Spyware / Malware / Virus Removal

Strange pop-up when starting pc [Solved]

12 min read

Looking for the outcome? Ask AI

Miathan Topic Starter

Post #1May 21, 2013, 4:37 PM UTC

Hi everybody,

I hope you can help me. I have a strange problem, which I cannot fix.

A couple of days ago, by accident, I opened a exe file which had just downloaded on my computer. I immedately scanned the c-drive with Windows Defendere and sure enough, it found a Trojan virus (Trojan:Win32/Urausy.C). I let Windows Defenfer delete it and ran a complete scan. Again, Defender found a virus (the same virus Trojan:Win32/Urausy.C) which I deleted.

But from then on I noticed a DOS pop-up when starting my pc. It flashes on the screen for a split second and disappears. Again a complete scan with Windows Defender. Now it found the Trojan:Win32/VB.AIX virus. Of course I deleted it.

However, the pop-up remained. Yesterday evening I again did a complete scan with Windows Defender, but the program did not find anything. Unfortunately, the pop-up still remains.

I have the feeling that something is still running on my pc. Please help me remove it.

Below are my HijackThis scanresults:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:22:39, on 21-5-2013
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v10.0 (10.00.9200.16518)
Boot mode: Normal

Running processes:
C:\Users\Ed\Program Files (x86)\DNA\btdna.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
D:\Ed\Desktop\HiJackThis.exe
C:\WINDOWS\SysWOW64\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.delta-search.com/?affID=119816…68D1C6F65C54DEC
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll
O3 - Toolbar: Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Ed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe -mini
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Ed\Program Files (x86)\DNA\btdna.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files (x86)\OpenSubtitlesPlayer\ALLUpdate.exe" "sleep"
O4 - HKCU\..\Run: [HKCU] C:\Users\Ed\AppData\Roaming\HKLM\rundll.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe
O9 - Extra 'Tools' menuitem: Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe
O9 - Extra button: (no name) - {64964764-1101-4bbd-8891-B56B1A53B9B3} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Classic Shell Service (ClassicShellService) - IvoSoft - C:\Program Files\Classic Shell\ClassicShellService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\WINDOWS\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 9771 bytes

Thanks in advance for your help!

Kind regards,
Ed

OCD

Post #2May 26, 2013, 2:53 PM UTC

Hi Miathan,

Sorry for the delay responding to your post. It's been a few days since you generated the logs posted, please run these tools to give me a fresh look.

=========================

1. Security Check

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Right click SecurityCheck.exe, select "Run as Administrator" and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

2. aswMBR

Download aswMBR.exe and save it to your desktop.

Right click and select "Run as Administrator".

When asked if you want to download Avast's virus definitions please select Yes.
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

=========================

3. OTL

Download OTL to your desktop.
Make sure all other windows are closed and to let it run uninterrupted.
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true
%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
BASESERVICES
DRIVES
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
- You may need two posts to fit them both in.

=========================

In your next post please provide the following:
checkup.txt
aswMBR.txt
attach MBR.zip
OTL.txt
Extras.txt
Symptoms you are experiencing

Miathan

Post #3May 26, 2013, 5:03 PM UTC

HI OCD, no problem for the delay. I'm just glad that you're helping out. Keep up the good work!

Here are my logs:

_________________________________________

1. Security Check

Results of screen317's Security Check version 0.99.64
x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 21
Adobe Flash Player 11.7.700.202
Adobe Reader XI
Google Chrome 27.0.1453.93
Google Chrome 27.0.1453.94
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
Windows Defender MsMpEng.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

_________________________________________

2. aswMBR

No logs. I downloaded the file and ran it as instructed. During the scan the program stopped and a error-message popped up: "avast! Antirootkit does not work anymore" (This is my own translation of the message, I run a Dutch version of Windows). Only option was to close the program. I downloaded the file again, but the scan stopped at the same place. Finally I tried to run the scan with Windows Defender switched off, but got the same result…

_________________________________________

3a. OTL

OTL.txt:

OTL logfile created on: 26-5-2013 17:58:23 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = D:\Ed\Desktop
64bit- Professional (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16580)
Locale: 00000413 | Country: Nederland | Language: NLD | Date Format: d-M-yyyy

3,98 Gb Total Physical Memory | 2,63 Gb Available Physical Memory | 65,97% Memory free
7,98 Gb Paging File | 6,26 Gb Available in Paging File | 78,39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 167,58 Gb Total Space | 26,62 Gb Free Space | 15,89% Space Free | Partition Type: NTFS
Drive D: | 219,73 Gb Total Space | 173,39 Gb Free Space | 78,91% Space Free | Partition Type: NTFS
Drive E: | 351,56 Gb Total Space | 324,92 Gb Free Space | 92,42% Space Free | Partition Type: NTFS
Drive F: | 360,22 Gb Total Space | 325,38 Gb Free Space | 90,33% Space Free | Partition Type: NTFS
Drive H: | 465,76 Gb Total Space | 156,04 Gb Free Space | 33,50% Space Free | Partition Type: NTFS
Drive N: | 1,82 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: ED-PC | User Name: Ed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - D:\Ed\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
PRC - C:\Program Files\Classic Shell\ClassicShellService.exe (IvoSoft)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\d29382ad4b800178b51631569c928f0b\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5cb0754debdf19b9f0d63d4d8721f532\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\398e7010fffe84888b310c1ad6c02e74\WindowsBase.ni.dll ()
MOD - C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e2f7dbe3bf08df200a4cdcf2e0eb82fa\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0d949755951d5b5e3472bde406ea02dd\IAStorUtil.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorCommon\3d20a38dd44a0ba3ddce6d96d7bee685\IAStorCommon.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\ae31f7dc9817e359d05c9c8efdd5f359\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7e6b074d3f3e3cc8e0270a3552c47aaa\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\28c2c6e7f48ff80c680a97b08df66a72\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\8d2929ad589e1092eb62a43424361465\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_nl_b77a5c561934e089\mscorlib.resources.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (AudioEndpointBuilder) – C:\Windows\SysNative\AudioEndpointBuilder.dll (Microsoft Corporation)
SRV:64bit: - (ClassicShellService) – C:\Program Files\Classic Shell\ClassicShellService.exe (IvoSoft)
SRV:64bit: - (TimeBroker) – C:\Windows\SysNative\TimeBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (SystemEventsBroker) – C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (netprofm) – C:\Windows\SysNative\netprofmsvc.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (wlidsvc) – C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
SRV:64bit: - (LSM) – C:\Windows\SysNative\lsm.dll (Microsoft Corporation)
SRV:64bit: - (PrintNotify) – C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV:64bit: - (WSService) – C:\Windows\SysNative\WSService.dll (Microsoft Corporation)
SRV:64bit: - (fhsvc) – C:\Windows\SysNative\fhsvc.dll (Microsoft Corporation)
SRV:64bit: - (BrokerInfrastructure) – C:\Windows\SysNative\bisrv.dll (Microsoft Corporation)
SRV:64bit: - (WiaRpc) – C:\Windows\SysNative\wiarpc.dll (Microsoft Corporation)
SRV:64bit: - (Wcmsvc) – C:\Windows\SysNative\wcmsvc.dll (Microsoft Corporation)
SRV:64bit: - (VaultSvc) – C:\Windows\SysNative\vaultsvc.dll (Microsoft Corporation)
SRV:64bit: - (svsvc) – C:\Windows\SysNative\svsvc.dll (Microsoft Corporation)
SRV:64bit: - (Netlogon) – C:\Windows\SysNative\netlogon.dll (Microsoft Corporation)
SRV:64bit: - (NcaSvc) – C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
SRV:64bit: - (NcdAutoSetup) – C:\Windows\SysNative\NcdAutoSetup.dll (Microsoft Corporation)
SRV:64bit: - (KeyIso) – C:\Windows\SysNative\keyiso.dll (Microsoft Corporation)
SRV:64bit: - (EFS) – C:\Windows\SysNative\efssvc.dll (Microsoft Corporation)
SRV:64bit: - (DsmSvc) – C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
SRV:64bit: - (DeviceAssociationService) – C:\Windows\SysNative\das.dll (Microsoft Corporation)
SRV:64bit: - (AllUserInstallAgent) – C:\Windows\SysNative\AUInstallAgent.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (vmicvss) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmictimesync) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicshutdown) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicrdv) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmickvpexchange) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicheartbeat) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (HiPatchService) – C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PrintNotify) – C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV - (StorSvc) – C:\Windows\SysWOW64\StorSvc.dll (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (dtsoftbus01) – C:\Windows\SysNative\Drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (spaceport) – C:\Windows\SysNative\Drivers\spaceport.sys (Microsoft Corporation)
DRV:64bit: - (USBXHCI) – C:\Windows\SysNative\Drivers\USBXHCI.SYS (Microsoft Corporation)
DRV:64bit: - (storahci) – C:\Windows\SysNative\Drivers\storahci.sys (Microsoft Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\Drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\Drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (pdc) – C:\Windows\SysNative\Drivers\pdc.sys (Microsoft Corporation)
DRV:64bit: - (USBHUB3) – C:\Windows\SysNative\Drivers\USBHUB3.SYS (Microsoft Corporation)
DRV:64bit: - (BthAvrcpTg) – C:\Windows\SysNative\Drivers\BthAvrcpTg.sys (Microsoft Corporation)
DRV:64bit: - (WdBoot) – C:\Windows\SysNative\Drivers\WdBoot.sys (Microsoft Corporation)
DRV:64bit: - (WdFilter) – C:\Windows\SysNative\Drivers\WdFilter.sys (Microsoft Corporation)
DRV:64bit: - (msgpiowin32) – C:\Windows\SysNative\Drivers\msgpiowin32.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\Drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (bthhfhid) – C:\Windows\SysNative\Drivers\BthhfHid.sys (Microsoft Corporation)
DRV:64bit: - (hidi2c) – C:\Windows\SysNative\Drivers\hidi2c.sys (Microsoft Corporation)
DRV:64bit: - (FxPPM) – C:\Windows\SysNative\Drivers\fxppm.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\Drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (sdstor) – C:\Windows\SysNative\Drivers\sdstor.sys (Microsoft Corporation)
DRV:64bit: - (dam) – C:\Windows\SysNative\Drivers\dam.sys (Microsoft Corporation)
DRV:64bit: - (UCX01000) – C:\Windows\SysNative\Drivers\UCX01000.SYS (Microsoft Corporation)
DRV:64bit: - (GPIOClx0101) – C:\Windows\SysNative\Drivers\msgpioclx.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\Drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\Drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\Drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) – C:\WINDOWS\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (condrv) – C:\Windows\SysNative\Drivers\condrv.sys (Microsoft Corporation)
DRV:64bit: - (VSTXRAID) – C:\Windows\SysNative\Drivers\VSTXRAID.SYS (VIA Corporation)
DRV:64bit: - (VerifierExt) – C:\Windows\SysNative\Drivers\VerifierExt.sys (Microsoft Corporation)
DRV:64bit: - (UASPStor) – C:\Windows\SysNative\Drivers\uaspstor.sys (Microsoft Corporation)
DRV:64bit: - (acpiex) – C:\Windows\SysNative\Drivers\acpiex.sys (Microsoft Corporation)
DRV:64bit: - (mvumis) – C:\Windows\SysNative\Drivers\mvumis.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\Drivers\stexstor.sys (Promise Technology, Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\Drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (LSI_SSS) – C:\Windows\SysNative\Drivers\lsi_sss.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\Drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (EhStorTcgDrv) – C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys (Microsoft Corporation)
DRV:64bit: - (EhStorClass) – C:\Windows\SysNative\Drivers\EhStorClass.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\Drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (3ware) – C:\Windows\SysNative\Drivers\3ware.sys (LSI)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\Drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\Drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (CLFS) – C:\Windows\SysNative\Drivers\clfs.sys (Microsoft Corporation)
DRV:64bit: - (WFPLWFS) – C:\Windows\SysNative\Drivers\wfplwfs.sys (Microsoft Corporation)
DRV:64bit: - (vpci) – C:\Windows\SysNative\Drivers\vpci.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) – C:\Windows\SysNative\Drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (mshidumdf) – C:\Windows\SysNative\Drivers\mshidumdf.sys (Microsoft Corporation)
DRV:64bit: - (BasicDisplay) – C:\Windows\SysNative\Drivers\BasicDisplay.sys (Microsoft Corporation)
DRV:64bit: - (HyperVideo) – C:\Windows\SysNative\Drivers\HyperVideo.sys (Microsoft Corporation)
DRV:64bit: - (BasicRender) – C:\Windows\SysNative\Drivers\BasicRender.sys (Microsoft Corporation)
DRV:64bit: - (gencounter) – C:\Windows\SysNative\Drivers\vmgencounter.sys (Microsoft Corporation)
DRV:64bit: - (kdnic) – C:\Windows\SysNative\Drivers\kdnic.sys (Microsoft Corporation)
DRV:64bit: - (acpitime) – C:\Windows\SysNative\Drivers\acpitime.sys (Microsoft Corporation)
DRV:64bit: - (npsvctrig) – C:\Windows\SysNative\Drivers\npsvctrig.sys (Microsoft Corporation)
DRV:64bit: - (WpdUpFltr) – C:\Windows\SysNative\Drivers\WpdUpFltr.sys (Microsoft Corporation)
DRV:64bit: - (acpipagr) – C:\Windows\SysNative\Drivers\acpipagr.sys (Microsoft Corporation)
DRV:64bit: - (hyperkbd) – C:\Windows\SysNative\Drivers\hyperkbd.sys (Microsoft Corporation)
DRV:64bit: - (SerCx) – C:\Windows\SysNative\Drivers\SerCx.sys (Microsoft Corporation)
DRV:64bit: - (SpbCx) – C:\Windows\SysNative\Drivers\SpbCx.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\Drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (BthHFEnum) – C:\Windows\SysNative\Drivers\bthhfenum.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\Drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\Drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (Vid) – C:\Windows\SysNative\Drivers\Vid.sys (Microsoft Corporation)
DRV:64bit: - (storvsp) – C:\Windows\SysNative\Drivers\storvsp.sys (Microsoft Corporation)
DRV:64bit: - (wpcfltr) – C:\Windows\SysNative\Drivers\wpcfltr.sys (Microsoft Corporation)
DRV:64bit: - (vmbusr) – C:\Windows\SysNative\Drivers\vmbusr.sys (Microsoft Corporation)
DRV:64bit: - (vpcivsp) – C:\Windows\SysNative\Drivers\vpcivsp.sys (Microsoft Corporation)
DRV:64bit: - (NdisImPlatform) – C:\Windows\SysNative\Drivers\NdisImPlatform.sys (Microsoft Corporation)
DRV:64bit: - (MsLldp) – C:\Windows\SysNative\Drivers\mslldp.sys (Microsoft Corporation)
DRV:64bit: - (Ndu) – C:\Windows\SysNative\Drivers\Ndu.sys (Microsoft Corporation)
DRV:64bit: - (RTL8168) – C:\Windows\SysNative\Drivers\Rt630x64.sys (Realtek )
DRV:64bit: - (MotioninJoyXFilter) – C:\Windows\SysNative\Drivers\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (mvs91xx) – C:\Windows\SysNative\Drivers\mvs91xx.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\Drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\Drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\Drivers\xusb21.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\..\SearchScopes\{68664A86-BEA6-4825-AD1C-D665EE1478EF}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searcerms}…amp;FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Ed\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\Ed\Program Files (x86)\DNA [2013-04-30 08:52:52 | 000,000,000 | —D | M]

[2013-04-30 16:30:37 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.nl/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: Mahjong Words 2 = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\akoaibgodkfmengiiainfdbjmmamfall\1.0.0.1_0\
CHR - Extension: Google Documenten = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Eredan iTCG = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdakdeclmfcolipiknbfealnjddfibfo\1_0\
CHR - Extension: YouTube = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4_0\
CHR - Extension: Star Legends = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\chcaflnbhnoegjedbjaamecefhglfamc\2.0.0.0_0\
CHR - Extension: Google Zoeken = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Pirates: Tides of Fortune = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\djlmofcgpnpnhlbkgbpenbecfboohcka\0.88_0\
CHR - Extension: Dragon's Call II = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\fekbihbhfoldbdbjkldepljgmfanhmlo\0.0.0.1_0\
CHR - Extension: Landleven = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgecadidkhhfaficfmhhhepidppfgbmi\2_0\
CHR - Extension: AdBlock = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.63_0\
CHR - Extension: Korelos = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\ididohflghloplfpbdgjfebnociebggh\1.0.0_0\
CHR - Extension: Auto HD For YouTube = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\koiaokdomkpjdgniimnkhgbilbjgpeak\3.8.9_0\
CHR - Extension: FVD Video Downloader = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\5.1.4_0\
CHR - Extension: Dragons of Atlantis = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\manlnjcghdempjdpndlcmaaobbighhcf\1.6.1_0\
CHR - Extension: Pocket Legends = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhpdbcnfpodnaefldpdohoibdajcfabp\2.0.0.0_0\
CHR - Extension: Picky Wallpapers = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\odklcfojpedohplkimfdpcamkjnhanaj\1.0.0_0\
CHR - Extension: Edgeworld = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcfmpdiaehhnljpdomnggcbfofdgkmbp\1.0.1.2_0\
CHR - Extension: Gmail = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Sexy Girl Chrome Theme - Arthur = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkibpgkliocdchedibhioiibdiddomac\1.0_0\

