\Cry Havoc\Desktop\Setup Files\DAEMOM Tools\DTLite4454-0316.exe"
"c:\users\Cry Havoc\Desktop\Setup Files\speedupmypc.exe"
"c:\users\Cry Havoc\Desktop\Setup Files\zp816free.exe"
"c:\users\Cry Havoc\Documents\Documents\Themes\Themes Updates\The 60's\1968.zip"
"c:\users\Cry Havoc\Documents\Documents\Themes\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat"
"c:\users\Cry Havoc\Documents\Documents\ThemesA\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat"
"f:\programdata\YouTube Downloader\ytd_installer.exe"
"f:\users\John David\Documents\Themes\Themes Updates\The 60's\1968.zip"
"f:\users\John David\Documents\Themes\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat"
"f:\users\John David\Documents\ThemesA\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat"
"g:\setup files\DAEMOM Tools\DAEMONToolsPro510-0333.exe"
"g:\setup files\DAEMOM Tools\DTLite4454-0316.exe"
"g:\setup files\zp816free.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Cry Havoc\Desktop\Setup Files\DAEMOM Tools\DAEMONToolsPro510-0333.exe
c:\users\Cry Havoc\Desktop\Setup Files\DAEMOM Tools\DTLite4454-0316.exe
c:\users\Cry Havoc\Desktop\Setup Files\speedupmypc.exe
c:\users\Cry Havoc\Desktop\Setup Files\zp816free.exe
c:\users\Cry Havoc\Documents\Documents\Themes\Themes Updates\The 60's\1968.zip
c:\users\Cry Havoc\Documents\Documents\Themes\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat
c:\users\Cry Havoc\Documents\Documents\ThemesA\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat
f:\programdata\YouTube Downloader\ytd_installer.exe
f:\users\John David\Documents\Themes\Themes Updates\The 60's\1968.zip
f:\users\John David\Documents\Themes\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat
f:\users\John David\Documents\ThemesA\Themes Updates\The 60's\1968\Program Files\Plus!\Themes\1968\screens restore.bat
g:\setup files\DAEMOM Tools\DAEMONToolsPro510-0333.exe
g:\setup files\DAEMOM Tools\DTLite4454-0316.exe
g:\setup files\zp816free.exe
.
Infected copy of c:\windows\SysWow64\kernel32.dll was found and disinfected
Restored copy from - c:\windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22209_none_fcd1e4cbba5cfc7b\kernel32.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-03-28 to 2013-04-29 )))))))))))))))))))))))))))))))
.
.
2013-04-29 14:09 . 2013-04-29 14:09 ——– d—–w- c:\users\TrustedInstaller\AppData\Local\temp
2013-04-29 14:09 . 2013-04-29 14:09 ——– d—–w- c:\users\TEMP\AppData\Local\temp
2013-04-29 14:09 . 2013-04-29 14:09 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-04-28 16:52 . 2013-04-28 16:52 ——– d—–w- c:\program files (x86)\ESET
2013-04-28 15:41 . 2013-04-28 15:41 ——– d—–w- c:\windows\ERUNT
2013-04-28 15:40 . 2013-04-28 15:40 ——– d—–w- C:\JRT
2013-04-24 13:32 . 2013-04-10 03:46 9317456 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C9E7AE99-C0C3-44F0-B427-0F53D0C276D4}\mpengine.dll
2013-04-24 13:31 . 2013-04-12 14:45 1656680 —-a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-24 13:27 . 2013-04-24 13:27 311200 —-a-w- c:\windows\system32\javaws.exe
2013-04-24 13:27 . 2013-04-24 13:27 108448 —-a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-04-24 13:27 . 2013-04-24 13:27 188832 —-a-w- c:\windows\system32\javaw.exe
2013-04-24 13:27 . 2013-04-24 13:27 188320 —-a-w- c:\windows\system32\java.exe
2013-04-24 13:26 . 2013-04-24 13:26 ——– d—–w- c:\program files\Java
2013-04-24 13:24 . 2013-04-24 13:24 ——– d—–w- c:\program files (x86)\Common Files\Java
2013-04-24 13:24 . 2013-04-24 13:23 95648 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-24 13:23 . 2013-04-24 13:23 ——– d—–w- c:\program files (x86)\Java
2013-04-21 21:10 . 2013-04-21 21:10 ——– d—–w- c:\users\Cry Havoc\AppData\Local\Nero_AG
2013-04-21 20:32 . 2013-04-21 20:32 ——– d—–w- c:\programdata\FUJIFILM