O1 HOSTS File: ([2012-07-26 07:26:49 | 000,000,824 | —- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O2:64bit: - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (ClassicIE9BHO Class) - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)
O2 - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ClassicIE9BHO Class) - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)
O3:64bit: - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
O3 - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)
O4 - HKCU..\Run: [ALLUpdate] "C:\Program Files (x86)\OpenSubtitlesPlayer\ALLUpdate.exe" "sleep" File not found
O4 - HKCU..\Run: [BitTorrent DNA] C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (Disc Soft Ltd)
O4 - HKCU..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe (www.motioninjoy.com)
O4 - HKCU..\Run: [HKCU] C:\Users\Ed\AppData\Roaming\HKLM\rundll.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Ed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9:64bit: - Extra 'Tools' menuitem : Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe (IvoSoft)
O9 - Extra 'Tools' menuitem : Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe (IvoSoft)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B6CAFE86-9B12-4DC4-9D08-41BF24E8B9E3}: DhcpNameServer = 192.168.2.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\WINDOWS\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012-11-06 00:23:37 | 000,011,786 | —- | M] () - D:\Autokosten.xlsx – [ NTFS ]
O32 - AutoRun File - [2009-01-29 21:12:27 | 000,000,175 | R— | M] () - N:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{7bf3f3bd-8e0c-11e2-be6e-1c6f65c54dec}\Shell - "" = AutoRun
O33 - MountPoints2\{7bf3f3bd-8e0c-11e2-be6e-1c6f65c54dec}\Shell\AutoRun\command - "" = "H:\iStudio.exe"
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell - "" = AutoRun
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\AutoRun\command - "" = N:\SETUP.EXE – [2009-01-29 21:13:09 | 000,463,152 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\configure\command - "" = N:\setup.exe – [2009-01-29 21:13:09 | 000,463,152 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\install\command - "" = N:\setup.exe – [2009-01-29 21:13:09 | 000,463,152 | R— | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs:64bit: wlidsvc - C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
NetSvcs:64bit: DsmSvc - C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
NetSvcs:64bit: NcaSvc - C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
NetSvcs:64bit: SystemEventsBroker - C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013-05-26 17:47:57 | 000,602,112 | —- | C] (OldTimer Tools) – D:\Ed\Desktop\OTL.exe
[2013-05-26 17:46:45 | 004,745,728 | —- | C] (AVAST Software) – D:\Ed\Desktop\aswMBR.exe
[2013-05-24 16:21:43 | 000,000,000 | —D | C] – C:\WINDOWS\SysNative\appmgmt
[2013-05-21 18:52:25 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\jscript9.dll
[2013-05-21 18:52:21 | 000,915,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\uxtheme.dll
[2013-05-21 18:52:21 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\jscript.dll
[2013-05-21 18:52:20 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\jscript.dll
[2013-05-21 18:52:20 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msfeeds.dll
[2013-05-21 18:52:20 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\iesysprep.dll
[2013-05-21 18:52:20 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iesysprep.dll
[2013-05-21 18:52:20 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iesetup.dll
[2013-05-21 18:52:20 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ie4uinit.exe
[2013-05-21 18:52:20 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iernonce.dll
[2013-05-21 18:51:58 | 001,161,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\sppobjs.dll
[2013-05-21 18:51:57 | 001,627,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WindowsCodecs.dll
[2013-05-21 18:51:55 | 005,978,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mstscax.dll
[2013-05-21 18:51:55 | 001,048,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mfasfsrcsnk.dll
[2013-05-21 18:51:55 | 000,328,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ubpm.dll
[2013-05-21 18:51:54 | 001,149,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winmde.dll
[2013-05-21 18:51:54 | 001,101,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wmpmde.dll
[2013-05-21 18:51:54 | 000,951,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Globalization.dll
[2013-05-21 18:51:54 | 000,850,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mfasfsrcsnk.dll
[2013-05-21 18:51:54 | 000,760,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuapi.dll
[2013-05-21 18:51:54 | 000,645,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Security.Authentication.OnlineId.dll
[2013-05-21 18:51:54 | 000,389,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\BCP47Langs.dll
[2013-05-21 18:51:54 | 000,327,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\Classpnp.sys
[2013-05-21 18:51:54 | 000,309,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\BCP47Langs.dll
[2013-05-21 18:51:54 | 000,246,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\ubpm.dll
[2013-05-21 18:51:53 | 005,091,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mstscax.dll
[2013-05-21 18:51:53 | 000,893,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\winmde.dll
[2013-05-21 18:51:53 | 000,601,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Globalization.dll
[2013-05-21 18:51:53 | 000,411,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\FWPKCLNT.SYS
[2013-05-21 18:51:53 | 000,357,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\netcfgx.dll
[2013-05-21 18:51:53 | 000,332,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\storport.sys
[2013-05-21 18:51:53 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SystemEventsBrokerServer.dll
[2013-05-21 18:51:53 | 000,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\TimeBrokerServer.dll
[2013-05-21 18:51:52 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drvstore.dll
[2013-05-21 18:51:52 | 000,621,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuapi.dll
[2013-05-21 18:51:52 | 000,550,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\drvstore.dll
[2013-05-21 18:51:52 | 000,504,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Security.Authentication.OnlineId.dll
[2013-05-21 18:51:52 | 000,455,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\netcfgx.dll
[2013-05-21 18:51:52 | 000,448,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SettingSync.dll
[2013-05-21 18:51:52 | 000,356,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\SettingSync.dll
[2013-05-21 18:51:52 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\usbmon.dll
[2013-05-21 18:51:52 | 000,150,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\discan.dll
[2013-05-21 18:51:52 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\taskhost.exe
[2013-05-21 18:51:52 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wups.dll
[2013-05-21 18:51:51 | 001,619,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wucltux.dll
[2013-05-21 18:51:51 | 000,337,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\USBXHCI.SYS
[2013-05-21 18:51:51 | 000,251,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WUSettingsProvider.dll
[2013-05-21 18:51:51 | 000,194,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\sdbus.sys
[2013-05-21 18:51:51 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\storewuauth.dll
[2013-05-21 18:51:51 | 000,156,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\powercfg.cpl
[2013-05-21 18:51:51 | 000,148,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\tpm.sys
[2013-05-21 18:51:51 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\powercfg.cpl
[2013-05-21 18:51:51 | 000,141,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuwebv.dll
[2013-05-21 18:51:51 | 000,128,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SettingSyncInfo.dll
[2013-05-21 18:51:51 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuwebv.dll
[2013-05-21 18:51:51 | 000,125,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\dumpsd.sys
[2013-05-21 18:51:51 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\NdisImPlatform.dll
[2013-05-21 18:51:51 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\SettingSyncInfo.dll
[2013-05-21 18:51:51 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wudriver.dll
[2013-05-21 18:51:51 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wudriver.dll
[2013-05-21 18:51:51 | 000,077,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\storahci.sys
[2013-05-21 18:51:51 | 000,072,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\taskhostex.exe
[2013-05-21 18:51:51 | 000,071,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WSDPrintProxy.DLL
[2013-05-21 18:51:51 | 000,058,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuauclt.exe
[2013-05-21 18:51:51 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\DevDispItemProvider.dll
[2013-05-21 18:51:50 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuapp.exe
[2013-05-21 18:51:50 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\DevDispItemProvider.dll
[2013-05-21 18:51:50 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuapp.exe
[2013-05-21 18:51:44 | 014,267,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wmp.dll
[2013-05-21 18:51:44 | 013,648,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.UI.Xaml.dll
[2013-05-21 18:51:44 | 003,552,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\tquery.dll
[2013-05-21 18:51:43 | 011,878,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wmp.dll
[2013-05-21 18:51:42 | 010,789,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll
[2013-05-21 18:51:42 | 002,767,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\tquery.dll
[2013-05-21 18:51:42 | 002,107,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssrch.dll
[2013-05-21 18:51:41 | 001,593,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssrch.dll
[2013-05-21 18:51:40 | 010,116,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\twinui.dll
[2013-05-21 18:51:40 | 008,857,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\twinui.dll
[2013-05-21 18:51:40 | 001,829,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ntdll.dll
[2013-05-21 18:51:39 | 001,444,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\MSAudDecMFT.dll
[2013-05-21 18:51:38 | 001,113,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\MSAudDecMFT.dll
[2013-05-21 18:51:38 | 000,446,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioSes.dll
[2013-05-21 18:51:38 | 000,403,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssph.dll
[2013-05-21 18:51:38 | 000,306,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kd_02_10ec.dll
[2013-05-21 18:51:38 | 000,298,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\rsaenh.dll
[2013-05-21 18:51:37 | 002,303,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\authui.dll
[2013-05-21 18:51:37 | 002,035,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\authui.dll
[2013-05-21 18:51:37 | 001,403,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winload.efi
[2013-05-21 18:51:37 | 000,804,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\RecoveryDrive.exe
[2013-05-21 18:51:37 | 000,595,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Networking.dll
[2013-05-21 18:51:37 | 000,489,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioEng.dll
[2013-05-21 18:51:37 | 000,456,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wpncore.dll
[2013-05-21 18:51:37 | 000,435,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssph.dll
[2013-05-21 18:51:37 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Networking.BackgroundTransfer.dll
[2013-05-21 18:51:37 | 000,373,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SearchProtocolHost.exe
[2013-05-21 18:51:37 | 000,367,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\conhost.exe
[2013-05-21 18:51:37 | 000,253,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\audiodg.exe
[2013-05-21 18:51:37 | 000,172,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\dwmredir.dll
[2013-05-21 18:51:36 | 001,267,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winload.exe
[2013-05-21 18:51:36 | 001,217,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winresume.efi
[2013-05-21 18:51:36 | 001,093,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winresume.exe
[2013-05-21 18:51:36 | 000,523,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\XpsGdiConverter.dll
[2013-05-21 18:51:36 | 000,503,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ci.dll
[2013-05-21 18:51:36 | 000,468,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\MFMediaEngine.dll
[2013-05-21 18:51:36 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\fhengine.dll
[2013-05-21 18:51:36 | 000,196,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\dmvdsitf.dll
[2013-05-21 18:51:35 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\actxprxy.dll
[2013-05-21 18:51:35 | 000,659,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssvp.dll
[2013-05-21 18:51:35 | 000,411,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Networking.dll
[2013-05-21 18:51:35 | 000,284,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\spaceport.sys
[2013-05-21 18:51:35 | 000,281,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mfreadwrite.dll
[2013-05-21 18:51:35 | 000,268,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Networking.BackgroundTransfer.dll
[2013-05-21 18:51:35 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SearchFilterHost.exe
[2013-05-21 18:51:35 | 000,169,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioEndpointBuilder.dll
[2013-05-21 18:51:35 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Robocopy.exe
[2013-05-21 18:51:35 | 000,123,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wscapi.dll
[2013-05-21 18:51:35 | 000,077,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kdvm.dll
[2013-05-21 18:51:34 | 000,745,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssvp.dll
[2013-05-21 18:51:34 | 000,419,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\intl.cpl
[2013-05-21 18:51:34 | 000,414,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\GenuineCenter.dll
[2013-05-21 18:51:34 | 000,364,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\XpsGdiConverter.dll
[2013-05-21 18:51:34 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mfreadwrite.dll
[2013-05-21 18:51:34 | 000,210,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\iuilp.dll
[2013-05-21 18:51:34 | 000,155,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\dmvdsitf.dll
[2013-05-21 18:51:34 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Robocopy.exe
[2013-05-21 18:51:34 | 000,086,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kdnet.dll
[2013-05-21 18:51:34 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\hidclass.sys
[2013-05-21 18:51:34 | 000,069,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\pdc.sys
[2013-05-21 18:51:33 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\intl.cpl
[2013-05-21 18:51:33 | 000,361,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\MFMediaEngine.dll
[2013-05-21 18:51:33 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssprxy.dll
[2013-05-21 18:51:33 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msscntrs.dll
[2013-05-21 18:51:33 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\fmifs.dll
[2013-05-21 18:51:33 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\fmifs.dll
[2013-05-21 18:51:33 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msshooks.dll
[2013-05-21 18:51:33 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\msshooks.dll
[2013-05-21 18:51:24 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\shdocvw.dll
[2013-05-21 18:51:24 | 000,112,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\consent.exe
[2013-05-21 18:49:31 | 002,851,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\esent.dll
[2013-05-21 18:49:31 | 002,382,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\esent.dll
[2013-05-21 18:49:30 | 001,011,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\reseteng.dll
[2013-05-21 18:49:30 | 000,375,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\ReAgent.dll
[2013-05-21 18:49:26 | 006,987,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ntoskrnl.exe
[2013-05-21 18:21:01 | 000,388,608 | —- | C] (Trend Micro Inc.) – D:\Ed\Desktop\HiJackThis.exe
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\ProgramData\Media Center Programs
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\BioWare
[2013-05-14 21:56:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013-05-14 21:56:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Works
[2013-05-14 21:56:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Visual Studio
[2013-05-14 21:56:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2013-05-14 21:56:12 | 000,000,000 | —D | C] – C:\WINDOWS\PCHEALTH
[2013-05-14 21:55:29 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2013-05-14 21:55:18 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\Microsoft Help
[2013-05-14 21:55:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Office
[2013-05-14 21:55:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2013-05-14 21:55:06 | 000,000,000 | RH-D | C] – C:\MSOCache
[2013-05-10 12:00:57 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\Two Worlds II
[2013-05-09 18:38:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013-05-05 16:46:12 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\TERA
[2013-05-05 16:46:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
[2013-05-05 16:45:58 | 000,000,000 | —D | C] – C:\Program Files (x86)\TERA
[2013-05-05 16:24:10 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\ALLPlayer
[2013-05-02 00:54:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013-05-02 00:07:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2013-04-30 16:33:58 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DealPly
[2013-04-30 16:33:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2013-04-30 16:33:38 | 000,283,200 | —- | C] (DT Soft Ltd) – C:\WINDOWS\SysNative\drivers\dtsoftbus01.sys
[2013-04-30 16:33:36 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DAEMON Tools Lite
[2013-04-30 16:33:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\DAEMON Tools Lite
[2013-04-30 16:32:51 | 000,000,000 | —D | C] – C:\ProgramData\DAEMON Tools Lite
[2013-04-30 16:30:45 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\Bundled software uninstaller
[2013-04-30 16:30:44 | 000,000,000 | —D | C] – C:\WINDOWS\SysWow64\searchplugins
[2013-04-30 16:30:44 | 000,000,000 | —D | C] – C:\WINDOWS\SysWow64\Extensions
[2013-04-30 16:30:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013-04-30 16:30:24 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\Babylon
[2013-04-30 16:30:24 | 000,000,000 | —D | C] – C:\ProgramData\Babylon
[2013-04-30 16:30:18 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DAEMON Tools Ultra
[2013-04-30 16:29:22 | 000,000,000 | —D | C] – C:\ProgramData\DAEMON Tools Ultra
[2013-04-30 08:52:52 | 000,000,000 | —D | C] – C:\Users\Ed\Program Files (x86)
[2013-04-29 15:25:05 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\BitTorrent
[2013-04-29 15:24:59 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitTorrent
[2013-04-29 15:24:58 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\DNA
[2013-04-29 15:24:57 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DNA
[2013-04-29 15:24:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\DNA
[2013-04-29 15:24:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\BitTorrent
[2013-04-28 23:53:19 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
[2013-04-28 23:53:19 | 000,000,000 | —D | C] – C:\ProgramData\Hi-Rez Studios
[2013-04-28 23:53:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hi-Rez Studios

========== Files - Modified Within 30 Days ==========

[2013-05-26 17:52:00 | 000,000,940 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013-05-26 17:48:16 | 004,745,728 | —- | M] (AVAST Software) – D:\Ed\Desktop\aswMBR.exe
[2013-05-26 17:47:58 | 000,602,112 | —- | M] (OldTimer Tools) – D:\Ed\Desktop\OTL.exe
[2013-05-26 17:46:04 | 000,890,854 | —- | M] () – D:\Ed\Desktop\SecurityCheck.exe
[2013-05-26 17:22:00 | 000,001,048 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013-05-26 09:05:20 | 000,001,044 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013-05-26 09:04:59 | 000,067,584 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013-05-24 16:43:48 | 001,792,392 | —- | M] () – C:\WINDOWS\SysNative\PerfStringBackup.INI
[2013-05-24 16:43:48 | 000,795,678 | —- | M] () – C:\WINDOWS\SysNative\perfh013.dat
[2013-05-24 16:43:48 | 000,710,046 | —- | M] () – C:\WINDOWS\SysNative\perfh009.dat
[2013-05-24 16:43:48 | 000,158,970 | —- | M] () – C:\WINDOWS\SysNative\perfc013.dat
[2013-05-24 16:43:48 | 000,132,416 | —- | M] () – C:\WINDOWS\SysNative\perfc009.dat
[2013-05-21 19:01:59 | 268,435,456 | -HS- | M] () – C:\swapfile.sys
[2013-05-21 19:01:44 | 3207,938,048 | -HS- | M] () – C:\hiberfil.sys
[2013-05-21 18:21:02 | 000,388,608 | —- | M] (Trend Micro Inc.) – D:\Ed\Desktop\HiJackThis.exe
[2013-05-19 16:51:01 | 000,000,703 | —- | M] () – C:\Users\Ed\Application Data\Microsoft\Internet Explorer\Quick Launch\Mass Effect.lnk
[2013-05-17 21:49:23 | 000,154,283 | -H– | M] () – C:\Users\Ed\AppData\Roaming\Ed-wchelper.dll
[2013-05-14 22:03:58 | 000,601,448 | —- | M] () – D:\Ed\Documents\SVA Ouder.pdf
[2013-05-07 22:07:50 | 000,693,112 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\SysWow64\FlashPlayerApp.exe
[2013-05-07 22:07:50 | 000,078,200 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
[2013-04-30 16:33:38 | 000,283,200 | —- | M] (DT Soft Ltd) – C:\WINDOWS\SysNative\drivers\dtsoftbus01.sys

========== Files Created - No Company Name ==========

[2013-05-26 17:46:21 | 000,890,854 | —- | C] () – D:\Ed\Desktop\SecurityCheck.exe
[2013-05-21 18:51:33 | 000,387,688 | —- | C] () – C:\WINDOWS\SysNative\ApnDatabase.xml
[2013-05-19 16:51:01 | 000,000,703 | —- | C] () – C:\Users\Ed\Application Data\Microsoft\Internet Explorer\Quick Launch\Mass Effect.lnk
[2013-05-17 21:49:23 | 000,154,283 | -H– | C] () – C:\Users\Ed\AppData\Roaming\Ed-wchelper.dll
[2013-05-14 22:03:58 | 000,601,448 | —- | C] () – D:\Ed\Documents\SVA Ouder.pdf
[2013-02-28 00:56:27 | 000,083,968 | —- | C] () – C:\WINDOWS\SysWow64\OEMLicense.dll
[2013-02-23 12:08:01 | 000,000,048 | —- | C] () – C:\Users\Ed\AppData\Roaming\burnaware.ini
[2013-02-22 22:35:17 | 000,008,192 | —- | C] () – C:\WINDOWS\SysWow64\drivers\IntelMEFWVer.dll
[2013-02-22 22:29:02 | 000,000,010 | —- | C] () – C:\WINDOWS\GSetup.ini
[2013-01-11 10:16:52 | 004,336,640 | —- | C] () – C:\WINDOWS\SysWow64\x264vfw.dll
[2012-07-26 10:13:10 | 000,215,943 | —- | C] () – C:\WINDOWS\SysWow64\dssec.dat
[2012-07-26 10:13:09 | 000,000,741 | —- | C] () – C:\WINDOWS\SysWow64\NOISE.DAT
[2012-07-26 09:21:26 | 000,067,584 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2012-07-26 03:17:42 | 000,043,520 | —- | C] () – C:\WINDOWS\SysWow64\BWContextHandler.dll
[2012-07-25 22:37:29 | 000,043,131 | —- | C] () – C:\WINDOWS\mib.bin
[2012-07-25 22:28:31 | 000,364,544 | —- | C] () – C:\WINDOWS\SysWow64\msjetoledb40.dll
[2012-07-17 15:22:04 | 000,179,200 | —- | C] () – C:\WINDOWS\SysWow64\unrar.dll
[2012-07-03 03:28:06 | 000,112,640 | —- | C] () – C:\WINDOWS\SysWow64\ff_vfw.dll
[2012-06-02 16:31:19 | 000,673,088 | —- | C] () – C:\WINDOWS\SysWow64\mlang.dat
[2012-05-22 01:28:58 | 000,155,648 | —- | C] () – C:\WINDOWS\SysWow64\mlc.dll
[2011-12-08 06:32:24 | 000,216,064 | —- | C] ( ) – C:\WINDOWS\SysWow64\lagarith.dll
[2011-09-28 18:44:14 | 000,179,271 | —- | C] () – C:\WINDOWS\SysWow64\xlive.dll.cat

========== ZeroAccess Check ==========

[2013-02-23 21:14:12 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013-03-06 08:31:28 | 019,758,592 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013-03-06 07:03:37 | 017,561,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012-07-26 05:05:38 | 001,004,544 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012-07-26 05:18:27 | 000,784,896 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012-07-26 05:07:41 | 000,455,680 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013-05-25 21:26:12 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\.minecraft
[2013-04-17 21:59:53 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\Awesomium
[2013-04-30 16:30:24 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\Babylon
[2013-03-07 21:06:11 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\Belastingdienst
[2013-04-30 00:17:59 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\BitTorrent
[2013-02-23 12:45:48 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\calibre
[2013-05-17 21:49:27 | 000,000,000 | -H-D | M] – C:\Users\Ed\AppData\Roaming\D68DF59D
[2013-04-30 16:34:01 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\DAEMON Tools Lite
[2013-04-30 16:30:18 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\DAEMON Tools Ultra
[2013-04-30 16:33:58 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\DealPly
[2013-05-26 17:56:29 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\DNA
[2013-05-21 20:59:29 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\GrabIt
[2006-01-18 12:29:05 | 000,000,000 | RHSD | M] – C:\Users\Ed\AppData\Roaming\HKLM
[2013-02-23 12:19:03 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\LibreOffice
[2013-03-01 14:56:51 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\MotioninJoy
[2013-02-23 11:53:21 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\Shark007
[2013-05-24 18:18:19 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\Spotify
[2013-05-05 16:46:12 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\TERA
[2013-02-23 11:52:56 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\Win7codecs
[2013-03-03 17:43:16 | 000,000,000 | —D | M] – C:\Users\Ed\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2012-10-11 07:53:24 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=0AD19A3CA61271BA872AD90771BA47DC – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_b592a71650d677ed\explorer.exe
[2012-10-11 10:09:58 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=0DDFEAA2AA18D4295EF220EB666B2312 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_ab3dfcc41c75b5f2\explorer.exe
[2012-07-26 05:50:01 | 002,114,936 | —- | M] (Microsoft Corporation) MD5=5B6ED1B57DBFF18D405A0260559B571E – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_b4d2f8c937e166b1\explorer.exe
[2012-07-26 06:49:13 | 002,380,440 | —- | M] (Microsoft Corporation) MD5=928791755FDDEA721B053535EF84FA17 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_aa7e4e770380a4b6\explorer.exe
[2012-10-11 07:56:41 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=953ADECFF08202A01EFC6110214FDE02 – C:\Windows\SysWOW64\explorer.exe
[2012-10-11 07:56:41 | 002,115,952 | —- | M] (Microsoft Corporation) MD5=953ADECFF08202A01EFC6110214FDE02 – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_b5080a0137b9becc\explorer.exe
[2012-10-11 09:35:16 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=E13A31D5254C25406A7946BDD9B06364 – C:\Windows\explorer.exe
[2012-10-11 09:35:16 | 002,380,944 | —- | M] (Microsoft Corporation) MD5=E13A31D5254C25406A7946BDD9B06364 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_aab35faf0358fcd1\explorer.exe

< MD5 for: SERVICES.EXE >
[2012-09-20 08:33:11 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=581190907DA1CF8CB7B87B35FFE64A07 – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.20521_none_98a9ea2e9f571eb2\services.exe
[2012-07-26 07:26:45 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=754A2CC1F32107EA87CBD305ABE3E618 – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16384_none_97e26cd38667756c\services.exe
[2012-09-20 08:33:46 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE – C:\WINDOWS\SysNative\services.exe
[2012-09-20 08:33:46 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16420_none_981f4d19863a6591\services.exe

< MD5 for: SVCHOST.EXE >
[2012-07-26 05:20:58 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=0A175AF8B65797BD22C11903A8BFEB2D – C:\Windows\WinSxS\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.2.9200.16384_none_b2666581d6b482a6\svchost.exe
[2012-07-26 05:08:47 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=57350BEDE3834915B6145B67C71C7BDA – C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.2.9200.16384_none_0e8501058f11f3dc\svchost.exe
[2012-09-20 08:33:14 | 000,029,696 | —- | M] (Microsoft Corporation) MD5=607F7CB143783A8F9BA058D2FC4F2D36 – C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.2.9200.20521_none_0f4c7e60a8019d22\svchost.exe
[2012-09-20 07:55:26 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=A46DC432F81473F526E3994AA483E366 – C:\Windows\SysWOW64\svchost.exe
[2012-09-20 07:55:26 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=A46DC432F81473F526E3994AA483E366 – C:\Windows\WinSxS\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.2.9200.16420_none_b2a345c7d68772cb\svchost.exe
[2012-09-20 08:33:52 | 000,029,696 | —- | M] (Microsoft Corporation) MD5=EDE27EACE742EE2888C5DD36400A2EC0 – C:\WINDOWS\SysNative\svchost.exe
[2012-09-20 08:33:52 | 000,029,696 | —- | M] (Microsoft Corporation) MD5=EDE27EACE742EE2888C5DD36400A2EC0 – C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.2.9200.16420_none_0ec1e14b8ee4e401\svchost.exe
[2012-09-20 07:56:27 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=EEF5E64822C3E21B186EA53463BE92DA – C:\Windows\WinSxS\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.2.9200.20521_none_b32de2dcefa42bec\svchost.exe

< MD5 for: USERINIT.EXE >
[2012-07-26 05:08:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E925F7BA032920D58DD284B6181A247 – C:\WINDOWS\SysNative\userinit.exe
[2012-07-26 05:08:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E925F7BA032920D58DD284B6181A247 – C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.2.9200.16384_none_34f2617a5b742e02\userinit.exe
[2012-07-26 05:21:00 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=9F6289D194A04A09671FEED4B6CB6EF7 – C:\Windows\SysWOW64\userinit.exe
[2012-07-26 05:21:00 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=9F6289D194A04A09671FEED4B6CB6EF7 – C:\Windows\WinSxS\x86_microsoft-windows-userinit_31bf3856ad364e35_6.2.9200.16384_none_d8d3c5f6a316bccc\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012-09-20 08:33:55 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=1F84B5F8DBDFFD36DF143C61CE25F12A – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16420_none_c8c988c15e88a211\winlogon.exe
[2012-09-20 08:33:17 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=6522E98C94A2A81AE11EB66D2AF5743A – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20521_none_c95425d677a55b32\winlogon.exe
[2012-07-26 05:08:50 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=93AB226C07A9789B2EC7B41F73602F76 – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16384_none_c88ca87b5eb5b1ec\winlogon.exe
[2012-10-11 07:46:58 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=BCF2036A0DD579E47C008C133550283E – C:\WINDOWS\SysNative\winlogon.exe
[2012-10-11 07:46:58 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=BCF2036A0DD579E47C008C133550283E – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16433_none_c8c1b9b35e8e0a07\winlogon.exe
[2012-10-11 07:45:27 | 000,517,120 | —- | M] (Microsoft Corporation) MD5=CBFD56B4EC07CB056A6ABD55DD33671F – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20534_none_c94c56c877aac328\winlogon.exe

< %systemroot%\*. /rp /s >

< %systemdrive%\$Recycle.Bin|@;true;true;true >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

========== Base Services ==========
SRV:64bit: - [2012-09-20 08:30:35 | 000,190,976 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\aelupsvc.dll – (AeLookupSvc)
SRV:64bit: - [2013-03-06 08:29:15 | 000,070,144 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\appinfo.dll – (Appinfo)
SRV:64bit: - [2012-07-26 05:08:16 | 000,094,208 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\alg.exe – (ALG)
SRV:64bit: - [2012-07-26 05:07:01 | 000,826,368 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\qmgr.dll – (BITS)
SRV:64bit: - [2012-11-27 06:17:32 | 000,718,848 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\BFE.DLL – (BFE)
SRV:64bit: - [2012-07-26 05:05:55 | 000,059,904 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\keyiso.dll – (KeyIso)
SRV - [2012-07-26 05:18:47 | 000,043,520 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\keyiso.dll – (KeyIso)
SRV:64bit: - [2012-07-26 05:05:36 | 000,507,904 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\es.dll – (EventSystem)
SRV - [2012-07-26 05:18:26 | 000,394,240 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\es.dll – (EventSystem)
SRV:64bit: - [2012-07-26 05:05:12 | 000,134,144 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\browser.dll – (Browser)
SRV:64bit: - [2012-07-26 05:05:21 | 000,067,584 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\cryptsvc.dll – (CryptSvc)
SRV:64bit: - [2012-07-26 05:07:06 | 000,817,152 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\rpcss.dll – (DcomLaunch)
SRV:64bit: - [2012-10-11 07:43:40 | 000,331,776 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dhcpcore.dll – (Dhcp)
SRV - [2012-10-11 07:06:02 | 000,270,336 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\dhcpcore.dll – (Dhcp)
SRV:64bit: - [2012-09-20 08:31:07 | 000,210,432 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dnsrslvr.dll – (Dnscache)
SRV:64bit: - [2012-07-26 05:05:34 | 000,105,472 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\eapsvc.dll – (Eaphost)
SRV:64bit: - [2012-07-26 05:05:46 | 000,036,352 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\hidserv.dll – (hidserv)
SRV - [2012-07-26 05:18:34 | 000,049,152 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\hidserv.dll – (hidserv)
SRV:64bit: - [2012-07-26 05:05:51 | 000,438,784 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\SysNative\ipnathlp.dll – (SharedAccess)
SRV:64bit: - [2012-07-26 05:05:51 | 000,474,624 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\IPSECSVC.DLL – (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV:64bit: - [2012-07-26 05:07:25 | 000,502,784 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\swprv.dll – (swprv)
SRV:64bit: - [2012-09-20 08:31:57 | 000,080,896 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\mmcss.dll – (MMCSS)
SRV:64bit: - [2012-07-26 05:06:34 | 000,255,488 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\netman.dll – (Netman)
SRV:64bit: - [2013-02-02 10:21:45 | 000,467,456 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\netprofmsvc.dll – (netprofm)
SRV:64bit: - [2012-09-20 08:32:17 | 000,356,352 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\nlasvc.dll – (NlaSvc)
SRV:64bit: - [2012-07-26 07:26:47 | 000,025,600 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\nsisvc.dll – (nsi)
SRV:64bit: - [2012-09-20 08:33:04 | 000,107,008 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\umpnpmgr.dll – (PlugPlay)
SRV:64bit: - [2012-07-26 05:08:47 | 000,769,024 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\spoolsv.exe – (Spooler)
No service found with a name of ProtectedStorage
No service found with a name of EMDMgmt
SRV:64bit: - [2012-07-26 05:07:03 | 000,099,840 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\rasauto.dll – (RasAuto)
SRV:64bit: - [2012-07-26 05:07:03 | 000,358,400 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\rasmans.dll – (RasMan)
SRV:64bit: - [2012-07-26 05:07:06 | 000,817,152 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\rpcss.dll – (RpcSs)
SRV:64bit: - [2012-07-26 05:07:09 | 000,030,720 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\seclogon.dll – (seclogon)
SRV:64bit: - [2012-09-20 08:33:39 | 000,035,840 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\lsass.exe – (SamSs)
SRV:64bit: - [2013-04-09 06:51:41 | 000,099,840 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wscsvc.dll – (wscsvc)
SRV:64bit: - [2012-07-26 05:07:23 | 000,309,248 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\srvsvc.dll – (LanmanServer)
SRV:64bit: - [2012-07-26 05:07:16 | 000,565,760 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\shsvcs.dll – (ShellHWDetection)
SRV - [2012-07-26 05:19:59 | 000,506,368 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\shsvcs.dll – (ShellHWDetection)
No service found with a name of slsvc
SRV:64bit: - [2013-04-09 06:50:39 | 001,285,632 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\schedsvc.dll – (Schedule)
SRV:64bit: - [2012-07-26 05:07:28 | 000,305,664 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\tapisrv.dll – (TapiSrv)
SRV - [2012-07-26 05:20:06 | 000,245,760 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysWOW64\tapisrv.dll – (TapiSrv)
SRV:64bit: - [2012-07-26 05:07:30 | 000,047,104 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\themeservice.dll – (Themes)
SRV:64bit: - [2012-07-26 05:07:00 | 000,209,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\profsvc.dll – (ProfSvc)
SRV:64bit: - [2012-07-26 05:08:49 | 001,482,752 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\VSSVC.exe – (VSS)
SRV:64bit: - [2013-04-09 06:48:42 | 000,785,408 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\audiosrv.dll – (Audiosrv)
SRV:64bit: - [2013-04-09 06:48:42 | 000,169,472 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\AudioEndpointBuilder.dll – (AudioEndpointBuilder)
SRV:64bit: - [2012-07-26 05:07:08 | 000,148,480 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\sdrsvc.dll – (SDRSVC)
SRV:64bit: - [2013-01-29 03:57:14 | 000,014,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV:64bit: - [2012-07-26 05:07:47 | 001,731,584 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wevtsvc.dll – (EventLog)
SRV:64bit: - [2012-10-11 07:44:35 | 000,904,192 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\MPSSVC.dll – (MpsSvc)
SRV:64bit: - [2012-07-26 05:07:47 | 000,570,880 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wiaservc.dll – (stisvc)
SRV:64bit: - [2012-07-26 05:08:34 | 000,124,416 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\SysNative\msiexec.exe – (msiserver)
SRV - [2012-07-26 05:20:50 | 000,062,976 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\WINDOWS\SysWow64\msiexec.exe – (msiserver)
SRV:64bit: - [2012-07-26 05:08:06 | 000,219,648 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wbem\WMIsvc.dll – (Winmgmt)
SRV:64bit: - [2013-03-02 04:45:19 | 003,240,448 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\wuaueng.dll – (wuauserv)
SRV:64bit: - [2012-07-26 05:05:31 | 000,252,928 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\dot3svc.dll – (dot3svc)
SRV:64bit: - [2012-11-06 06:19:59 | 001,386,496 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\wlansvc.dll – (WlanSvc)
SRV:64bit: - [2012-07-26 05:08:02 | 000,191,488 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\wkssvc.dll – (LanmanWorkstation)

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: OCZ-VERTEX2
Partitions: 2
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: WDC WD10EALX-009BA0
Partitions: 3
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 - External hard disk media
Interface type: USB
Media Type: External hard disk media
Model: Hitachi HDP725050GLA360 USB Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 -
Interface type: USB
Media Type:
Model: Generic- Compact Flash USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE4 -
Interface type: USB
Media Type:
Model: Generic- SM/xD-Picture USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE5 -
Interface type: USB
Media Type:
Model: Generic- SD/MMC USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE6 -
Interface type: USB
Media Type:
Model: Generic- MS/MS-Pro USB Device
Partitions: 0
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 100,00MB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 168,00GB
Starting Offset: 105906176
Hidden sectors: 0

DeviceID: Disk #1, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 220,00GB
Starting Offset: 1048576
Hidden sectors: 0

DeviceID: Disk #1, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 352,00GB
Starting Offset: 235930648576
Hidden sectors: 0

DeviceID: Disk #1, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 360,00GB
Starting Offset: 613418008576
Hidden sectors: 0

DeviceID: Disk #2, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 466,00GB
Starting Offset: 32256
Hidden sectors: 0

< End of report >

Miathan

Post #4May 26, 2013, 5:15 PM UTC

3b. OTL

Extras.txt:

OTL Extras logfile created on: 26-5-2013 17:58:23 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = D:\Ed\Desktop
64bit- Professional (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16580)
Locale: 00000413 | Country: Nederland | Language: NLD | Date Format: d-M-yyyy