2013-04-21 20:31 . 2013-04-21 20:31 ——– d—–w- c:\program files (x86)\FUJIFILM
2013-04-21 18:21 . 2013-04-22 22:41 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\Uniblue
2013-04-21 14:54 . 2013-04-21 14:54 ——– d—–w- c:\program files (x86)\Common Files\InstallShield
2013-04-21 11:42 . 2013-04-21 11:42 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\InstallShield
2013-04-19 14:48 . 2013-04-19 14:48 388096 —-a-r- c:\users\Cry Havoc\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-04-19 14:48 . 2013-04-19 14:48 ——– d—–w- c:\program files (x86)\Trend Micro
2013-04-16 13:33 . 2013-04-16 13:33 ——– d—–w- c:\programdata\Stardock
2013-04-16 13:33 . 2013-04-16 13:33 ——– d—–w- c:\programdata\Ironclad Games
2013-04-16 03:44 . 2013-04-16 03:44 ——– d—–w- c:\program files (x86)\AML Products
2013-04-16 03:44 . 2002-01-05 09:40 487424 —-a-w- c:\windows\SysWow64\msvcp70.dll
2013-04-16 03:31 . 2013-04-16 03:31 ——– d—–w- c:\program files (x86)\Common Files\Symantec Shared
2013-04-16 02:47 . 2013-04-16 02:47 177312 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2013-04-16 02:46 . 2013-04-16 02:46 ——– d—–w- c:\program files (x86)\Norton Internet Security
2013-04-16 02:39 . 2013-04-16 02:39 ——– d—–w- c:\programdata\PCSettings
2013-04-16 02:04 . 2013-04-16 02:46 ——– d—–w- c:\windows\system32\drivers\NISx64\1403010.016
2013-04-14 23:58 . 2013-04-17 20:15 ——– d—–w- c:\users\Cry Havoc\AppData\Local\Zeromus Browser
2013-04-14 23:58 . 2013-04-14 23:58 ——– d—–w- c:\program files (x86)\Zeromus Browser
2013-04-14 23:29 . 2013-02-15 06:08 44032 —-a-w- c:\windows\system32\tsgqec.dll
2013-04-14 23:29 . 2013-02-15 06:06 3717632 —-a-w- c:\windows\system32\mstscax.dll
2013-04-14 23:29 . 2013-02-15 06:02 158720 —-a-w- c:\windows\system32\aaclient.dll
2013-04-14 23:29 . 2013-02-15 04:37 3217408 —-a-w- c:\windows\SysWow64\mstscax.dll
2013-04-14 23:29 . 2013-02-15 04:34 131584 —-a-w- c:\windows\SysWow64\aaclient.dll
2013-04-14 23:29 . 2013-02-15 03:25 36864 —-a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-14 23:27 . 2013-03-01 03:36 3153408 —-a-w- c:\windows\system32\win32k.sys
2013-04-14 23:27 . 2013-01-24 06:01 223752 —-a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-14 23:27 . 2013-03-19 06:04 5550424 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-04-14 23:27 . 2013-03-19 05:46 43520 —-a-w- c:\windows\system32\csrsrv.dll
2013-04-14 23:27 . 2013-03-19 05:04 3968856 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-14 23:27 . 2013-03-19 05:04 3913560 —-a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-14 23:27 . 2013-03-19 03:06 112640 —-a-w- c:\windows\system32\smss.exe
2013-04-14 23:27 . 2013-03-19 04:47 6656 —-a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-14 22:32 . 2013-04-10 06:58 263064 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll
2013-04-14 22:32 . 2013-04-10 06:58 26520 —-a-w- c:\program files (x86)\Mozilla Firefox\plugin-hang-ui.exe
2013-04-11 21:48 . 2013-04-11 21:48 ——– d—–w- c:\programdata\NVIDIA Corporation
2013-04-11 20:31 . 2013-04-11 20:31 ——– d-sh–w- c:\programdata\SecuROM
2013-04-05 18:24 . 2013-04-14 22:08 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\Bioshock
2013-04-05 18:24 . 2013-04-05 18:24 ——– d–h–r- c:\users\Cry Havoc\AppData\Roaming\SecuROM
2013-04-02 22:45 . 2013-04-02 22:45 ——– d—–w- c:\programdata\RELOADED
2013-03-31 23:39 . 2013-03-31 23:39 ——– d—–w- c:\programdata\VirtualizedApplications
2013-03-31 16:21 . 2013-03-31 16:21 ——– d—–w- c:\users\Cry Havoc\AppData\Local\SoftGrid Client
2013-03-31 16:21 . 2013-04-01 16:09 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\SoftGrid Client
2013-03-31 16:19 . 2013-03-31 16:21 ——– d—–w- c:\users\Cry Havoc\AppData\Roaming\TP