3,98 Gb Total Physical Memory | 2,63 Gb Available Physical Memory | 65,97% Memory free
7,98 Gb Paging File | 6,26 Gb Available in Paging File | 78,39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 167,58 Gb Total Space | 26,62 Gb Free Space | 15,89% Space Free | Partition Type: NTFS
Drive D: | 219,73 Gb Total Space | 173,39 Gb Free Space | 78,91% Space Free | Partition Type: NTFS
Drive E: | 351,56 Gb Total Space | 324,92 Gb Free Space | 92,42% Space Free | Partition Type: NTFS
Drive F: | 360,22 Gb Total Space | 325,38 Gb Free Space | 90,33% Space Free | Partition Type: NTFS
Drive H: | 465,76 Gb Total Space | 156,04 Gb Free Space | 33,50% Space Free | Partition Type: NTFS
Drive N: | 1,82 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: ED-PC | User Name: Ed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.url[@ = InternetShortcut] – C:\WINDOWS\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\WINDOWS\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" (VideoLAN)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" (VideoLAN)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" (VideoLAN)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" (VideoLAN)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\BitTorrent\bittorrent.exe" = C:\Program Files (x86)\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – (BitTorrent Inc.)
"C:\Program Files (x86)\BitTorrent\bittorrent.exe" = C:\Program Files (x86)\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – (BitTorrent Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{27D6BE7E-27EE-4FE6-8E6E-8FFDB14B550A}" = lport=10243 | protocol=6 | dir=in | app=system |
"{3BF4F537-4EBA-48CE-966F-5B9163E5EEDE}" = rport=10243 | protocol=6 | dir=out | app=system |
"{467EC4F6-7FF4-4EFE-B33C-B94822EC9A22}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{524ACBC8-8B0A-47CF-8E24-27191471DF34}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5E161FAD-3995-40D5-A9B4-B14F150E8614}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6BFDC68E-DB91-4185-890A-C4B9D67A91FC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6CBC1808-5DAD-4766-9C76-4FC6A3C7E019}" = lport=2869 | protocol=6 | dir=in | app=system |
"{98AD0B43-D428-4B17-AAAA-4D49C9F39C4D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A2097B69-43E8-4FB6-8B33-F1103D5ED158}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{BD89DA49-2383-48D9-B596-6B39451EB309}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D088E1C9-A9A7-4E67-92A0-9C3C8C3D77CD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DC4DF42A-F9DC-42EA-A4D5-11791367BE78}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FC537BA7-C98A-4735-A1EA-6AD82DA462A6}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02A6D477-ED48-44B3-86D0-3C199701B2BB}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{04458C9A-5FAA-4DC1-B824-CC93C35F4674}" = dir=out | name=@{microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{0590822F-B0FC-469B-8D25-C72E0387E002}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\just cause 2\justcause2.exe |
"{12806334-AEDA-4B09-BB80-B9942F8F0211}" = dir=in | name=radyo |
"{13C181D3-887F-43BA-BCB0-29B9175D3620}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bastion\bastion.exe |
"{16DAE7C1-6D55-4740-9109-865208093808}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{1A639066-BE65-425E-86CC-966C8949ACE9}" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{1E57AFB9-D7BA-46AA-AD93-7C933EA3DB91}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe |
"{230ACE17-F2FE-4FB0-B1BC-D6B000231F2E}" = protocol=17 | dir=in | app=c:\program files (x86)\dna\btdna.exe |
"{2490C5B9-9E39-4D8D-A702-8D04C416F0DC}" = dir=out | name=app radio |
"{25FE319B-5330-4793-B32C-2AED39064269}" = dir=in | name=@{microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{28D15EBE-B5F2-4F66-8FED-CD501DD7333A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\two worlds ii\twoworlds2.exe |
"{2A3139BE-06BB-471B-A86C-EC7C746AEB34}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{2C04F0F5-3EF7-4F16-9E3D-6471830FBD1B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\two worlds ii\twoworlds2_dx10.exe |
"{2CB1EB30-04EF-4721-853F-ECEF21145067}" = dir=in | name=@{microsoft.reader_6.2.9200.20623_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{2D964100-F908-4677-8AF4-0A95AFE2FE4C}" = dir=out | name=@{microsoft.bingnews_1.7.0.38_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
"{2F5DF253-5A83-4ACA-8E33-02D46F9A2B6C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{32961191-4192-4BD1-B71E-3C2E5C104E8A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{375F9478-4E9E-4236-A6E6-56DAC67A25BA}" = protocol=6 | dir=out | app=system |
"{493A8A73-C8FC-4C26-95DC-8B559734117C}" = dir=out | name=@{microsoft.bingmaps_1.5.1.240_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
"{4987CD3B-E288-48A8-9B3E-F209D9B4DC57}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\two worlds ii\twoworlds2_dx10.exe |
"{49A0B9BD-BABB-493D-ACED-D3441AE95736}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4ABC03D5-8BCE-491B-8F50-62F02952EE7D}" = dir=out | name=radyo |
"{4C2B909A-DA95-4D18-8F2C-3CDD4B55E055}" = dir=in | app=c:\users\ed\appdata\local\microsoft\skydrive\skydrive.exe |
"{50320348-770C-4E92-A770-EEF657C91CCF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{51112273-A346-4AD0-9CCE-C536258798DF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5730105D-2BE8-4035-A049-32F7AE1B57E9}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1675\agent.exe |
"{59249041-5DF8-4D3F-9A6D-F5E721510441}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\bastion\bastion.exe |
"{59A44822-3ABE-4759-BB72-618C6E214FF2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5EB655E3-483B-4374-AE93-E9B20E993709}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{5EE6DFDF-2C69-4511-AB7C-1744CD6B5746}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{66874AED-283E-419A-9EA5-B0340421B81D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic 2013 demo\dotp_d13_demo.exe |
"{6A406011-3319-40B2-B818-FF6765C3D712}" = dir=out | name=@{48342d1e3dbf1.23385d3c35d_1.0.0.45_neutral__zgp850mw2wtsr?ms-resource://48342d1e3dbf1.23385d3c35d/resources/displayname} |
"{6B44EE97-FA31-43AE-AFC0-A7F781F14067}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6D8CE618-30A5-4E08-AA07-A23A2876F03B}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{702CEB3A-746A-437C-952B-11866FDF0D84}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magic 2013 demo\dotp_d13_demo.exe |
"{73A286F8-1319-4B26-92A5-E420CC34FAEA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\batman arkham asylum goty\binaries\bmlauncher.exe |
"{74B57125-E58C-40DC-A4B0-82D5CDE3C6D5}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4388.928_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
"{74D58F24-863E-4B14-B213-47611A03103A}" = protocol=17 | dir=in | app=h:\games\mass effect\binaries\masseffect.exe |
"{77B8D57E-DECF-40E4-B7D7-5E666F29A236}" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{7A1573D6-3C7A-4949-8966-A4C1125648C1}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{7A1A9F77-BC85-4679-B923-00AF5D8133C3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{7F0B13FC-6BFC-4FAD-9232-187E298924DB}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{869B2DE1-BE18-4FF5-8DCE-1C24D38ABA5D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8A16D135-B1DA-4306-B11C-CF80BC71DB75}" = dir=out | name=@{microsoft.bingtravel_1.7.0.26_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
"{8A182D8D-FE37-4310-BFED-94CEA8B6031E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8BC2D787-4B99-4D22-9AD9-AA3DEA7DC85F}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.0.1114.318_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{957909C5-999E-4913-9AA3-DDD7104576FB}" = dir=out | name=@{browserchoice_6.2.0.0_neutral_neutral_cw5n1h2txyewy?ms-resource://browserchoice/resources/displayname} |
"{9A7C5F48-A114-4204-8DE0-2DEE4244A9E8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\just cause 2\justcause2.exe |
"{9C8849BE-43A4-4195-AE21-AAD8F6235D92}" = dir=out | name=@{microsoft.bingsports_1.8.0.51_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} |
"{9D3EE1A2-D643-41A5-9072-A236C2E4DF5C}" = protocol=6 | dir=in | app=h:\games\mass effect\binaries\masseffect.exe |
"{A1766354-775F-4360-8438-11CDC1B681F6}" = dir=out | name=@{microsoft.reader_6.2.9200.20623_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{A7468C3E-BBC3-48F3-8F45-127AF8736564}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1675\agent.exe |
"{A923B63D-4DA0-4461-803D-50604718CFCA}" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{B3ADAFCE-A896-4188-A641-6D2B0A8323D4}" = dir=out | name=@{microsoft.bingweather_1.7.0.26_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
"{B8667333-226B-435C-A39E-A1C793071523}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{BD368671-B888-4234-9540-23DB43193156}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{C7D1D612-766A-43EC-B426-DEB913C1C691}" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"{CB028472-0DF3-4EC2-9130-7D794AC8ADD6}" = protocol=6 | dir=in | app=c:\program files (x86)\dna\btdna.exe |
"{CC6EACAE-7DE5-437F-A7A1-E0662AB3A8EF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\tomb raider\tombraider.exe |
"{CCD63DBE-BD51-4BA9-86D3-E0EFD178EF07}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\tomb raider\tombraider.exe |
"{CD44E866-6B04-4A71-9C97-76EE8420642D}" = dir=out | name=windows_ie_ac_001 |
"{D228422D-FEDD-4AEA-8447-A44329B2ECBD}" = dir=out | name=@{microsoft.xboxlivegames_1.2.143.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
"{D4DAE03A-8A04-49A0-8738-953633E866F9}" = protocol=6 | dir=in | app=h:\games\mass effect\masseffectlauncher.exe |
"{D5279261-0BDB-4472-95FB-A327F76ADD17}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{D87B0415-FD8A-460A-AE7C-E8DECF40E716}" = dir=in | name=@{browserchoice_6.2.0.0_neutral_neutral_cw5n1h2txyewy?ms-resource://browserchoice/resources/displayname} |
"{D8B5F31F-AA8B-4D18-B339-B3E868DA9716}" = dir=out | name=@{microsoft.bing_1.5.1.259_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{DB6C9C44-9374-4A90-B954-B9BAADA40B15}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DD7B4C66-69F6-43A4-B8DF-20EC5393B6D8}" = dir=out | name=@{microsoft.zunemusic_1.2.150.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/33273} |
"{E1CE9B26-E426-4CDD-B0DE-C871278D91CE}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.0.1114.318_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{E1F436D8-5516-4F14-91EB-9AC21BE6FFFF}" = dir=out | name=@{microsoft.zunevideo_1.2.150.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/33270} |
"{E21BB828-816D-48B1-B377-C2474EECBE04}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{E3518D53-8700-418D-9B79-C518726C2E14}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{EAC770DE-66B8-44D1-B95A-FA90F7B5A43C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\two worlds ii\twoworlds2.exe |
"{FA041077-372D-4545-9518-110C16EB1B7E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{FD894C0B-FD95-41FA-8C83-6B5F36DB4FCB}" = protocol=17 | dir=in | app=h:\games\mass effect\masseffectlauncher.exe |
"TCP Query User{08A595AA-2EA3-45FF-8644-C6C63CFFBD7D}C:\program files (x86)\entropia universe\bin32\entropia.exe" = protocol=6 | dir=in | app=c:\program files (x86)\entropia universe\bin32\entropia.exe |
"TCP Query User{1AA901B4-8067-4199-9B3A-CBAB135D1323}C:\program files (x86)\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe |
"TCP Query User{1CF1D54F-E6F3-4CC4-8380-9C166549E233}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{37D0ADB1-E26D-43F1-A1A5-9589BDD5611F}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |
"TCP Query User{41540353-8611-4D19-8E83-AFE4CD8BE8DC}C:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe |
"TCP Query User{455F481D-0153-4037-B24B-A4C6375A2A41}C:\program files (x86)\atari\tdu2\uplauncher.exe" = protocol=6 | dir=in | app=c:\program files (x86)\atari\tdu2\uplauncher.exe |
"TCP Query User{4ECD1797-4CF7-4A7E-86E7-C7A6F8A317F9}C:\program files (x86)\atari\tdu2\_uplauncher.exe" = protocol=6 | dir=in | app=c:\program files (x86)\atari\tdu2\_uplauncher.exe |
"TCP Query User{595F6016-A04A-4EAF-AC86-236DC7D23BA3}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{5F288923-83C1-442F-8D4F-A6903CD7D282}C:\program files (x86)\atari\tdu2\testdrive2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\atari\tdu2\testdrive2.exe |
"TCP Query User{705A9231-F0DB-421E-94AE-671342F33CC0}C:\users\ed\program files (x86)\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\ed\program files (x86)\dna\btdna.exe |
"TCP Query User{7ACCA6A8-CCF3-4FFE-B78A-960463A19C91}C:\program files (x86)\steam\steamapps\common\age of conan\ageofconan.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\age of conan\ageofconan.exe |
"TCP Query User{B15423DC-A773-46FA-A7A3-EF07EF6455D4}C:\users\ed\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\ed\appdata\roaming\spotify\spotify.exe |
"TCP Query User{E1135F57-9C1D-497E-B884-2F3CB600E58F}C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base24944\sc2.exe |
"TCP Query User{E9B163C4-63E5-4BF0-847E-7D928194AA79}C:\program files (x86)\tera\tera-launcher.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tera\tera-launcher.exe |
"UDP Query User{0A262D71-C7A8-43F2-AA7A-36EEFA9CC30F}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |
"UDP Query User{29552AE7-BF57-4866-9403-671A38D3D49F}C:\users\ed\program files (x86)\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\ed\program files (x86)\dna\btdna.exe |
"UDP Query User{31937D6B-0BDC-49D3-A7A0-A5578061BD70}C:\program files (x86)\atari\tdu2\testdrive2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\atari\tdu2\testdrive2.exe |
"UDP Query User{437EE46D-D266-4B01-A27F-9F74910F193A}C:\users\ed\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\ed\appdata\roaming\spotify\spotify.exe |
"UDP Query User{AD1E3C86-B2BB-4099-A0BE-97A595C07E22}C:\program files (x86)\tera\tera-launcher.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tera\tera-launcher.exe |
"UDP Query User{B9DE6B44-0690-403C-976E-ABED8B5E7570}C:\program files (x86)\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\batman arkham asylum goty\binaries\shippingpc-bmgame.exe |
"UDP Query User{C719401E-0D7C-44A1-8CF6-8A9006C1A8D8}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{E395B89F-C9DC-4173-91DB-8AB89D2D955B}C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base24944\sc2.exe |
"UDP Query User{E94689A5-C4EE-4D6F-8201-E6D0EDD3DEDE}C:\program files (x86)\atari\tdu2\uplauncher.exe" = protocol=17 | dir=in | app=c:\program files (x86)\atari\tdu2\uplauncher.exe |
"UDP Query User{EDB5DFDC-1B92-446E-8729-0C170B8E25D2}C:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe |
"UDP Query User{F3D73E48-AFC3-42F5-82AC-5CA18C1B9133}C:\program files (x86)\entropia universe\bin32\entropia.exe" = protocol=17 | dir=in | app=c:\program files (x86)\entropia universe\bin32\entropia.exe |
"UDP Query User{F95BB136-E9AE-480C-B2C5-BE9E17C11D43}C:\program files (x86)\atari\tdu2\_uplauncher.exe" = protocol=17 | dir=in | app=c:\program files (x86)\atari\tdu2\_uplauncher.exe |
"UDP Query User{FBF96B82-74ED-4C71-955D-E402FCD97FA2}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{FC813577-FED3-4675-9E44-7EC0CC96B38D}C:\program files (x86)\steam\steamapps\common\age of conan\ageofconan.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\age of conan\ageofconan.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP610_series" = Canon MP610 series
"{1B1D3C64-EEBC-4807-93FF-DB71719E77F7}" = Image Resizer for Windows (64 bit)
"{26A24AE4-039D-4CA4-87B4-2F86417017FF}" = Java 7 Update 17 (64-bit)
"{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1" = MotioninJoy DS3 driver version 0.6.0005
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{54E8F0F3-1827-4E6E-86C0-F6946E9CBE83}" = Classic Shell
"{5F611ADA-B98C-4DBB-ADDE-414F08457ECF}" = Windows Live Family Safety
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0413-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Dutch) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A8E86B3F-2884-4632-93D8-803142000662}" = calibre 64bit
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision stuurprogramma 314.07
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA-configuratiescherm 314.07
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafisch stuurprogramma 314.07
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision controllerstuurprogramma 314.07
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX systeemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.12.12
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio-stuurprogramma [removed]
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"{F6822EFD-3F7D-4B35-8845-757A26AEC8E2}" = Windows Live MIME IFilter
"WinRAR archiver" = WinRAR 4.20 (64-bit)
"x64 Components_is1" = x64 Components v4.0.2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06EED60F-7FFC-43A7-936E-AA4A8BD948B4}" = Windows Live Writer
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 21
"{30F99474-EBE3-4134-A02B-F6CD38CFE243}" = Photo Gallery
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}" = Smite
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3D44D783-D027-4135-AC39-81E320ED2D3A}" = Windows Live Family Safety
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{400C31E4-796F-4E86-8FDC-C3C4FACC6847}" = Junk Mail filter update
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AA2A466-8031-403A-8236-5301B4E391FB}" = Windows Live UX Platform Language Pack
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform
"{6BA9BA04-B062-42F4-A852-902229FD4C2A}" = Adobe Flash Player 11 ActiveX
"{70854FE6-3BF1-4C69-94D0-BEB821102E34}" = Windows Live Mail
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{743FD554-A73F-4FE8-BE7B-C283D16297F9}" = Photo Common
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{83C9377F-5ED1-4AD8-B113-7C876AEAF3AB}" = Windows Live Messenger
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0413-0000-0000000FF1CE}" = Microsoft Office Access MUI (Dutch) 2007
"{90120000-0015-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0413-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Dutch) 2007
"{90120000-0016-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0413-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Dutch) 2007
"{90120000-0018-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0413-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Dutch) 2007
"{90120000-0019-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0413-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Dutch) 2007
"{90120000-001A-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0413-0000-0000000FF1CE}" = Microsoft Office Word MUI (Dutch) 2007
"{90120000-001B-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUS_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_PROPLUS_{2C95E7EE-FEA7-4B3A-A6E5-DF90A88B816A}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_PROPLUS_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0413-1000-0000000FF1CE}_PROPLUS_{1D12BC91-360E-424C-97C4-813651313660}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0413-0000-0000000FF1CE}" = Microsoft Office Proofing (Dutch) 2007
"{90120000-0044-0413-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Dutch) 2007
"{90120000-0044-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0413-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Dutch) 2007
"{90120000-006E-0413-0000-0000000FF1CE}_PROPLUS_{1D12BC91-360E-424C-97C4-813651313660}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{97C79BEC-43F7-4BD8-A6A7-85C0257E488A}" = Windows Live Writer
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9dfff2f7-5cd7-4fd4-9b75-7d53b042d94b}" = Image Resizer for Windows
"{A2F166A0-F031-4E27-A057-C69733219434}_is1" = TERA
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1043-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Nederlands
"{AE8044B5-FCA3-4EBE-AC78-0FB3A6E8DC76}" = Movie Maker
"{B7F31B9C-8775-4500-8E9D-6ABE9AE17CF4}" = Windows Live Essentials
"{BA72DF5C-E458-48F4-AF52-6CC343125844}" = TV gemist
"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer
"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D2C146B1-948D-47EF-8387-5D1C6B980F7C}" = Windows Live Writer
"{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{ED6C77F9-4D7E-447C-9EC0-9A212D075535}" = Movie Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2235E5E-7881-4293-9B6F-04B2609FBFF0}" = Windows Live Messenger
"{F67CA22C-C11F-4573-8406-57F75BA06B51}" = Photo Gallery
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{FA75723A-BF4A-40A2-BFCB-BBC320C27DC9}" = Windows Live Mail
"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE
"{FEFD91C5-A25D-48D9-89DA-0FB7BB8B3EF7}" = Windows Live Writer Resources
"Aangifte inkomstenbelasting 2012" = Aangifte inkomstenbelasting 2012
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"bi_uninstaller" = Bundled software uninstaller
"BurnAware Free_is1" = BurnAware Free 6.0
"DAEMON Tools Lite" = DAEMON Tools Lite
"ecobutton_is1" = ecobutton
"Google Chrome" = Google Chrome
"GrabIt_is1" = GrabIt 1.7.2 Beta 6 (build 1008)
"InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"MagniDriver" = marvell 91xx driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PROPLUS" = Microsoft Office Professional Plus 2007
"QuickPar" = QuickPar 0.9
"StarCraft II" = StarCraft II
"Steam App 107100" = Bastion
"Steam App 203160" = Tomb Raider
"Steam App 35140" = Batman: Arkham Asylum GOTY Edition
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 7520" = Two Worlds II
"Steam App 8190" = Just Cause 2
"Steam App 97340" = Magic: The Gathering - Duels of the Planeswalkers 2013 Demo
"Test Drive Unlimited 2_is1" = Test Drive Unlimited 2
"VLC media player" = VLC media player 2.0.6
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent 6.0.1
"BitTorrent DNA" = DNA
"SkyDriveSetup.exe" = Microsoft SkyDrive
"Spotify" = Spotify

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 25-5-2013 8:29:46 | Computer Name = Ed-PC | Source = .NET Runtime | ID = 1022
Description =

Error - 25-5-2013 9:20:44 | Computer Name = Ed-PC | Source = Application Error | ID = 1000
Description = Naam van toepassing met fout: TestDrive2.exe, versie: 0.1.5.1, tijdstempel:
0x00000000 Naam van module met fout: TestDrive2.exe, versie: 0.1.5.1, tijdstempel:
0x00000000 Uitzonderingscode: 0xc000001d Foutmarge: 0x01249dfd Id van proces met fout:
0x1cf8 Starttijd van toepassing met fout: 0x01ce594aa8bdc472 Pad naar toepassing
met fout: C:\Program Files (x86)\Atari\TDU2\TestDrive2.exe Pad naar module met fout:
C:\Program Files (x86)\Atari\TDU2\TestDrive2.exe Rapport-id: e75262cb-c53d-11e2-be76-1c6f65c54dec
Volledige
pakketnaam met fout: Relatieve toepassings-id van pakket met fout:

Error - 25-5-2013 9:20:44 | Computer Name = Ed-PC | Source = Application Error | ID = 1005
Description = Geen toegang tot bestand om een van de volgende redenen: Er is een
probleem met de netwerkverbinding, met de schijf waarop het bestand is opgeslagen,
met
de opslagstuurprogramma's op deze computer, of de schijf ontbreekt. Programma Test
Drive Unlimited 2 werd afgesloten vanwege deze fout. Programma: Test Drive Unlimited
2 Bestand: De foutwaarde wordt weergegeven in de sectie Extra gegevens. Gebruikersactie
1.
Open het bestand opnieuw. Mogelijk is dit een tijdelijk probleem dat vanzelf wordt
opgelost als het programma opnieuw wordt uitgevoerd. 2. Als toegang tot het bestand
nog steeds niet mogelijk is en - Als het bestand zich in het netwerk bevindt, dient
de netwerkbeheerder te controleren of er geen probleem met het netwerk is en dat
verbinding met de server kan worden gemaakt. - Als het bestand zich op een verwisselbare
schijf bevindt, zoals een diskette of cd-rom, dient u te controleren of deze schijf
correct in het schijfstation is geplaatst. 3. Controleer en repareer het bestandssysteem
met CHKDSK. Klik hiervoor op Start, Uitvoeren en typ CMD. Klik OK en typ CHKDSK
/F op de opdrachtprompt. Druk vervolgens op ENTER. 4. Als het probleem blijft bestaan,
dient u het bestand terug te zetten via een back-upmedium. 5. Bepaal of andere bestanden
op dezelfde schijf kunnen worden geopend. Als dit niet zo is, is de schijf beschadigd.
Als het een harde schijf is, neemt u contact op met de netwerkbeheerder of hardwareleverancier
voor ondersteuning. Aanvullende gegevens Foutwaarde: 00000000 Type schijf: 0

Error - 25-5-2013 11:21:26 | Computer Name = Ed-PC | Source = Application Error | ID = 1000
Description = Naam van toepassing met fout: TestDrive2.exe, versie: 0.1.5.1, tijdstempel:
0x00000000 Naam van module met fout: TestDrive2.exe, versie: 0.1.5.1, tijdstempel:
0x00000000 Uitzonderingscode: 0xc000001d Foutmarge: 0x01249dfd Id van proces met fout:
0x1c88 Starttijd van toepassing met fout: 0x01ce595b850cfbe7 Pad naar toepassing
met fout: C:\Program Files (x86)\Atari\TDU2\TestDrive2.exe Pad naar module met fout:
C:\Program Files (x86)\Atari\TDU2\TestDrive2.exe Rapport-id: c3816e02-c54e-11e2-be76-1c6f65c54dec
Volledige
pakketnaam met fout: Relatieve toepassings-id van pakket met fout:

Error - 25-5-2013 11:21:26 | Computer Name = Ed-PC | Source = Application Error | ID = 1005
Description = Geen toegang tot bestand om een van de volgende redenen: Er is een
probleem met de netwerkverbinding, met de schijf waarop het bestand is opgeslagen,
met
de opslagstuurprogramma's op deze computer, of de schijf ontbreekt. Programma Test
Drive Unlimited 2 werd afgesloten vanwege deze fout. Programma: Test Drive Unlimited
2 Bestand: De foutwaarde wordt weergegeven in de sectie Extra gegevens. Gebruikersactie
1.
Open het bestand opnieuw. Mogelijk is dit een tijdelijk probleem dat vanzelf wordt
opgelost als het programma opnieuw wordt uitgevoerd. 2. Als toegang tot het bestand
nog steeds niet mogelijk is en - Als het bestand zich in het netwerk bevindt, dient
de netwerkbeheerder te controleren of er geen probleem met het netwerk is en dat
verbinding met de server kan worden gemaakt. - Als het bestand zich op een verwisselbare
schijf bevindt, zoals een diskette of cd-rom, dient u te controleren of deze schijf
correct in het schijfstation is geplaatst. 3. Controleer en repareer het bestandssysteem
met CHKDSK. Klik hiervoor op Start, Uitvoeren en typ CMD. Klik OK en typ CHKDSK
/F op de opdrachtprompt. Druk vervolgens op ENTER. 4. Als het probleem blijft bestaan,
dient u het bestand terug te zetten via een back-upmedium. 5. Bepaal of andere bestanden
op dezelfde schijf kunnen worden geopend. Als dit niet zo is, is de schijf beschadigd.
Als het een harde schijf is, neemt u contact op met de netwerkbeheerder of hardwareleverancier
voor ondersteuning. Aanvullende gegevens Foutwaarde: 00000000 Type schijf: 0

Error - 25-5-2013 14:46:15 | Computer Name = Ed-PC | Source = Application Error | ID = 1000
Description = Naam van toepassing met fout: TestDrive2.exe, versie: 0.1.5.1, tijdstempel:
0x00000000 Naam van module met fout: TestDrive2.exe, versie: 0.1.5.1, tijdstempel:
0x00000000 Uitzonderingscode: 0xc000001d Foutmarge: 0x01249dfd Id van proces met fout:
0xe6c Starttijd van toepassing met fout: 0x01ce597821bc07a3 Pad naar toepassing met
fout: C:\Program Files (x86)\Atari\TDU2\TestDrive2.exe Pad naar module met fout:
C:\Program Files (x86)\Atari\TDU2\TestDrive2.exe Rapport-id: 6041ca13-c56b-11e2-be76-1c6f65c54dec
Volledige
pakketnaam met fout: Relatieve toepassings-id van pakket met fout:

Error - 25-5-2013 14:46:15 | Computer Name = Ed-PC | Source = Application Error | ID = 1005
Description = Geen toegang tot bestand om een van de volgende redenen: Er is een
probleem met de netwerkverbinding, met de schijf waarop het bestand is opgeslagen,
met
de opslagstuurprogramma's op deze computer, of de schijf ontbreekt. Programma Test
Drive Unlimited 2 werd afgesloten vanwege deze fout. Programma: Test Drive Unlimited
2 Bestand: De foutwaarde wordt weergegeven in de sectie Extra gegevens. Gebruikersactie
1.
Open het bestand opnieuw. Mogelijk is dit een tijdelijk probleem dat vanzelf wordt
opgelost als het programma opnieuw wordt uitgevoerd. 2. Als toegang tot het bestand
nog steeds niet mogelijk is en - Als het bestand zich in het netwerk bevindt, dient
de netwerkbeheerder te controleren of er geen probleem met het netwerk is en dat
verbinding met de server kan worden gemaakt. - Als het bestand zich op een verwisselbare
schijf bevindt, zoals een diskette of cd-rom, dient u te controleren of deze schijf
correct in het schijfstation is geplaatst. 3. Controleer en repareer het bestandssysteem
met CHKDSK. Klik hiervoor op Start, Uitvoeren en typ CMD. Klik OK en typ CHKDSK
/F op de opdrachtprompt. Druk vervolgens op ENTER. 4. Als het probleem blijft bestaan,
dient u het bestand terug te zetten via een back-upmedium. 5. Bepaal of andere bestanden
op dezelfde schijf kunnen worden geopend. Als dit niet zo is, is de schijf beschadigd.
Als het een harde schijf is, neemt u contact op met de netwerkbeheerder of hardwareleverancier
voor ondersteuning. Aanvullende gegevens Foutwaarde: 00000000 Type schijf: 0

Error - 26-5-2013 3:05:40 | Computer Name = Ed-PC | Source = .NET Runtime | ID = 1022
Description =

Error - 26-5-2013 11:53:07 | Computer Name = Ed-PC | Source = Application Error | ID = 1000
Description = Naam van toepassing met fout: aswMBR.exe, versie: 0.9.9.1771, tijdstempel:
0x5147644e Naam van module met fout: ntdll.dll, versie: 6.2.9200.16578, tijdstempel:
0x515fac6e Uitzonderingscode: 0xc0000005 Foutmarge: 0x00051f81 Id van proces met fout:
0x1498 Starttijd van toepassing met fout: 0x01ce5a28f9922ed1 Pad naar toepassing
met fout: D:\Ed\Desktop\aswMBR.exe Pad naar module met fout: C:\WINDOWS\SYSTEM32\ntdll.dll
Rapport-id:
5b4ca98f-c61c-11e2-be76-1c6f65c54dec Volledige pakketnaam met fout: Relatieve toepassings-id
van pakket met fout:

Error - 26-5-2013 11:54:33 | Computer Name = Ed-PC | Source = Application Error | ID = 1000
Description = Naam van toepassing met fout: aswMBR.exe, versie: 0.9.9.1771, tijdstempel:
0x5147644e Naam van module met fout: ntdll.dll, versie: 6.2.9200.16578, tijdstempel:
0x515fac6e Uitzonderingscode: 0xc0000005 Foutmarge: 0x00051f81 Id van proces met fout:
0x14c4 Starttijd van toepassing met fout: 0x01ce5a29435d8a0b Pad naar toepassing
met fout: D:\Ed\Desktop\aswMBR.exe Pad naar module met fout: C:\WINDOWS\SYSTEM32\ntdll.dll
Rapport-id:
8e5e90ba-c61c-11e2-be76-1c6f65c54dec Volledige pakketnaam met fout: Relatieve toepassings-id
van pakket met fout:

[ System Events ]
Error - 10-5-2013 6:20:12 | Computer Name = Ed-PC | Source = Service Control Manager | ID = 7009
Description = Time-out (30000 seconden) tijdens het wachten op het verbinden van
deze service: Steam Client Service.

Error - 10-5-2013 6:20:12 | Computer Name = Ed-PC | Source = Service Control Manager | ID = 7000
Description = De Steam Client Service-service kan vanwege de volgende fout niet
worden gestart: %%1053

Error - 11-5-2013 12:11:46 | Computer Name = Ed-PC | Source = Microsoft-Windows-Kernel-Boot | ID = 29
Description =

Error - 11-5-2013 12:11:58 | Computer Name = Ed-PC | Source = EventLog | ID = 6008
Description = De vorige afsluiting van het systeem om 15:46:31 op ?11-?5-?2013 is
onverwacht gebeurd.

Error - 11-5-2013 12:11:51 | Computer Name = Ed-PC | Source = MEIx64 | ID = 458755
Description = Intel® Management Engine Interface driver has failed to perform
handshake with the Firmware.

Error - 11-5-2013 12:14:02 | Computer Name = Ed-PC | Source = Service Control Manager | ID = 7038
Description = De nvUpdatusService-service kan niet als .\UpdatusUser met het huidig
ingestelde wachtwoord worden aangemeld vanwege de volgende fout: %%1330 Gebruik
de module Services in de Microsoft Management Console (MMC) om te controleren of
de service juist is geconfigureerd.

Error - 11-5-2013 12:14:02 | Computer Name = Ed-PC | Source = Service Control Manager | ID = 7000
Description = De NVIDIA Update Service Daemon-service kan vanwege de volgende fout
niet worden gestart: %%1069

Error - 21-5-2013 13:01:44 | Computer Name = Ed-PC | Source = MEIx64 | ID = 458755
Description = Intel® Management Engine Interface driver has failed to perform
handshake with the Firmware.

Error - 21-5-2013 13:04:04 | Computer Name = Ed-PC | Source = Service Control Manager | ID = 7038
Description = De nvUpdatusService-service kan niet als .\UpdatusUser met het huidig
ingestelde wachtwoord worden aangemeld vanwege de volgende fout: %%1330 Gebruik
de module Services in de Microsoft Management Console (MMC) om te controleren of
de service juist is geconfigureerd.

Error - 21-5-2013 13:04:04 | Computer Name = Ed-PC | Source = Service Control Manager | ID = 7000
Description = De NVIDIA Update Service Daemon-service kan vanwege de volgende fout
niet worden gestart: %%1069

< End of report >

_________________________________________

Symptoms you are experiencing

On start-up my computer loads Windows without problems. Once Windows is running, I see a window opening and closing, too fast to see its contents. It looks like a DOS window (you know, similar to a window when you type "cmd" in the startmenu). Also a Windows-type message box flashes open and closed. I do not experience any performance loss or any other strange behaviour.

OCD

Post #5May 26, 2013, 5:20 PM UTC

Hi Miathan,

While I review your other logs, please try this Rootkit Scanner.

=========================

1. GMER Rootkit Scanner

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Right-click gmer.exe. select "Run as Administrator" The program will begin to run.

[external image: Posted Image]

**Caution** These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

=========================

In your next post please provide the following:
GMER.txt

Miathan

Post #6May 26, 2013, 5:36 PM UTC

Hi OCD,

Here you go.

_________________________________________

1. GMER Rootkit Scanner

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-05-26 19:32:43
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 OCZ-VERT rev.1.37 167,68GB
Running: gmer.exe; Driver: C:\Users\Ed\AppData\Local\Temp\pxloapoc.sys

—- Kernel code sections - GMER 2.1 —-

.text C:\WINDOWS\system32\ntoskrnl.exe!KiCpuId + 988 fffff80204ed641c 1 byte [31]
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff960001acc00 7 bytes [40, A3, 82, 01, 00, 52, F2]
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 8 fffff960001acc08 7 bytes [01, 04, C2, FF, 00, A4, DC]

—- User code sections - GMER 2.1 —-

.text C:\WINDOWS\System32\spoolsv.exe[1588] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fd4911177a 4 bytes [11, 49, FD, 07]
.text C:\WINDOWS\System32\spoolsv.exe[1588] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fd49111782 4 bytes [11, 49, FD, 07]
.text C:\WINDOWS\System32\spoolsv.exe[1588] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fd46321532 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\System32\spoolsv.exe[1588] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fd4632153a 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\System32\spoolsv.exe[1588] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fd4632165a 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\System32\dwm.exe[3812] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fd4911177a 4 bytes [11, 49, FD, 07]
.text C:\WINDOWS\System32\dwm.exe[3812] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fd49111782 4 bytes [11, 49, FD, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[3376] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fd46321532 4 bytes [32, 46, FD, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[3376] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fd4632153a 4 bytes [32, 46, FD, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[3376] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fd4632165a 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\system32\nvvsvc.exe[7252] C:\WINDOWS\system32\MSIMG32.dll!GradientFill + 690 000007fd46321532 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\system32\nvvsvc.exe[7252] C:\WINDOWS\system32\MSIMG32.dll!GradientFill + 698 000007fd4632153a 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\system32\nvvsvc.exe[7252] C:\WINDOWS\system32\MSIMG32.dll!TransparentBlt + 246 000007fd4632165a 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\system32\nvvsvc.exe[7252] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fd4911177a 4 bytes [11, 49, FD, 07]
.text C:\WINDOWS\system32\nvvsvc.exe[7252] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fd49111782 4 bytes [11, 49, FD, 07]
.text C:\Program Files\Classic Shell\ClassicStartMenu.exe[6624] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fd46321532 4 bytes [32, 46, FD, 07]
.text C:\Program Files\Classic Shell\ClassicStartMenu.exe[6624] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fd4632153a 4 bytes [32, 46, FD, 07]
.text C:\Program Files\Classic Shell\ClassicStartMenu.exe[6624] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fd4632165a 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\Explorer.EXE[7848] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fd4911177a 4 bytes [11, 49, FD, 07]
.text C:\WINDOWS\Explorer.EXE[7848] C:\WINDOWS\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fd49111782 4 bytes [11, 49, FD, 07]
.text C:\WINDOWS\Explorer.EXE[7848] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fd46321532 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\Explorer.EXE[7848] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fd4632153a 4 bytes [32, 46, FD, 07]
.text C:\WINDOWS\Explorer.EXE[7848] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fd4632165a 4 bytes [32, 46, FD, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[5528] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fd46321532 4 bytes [32, 46, FD, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[5528] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fd4632153a 4 bytes [32, 46, FD, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[5528] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fd4632165a 4 bytes [32, 46, FD, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1764] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fd46321532 4 bytes [32, 46, FD, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1764] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fd4632153a 4 bytes [32, 46, FD, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1764] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fd4632165a 4 bytes [32, 46, FD, 07]
.text C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe[7360] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fd46321532 4 bytes [32, 46, FD, 07]
.text C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe[7360] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fd4632153a 4 bytes [32, 46, FD, 07]
.text C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe[7360] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fd4632165a 4 bytes [32, 46, FD, 07]

—- Threads - GMER 2.1 —-

Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3684:2976] 000007fd355d76c0
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3684:3756] 000007fd355d76c0
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3684:3640] 000007fd355d76c0
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3684:5252] 000007fd355d76c0
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3684:6736] 000007fd355d76c0
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3684:3168] 000007fd355d76c0
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3684:4056] 000007fd355d76c0
Thread C:\WINDOWS\system32\csrss.exe [4912:5180] fffff960008a45e8

—- Registry - GMER 2.1 —-

Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 1664776674

—- EOF - GMER 2.1 —-

OCD

Post #7May 26, 2013, 5:47 PM UTC

Hi Miathan,

Thanks, looks good.

1. P2P - (Peer to Peer)

I see you have/had P2P software BitTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections and possibly Identity Theft. It likely contributed to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall this now.

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

BitTorrent

If you choose to not remove this program please refrain from using it until we have finished cleaning your computer.

Uninstall Tutorial : http://www.wintips.org/how-to-add-or-remov…erver-versions/

If you have choosen to remove BitTorrent, please let me know there are numerous entries in your OTL log that we will need to remove.

=========================

2. DeFogger

Please download DeFogger to your desktop.
Right click and select "Run as Administrator" DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
If it needs to, DeFogger may ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.

=========================

3. AdwCleaner

Download AdwCleaner to your desktop.

Right click and select "Run as Administrator".

Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

=========================

4. Junkware Removal Tool

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.

Right click and select "Run as Administrator".

Shut down your protection software now to avoid potential conflicts.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

=========================

In your next post please provide the following:
AdwCleaner[S1]/txt
JRT.txt
BitTorrent decision

Miathan

Post #8May 26, 2013, 6:22 PM UTC

HI OCD,

1. P2P - (Peer to Peer)

Of course you are right and I know that there are risks involved in using BitTorrent. But, you know, sometimes I cannot resist the temptation…

I've uninstalled the software.

_________________________________________

2. DeFogger

Ran the file.

_________________________________________

3. AdwCleaner

Here is the "AdwCleaner[S1]" log:

# AdwCleaner v2.301 - Verslag gemaakt op 26/05/2013 om 20:00:26
# Geactualiseerd op 16/05/2013 door Xplode
# Besturingssysteem : Windows 8 Pro (64 bits)
# Gebruiker : Ed - ED-PC
# Opstarten Modus : Normale modus
# Gelanceerd vanaf : D:\Ed\Desktop\AdwCleaner.exe
# Optie [Verwijderen]

***** [Diensten] *****

***** [Files / Mappen] *****

File Verwijdert : C:\Users\Ed\AppData\Local\Temp\Uninstall.exe
Map Verwijdert : C:\ProgramData\Babylon
Map Verwijdert : C:\Users\Ed\AppData\Local\Bundled software uninstaller
Map Verwijdert : C:\Users\Ed\AppData\Roaming\Babylon
Map Verwijdert : C:\Users\Ed\AppData\Roaming\DealPly

***** [Register] *****

Sleutel Verwijdert : HKCU\Software\BabylonToolbar
Sleutel Verwijdert : HKCU\Software\BI
Sleutel Verwijdert : HKCU\Software\DataMngr
Sleutel Verwijdert : HKCU\Software\DataMngr_Toolbar
Sleutel Verwijdert : HKLM\Software\Babylon
Sleutel Verwijdert : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Sleutel Verwijdert : HKLM\SOFTWARE\Classes\Prod.cap
Sleutel Verwijdert : HKLM\Software\DataMngr
Sleutel Verwijdert : HKLM\SOFTWARE\Wow6432Node\f0d68de239e515
Sleutel Verwijdert : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller

***** [Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Het register bevat geen enkele ongeoorloofde invoer.

-\\ Google Chrome v27.0.1453.94

File : C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] De file bevat geen enkele ongeoorloofde invoer.

*************************

AdwCleaner[S1].txt - [1589 octets] - [26/05/2013 20:00:26]

########## EOF - C:\AdwCleaner[S1].txt - [1649 octets] ##########

_________________________________________

4. Junkware Removal Tool

Here is the "JRT" log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 8 Pro x64
Ran by [removed] on zo 26-05-2013 at 20:08:28,28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on zo 26-05-2013 at 20:09:58,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

OCD

Post #9May 26, 2013, 6:40 PM UTC

Hi Miathan,

1. Re-run OTL (it should be located on your desktop).

Windows Vista and Windows 7 & 8 users Right Click and select "Run as Administrator" on the icon to run it.

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Uncheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open one notepad window. OTL.Txt. (No Extras.txt will be produced)
Note:The log can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of the file, and post it with your next reply.

=========================

In your next post please provide the following:
OTL.txt
Any change with regards to the DOS pop-up?

OCD

Post #10May 26, 2013, 7:02 PM UTC

Hi Miathan,

1. DOS pop-up window

Do you remember when this started? (the date if possible)
Did you install any new software or hardware around the time the pop-ups started? (Other than the suspected malware)

=========================

Miathan

Post #11May 26, 2013, 7:20 PM UTC

Hi OCD,

1. Re-run OTL

Here is the log.

OTL logfile created on: 26-5-2013 20:55:08 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = D:\Ed\Desktop
64bit- Professional (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16580)
Locale: 00000413 | Country: Nederland | Language: NLD | Date Format: d-M-yyyy

3,98 Gb Total Physical Memory | 2,88 Gb Available Physical Memory | 72,23% Memory free
7,98 Gb Paging File | 6,75 Gb Available in Paging File | 84,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 167,58 Gb Total Space | 26,57 Gb Free Space | 15,86% Space Free | Partition Type: NTFS
Drive D: | 219,73 Gb Total Space | 173,38 Gb Free Space | 78,91% Space Free | Partition Type: NTFS
Drive E: | 351,56 Gb Total Space | 324,92 Gb Free Space | 92,42% Space Free | Partition Type: NTFS
Drive F: | 360,22 Gb Total Space | 325,38 Gb Free Space | 90,33% Space Free | Partition Type: NTFS
Drive H: | 465,76 Gb Total Space | 156,04 Gb Free Space | 33,50% Space Free | Partition Type: NTFS

Computer Name: ED-PC | User Name: Ed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - D:\Ed\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
PRC - C:\Program Files\Classic Shell\ClassicShellService.exe (IvoSoft)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\d29382ad4b800178b51631569c928f0b\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5cb0754debdf19b9f0d63d4d8721f532\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\398e7010fffe84888b310c1ad6c02e74\WindowsBase.ni.dll ()
MOD - C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e2f7dbe3bf08df200a4cdcf2e0eb82fa\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0d949755951d5b5e3472bde406ea02dd\IAStorUtil.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorCommon\3d20a38dd44a0ba3ddce6d96d7bee685\IAStorCommon.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\ae31f7dc9817e359d05c9c8efdd5f359\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7e6b074d3f3e3cc8e0270a3552c47aaa\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\28c2c6e7f48ff80c680a97b08df66a72\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\8d2929ad589e1092eb62a43424361465\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_nl_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_nl_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (AudioEndpointBuilder) – C:\Windows\SysNative\AudioEndpointBuilder.dll (Microsoft Corporation)
SRV:64bit: - (ClassicShellService) – C:\Program Files\Classic Shell\ClassicShellService.exe (IvoSoft)
SRV:64bit: - (TimeBroker) – C:\Windows\SysNative\TimeBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (SystemEventsBroker) – C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (netprofm) – C:\Windows\SysNative\netprofmsvc.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (wlidsvc) – C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
SRV:64bit: - (LSM) – C:\Windows\SysNative\lsm.dll (Microsoft Corporation)
SRV:64bit: - (PrintNotify) – C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV:64bit: - (WSService) – C:\Windows\SysNative\WSService.dll (Microsoft Corporation)
SRV:64bit: - (fhsvc) – C:\Windows\SysNative\fhsvc.dll (Microsoft Corporation)
SRV:64bit: - (BrokerInfrastructure) – C:\Windows\SysNative\bisrv.dll (Microsoft Corporation)
SRV:64bit: - (WiaRpc) – C:\Windows\SysNative\wiarpc.dll (Microsoft Corporation)
SRV:64bit: - (Wcmsvc) – C:\Windows\SysNative\wcmsvc.dll (Microsoft Corporation)
SRV:64bit: - (VaultSvc) – C:\Windows\SysNative\vaultsvc.dll (Microsoft Corporation)
SRV:64bit: - (svsvc) – C:\Windows\SysNative\svsvc.dll (Microsoft Corporation)
SRV:64bit: - (Netlogon) – C:\Windows\SysNative\netlogon.dll (Microsoft Corporation)
SRV:64bit: - (NcaSvc) – C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
SRV:64bit: - (NcdAutoSetup) – C:\Windows\SysNative\NcdAutoSetup.dll (Microsoft Corporation)
SRV:64bit: - (KeyIso) – C:\Windows\SysNative\keyiso.dll (Microsoft Corporation)
SRV:64bit: - (EFS) – C:\Windows\SysNative\efssvc.dll (Microsoft Corporation)
SRV:64bit: - (DsmSvc) – C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
SRV:64bit: - (DeviceAssociationService) – C:\Windows\SysNative\das.dll (Microsoft Corporation)
SRV:64bit: - (AllUserInstallAgent) – C:\Windows\SysNative\AUInstallAgent.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (vmicvss) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmictimesync) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicshutdown) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicrdv) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmickvpexchange) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicheartbeat) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (HiPatchService) – C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PrintNotify) – C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV - (StorSvc) – C:\Windows\SysWOW64\StorSvc.dll (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (dtsoftbus01) – C:\Windows\SysNative\Drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (spaceport) – C:\Windows\SysNative\Drivers\spaceport.sys (Microsoft Corporation)
DRV:64bit: - (USBXHCI) – C:\Windows\SysNative\Drivers\USBXHCI.SYS (Microsoft Corporation)
DRV:64bit: - (storahci) – C:\Windows\SysNative\Drivers\storahci.sys (Microsoft Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\Drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\Drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (pdc) – C:\Windows\SysNative\Drivers\pdc.sys (Microsoft Corporation)
DRV:64bit: - (USBHUB3) – C:\Windows\SysNative\Drivers\USBHUB3.SYS (Microsoft Corporation)
DRV:64bit: - (BthAvrcpTg) – C:\Windows\SysNative\Drivers\BthAvrcpTg.sys (Microsoft Corporation)
DRV:64bit: - (WdBoot) – C:\Windows\SysNative\Drivers\WdBoot.sys (Microsoft Corporation)
DRV:64bit: - (WdFilter) – C:\Windows\SysNative\Drivers\WdFilter.sys (Microsoft Corporation)
DRV:64bit: - (msgpiowin32) – C:\Windows\SysNative\Drivers\msgpiowin32.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\Drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (bthhfhid) – C:\Windows\SysNative\Drivers\BthhfHid.sys (Microsoft Corporation)
DRV:64bit: - (hidi2c) – C:\Windows\SysNative\Drivers\hidi2c.sys (Microsoft Corporation)
DRV:64bit: - (FxPPM) – C:\Windows\SysNative\Drivers\fxppm.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\Drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (sdstor) – C:\Windows\SysNative\Drivers\sdstor.sys (Microsoft Corporation)
DRV:64bit: - (dam) – C:\Windows\SysNative\Drivers\dam.sys (Microsoft Corporation)
DRV:64bit: - (UCX01000) – C:\Windows\SysNative\Drivers\UCX01000.SYS (Microsoft Corporation)
DRV:64bit: - (GPIOClx0101) – C:\Windows\SysNative\Drivers\msgpioclx.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\Drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\Drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\Drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) – C:\WINDOWS\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (condrv) – C:\Windows\SysNative\Drivers\condrv.sys (Microsoft Corporation)
DRV:64bit: - (VSTXRAID) – C:\Windows\SysNative\Drivers\VSTXRAID.SYS (VIA Corporation)
DRV:64bit: - (VerifierExt) – C:\Windows\SysNative\Drivers\VerifierExt.sys (Microsoft Corporation)
DRV:64bit: - (UASPStor) – C:\Windows\SysNative\Drivers\uaspstor.sys (Microsoft Corporation)
DRV:64bit: - (acpiex) – C:\Windows\SysNative\Drivers\acpiex.sys (Microsoft Corporation)
DRV:64bit: - (mvumis) – C:\Windows\SysNative\Drivers\mvumis.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\Drivers\stexstor.sys (Promise Technology, Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\Drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (LSI_SSS) – C:\Windows\SysNative\Drivers\lsi_sss.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\Drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (EhStorTcgDrv) – C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys (Microsoft Corporation)
DRV:64bit: - (EhStorClass) – C:\Windows\SysNative\Drivers\EhStorClass.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\Drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (3ware) – C:\Windows\SysNative\Drivers\3ware.sys (LSI)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\Drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\Drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (CLFS) – C:\Windows\SysNative\Drivers\clfs.sys (Microsoft Corporation)
DRV:64bit: - (WFPLWFS) – C:\Windows\SysNative\Drivers\wfplwfs.sys (Microsoft Corporation)
DRV:64bit: - (vpci) – C:\Windows\SysNative\Drivers\vpci.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) – C:\Windows\SysNative\Drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (mshidumdf) – C:\Windows\SysNative\Drivers\mshidumdf.sys (Microsoft Corporation)
DRV:64bit: - (BasicDisplay) – C:\Windows\SysNative\Drivers\BasicDisplay.sys (Microsoft Corporation)
DRV:64bit: - (HyperVideo) – C:\Windows\SysNative\Drivers\HyperVideo.sys (Microsoft Corporation)
DRV:64bit: - (BasicRender) – C:\Windows\SysNative\Drivers\BasicRender.sys (Microsoft Corporation)
DRV:64bit: - (gencounter) – C:\Windows\SysNative\Drivers\vmgencounter.sys (Microsoft Corporation)
DRV:64bit: - (kdnic) – C:\Windows\SysNative\Drivers\kdnic.sys (Microsoft Corporation)
DRV:64bit: - (acpitime) – C:\Windows\SysNative\Drivers\acpitime.sys (Microsoft Corporation)
DRV:64bit: - (npsvctrig) – C:\Windows\SysNative\Drivers\npsvctrig.sys (Microsoft Corporation)
DRV:64bit: - (WpdUpFltr) – C:\Windows\SysNative\Drivers\WpdUpFltr.sys (Microsoft Corporation)
DRV:64bit: - (acpipagr) – C:\Windows\SysNative\Drivers\acpipagr.sys (Microsoft Corporation)
DRV:64bit: - (hyperkbd) – C:\Windows\SysNative\Drivers\hyperkbd.sys (Microsoft Corporation)
DRV:64bit: - (SerCx) – C:\Windows\SysNative\Drivers\SerCx.sys (Microsoft Corporation)
DRV:64bit: - (SpbCx) – C:\Windows\SysNative\Drivers\SpbCx.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\Drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (BthHFEnum) – C:\Windows\SysNative\Drivers\bthhfenum.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\Drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\Drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (Vid) – C:\Windows\SysNative\Drivers\Vid.sys (Microsoft Corporation)
DRV:64bit: - (storvsp) – C:\Windows\SysNative\Drivers\storvsp.sys (Microsoft Corporation)
DRV:64bit: - (wpcfltr) – C:\Windows\SysNative\Drivers\wpcfltr.sys (Microsoft Corporation)
DRV:64bit: - (vmbusr) – C:\Windows\SysNative\Drivers\vmbusr.sys (Microsoft Corporation)
DRV:64bit: - (vpcivsp) – C:\Windows\SysNative\Drivers\vpcivsp.sys (Microsoft Corporation)
DRV:64bit: - (NdisImPlatform) – C:\Windows\SysNative\Drivers\NdisImPlatform.sys (Microsoft Corporation)
DRV:64bit: - (MsLldp) – C:\Windows\SysNative\Drivers\mslldp.sys (Microsoft Corporation)
DRV:64bit: - (Ndu) – C:\Windows\SysNative\Drivers\Ndu.sys (Microsoft Corporation)
DRV:64bit: - (RTL8168) – C:\Windows\SysNative\Drivers\Rt630x64.sys (Realtek )
DRV:64bit: - (MotioninJoyXFilter) – C:\Windows\SysNative\Drivers\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (mvs91xx) – C:\Windows\SysNative\Drivers\mvs91xx.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\Drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\Drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\Drivers\xusb21.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\..\SearchScopes\{68664A86-BEA6-4825-AD1C-D665EE1478EF}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searcerms}…amp;FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Ed\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\Ed\Program Files (x86)\DNA [2013-04-30 08:52:52 | 000,000,000 | —D | M]