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-24 13:27 . 2012-06-27 14:25 1092512 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-04-24 13:27 . 2012-04-18 14:00 971680 —-a-w- c:\windows\system32\deployJava1.dll
2013-04-24 13:23 . 2012-06-11 19:42 866720 —-a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-04-24 13:23 . 2012-03-10 01:31 788896 —-a-w- c:\windows\SysWow64\deployJava1.dll
2013-04-14 23:32 . 2012-03-09 20:32 72702784 —-a-w- c:\windows\system32\MRT.exe
2013-04-14 22:36 . 2012-04-05 20:59 691592 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-04-14 22:36 . 2012-02-29 21:28 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-04-02 00:29 . 2012-02-29 21:30 29480 —-a-w- c:\windows\SysWow64\msxml3a.dll
2013-04-02 00:29 . 2013-03-18 16:02 505128 —-a-w- c:\windows\SysWow64\msvcp71.dll
2013-03-23 01:09 . 2013-03-23 01:09 354656 —-a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2013-03-18 16:20 . 2013-03-18 16:20 172032 —-a-w- c:\windows\SysWow64\AniGIF.ocx
2013-03-16 15:53 . 2013-03-16 15:53 1054720 —-a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-16 15:53 . 2013-03-16 15:53 719360 —-a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-03-16 15:53 . 2013-03-16 15:53 226304 —-a-w- c:\windows\system32\elshyph.dll
2013-03-16 15:53 . 2013-03-16 15:53 185344 —-a-w- c:\windows\SysWow64\elshyph.dll
2013-03-16 15:53 . 2013-03-16 15:53 158720 —-a-w- c:\windows\SysWow64\msls31.dll
2013-03-16 15:53 . 2013-03-16 15:53 150528 —-a-w- c:\windows\SysWow64\iexpress.exe
2013-03-16 15:53 . 2013-03-16 15:53 138752 —-a-w- c:\windows\SysWow64\wextract.exe
2013-03-16 15:53 . 2013-03-16 15:53 73728 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-03-16 15:53 . 2013-03-16 15:53 61952 —-a-w- c:\windows\SysWow64\tdc.ocx
2013-03-16 15:53 . 2013-03-16 15:53 523264 —-a-w- c:\windows\SysWow64\vbscript.dll
2013-03-16 15:53 . 2013-03-16 15:53 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll
2013-03-16 15:53 . 2013-03-16 15:53 38400 —-a-w- c:\windows\SysWow64\imgutil.dll
2013-03-16 15:53 . 2013-03-16 15:53 361984 —-a-w- c:\windows\SysWow64\html.iec
2013-03-16 15:53 . 2013-03-16 15:53 1441280 —-a-w- c:\windows\SysWow64\inetcpl.cpl
2013-03-16 15:53 . 2013-03-16 15:53 137216 —-a-w- c:\windows\SysWow64\ieUnatt.exe
2013-03-16 15:53 . 2013-03-16 15:53 12800 —-a-w- c:\windows\SysWow64\mshta.exe
2013-03-16 15:53 . 2013-03-16 15:53 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-03-16 15:53 . 2013-03-16 15:53 97280 —-a-w- c:\windows\system32\mshtmled.dll
2013-03-16 15:53 . 2013-03-16 15:53 905728 —-a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-16 15:53 . 2013-03-16 15:53 81408 —-a-w- c:\windows\system32\icardie.dll
2013-03-16 15:53 . 2013-03-16 15:53 762368 —-a-w- c:\windows\system32\ieapfltr.dll
2013-03-16 15:53 . 2013-03-16 15:53 452096 —-a-w- c:\windows\system32\dxtmsft.dll
2013-03-16 15:53 . 2013-03-16 15:53 441856 —-a-w- c:\windows\system32\html.iec
2013-03-16 15:53 . 2013-03-16 15:53 281600 —-a-w- c:\windows\system32\dxtrans.dll
2013-03-16 15:53 . 2013-03-16 15:53 27648 —-a-w- c:\windows\system32\licmgr10.dll
2013-03-16 15:53 . 2013-03-16 15:53 270848 —-a-w- c:\windows\system32\iedkcs32.dll
2013-03-16 15:53 . 2013-03-16 15:53 247296 —-a-w- c:\windows\system32\webcheck.dll
2013-03-16 15:53 . 2013-03-16 15:53 235008 —-a-w- c:\windows\system32\url.dll
2013-03-16 15:53 . 2013-03-16 15:53 23040 —-a-w- c:\windows\SysWow64\licmgr10.dll
2013-03-16 15:53 . 2013-03-16 15:53 216064 —-a-w- c:\windows\system32\msls31.dll
2013-03-16 15:53 . 2013-03-16 15:53 197120 —-a-w- c:\windows\system32\msrating.dll
2013-03-16 15:53 . 2013-03-16 15:53 167424 —-a-w- c:\windows\system32\iexpress.exe
2013-03-16 15:53 . 2013-03-16 15:53 1509376 —-a-w- c:\windows\system32\inetcpl.cpl
2013-03-16 15:53 . 2013-03-16 15:53 144896 —-a-w- c:\windows\system32\wextract.exe
2013-03-16 15:53 . 2013-03-16 15:53 1400416 —-a-w- c:\windows\system32\ieapfltr.dat
2013-03-16 15:53 . 2013-03-16 15:53 102912 —-a-w- c:\windows\system32\inseng.dll
2013-03-16 15:52 . 2013-03-16 15:52 599552 —-a-w- c:\windows\system32\vbscript.dll
2013-03-16 15:52 . 2013-03-16 15:52 92160 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-16 15:52 . 2013-03-16 15:52 77312 —-a-w- c:\windows\system32\tdc.ocx
2013-03-16 15:52 . 2013-03-16 15:52 62976 —-a-w- c:\windows\system32\pngfilt.dll
2013-03-16 15:52 . 2013-03-16 15:52 52224 —-a-w- c:\windows\system32\msfeedsbs.dll
2013-03-16 15:52 . 2013-03-16 15:52 51200 —-a-w- c:\windows\system32\imgutil.dll
2013-03-16 15:52 . 2013-03-16 15:52 48640 —-a-w- c:\windows\system32\mshtmler.dll
2013-03-16 15:52 . 2013-03-16 15:52 173568 —-a-w- c:\windows\system32\ieUnatt.exe
2013-03-16 15:52 . 2013-03-16 15:52 149504 —-a-w- c:\windows\system32\occache.dll
2013-03-16 15:52 . 2013-03-16 15:52 13824 —-a-w- c:\windows\system32\mshta.exe
2013-03-16 15:52 . 2013-03-16 15:52 136192 —-a-w- c:\windows\system32\iepeers.dll
2013-03-16 15:52 . 2013-03-16 15:52 135680 —-a-w- c:\windows\system32\IEAdvpack.dll
2013-03-16 15:52 . 2013-03-16 15:52 12800 —-a-w- c:\windows\system32\msfeedssync.exe
2013-03-15 05:53 . 2013-02-24 02:03 15508512 —-a-w- c:\windows\system32\nvwgf2umx.dll
2013-03-15 05:53 . 2013-02-24 02:03 1118776 —-a-w- c:\windows\system32\nvumdshimx.dll
2013-03-15 05:53 . 2013-02-24 02:03 17990800 —-a-w- c:\windows\system32\nvd3dumx.dll
2013-03-15 05:53 . 2013-02-24 02:03 15042928 —-a-w- c:\windows\SysWow64\nvd3dum.dll
2013-03-15 05:53 . 2013-02-24 02:03 2864144 —-a-w- c:\windows\system32\nvapi64.dll
2013-03-15 04:16 . 2013-02-24 02:04 3477280 —-a-w- c:\windows\system32\nvsvc64.dll
2013-03-15 04:16 . 2013-02-24 02:04 6398240 —-a-w- c:\windows\system32\nvcpl.dll
2013-03-15 04:16 . 2013-02-24 02:04 877856 —-a-w- c:\windows\system32\nvvsvc.exe
2013-03-15 04:16 . 2013-02-24 02:04 63776 —-a-w- c:\windows\system32\nvshext.dll
2013-03-15 04:16 . 2013-02-24 02:04 237856 —-a-w- c:\windows\system32\nvmctray.dll
2013-03-15 02:07 . 2013-03-15 02:07 559904 —-a-w- c:\windows\SysWow64\nvStreaming.exe
2013-03-13 16:24 . 2013-02-24 02:04 3065455 —-a-w- c:\windows\system32\nvcoproc.bin
2013-03-12 05:10 . 2010-11-21 03:27 282744 ——w- c:\windows\system32\MpSigStub.exe
2013-02-12 05:45 . 2013-03-16 15:12 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-16 15:12 308736 —-a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-16 15:12 111104 —-a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 05:45 . 2013-03-16 15:12 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 04:48 . 2013-03-16 15:12 474112 —-a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-16 15:12 2176512 —-a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-03-16 15:49 19968 —-a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-10 03:25 . 2013-02-24 02:03 1807136 —-a-w- c:\windows\system32\nvdispco6420294.dll
2013-02-10 03:25 . 2013-02-24 02:03 1510176 —-a-w- c:\windows\system32\nvdispgenco6420162.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Norton Online Backup"=c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
""=
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
"PDF Complete"=c:\program files (x86)\PDF Complete\pdfsty.exe
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"dcmsvc"=c:\program files (x86)\dcmsvc\dcmsvc.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"DivXMediaServer"=c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"amd_dc_opt"=c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
"LaunchHPOSIAPP"=c:\program files (x86)\Hewlett-Packard\HP Keyboard\LaunchApp.exe
"AML Registry Cleaner"=c:\program files (x86)\AML Products\Registry Cleaner\regclean.exe /min
.