[2013-04-30 16:30:37 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.nl/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: Mahjong Words 2 = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\akoaibgodkfmengiiainfdbjmmamfall\1.0.0.1_0\
CHR - Extension: Google Documenten = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Eredan iTCG = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdakdeclmfcolipiknbfealnjddfibfo\1_0\
CHR - Extension: YouTube = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4_0\
CHR - Extension: Star Legends = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\chcaflnbhnoegjedbjaamecefhglfamc\2.0.0.0_0\
CHR - Extension: Google Zoeken = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Pirates: Tides of Fortune = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\djlmofcgpnpnhlbkgbpenbecfboohcka\0.88_0\
CHR - Extension: Dragon's Call II = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\fekbihbhfoldbdbjkldepljgmfanhmlo\0.0.0.1_0\
CHR - Extension: Landleven = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgecadidkhhfaficfmhhhepidppfgbmi\2_0\
CHR - Extension: AdBlock = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.63_0\
CHR - Extension: Korelos = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\ididohflghloplfpbdgjfebnociebggh\1.0.0_0\
CHR - Extension: Auto HD For YouTube = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\koiaokdomkpjdgniimnkhgbilbjgpeak\3.8.9_0\
CHR - Extension: FVD Video Downloader = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\5.1.4_0\
CHR - Extension: Dragons of Atlantis = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\manlnjcghdempjdpndlcmaaobbighhcf\1.6.1_0\
CHR - Extension: Pocket Legends = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhpdbcnfpodnaefldpdohoibdajcfabp\2.0.0.0_0\
CHR - Extension: Picky Wallpapers = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\odklcfojpedohplkimfdpcamkjnhanaj\1.0.0_0\
CHR - Extension: Edgeworld = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcfmpdiaehhnljpdomnggcbfofdgkmbp\1.0.1.2_0\
CHR - Extension: Gmail = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Sexy Girl Chrome Theme - Arthur = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkibpgkliocdchedibhioiibdiddomac\1.0_0\

O1 HOSTS File: ([2012-07-26 07:26:49 | 000,000,824 | —- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O2:64bit: - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (ClassicIE9BHO Class) - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)
O2 - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ClassicIE9BHO Class) - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)
O3:64bit: - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
O3 - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)
O4 - HKCU..\Run: [ALLUpdate] "C:\Program Files (x86)\OpenSubtitlesPlayer\ALLUpdate.exe" "sleep" File not found
O4 - HKCU..\Run: [BitTorrent DNA] C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
O4 - HKCU..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe (www.motioninjoy.com)
O4 - HKCU..\Run: [HKCU] C:\Users\Ed\AppData\Roaming\HKLM\rundll.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Ed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9:64bit: - Extra 'Tools' menuitem : Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe (IvoSoft)
O9 - Extra 'Tools' menuitem : Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe (IvoSoft)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B6CAFE86-9B12-4DC4-9D08-41BF24E8B9E3}: DhcpNameServer = 192.168.2.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\WINDOWS\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012-11-06 00:23:37 | 000,011,786 | —- | M] () - D:\Autokosten.xlsx – [ NTFS ]
O33 - MountPoints2\{7bf3f3bd-8e0c-11e2-be6e-1c6f65c54dec}\Shell - "" = AutoRun
O33 - MountPoints2\{7bf3f3bd-8e0c-11e2-be6e-1c6f65c54dec}\Shell\AutoRun\command - "" = "H:\iStudio.exe"
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell - "" = AutoRun
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\AutoRun\command - "" = "N:\SETUP.EXE"
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\configure\command - "" = N:\SETUP.EXE
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\install\command - "" = N:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013-05-26 20:08:27 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013-05-26 20:08:05 | 000,000,000 | —D | C] – C:\JRT
[2013-05-26 19:55:03 | 000,545,954 | —- | C] (Oleg N. Scherbakov) – D:\Ed\Desktop\JRT.exe
[2013-05-26 19:23:56 | 000,000,000 | —D | C] – D:\Ed\Desktop\gmer
[2013-05-26 18:05:58 | 004,745,728 | —- | C] (AVAST Software) – D:\Ed\Desktop\aswMBR.exe
[2013-05-26 17:47:57 | 000,602,112 | —- | C] (OldTimer Tools) – D:\Ed\Desktop\OTL.exe
[2013-05-24 16:21:43 | 000,000,000 | —D | C] – C:\WINDOWS\SysNative\appmgmt
[2013-05-21 18:52:25 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\jscript9.dll
[2013-05-21 18:52:21 | 000,915,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\uxtheme.dll
[2013-05-21 18:52:21 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\jscript.dll
[2013-05-21 18:52:20 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\jscript.dll
[2013-05-21 18:52:20 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msfeeds.dll
[2013-05-21 18:52:20 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\iesysprep.dll
[2013-05-21 18:52:20 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iesysprep.dll
[2013-05-21 18:52:20 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iesetup.dll
[2013-05-21 18:52:20 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ie4uinit.exe
[2013-05-21 18:52:20 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iernonce.dll
[2013-05-21 18:51:58 | 001,161,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\sppobjs.dll
[2013-05-21 18:51:57 | 001,627,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WindowsCodecs.dll
[2013-05-21 18:51:55 | 005,978,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mstscax.dll
[2013-05-21 18:51:55 | 001,048,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mfasfsrcsnk.dll
[2013-05-21 18:51:55 | 000,328,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ubpm.dll
[2013-05-21 18:51:54 | 001,149,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winmde.dll
[2013-05-21 18:51:54 | 001,101,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wmpmde.dll
[2013-05-21 18:51:54 | 000,951,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Globalization.dll
[2013-05-21 18:51:54 | 000,850,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mfasfsrcsnk.dll
[2013-05-21 18:51:54 | 000,760,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuapi.dll
[2013-05-21 18:51:54 | 000,645,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Security.Authentication.OnlineId.dll
[2013-05-21 18:51:54 | 000,389,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\BCP47Langs.dll
[2013-05-21 18:51:54 | 000,327,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\Classpnp.sys
[2013-05-21 18:51:54 | 000,309,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\BCP47Langs.dll
[2013-05-21 18:51:54 | 000,246,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\ubpm.dll
[2013-05-21 18:51:53 | 005,091,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mstscax.dll
[2013-05-21 18:51:53 | 000,893,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\winmde.dll
[2013-05-21 18:51:53 | 000,601,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Globalization.dll
[2013-05-21 18:51:53 | 000,411,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\FWPKCLNT.SYS
[2013-05-21 18:51:53 | 000,357,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\netcfgx.dll
[2013-05-21 18:51:53 | 000,332,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\storport.sys
[2013-05-21 18:51:53 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SystemEventsBrokerServer.dll
[2013-05-21 18:51:53 | 000,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\TimeBrokerServer.dll
[2013-05-21 18:51:52 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drvstore.dll
[2013-05-21 18:51:52 | 000,621,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuapi.dll
[2013-05-21 18:51:52 | 000,550,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\drvstore.dll
[2013-05-21 18:51:52 | 000,504,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Security.Authentication.OnlineId.dll
[2013-05-21 18:51:52 | 000,455,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\netcfgx.dll
[2013-05-21 18:51:52 | 000,448,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SettingSync.dll
[2013-05-21 18:51:52 | 000,356,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\SettingSync.dll
[2013-05-21 18:51:52 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\usbmon.dll
[2013-05-21 18:51:52 | 000,150,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\discan.dll
[2013-05-21 18:51:52 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\taskhost.exe
[2013-05-21 18:51:52 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wups.dll
[2013-05-21 18:51:51 | 001,619,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wucltux.dll
[2013-05-21 18:51:51 | 000,337,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\USBXHCI.SYS
[2013-05-21 18:51:51 | 000,251,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WUSettingsProvider.dll
[2013-05-21 18:51:51 | 000,194,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\sdbus.sys
[2013-05-21 18:51:51 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\storewuauth.dll
[2013-05-21 18:51:51 | 000,156,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\powercfg.cpl
[2013-05-21 18:51:51 | 000,148,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\tpm.sys
[2013-05-21 18:51:51 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\powercfg.cpl
[2013-05-21 18:51:51 | 000,141,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuwebv.dll
[2013-05-21 18:51:51 | 000,128,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SettingSyncInfo.dll
[2013-05-21 18:51:51 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuwebv.dll
[2013-05-21 18:51:51 | 000,125,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\dumpsd.sys
[2013-05-21 18:51:51 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\NdisImPlatform.dll
[2013-05-21 18:51:51 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\SettingSyncInfo.dll
[2013-05-21 18:51:51 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wudriver.dll
[2013-05-21 18:51:51 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wudriver.dll
[2013-05-21 18:51:51 | 000,077,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\storahci.sys
[2013-05-21 18:51:51 | 000,072,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\taskhostex.exe
[2013-05-21 18:51:51 | 000,071,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WSDPrintProxy.DLL
[2013-05-21 18:51:51 | 000,058,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuauclt.exe
[2013-05-21 18:51:51 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\DevDispItemProvider.dll
[2013-05-21 18:51:50 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuapp.exe
[2013-05-21 18:51:50 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\DevDispItemProvider.dll
[2013-05-21 18:51:50 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuapp.exe
[2013-05-21 18:51:44 | 014,267,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wmp.dll
[2013-05-21 18:51:44 | 013,648,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.UI.Xaml.dll
[2013-05-21 18:51:44 | 003,552,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\tquery.dll
[2013-05-21 18:51:43 | 011,878,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wmp.dll
[2013-05-21 18:51:42 | 010,789,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll
[2013-05-21 18:51:42 | 002,767,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\tquery.dll
[2013-05-21 18:51:42 | 002,107,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssrch.dll
[2013-05-21 18:51:41 | 001,593,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssrch.dll
[2013-05-21 18:51:40 | 010,116,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\twinui.dll
[2013-05-21 18:51:40 | 008,857,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\twinui.dll
[2013-05-21 18:51:40 | 001,829,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ntdll.dll
[2013-05-21 18:51:39 | 001,444,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\MSAudDecMFT.dll
[2013-05-21 18:51:38 | 001,113,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\MSAudDecMFT.dll
[2013-05-21 18:51:38 | 000,446,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioSes.dll
[2013-05-21 18:51:38 | 000,403,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssph.dll
[2013-05-21 18:51:38 | 000,306,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kd_02_10ec.dll
[2013-05-21 18:51:38 | 000,298,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\rsaenh.dll
[2013-05-21 18:51:37 | 002,303,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\authui.dll
[2013-05-21 18:51:37 | 002,035,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\authui.dll
[2013-05-21 18:51:37 | 001,403,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winload.efi
[2013-05-21 18:51:37 | 000,804,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\RecoveryDrive.exe
[2013-05-21 18:51:37 | 000,595,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Networking.dll
[2013-05-21 18:51:37 | 000,489,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioEng.dll
[2013-05-21 18:51:37 | 000,456,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wpncore.dll
[2013-05-21 18:51:37 | 000,435,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssph.dll
[2013-05-21 18:51:37 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Networking.BackgroundTransfer.dll
[2013-05-21 18:51:37 | 000,373,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SearchProtocolHost.exe
[2013-05-21 18:51:37 | 000,367,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\conhost.exe
[2013-05-21 18:51:37 | 000,253,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\audiodg.exe
[2013-05-21 18:51:37 | 000,172,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\dwmredir.dll
[2013-05-21 18:51:36 | 001,267,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winload.exe
[2013-05-21 18:51:36 | 001,217,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winresume.efi
[2013-05-21 18:51:36 | 001,093,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winresume.exe
[2013-05-21 18:51:36 | 000,523,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\XpsGdiConverter.dll
[2013-05-21 18:51:36 | 000,503,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ci.dll
[2013-05-21 18:51:36 | 000,468,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\MFMediaEngine.dll
[2013-05-21 18:51:36 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\fhengine.dll
[2013-05-21 18:51:36 | 000,196,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\dmvdsitf.dll
[2013-05-21 18:51:35 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\actxprxy.dll
[2013-05-21 18:51:35 | 000,659,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssvp.dll
[2013-05-21 18:51:35 | 000,411,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Networking.dll
[2013-05-21 18:51:35 | 000,284,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\spaceport.sys
[2013-05-21 18:51:35 | 000,281,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mfreadwrite.dll
[2013-05-21 18:51:35 | 000,268,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Networking.BackgroundTransfer.dll
[2013-05-21 18:51:35 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SearchFilterHost.exe
[2013-05-21 18:51:35 | 000,169,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioEndpointBuilder.dll
[2013-05-21 18:51:35 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Robocopy.exe
[2013-05-21 18:51:35 | 000,123,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wscapi.dll
[2013-05-21 18:51:35 | 000,077,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kdvm.dll
[2013-05-21 18:51:34 | 000,745,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssvp.dll
[2013-05-21 18:51:34 | 000,419,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\intl.cpl
[2013-05-21 18:51:34 | 000,414,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\GenuineCenter.dll
[2013-05-21 18:51:34 | 000,364,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\XpsGdiConverter.dll
[2013-05-21 18:51:34 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mfreadwrite.dll
[2013-05-21 18:51:34 | 000,210,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\iuilp.dll
[2013-05-21 18:51:34 | 000,155,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\dmvdsitf.dll
[2013-05-21 18:51:34 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Robocopy.exe
[2013-05-21 18:51:34 | 000,086,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kdnet.dll
[2013-05-21 18:51:34 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\hidclass.sys
[2013-05-21 18:51:34 | 000,069,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\pdc.sys
[2013-05-21 18:51:33 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\intl.cpl
[2013-05-21 18:51:33 | 000,361,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\MFMediaEngine.dll
[2013-05-21 18:51:33 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssprxy.dll
[2013-05-21 18:51:33 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msscntrs.dll
[2013-05-21 18:51:33 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\fmifs.dll
[2013-05-21 18:51:33 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\fmifs.dll
[2013-05-21 18:51:33 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msshooks.dll
[2013-05-21 18:51:33 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\msshooks.dll
[2013-05-21 18:51:24 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\shdocvw.dll
[2013-05-21 18:51:24 | 000,112,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\consent.exe
[2013-05-21 18:49:31 | 002,851,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\esent.dll
[2013-05-21 18:49:31 | 002,382,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\esent.dll
[2013-05-21 18:49:30 | 001,011,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\reseteng.dll
[2013-05-21 18:49:30 | 000,375,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\ReAgent.dll
[2013-05-21 18:49:26 | 006,987,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ntoskrnl.exe
[2013-05-21 18:21:01 | 000,388,608 | —- | C] (Trend Micro Inc.) – D:\Ed\Desktop\HiJackThis.exe
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\ProgramData\Media Center Programs
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\BioWare
[2013-05-14 21:56:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013-05-14 21:56:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Works
[2013-05-14 21:56:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Visual Studio
[2013-05-14 21:56:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2013-05-14 21:56:12 | 000,000,000 | —D | C] – C:\WINDOWS\PCHEALTH
[2013-05-14 21:55:29 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2013-05-14 21:55:18 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\Microsoft Help
[2013-05-14 21:55:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Office
[2013-05-14 21:55:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2013-05-14 21:55:06 | 000,000,000 | RH-D | C] – C:\MSOCache
[2013-05-10 12:00:57 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\Two Worlds II
[2013-05-09 18:38:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013-05-05 16:46:12 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\TERA
[2013-05-05 16:46:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
[2013-05-05 16:45:58 | 000,000,000 | —D | C] – C:\Program Files (x86)\TERA
[2013-05-05 16:24:10 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\ALLPlayer
[2013-05-02 00:54:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013-05-02 00:07:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2013-04-30 16:33:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2013-04-30 16:33:38 | 000,283,200 | —- | C] (DT Soft Ltd) – C:\WINDOWS\SysNative\drivers\dtsoftbus01.sys
[2013-04-30 16:33:36 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DAEMON Tools Lite
[2013-04-30 16:33:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\DAEMON Tools Lite
[2013-04-30 16:32:51 | 000,000,000 | —D | C] – C:\ProgramData\DAEMON Tools Lite
[2013-04-30 16:30:44 | 000,000,000 | —D | C] – C:\WINDOWS\SysWow64\searchplugins
[2013-04-30 16:30:44 | 000,000,000 | —D | C] – C:\WINDOWS\SysWow64\Extensions
[2013-04-30 16:30:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013-04-30 16:30:18 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DAEMON Tools Ultra
[2013-04-30 16:29:22 | 000,000,000 | —D | C] – C:\ProgramData\DAEMON Tools Ultra
[2013-04-30 08:52:52 | 000,000,000 | —D | C] – C:\Users\Ed\Program Files (x86)
[2013-04-29 15:25:05 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\BitTorrent
[2013-04-29 15:24:58 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\DNA
[2013-04-29 15:24:57 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DNA
[2013-04-29 15:24:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\DNA
[2013-04-28 23:53:19 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
[2013-04-28 23:53:19 | 000,000,000 | —D | C] – C:\ProgramData\Hi-Rez Studios
[2013-04-28 23:53:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hi-Rez Studios

========== Files - Modified Within 30 Days ==========

[2013-05-26 20:52:00 | 000,000,940 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013-05-26 20:22:00 | 000,001,048 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013-05-26 20:15:51 | 001,792,392 | —- | M] () – C:\WINDOWS\SysNative\PerfStringBackup.INI
[2013-05-26 20:15:51 | 000,795,678 | —- | M] () – C:\WINDOWS\SysNative\perfh013.dat
[2013-05-26 20:15:51 | 000,710,046 | —- | M] () – C:\WINDOWS\SysNative\perfh009.dat
[2013-05-26 20:15:51 | 000,158,970 | —- | M] () – C:\WINDOWS\SysNative\perfc013.dat
[2013-05-26 20:15:51 | 000,132,416 | —- | M] () – C:\WINDOWS\SysNative\perfc009.dat
[2013-05-26 20:13:41 | 000,067,584 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013-05-26 20:11:51 | 000,001,044 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013-05-26 20:11:43 | 268,435,456 | -HS- | M] () – C:\swapfile.sys
[2013-05-26 20:11:31 | 3207,938,048 | -HS- | M] () – C:\hiberfil.sys
[2013-05-26 20:01:52 | 000,403,816 | —- | M] () – C:\WINDOWS\SysNative\FNTCACHE.DAT
[2013-05-26 19:58:07 | 000,000,168 | —- | M] () – C:\Users\Ed\defogger_reenable
[2013-05-26 19:54:48 | 000,545,954 | —- | M] (Oleg N. Scherbakov) – D:\Ed\Desktop\JRT.exe
[2013-05-26 19:53:59 | 000,632,031 | —- | M] () – D:\Ed\Desktop\AdwCleaner.exe
[2013-05-26 19:52:54 | 000,050,477 | —- | M] () – D:\Ed\Desktop\Defogger.exe
[2013-05-26 18:05:42 | 004,745,728 | —- | M] (AVAST Software) – D:\Ed\Desktop\aswMBR.exe
[2013-05-26 17:47:58 | 000,602,112 | —- | M] (OldTimer Tools) – D:\Ed\Desktop\OTL.exe
[2013-05-26 17:46:04 | 000,890,854 | —- | M] () – D:\Ed\Desktop\SecurityCheck.exe
[2013-05-21 18:21:02 | 000,388,608 | —- | M] (Trend Micro Inc.) – D:\Ed\Desktop\HiJackThis.exe
[2013-05-19 16:51:01 | 000,000,703 | —- | M] () – C:\Users\Ed\Application Data\Microsoft\Internet Explorer\Quick Launch\Mass Effect.lnk
[2013-05-17 21:49:23 | 000,154,283 | -H– | M] () – C:\Users\Ed\AppData\Roaming\Ed-wchelper.dll
[2013-05-14 22:03:58 | 000,601,448 | —- | M] () – D:\Ed\Documents\SVA Ouder.pdf
[2013-05-07 22:07:50 | 000,693,112 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\SysWow64\FlashPlayerApp.exe
[2013-05-07 22:07:50 | 000,078,200 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
[2013-04-30 16:33:38 | 000,283,200 | —- | M] (DT Soft Ltd) – C:\WINDOWS\SysNative\drivers\dtsoftbus01.sys

========== Files Created - No Company Name ==========

[2013-05-26 20:01:49 | 000,403,816 | —- | C] () – C:\WINDOWS\SysNative\FNTCACHE.DAT
[2013-05-26 19:58:07 | 000,000,168 | —- | C] () – C:\Users\Ed\defogger_reenable
[2013-05-26 19:54:12 | 000,632,031 | —- | C] () – D:\Ed\Desktop\AdwCleaner.exe
[2013-05-26 19:52:54 | 000,050,477 | —- | C] () – D:\Ed\Desktop\Defogger.exe
[2013-05-26 17:46:21 | 000,890,854 | —- | C] () – D:\Ed\Desktop\SecurityCheck.exe
[2013-05-21 18:51:33 | 000,387,688 | —- | C] () – C:\WINDOWS\SysNative\ApnDatabase.xml
[2013-05-19 16:51:01 | 000,000,703 | —- | C] () – C:\Users\Ed\Application Data\Microsoft\Internet Explorer\Quick Launch\Mass Effect.lnk
[2013-05-17 21:49:23 | 000,154,283 | -H– | C] () – C:\Users\Ed\AppData\Roaming\Ed-wchelper.dll
[2013-05-14 22:03:58 | 000,601,448 | —- | C] () – D:\Ed\Documents\SVA Ouder.pdf
[2013-02-28 00:56:27 | 000,083,968 | —- | C] () – C:\WINDOWS\SysWow64\OEMLicense.dll
[2013-02-23 12:08:01 | 000,000,048 | —- | C] () – C:\Users\Ed\AppData\Roaming\burnaware.ini
[2013-02-22 22:35:17 | 000,008,192 | —- | C] () – C:\WINDOWS\SysWow64\drivers\IntelMEFWVer.dll
[2013-02-22 22:29:02 | 000,000,010 | —- | C] () – C:\WINDOWS\GSetup.ini
[2013-01-11 10:16:52 | 004,336,640 | —- | C] () – C:\WINDOWS\SysWow64\x264vfw.dll
[2012-07-26 10:13:10 | 000,215,943 | —- | C] () – C:\WINDOWS\SysWow64\dssec.dat
[2012-07-26 10:13:09 | 000,000,741 | —- | C] () – C:\WINDOWS\SysWow64\NOISE.DAT
[2012-07-26 09:21:26 | 000,067,584 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2012-07-26 03:17:42 | 000,043,520 | —- | C] () – C:\WINDOWS\SysWow64\BWContextHandler.dll
[2012-07-25 22:37:29 | 000,043,131 | —- | C] () – C:\WINDOWS\mib.bin
[2012-07-25 22:28:31 | 000,364,544 | —- | C] () – C:\WINDOWS\SysWow64\msjetoledb40.dll
[2012-07-17 15:22:04 | 000,179,200 | —- | C] () – C:\WINDOWS\SysWow64\unrar.dll
[2012-07-03 03:28:06 | 000,112,640 | —- | C] () – C:\WINDOWS\SysWow64\ff_vfw.dll
[2012-06-02 16:31:19 | 000,673,088 | —- | C] () – C:\WINDOWS\SysWow64\mlang.dat
[2012-05-22 01:28:58 | 000,155,648 | —- | C] () – C:\WINDOWS\SysWow64\mlc.dll
[2011-12-08 06:32:24 | 000,216,064 | —- | C] ( ) – C:\WINDOWS\SysWow64\lagarith.dll
[2011-09-28 18:44:14 | 000,179,271 | —- | C] () – C:\WINDOWS\SysWow64\xlive.dll.cat

========== ZeroAccess Check ==========

[2013-02-23 21:14:12 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013-03-06 08:31:28 | 019,758,592 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013-03-06 07:03:37 | 017,561,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012-07-26 05:05:38 | 001,004,544 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012-07-26 05:18:27 | 000,784,896 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012-07-26 05:07:41 | 000,455,680 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

_________________________________________

Any change with regards to the DOS pop-up?

Unfortunately no change in the DOS pop-up. The secondary Windows pop-up is gone.

_________________________________________

Do you remember when this started? (the date if possible)
Did you install any new software or hardware around the time the pop-ups started?

This problem started one or two days before my initial post, when I accidentially double-clicked an .exe file, which I had downloaded from a binary newsgroup (yeah, yeah, I know…

). This must be around 19th or 20th of May. On the 19th I've installed Mass Effect from the dvd I had bought. I've installed no other software of hardware round that date.

Miathan

Post #12May 26, 2013, 7:29 PM UTC

Hi OCD

After my last post I looked through the OTL-log (just curious) and noticed a BitTorrent application under the name DNA. I have uninstalled this too and ran the OTL scan again. However, the pop-up remains on start-up.

_________________________________________

Fresh "OTL" log:

OTL logfile created on: 26-5-2013 21:20:12 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = D:\Ed\Desktop
64bit- Professional (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16580)
Locale: 00000413 | Country: Nederland | Language: NLD | Date Format: d-M-yyyy

3,98 Gb Total Physical Memory | 2,84 Gb Available Physical Memory | 71,18% Memory free
7,98 Gb Paging File | 6,72 Gb Available in Paging File | 84,23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 167,58 Gb Total Space | 26,57 Gb Free Space | 15,85% Space Free | Partition Type: NTFS
Drive D: | 219,73 Gb Total Space | 173,38 Gb Free Space | 78,91% Space Free | Partition Type: NTFS
Drive E: | 351,56 Gb Total Space | 324,92 Gb Free Space | 92,42% Space Free | Partition Type: NTFS
Drive F: | 360,22 Gb Total Space | 325,38 Gb Free Space | 90,33% Space Free | Partition Type: NTFS
Drive H: | 465,76 Gb Total Space | 156,04 Gb Free Space | 33,50% Space Free | Partition Type: NTFS

Computer Name: ED-PC | User Name: Ed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - D:\Ed\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Classic Shell\ClassicShellService.exe (IvoSoft)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)

========== Modules (No Company Name) ==========

MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\d29382ad4b800178b51631569c928f0b\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\5cb0754debdf19b9f0d63d4d8721f532\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\398e7010fffe84888b310c1ad6c02e74\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e2f7dbe3bf08df200a4cdcf2e0eb82fa\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0d949755951d5b5e3472bde406ea02dd\IAStorUtil.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IAStorCommon\3d20a38dd44a0ba3ddce6d96d7bee685\IAStorCommon.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\ae31f7dc9817e359d05c9c8efdd5f359\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\7e6b074d3f3e3cc8e0270a3552c47aaa\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\28c2c6e7f48ff80c680a97b08df66a72\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\8d2929ad589e1092eb62a43424361465\mscorlib.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_nl_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_nl_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (AudioEndpointBuilder) – C:\Windows\SysNative\AudioEndpointBuilder.dll (Microsoft Corporation)
SRV:64bit: - (ClassicShellService) – C:\Program Files\Classic Shell\ClassicShellService.exe (IvoSoft)
SRV:64bit: - (TimeBroker) – C:\Windows\SysNative\TimeBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (SystemEventsBroker) – C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (netprofm) – C:\Windows\SysNative\netprofmsvc.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (wlidsvc) – C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
SRV:64bit: - (LSM) – C:\Windows\SysNative\lsm.dll (Microsoft Corporation)
SRV:64bit: - (PrintNotify) – C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV:64bit: - (WSService) – C:\Windows\SysNative\WSService.dll (Microsoft Corporation)
SRV:64bit: - (fhsvc) – C:\Windows\SysNative\fhsvc.dll (Microsoft Corporation)
SRV:64bit: - (BrokerInfrastructure) – C:\Windows\SysNative\bisrv.dll (Microsoft Corporation)
SRV:64bit: - (WiaRpc) – C:\Windows\SysNative\wiarpc.dll (Microsoft Corporation)
SRV:64bit: - (Wcmsvc) – C:\Windows\SysNative\wcmsvc.dll (Microsoft Corporation)
SRV:64bit: - (VaultSvc) – C:\Windows\SysNative\vaultsvc.dll (Microsoft Corporation)
SRV:64bit: - (svsvc) – C:\Windows\SysNative\svsvc.dll (Microsoft Corporation)
SRV:64bit: - (Netlogon) – C:\Windows\SysNative\netlogon.dll (Microsoft Corporation)
SRV:64bit: - (NcaSvc) – C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
SRV:64bit: - (NcdAutoSetup) – C:\Windows\SysNative\NcdAutoSetup.dll (Microsoft Corporation)
SRV:64bit: - (KeyIso) – C:\Windows\SysNative\keyiso.dll (Microsoft Corporation)
SRV:64bit: - (EFS) – C:\Windows\SysNative\efssvc.dll (Microsoft Corporation)
SRV:64bit: - (DsmSvc) – C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
SRV:64bit: - (DeviceAssociationService) – C:\Windows\SysNative\das.dll (Microsoft Corporation)
SRV:64bit: - (AllUserInstallAgent) – C:\Windows\SysNative\AUInstallAgent.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (vmicvss) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmictimesync) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicshutdown) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicrdv) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmickvpexchange) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicheartbeat) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (HiPatchService) – C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) – C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PrintNotify) – C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV - (StorSvc) – C:\Windows\SysWOW64\StorSvc.dll (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (dtsoftbus01) – C:\Windows\SysNative\Drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (spaceport) – C:\Windows\SysNative\Drivers\spaceport.sys (Microsoft Corporation)
DRV:64bit: - (USBXHCI) – C:\Windows\SysNative\Drivers\USBXHCI.SYS (Microsoft Corporation)
DRV:64bit: - (storahci) – C:\Windows\SysNative\Drivers\storahci.sys (Microsoft Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\Drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\Drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (pdc) – C:\Windows\SysNative\Drivers\pdc.sys (Microsoft Corporation)
DRV:64bit: - (USBHUB3) – C:\Windows\SysNative\Drivers\USBHUB3.SYS (Microsoft Corporation)
DRV:64bit: - (BthAvrcpTg) – C:\Windows\SysNative\Drivers\BthAvrcpTg.sys (Microsoft Corporation)
DRV:64bit: - (WdBoot) – C:\Windows\SysNative\Drivers\WdBoot.sys (Microsoft Corporation)
DRV:64bit: - (WdFilter) – C:\Windows\SysNative\Drivers\WdFilter.sys (Microsoft Corporation)
DRV:64bit: - (msgpiowin32) – C:\Windows\SysNative\Drivers\msgpiowin32.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) – C:\Windows\SysNative\Drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (bthhfhid) – C:\Windows\SysNative\Drivers\BthhfHid.sys (Microsoft Corporation)
DRV:64bit: - (hidi2c) – C:\Windows\SysNative\Drivers\hidi2c.sys (Microsoft Corporation)
DRV:64bit: - (FxPPM) – C:\Windows\SysNative\Drivers\fxppm.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\Drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (sdstor) – C:\Windows\SysNative\Drivers\sdstor.sys (Microsoft Corporation)
DRV:64bit: - (dam) – C:\Windows\SysNative\Drivers\dam.sys (Microsoft Corporation)
DRV:64bit: - (UCX01000) – C:\Windows\SysNative\Drivers\UCX01000.SYS (Microsoft Corporation)
DRV:64bit: - (GPIOClx0101) – C:\Windows\SysNative\Drivers\msgpioclx.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\Drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\Drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\Drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) – C:\WINDOWS\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (condrv) – C:\Windows\SysNative\Drivers\condrv.sys (Microsoft Corporation)
DRV:64bit: - (VSTXRAID) – C:\Windows\SysNative\Drivers\VSTXRAID.SYS (VIA Corporation)
DRV:64bit: - (VerifierExt) – C:\Windows\SysNative\Drivers\VerifierExt.sys (Microsoft Corporation)
DRV:64bit: - (UASPStor) – C:\Windows\SysNative\Drivers\uaspstor.sys (Microsoft Corporation)
DRV:64bit: - (acpiex) – C:\Windows\SysNative\Drivers\acpiex.sys (Microsoft Corporation)
DRV:64bit: - (mvumis) – C:\Windows\SysNative\Drivers\mvumis.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\Drivers\stexstor.sys (Promise Technology, Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\Drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (LSI_SSS) – C:\Windows\SysNative\Drivers\lsi_sss.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\Drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (EhStorTcgDrv) – C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys (Microsoft Corporation)
DRV:64bit: - (EhStorClass) – C:\Windows\SysNative\Drivers\EhStorClass.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\Drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (3ware) – C:\Windows\SysNative\Drivers\3ware.sys (LSI)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\Drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\Drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (CLFS) – C:\Windows\SysNative\Drivers\clfs.sys (Microsoft Corporation)
DRV:64bit: - (WFPLWFS) – C:\Windows\SysNative\Drivers\wfplwfs.sys (Microsoft Corporation)
DRV:64bit: - (vpci) – C:\Windows\SysNative\Drivers\vpci.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) – C:\Windows\SysNative\Drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (mshidumdf) – C:\Windows\SysNative\Drivers\mshidumdf.sys (Microsoft Corporation)
DRV:64bit: - (BasicDisplay) – C:\Windows\SysNative\Drivers\BasicDisplay.sys (Microsoft Corporation)
DRV:64bit: - (HyperVideo) – C:\Windows\SysNative\Drivers\HyperVideo.sys (Microsoft Corporation)
DRV:64bit: - (BasicRender) – C:\Windows\SysNative\Drivers\BasicRender.sys (Microsoft Corporation)
DRV:64bit: - (gencounter) – C:\Windows\SysNative\Drivers\vmgencounter.sys (Microsoft Corporation)
DRV:64bit: - (kdnic) – C:\Windows\SysNative\Drivers\kdnic.sys (Microsoft Corporation)
DRV:64bit: - (acpitime) – C:\Windows\SysNative\Drivers\acpitime.sys (Microsoft Corporation)
DRV:64bit: - (npsvctrig) – C:\Windows\SysNative\Drivers\npsvctrig.sys (Microsoft Corporation)
DRV:64bit: - (WpdUpFltr) – C:\Windows\SysNative\Drivers\WpdUpFltr.sys (Microsoft Corporation)
DRV:64bit: - (acpipagr) – C:\Windows\SysNative\Drivers\acpipagr.sys (Microsoft Corporation)
DRV:64bit: - (hyperkbd) – C:\Windows\SysNative\Drivers\hyperkbd.sys (Microsoft Corporation)
DRV:64bit: - (SerCx) – C:\Windows\SysNative\Drivers\SerCx.sys (Microsoft Corporation)
DRV:64bit: - (SpbCx) – C:\Windows\SysNative\Drivers\SpbCx.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\Drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (BthHFEnum) – C:\Windows\SysNative\Drivers\bthhfenum.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\Drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\Drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (Vid) – C:\Windows\SysNative\Drivers\Vid.sys (Microsoft Corporation)
DRV:64bit: - (storvsp) – C:\Windows\SysNative\Drivers\storvsp.sys (Microsoft Corporation)
DRV:64bit: - (wpcfltr) – C:\Windows\SysNative\Drivers\wpcfltr.sys (Microsoft Corporation)
DRV:64bit: - (vmbusr) – C:\Windows\SysNative\Drivers\vmbusr.sys (Microsoft Corporation)
DRV:64bit: - (vpcivsp) – C:\Windows\SysNative\Drivers\vpcivsp.sys (Microsoft Corporation)
DRV:64bit: - (NdisImPlatform) – C:\Windows\SysNative\Drivers\NdisImPlatform.sys (Microsoft Corporation)
DRV:64bit: - (MsLldp) – C:\Windows\SysNative\Drivers\mslldp.sys (Microsoft Corporation)
DRV:64bit: - (Ndu) – C:\Windows\SysNative\Drivers\Ndu.sys (Microsoft Corporation)
DRV:64bit: - (RTL8168) – C:\Windows\SysNative\Drivers\Rt630x64.sys (Realtek )
DRV:64bit: - (MotioninJoyXFilter) – C:\Windows\SysNative\Drivers\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (mvs91xx) – C:\Windows\SysNative\Drivers\mvs91xx.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\Drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\Drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\Drivers\xusb21.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE10SR
IE - HKCU\..\SearchScopes\{68664A86-BEA6-4825-AD1C-D665EE1478EF}: "URL" = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searcerms}…amp;FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

[2013-04-30 16:30:37 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.nl/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: Mahjong Words 2 = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\akoaibgodkfmengiiainfdbjmmamfall\1.0.0.1_0\
CHR - Extension: Google Documenten = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Eredan iTCG = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdakdeclmfcolipiknbfealnjddfibfo\1_0\
CHR - Extension: YouTube = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4_0\
CHR - Extension: Star Legends = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\chcaflnbhnoegjedbjaamecefhglfamc\2.0.0.0_0\
CHR - Extension: Google Zoeken = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Pirates: Tides of Fortune = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\djlmofcgpnpnhlbkgbpenbecfboohcka\0.88_0\
CHR - Extension: Dragon's Call II = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\fekbihbhfoldbdbjkldepljgmfanhmlo\0.0.0.1_0\
CHR - Extension: Landleven = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgecadidkhhfaficfmhhhepidppfgbmi\2_0\
CHR - Extension: AdBlock = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.63_0\
CHR - Extension: Korelos = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\ididohflghloplfpbdgjfebnociebggh\1.0.0_0\
CHR - Extension: Auto HD For YouTube = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\koiaokdomkpjdgniimnkhgbilbjgpeak\3.8.9_0\
CHR - Extension: FVD Video Downloader = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\5.1.4_0\
CHR - Extension: Dragons of Atlantis = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\manlnjcghdempjdpndlcmaaobbighhcf\1.6.1_0\
CHR - Extension: Pocket Legends = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhpdbcnfpodnaefldpdohoibdajcfabp\2.0.0.0_0\
CHR - Extension: Picky Wallpapers = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\odklcfojpedohplkimfdpcamkjnhanaj\1.0.0_0\
CHR - Extension: Edgeworld = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcfmpdiaehhnljpdomnggcbfofdgkmbp\1.0.1.2_0\
CHR - Extension: Gmail = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Sexy Girl Chrome Theme - Arthur = C:\Users\Ed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkibpgkliocdchedibhioiibdiddomac\1.0_0\