R2 CLKMSVC10_38F51D56;CyberLink Product - 2013/04/01 20:34;c:\program files (x86)\Cyberlink\PowerDVD10\NavFilter\kmsvc.exe [2011-02-25 241648]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-07 676936]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~2\SPEEDB~1\VideoAcceleratorService.exe [2013-03-18 277744]
R3 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]
R3 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R3 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-09 1255736]
R4 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-09-07 140672]
R4 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-02 89600]
R4 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [2011-08-16 16384]
R4 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R4 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 ahcix64s;ahcix64s;c:\windows\system32\drivers\ahcix64s.sys [2011-08-16 280656]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1403010.016\SYMDS64.SYS [2013-01-22 493656]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1403010.016\SYMEFA64.SYS [2013-01-31 1139800]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-04-12 1390680]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1403010.016\ccSetx64.sys [2012-11-16 168096]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20130426.001\IDSvia64.sys [2013-04-13 513184]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1403010.016\Ironx64.SYS [2012-11-16 224416]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1403010.016\SYMNETS.SYS [2013-01-31 432800]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [2011-05-13 128904]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-07 399432]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe [2012-12-24 144520]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-08-12 1128952]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-03-06 39056]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-03-15 383264]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 47616]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-04-15 138912]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-07 25928]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2012-12-06 2350176]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2013-01-05 50800]
S3 RTCore64;RTCore64;c:\program files (x86)\EVGA Precision X\RTCore64.sys [2013-04-05 15176]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-07-09 708200]
S3 tihub3;TI USB3 Hub Service;c:\windows\system32\drivers\tihub3.sys [2011-12-29 136000]
S3 tixhci;TI XHCI Service;c:\windows\system32\drivers\tixhci.sys [2011-12-29 409408]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2011-08-16 47232]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - CLKMDRV10_38F51D56
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23 16:33]
.
2013-04-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-23 16:33]
.
2013-04-29 c:\windows\Tasks\HPCeeScheduleForCry Havoc.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 12:43]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BeatsOSDApp"="c:\program files\IDT\WDM\beats64.exe" [2011-12-23 37888]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-04-25 1425408]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.onthestart.com/auto2.asp?pageid=6078
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
LSP: c:\program files (x86)\SpeedBit Video Accelerator\LSP3.3.6.3\SBLSP.dll
TCP: DhcpNameServer = [removed] [removed] [removed]
FF - ProfilePath - c:\users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\
FF - prefs.js: browser.search.selectedEngine - Dogpile
FF - prefs.js: browser.startup.homepage - hxxp://www.onthestart.com/auto2.asp?pageid=6078
FF - ExtSQL: 2013-04-14 10:44; {e968fc70-8f95-4ab9-9e79-304de2a71ee1}; c:\users\Cry Havoc\AppData\Roaming\Mozilla\Firefox\Profiles\e5zgtxr7.default-1353468220625\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Macromedia Shockwave Player - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\20.3.1.22\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,38,12,8d,ec,f8,
7b,2b,25,27,06,e7,c4,bc,f0,98,15,0d,de
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,38,12,87,c0,5a,
34,53,fa,ab,0e,f7,66,0f,49,11,3f,d6,de
"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,
36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0
"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,
57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b
"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,38,12,60,d8,39,
64,cd,04,79,07,f5,b7,d6,9a,c1,81,e0,1c
"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,
69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:68,0e,84,80,03,d0,cd,01
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe
c:\program files (x86)\EVGA Precision X\EVGAPrecision.exe
c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
.
**************************************************************************
.
Completion time: 2013-04-29 10:18:11 - machine was rebooted
ComboFix-quarantined-files.txt 2013-04-29 14:18
ComboFix2.txt 2013-04-26 16:35
.
Pre-Run: 582,482,128,896 bytes free
Post-Run: 582,153,965,568 bytes free
.
- - End Of File - - C04D471ABAE5796168D6B05895B827E4