O1 HOSTS File: ([2012-07-26 07:26:49 | 000,000,824 | —- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O2:64bit: - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (ClassicIE9BHO Class) - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)
O2 - BHO: (ExplorerBHO Class) - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ClassicIE9BHO Class) - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)
O3:64bit: - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
O3 - HKLM\..\Toolbar: (Classic Explorer Bar) - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)
O4 - HKCU..\Run: [ALLUpdate] "C:\Program Files (x86)\OpenSubtitlesPlayer\ALLUpdate.exe" "sleep" File not found
O4 - HKCU..\Run: [DS3 Tool] C:\Program Files\MotioninJoy\ds3\DS3_Tool.exe (www.motioninjoy.com)
O4 - HKCU..\Run: [HKCU] C:\Users\Ed\AppData\Roaming\HKLM\rundll.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Ed\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9:64bit: - Extra 'Tools' menuitem : Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe (IvoSoft)
O9 - Extra 'Tools' menuitem : Classic IE9 Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE9_32.exe (IvoSoft)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B6CAFE86-9B12-4DC4-9D08-41BF24E8B9E3}: DhcpNameServer = 192.168.2.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\WINDOWS\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012-11-06 00:23:37 | 000,011,786 | —- | M] () - D:\Autokosten.xlsx – [ NTFS ]
O33 - MountPoints2\{7bf3f3bd-8e0c-11e2-be6e-1c6f65c54dec}\Shell - "" = AutoRun
O33 - MountPoints2\{7bf3f3bd-8e0c-11e2-be6e-1c6f65c54dec}\Shell\AutoRun\command - "" = "H:\iStudio.exe"
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell - "" = AutoRun
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\AutoRun\command - "" = "N:\SETUP.EXE"
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\configure\command - "" = N:\SETUP.EXE
O33 - MountPoints2\{b642be60-af88-11e2-be72-1c6f65c54dec}\Shell\install\command - "" = N:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013-05-26 20:08:27 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013-05-26 20:08:05 | 000,000,000 | —D | C] – C:\JRT
[2013-05-26 19:55:03 | 000,545,954 | —- | C] (Oleg N. Scherbakov) – D:\Ed\Desktop\JRT.exe
[2013-05-26 19:23:56 | 000,000,000 | —D | C] – D:\Ed\Desktop\gmer
[2013-05-26 18:05:58 | 004,745,728 | —- | C] (AVAST Software) – D:\Ed\Desktop\aswMBR.exe
[2013-05-26 17:47:57 | 000,602,112 | —- | C] (OldTimer Tools) – D:\Ed\Desktop\OTL.exe
[2013-05-24 16:21:43 | 000,000,000 | —D | C] – C:\WINDOWS\SysNative\appmgmt
[2013-05-21 18:52:25 | 003,958,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\jscript9.dll
[2013-05-21 18:52:21 | 000,915,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\uxtheme.dll
[2013-05-21 18:52:21 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\jscript.dll
[2013-05-21 18:52:20 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\jscript.dll
[2013-05-21 18:52:20 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msfeeds.dll
[2013-05-21 18:52:20 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\iesysprep.dll
[2013-05-21 18:52:20 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iesysprep.dll
[2013-05-21 18:52:20 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iesetup.dll
[2013-05-21 18:52:20 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ie4uinit.exe
[2013-05-21 18:52:20 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\iernonce.dll
[2013-05-21 18:51:58 | 001,161,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\sppobjs.dll
[2013-05-21 18:51:57 | 001,627,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WindowsCodecs.dll
[2013-05-21 18:51:55 | 005,978,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mstscax.dll
[2013-05-21 18:51:55 | 001,048,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mfasfsrcsnk.dll
[2013-05-21 18:51:55 | 000,328,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ubpm.dll
[2013-05-21 18:51:54 | 001,149,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winmde.dll
[2013-05-21 18:51:54 | 001,101,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wmpmde.dll
[2013-05-21 18:51:54 | 000,951,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Globalization.dll
[2013-05-21 18:51:54 | 000,850,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mfasfsrcsnk.dll
[2013-05-21 18:51:54 | 000,760,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuapi.dll
[2013-05-21 18:51:54 | 000,645,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Security.Authentication.OnlineId.dll
[2013-05-21 18:51:54 | 000,389,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\BCP47Langs.dll
[2013-05-21 18:51:54 | 000,327,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\Classpnp.sys
[2013-05-21 18:51:54 | 000,309,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\BCP47Langs.dll
[2013-05-21 18:51:54 | 000,246,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\ubpm.dll
[2013-05-21 18:51:53 | 005,091,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mstscax.dll
[2013-05-21 18:51:53 | 000,893,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\winmde.dll
[2013-05-21 18:51:53 | 000,601,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Globalization.dll
[2013-05-21 18:51:53 | 000,411,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\FWPKCLNT.SYS
[2013-05-21 18:51:53 | 000,357,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\netcfgx.dll
[2013-05-21 18:51:53 | 000,332,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\storport.sys
[2013-05-21 18:51:53 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SystemEventsBrokerServer.dll
[2013-05-21 18:51:53 | 000,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\TimeBrokerServer.dll
[2013-05-21 18:51:52 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drvstore.dll
[2013-05-21 18:51:52 | 000,621,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuapi.dll
[2013-05-21 18:51:52 | 000,550,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\drvstore.dll
[2013-05-21 18:51:52 | 000,504,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Security.Authentication.OnlineId.dll
[2013-05-21 18:51:52 | 000,455,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\netcfgx.dll
[2013-05-21 18:51:52 | 000,448,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SettingSync.dll
[2013-05-21 18:51:52 | 000,356,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\SettingSync.dll
[2013-05-21 18:51:52 | 000,245,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\usbmon.dll
[2013-05-21 18:51:52 | 000,150,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\discan.dll
[2013-05-21 18:51:52 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\taskhost.exe
[2013-05-21 18:51:52 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wups.dll
[2013-05-21 18:51:51 | 001,619,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wucltux.dll
[2013-05-21 18:51:51 | 000,337,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\USBXHCI.SYS
[2013-05-21 18:51:51 | 000,251,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WUSettingsProvider.dll
[2013-05-21 18:51:51 | 000,194,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\sdbus.sys
[2013-05-21 18:51:51 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\storewuauth.dll
[2013-05-21 18:51:51 | 000,156,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\powercfg.cpl
[2013-05-21 18:51:51 | 000,148,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\tpm.sys
[2013-05-21 18:51:51 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\powercfg.cpl
[2013-05-21 18:51:51 | 000,141,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuwebv.dll
[2013-05-21 18:51:51 | 000,128,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SettingSyncInfo.dll
[2013-05-21 18:51:51 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuwebv.dll
[2013-05-21 18:51:51 | 000,125,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\dumpsd.sys
[2013-05-21 18:51:51 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\NdisImPlatform.dll
[2013-05-21 18:51:51 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\SettingSyncInfo.dll
[2013-05-21 18:51:51 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wudriver.dll
[2013-05-21 18:51:51 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wudriver.dll
[2013-05-21 18:51:51 | 000,077,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\storahci.sys
[2013-05-21 18:51:51 | 000,072,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\taskhostex.exe
[2013-05-21 18:51:51 | 000,071,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\WSDPrintProxy.DLL
[2013-05-21 18:51:51 | 000,058,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuauclt.exe
[2013-05-21 18:51:51 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\DevDispItemProvider.dll
[2013-05-21 18:51:50 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wuapp.exe
[2013-05-21 18:51:50 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\DevDispItemProvider.dll
[2013-05-21 18:51:50 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wuapp.exe
[2013-05-21 18:51:44 | 014,267,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wmp.dll
[2013-05-21 18:51:44 | 013,648,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.UI.Xaml.dll
[2013-05-21 18:51:44 | 003,552,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\tquery.dll
[2013-05-21 18:51:43 | 011,878,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wmp.dll
[2013-05-21 18:51:42 | 010,789,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll
[2013-05-21 18:51:42 | 002,767,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\tquery.dll
[2013-05-21 18:51:42 | 002,107,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssrch.dll
[2013-05-21 18:51:41 | 001,593,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssrch.dll
[2013-05-21 18:51:40 | 010,116,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\twinui.dll
[2013-05-21 18:51:40 | 008,857,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\twinui.dll
[2013-05-21 18:51:40 | 001,829,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ntdll.dll
[2013-05-21 18:51:39 | 001,444,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\MSAudDecMFT.dll
[2013-05-21 18:51:38 | 001,113,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\MSAudDecMFT.dll
[2013-05-21 18:51:38 | 000,446,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioSes.dll
[2013-05-21 18:51:38 | 000,403,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssph.dll
[2013-05-21 18:51:38 | 000,306,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kd_02_10ec.dll
[2013-05-21 18:51:38 | 000,298,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\rsaenh.dll
[2013-05-21 18:51:37 | 002,303,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\authui.dll
[2013-05-21 18:51:37 | 002,035,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\authui.dll
[2013-05-21 18:51:37 | 001,403,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winload.efi
[2013-05-21 18:51:37 | 000,804,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\RecoveryDrive.exe
[2013-05-21 18:51:37 | 000,595,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Networking.dll
[2013-05-21 18:51:37 | 000,489,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioEng.dll
[2013-05-21 18:51:37 | 000,456,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\wpncore.dll
[2013-05-21 18:51:37 | 000,435,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssph.dll
[2013-05-21 18:51:37 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Windows.Networking.BackgroundTransfer.dll
[2013-05-21 18:51:37 | 000,373,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SearchProtocolHost.exe
[2013-05-21 18:51:37 | 000,367,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\conhost.exe
[2013-05-21 18:51:37 | 000,253,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\audiodg.exe
[2013-05-21 18:51:37 | 000,172,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\dwmredir.dll
[2013-05-21 18:51:36 | 001,267,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winload.exe
[2013-05-21 18:51:36 | 001,217,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winresume.efi
[2013-05-21 18:51:36 | 001,093,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\winresume.exe
[2013-05-21 18:51:36 | 000,523,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\XpsGdiConverter.dll
[2013-05-21 18:51:36 | 000,503,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ci.dll
[2013-05-21 18:51:36 | 000,468,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\MFMediaEngine.dll
[2013-05-21 18:51:36 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\fhengine.dll
[2013-05-21 18:51:36 | 000,196,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\dmvdsitf.dll
[2013-05-21 18:51:35 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\actxprxy.dll
[2013-05-21 18:51:35 | 000,659,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mssvp.dll
[2013-05-21 18:51:35 | 000,411,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Networking.dll
[2013-05-21 18:51:35 | 000,284,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\spaceport.sys
[2013-05-21 18:51:35 | 000,281,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mfreadwrite.dll
[2013-05-21 18:51:35 | 000,268,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Windows.Networking.BackgroundTransfer.dll
[2013-05-21 18:51:35 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\SearchFilterHost.exe
[2013-05-21 18:51:35 | 000,169,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\AudioEndpointBuilder.dll
[2013-05-21 18:51:35 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\Robocopy.exe
[2013-05-21 18:51:35 | 000,123,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\wscapi.dll
[2013-05-21 18:51:35 | 000,077,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kdvm.dll
[2013-05-21 18:51:34 | 000,745,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssvp.dll
[2013-05-21 18:51:34 | 000,419,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\intl.cpl
[2013-05-21 18:51:34 | 000,414,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\GenuineCenter.dll
[2013-05-21 18:51:34 | 000,364,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\XpsGdiConverter.dll
[2013-05-21 18:51:34 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\mfreadwrite.dll
[2013-05-21 18:51:34 | 000,210,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\iuilp.dll
[2013-05-21 18:51:34 | 000,155,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\dmvdsitf.dll
[2013-05-21 18:51:34 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\Robocopy.exe
[2013-05-21 18:51:34 | 000,086,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\kdnet.dll
[2013-05-21 18:51:34 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\hidclass.sys
[2013-05-21 18:51:34 | 000,069,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\drivers\pdc.sys
[2013-05-21 18:51:33 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\intl.cpl
[2013-05-21 18:51:33 | 000,361,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\MFMediaEngine.dll
[2013-05-21 18:51:33 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\mssprxy.dll
[2013-05-21 18:51:33 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msscntrs.dll
[2013-05-21 18:51:33 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\fmifs.dll
[2013-05-21 18:51:33 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\fmifs.dll
[2013-05-21 18:51:33 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\msshooks.dll
[2013-05-21 18:51:33 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\msshooks.dll
[2013-05-21 18:51:24 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\shdocvw.dll
[2013-05-21 18:51:24 | 000,112,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\consent.exe
[2013-05-21 18:49:31 | 002,851,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\esent.dll
[2013-05-21 18:49:31 | 002,382,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\esent.dll
[2013-05-21 18:49:30 | 001,011,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\reseteng.dll
[2013-05-21 18:49:30 | 000,375,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysWow64\ReAgent.dll
[2013-05-21 18:49:26 | 006,987,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\SysNative\ntoskrnl.exe
[2013-05-21 18:21:01 | 000,388,608 | —- | C] (Trend Micro Inc.) – D:\Ed\Desktop\HiJackThis.exe
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\ProgramData\Media Center Programs
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\BioWare
[2013-05-14 21:56:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013-05-14 21:56:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Works
[2013-05-14 21:56:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Visual Studio
[2013-05-14 21:56:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\DESIGNER
[2013-05-14 21:56:12 | 000,000,000 | —D | C] – C:\WINDOWS\PCHEALTH
[2013-05-14 21:55:29 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2013-05-14 21:55:18 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\Microsoft Help
[2013-05-14 21:55:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Office
[2013-05-14 21:55:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2013-05-14 21:55:06 | 000,000,000 | RH-D | C] – C:\MSOCache
[2013-05-10 12:00:57 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\Two Worlds II
[2013-05-09 18:38:54 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013-05-05 16:46:12 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\TERA
[2013-05-05 16:46:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
[2013-05-05 16:45:58 | 000,000,000 | —D | C] – C:\Program Files (x86)\TERA
[2013-05-05 16:24:10 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\ALLPlayer
[2013-05-02 00:54:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013-05-02 00:07:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2013-04-30 16:33:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2013-04-30 16:33:38 | 000,283,200 | —- | C] (DT Soft Ltd) – C:\WINDOWS\SysNative\drivers\dtsoftbus01.sys
[2013-04-30 16:33:36 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DAEMON Tools Lite
[2013-04-30 16:33:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\DAEMON Tools Lite
[2013-04-30 16:32:51 | 000,000,000 | —D | C] – C:\ProgramData\DAEMON Tools Lite
[2013-04-30 16:30:44 | 000,000,000 | —D | C] – C:\WINDOWS\SysWow64\searchplugins
[2013-04-30 16:30:44 | 000,000,000 | —D | C] – C:\WINDOWS\SysWow64\Extensions
[2013-04-30 16:30:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013-04-30 16:30:18 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DAEMON Tools Ultra
[2013-04-30 16:29:22 | 000,000,000 | —D | C] – C:\ProgramData\DAEMON Tools Ultra
[2013-04-29 15:25:05 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\BitTorrent
[2013-04-29 15:24:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\DNA
[2013-04-28 23:53:19 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
[2013-04-28 23:53:19 | 000,000,000 | —D | C] – C:\ProgramData\Hi-Rez Studios
[2013-04-28 23:53:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hi-Rez Studios

========== Files - Modified Within 30 Days ==========

[2013-05-26 21:03:51 | 001,792,392 | —- | M] () – C:\WINDOWS\SysNative\PerfStringBackup.INI
[2013-05-26 21:03:51 | 000,795,678 | —- | M] () – C:\WINDOWS\SysNative\perfh013.dat
[2013-05-26 21:03:51 | 000,710,046 | —- | M] () – C:\WINDOWS\SysNative\perfh009.dat
[2013-05-26 21:03:51 | 000,158,970 | —- | M] () – C:\WINDOWS\SysNative\perfc013.dat
[2013-05-26 21:03:51 | 000,132,416 | —- | M] () – C:\WINDOWS\SysNative\perfc009.dat
[2013-05-26 21:01:37 | 000,067,584 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013-05-26 20:59:48 | 000,001,044 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013-05-26 20:59:40 | 268,435,456 | -HS- | M] () – C:\swapfile.sys
[2013-05-26 20:59:27 | 3207,938,048 | -HS- | M] () – C:\hiberfil.sys
[2013-05-26 20:52:00 | 000,000,940 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013-05-26 20:22:00 | 000,001,048 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013-05-26 20:01:52 | 000,403,816 | —- | M] () – C:\WINDOWS\SysNative\FNTCACHE.DAT
[2013-05-26 19:58:07 | 000,000,168 | —- | M] () – C:\Users\Ed\defogger_reenable
[2013-05-26 19:54:48 | 000,545,954 | —- | M] (Oleg N. Scherbakov) – D:\Ed\Desktop\JRT.exe
[2013-05-26 19:53:59 | 000,632,031 | —- | M] () – D:\Ed\Desktop\AdwCleaner.exe
[2013-05-26 19:52:54 | 000,050,477 | —- | M] () – D:\Ed\Desktop\Defogger.exe
[2013-05-26 18:05:42 | 004,745,728 | —- | M] (AVAST Software) – D:\Ed\Desktop\aswMBR.exe
[2013-05-26 17:47:58 | 000,602,112 | —- | M] (OldTimer Tools) – D:\Ed\Desktop\OTL.exe
[2013-05-26 17:46:04 | 000,890,854 | —- | M] () – D:\Ed\Desktop\SecurityCheck.exe
[2013-05-21 18:21:02 | 000,388,608 | —- | M] (Trend Micro Inc.) – D:\Ed\Desktop\HiJackThis.exe
[2013-05-19 16:51:01 | 000,000,703 | —- | M] () – C:\Users\Ed\Application Data\Microsoft\Internet Explorer\Quick Launch\Mass Effect.lnk
[2013-05-17 21:49:23 | 000,154,283 | -H– | M] () – C:\Users\Ed\AppData\Roaming\Ed-wchelper.dll
[2013-05-14 22:03:58 | 000,601,448 | —- | M] () – D:\Ed\Documents\SVA Ouder.pdf
[2013-05-07 22:07:50 | 000,693,112 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\SysWow64\FlashPlayerApp.exe
[2013-05-07 22:07:50 | 000,078,200 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
[2013-04-30 16:33:38 | 000,283,200 | —- | M] (DT Soft Ltd) – C:\WINDOWS\SysNative\drivers\dtsoftbus01.sys

========== Files Created - No Company Name ==========

[2013-05-26 20:01:49 | 000,403,816 | —- | C] () – C:\WINDOWS\SysNative\FNTCACHE.DAT
[2013-05-26 19:58:07 | 000,000,168 | —- | C] () – C:\Users\Ed\defogger_reenable
[2013-05-26 19:54:12 | 000,632,031 | —- | C] () – D:\Ed\Desktop\AdwCleaner.exe
[2013-05-26 19:52:54 | 000,050,477 | —- | C] () – D:\Ed\Desktop\Defogger.exe
[2013-05-26 17:46:21 | 000,890,854 | —- | C] () – D:\Ed\Desktop\SecurityCheck.exe
[2013-05-21 18:51:33 | 000,387,688 | —- | C] () – C:\WINDOWS\SysNative\ApnDatabase.xml
[2013-05-19 16:51:01 | 000,000,703 | —- | C] () – C:\Users\Ed\Application Data\Microsoft\Internet Explorer\Quick Launch\Mass Effect.lnk
[2013-05-17 21:49:23 | 000,154,283 | -H– | C] () – C:\Users\Ed\AppData\Roaming\Ed-wchelper.dll
[2013-05-14 22:03:58 | 000,601,448 | —- | C] () – D:\Ed\Documents\SVA Ouder.pdf
[2013-02-28 00:56:27 | 000,083,968 | —- | C] () – C:\WINDOWS\SysWow64\OEMLicense.dll
[2013-02-23 12:08:01 | 000,000,048 | —- | C] () – C:\Users\Ed\AppData\Roaming\burnaware.ini
[2013-02-22 22:35:17 | 000,008,192 | —- | C] () – C:\WINDOWS\SysWow64\drivers\IntelMEFWVer.dll
[2013-02-22 22:29:02 | 000,000,010 | —- | C] () – C:\WINDOWS\GSetup.ini
[2013-01-11 10:16:52 | 004,336,640 | —- | C] () – C:\WINDOWS\SysWow64\x264vfw.dll
[2012-07-26 10:13:10 | 000,215,943 | —- | C] () – C:\WINDOWS\SysWow64\dssec.dat
[2012-07-26 10:13:09 | 000,000,741 | —- | C] () – C:\WINDOWS\SysWow64\NOISE.DAT
[2012-07-26 09:21:26 | 000,067,584 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2012-07-26 03:17:42 | 000,043,520 | —- | C] () – C:\WINDOWS\SysWow64\BWContextHandler.dll
[2012-07-25 22:37:29 | 000,043,131 | —- | C] () – C:\WINDOWS\mib.bin
[2012-07-25 22:28:31 | 000,364,544 | —- | C] () – C:\WINDOWS\SysWow64\msjetoledb40.dll
[2012-07-17 15:22:04 | 000,179,200 | —- | C] () – C:\WINDOWS\SysWow64\unrar.dll
[2012-07-03 03:28:06 | 000,112,640 | —- | C] () – C:\WINDOWS\SysWow64\ff_vfw.dll
[2012-06-02 16:31:19 | 000,673,088 | —- | C] () – C:\WINDOWS\SysWow64\mlang.dat
[2012-05-22 01:28:58 | 000,155,648 | —- | C] () – C:\WINDOWS\SysWow64\mlc.dll
[2011-12-08 06:32:24 | 000,216,064 | —- | C] ( ) – C:\WINDOWS\SysWow64\lagarith.dll
[2011-09-28 18:44:14 | 000,179,271 | —- | C] () – C:\WINDOWS\SysWow64\xlive.dll.cat

========== ZeroAccess Check ==========

[2013-02-23 21:14:12 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013-03-06 08:31:28 | 019,758,592 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013-03-06 07:03:37 | 017,561,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012-07-26 05:05:38 | 001,004,544 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012-07-26 05:18:27 | 000,784,896 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012-07-26 05:07:41 | 000,455,680 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

OCD

Post #13May 26, 2013, 7:45 PM UTC

Hi Miathan,

You're too quick for me ….

Thanks for the update. These are the programs you installed around that time:

[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\ProgramData\Media Center Programs
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect
[2013-05-19 16:51:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\BioWare

You probably have an application that is doing some type of update, which causes the dos box to appear and disappear as it runs. One way to track it down is to disable a startup item; if box still appears, disable another til you see what is causing it.

Since you said you have the Mass Effect installation disk, try uninstalling in and see if that makes any difference.

=========================

1. Run OTL.exe

Windows Vista and Windows 7 users Right Click and select "Run as Administrator"

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
MOD - C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Ed\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}: C:\Users\Ed\Program Files (x86)\DNA [2013-04-30 08:52:52 | 000,000,000 | —D | M]
O4 - HKCU..\Run: [BitTorrent DNA] C:\Users\Ed\Program Files (x86)\DNA\btdna.exe ()
[2013-04-29 15:25:05 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\BitTorrent
[2013-04-29 15:24:58 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Local\DNA
[2013-04-29 15:24:57 | 000,000,000 | —D | C] – C:\Users\Ed\AppData\Roaming\DNA
[2013-04-29 15:24:57 | 000,000,000 | —D | C] – C:\Program Files (x86)\DNA

:Commands
[purity]
[createrestorepoint]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then re-run OTL and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

=========================

In your next post please provide the following:
OTL fix log
OTL.txt

Miathan

Post #14May 26, 2013, 8:03 PM UTC

Hi OCD, well I've nothing better to do at the moment. Just watching the WCS Starcraft 2 finals at Twitch.tv

1. I have removed Mass Effect (the pop-up box remains).

2. I have to run OTL two times. First with the code pasted in the Custom Scans/Fixes box.
Question: I DO check the boxes beside LOP Check or Purity?

In the mean time I will do the test with disabling and enabling start up items..

OCD

Post #15May 26, 2013, 8:06 PM UTC last edited May 26, 2013, 8:07 PM UTC

Hi Miathan,

I DO check the boxes beside LOP Check or Purity?

Not necessary this go around.

Did you reboot after you uninstalled Mass Effect?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Strange pop-up when starting pc [Solved]

✨ Ask AI

Ask AI