AGain! REPEAT - I'M INFECTED [Closed]

OTL logfile created on: 6/10/2013 9:09:56 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\cici\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.71 Gb Available Physical Memory | 62.13% Memory free
5.49 Gb Paging File | 4.31 Gb Available in Paging File | 78.50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 105.10 Gb Total Space | 78.23 Gb Free Space | 74.43% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 8.25 Gb Free Space | 28.44% Space Free | Partition Type: NTFS

Computer Name: CICI-PC | User Name: cici | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/06/10 06:41:10 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\cici\Desktop\OTL.exe
PRC - [2013/05/11 06:37:26 | 000,065,640 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/10/30 19:50:59 | 004,297,136 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/10/30 19:50:59 | 000,044,808 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/11/14 15:13:36 | 000,563,104 | —- | M] (Affinegy, Inc.) – C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
PRC - [2011/11/14 15:13:32 | 001,884,064 | —- | M] (Affinegy, Inc.) – C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
PRC - [2011/11/14 15:13:30 | 007,029,664 | —- | M] (Affinegy, Inc.) – C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
PRC - [2011/06/24 00:22:20 | 000,271,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/03/10 03:44:56 | 000,496,184 | —- | M] (Conexant Systems, Inc.) – C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe
PRC - [2010/03/04 13:15:22 | 000,160,432 | —- | M] (Digital Delivery Networks, Inc.) – C:\Program Files\DDNI\DIBS\DDNIService.exe
PRC - [2010/03/03 00:12:32 | 000,372,736 | —- | M] (AMD) – C:\Windows\System32\atieclxx.exe
PRC - [2010/03/03 00:11:58 | 000,172,032 | —- | M] (AMD) – C:\Windows\System32\atiesrxx.exe
PRC - [2010/01/21 14:42:02 | 000,172,720 | —- | M] (Digital Delivery Networks, Inc.) – C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe
PRC - [2009/12/22 08:40:58 | 000,167,008 | —- | M] (CyberLink Corp.) – C:\Program Files\Lenovo\YouCam\YouCamTray.exe
PRC - [2009/12/17 02:33:56 | 004,114,368 | —- | M] (Lenovo(beijing) Limited) – C:\Program Files\Lenovo\Energy Management\utility.exe
PRC - [2009/12/17 02:31:22 | 006,223,808 | —- | M] (Lenovo (Beijing) Limited) – C:\Program Files\Lenovo\Energy Management\Energy Management.exe
PRC - [2009/08/24 08:15:32 | 000,221,872 | —- | M] (Digital Delivery Networks, Inc.) – C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe
PRC - [2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) – C:\Windows\System32\IgrsSvcs.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) – C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/01/11 13:50:16 | 000,030,312 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe


========== Modules (No Company Name) ==========

MOD - [2013/05/24 11:26:15 | 012,432,896 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
MOD - [2013/05/24 11:25:04 | 000,771,584 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\System.Runtime.Remoting.ni.dll
MOD - [2013/05/24 11:24:34 | 011,819,520 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\da5da08245467818759aa44c4eb948e1\System.Web.ni.dll
MOD - [2013/05/24 11:24:03 | 001,587,200 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
MOD - [2013/05/24 11:22:34 | 005,767,680 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\22f2313e1725456aa9f0873594559c39\System.Xml.ni.dll
MOD - [2013/05/24 11:12:04 | 000,971,264 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
MOD - [2013/05/24 11:11:17 | 007,963,136 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
MOD - [2013/05/24 11:09:18 | 011,490,304 | —- | M] () – C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
MOD - [2011/11/14 15:13:38 | 000,022,944 | —- | M] () – C:\Program Files\Belkin\Router Setup and Monitor\BelkinServicePS.dll
MOD - [2011/11/14 14:28:24 | 000,663,552 | —- | M] () – C:\Program Files\Belkin\Router Setup and Monitor\gateways\GenericBelkinGatewayLOC.dll
MOD - [2010/08/22 20:01:36 | 007,187,456 | —- | M] () – C:\Program Files\Belkin\Router Setup and Monitor\QtGui4.dll
MOD - [2010/08/22 20:01:08 | 000,325,632 | —- | M] () – C:\Program Files\Belkin\Router Setup and Monitor\QtXml4.dll
MOD - [2010/08/22 20:01:06 | 001,954,304 | —- | M] () – C:\Program Files\Belkin\Router Setup and Monitor\QtCore4.dll
MOD - [2010/08/22 20:01:06 | 000,847,360 | —- | M] () – C:\Program Files\Belkin\Router Setup and Monitor\QtNetwork4.dll
MOD - [2010/08/22 19:32:34 | 000,119,808 | —- | M] () – C:\Program Files\Belkin\Router Setup and Monitor\imageformats\qjpeg4.dll
MOD - [2010/04/20 02:01:55 | 001,708,032 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Wizard\2.0.3713.40579__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll
MOD - [2010/04/20 02:01:55 | 000,380,928 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3713.40390__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:55 | 000,204,800 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3713.40421__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2010/04/20 02:01:55 | 000,040,960 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3713.40413__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2010/04/20 02:01:55 | 000,020,480 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3713.40403__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 001,294,336 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3713.40574__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,827,392 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3713.40458__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,573,440 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3713.40423__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,491,520 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3713.40531__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2010/04/20 02:01:54 | 000,409,600 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3713.40492__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2010/04/20 02:01:54 | 000,397,312 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3713.40456__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,356,352 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3713.40478__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,323,584 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3713.40467__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,307,200 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3713.40429__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
MOD - [2010/04/20 02:01:54 | 000,270,336 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,196,608 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3713.40422__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,118,784 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3713.40530__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,094,208 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3713.40479__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2010/04/20 02:01:54 | 000,094,208 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3713.40457__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,094,208 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3713.40465__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,077,824 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3713.40502__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,073,728 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3713.40402__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,069,632 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3713.40470__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,065,536 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3713.40532__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2010/04/20 02:01:54 | 000,065,536 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3713.40477__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,065,536 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3713.40455__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,053,248 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3713.40454__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,045,056 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3713.40529__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,045,056 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3713.40456__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,040,960 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3713.40465__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,040,960 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3713.40428__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,036,864 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3713.40467__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:54 | 000,013,312 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Runtime\2.0.3713.40579__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Runtime.dll
MOD - [2010/04/20 02:01:53 | 000,151,552 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3713.40379__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,098,304 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3713.40376__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2010/04/20 02:01:53 | 000,065,536 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3713.40501__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,061,440 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3713.40444__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,057,344 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3713.40477__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,053,248 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3713.40417__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,053,248 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3713.40455__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,049,152 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3713.40402__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,045,056 | —- | M] () – C:\windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2010/04/20 02:01:53 | 000,040,960 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3713.40530__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,040,960 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3713.40469__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,032,768 | —- | M] () – C:\windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3713.40375__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2010/04/20 02:01:53 | 000,032,768 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3713.40403__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,028,672 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3713.40522__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2010/04/20 02:01:53 | 000,028,672 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3713.40493__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,028,672 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3713.40403__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,028,672 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3713.40417__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,024,576 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3713.40378__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,024,576 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3713.40464__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,020,480 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3713.40378__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,020,480 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3713.40388__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,020,480 | —- | M] () – C:\windows\assembly\GAC_MSIL\APM.Foundation\2.0.3713.40377__90ba9c70f846762e\APM.Foundation.dll
MOD - [2010/04/20 02:01:53 | 000,016,384 | —- | M] () – C:\windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2010/04/20 02:01:53 | 000,016,384 | —- | M] () – C:\windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2010/04/20 02:01:53 | 000,016,384 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3713.40412__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,016,384 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3713.40401__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,015,360 | —- | M] () – C:\windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3713.40376__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2010/04/20 02:01:53 | 000,009,728 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Shared\2.0.3713.40531__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,008,192 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3713.40382__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,007,680 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3713.40377__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,007,168 | —- | M] () – C:\windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2010/04/20 02:01:53 | 000,007,168 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3713.40377__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,006,656 | —- | M] () – C:\windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3713.40388__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2010/04/20 02:01:53 | 000,006,656 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3713.40529__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,006,144 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3713.40384__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,006,144 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3713.40382__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,005,632 | —- | M] () – C:\windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3713.40380__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2010/04/20 02:01:53 | 000,005,632 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3713.40381__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,005,632 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3713.40540__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,005,632 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3713.40389__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2010/04/20 02:01:53 | 000,005,632 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3713.40383__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2010/04/20 02:01:52 | 001,220,608 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3713.40397__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2010/04/20 02:01:52 | 000,741,376 | —- | M] () – C:\windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3713.40571__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll
MOD - [2010/04/20 02:01:52 | 000,577,536 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3713.40515__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2010/04/20 02:01:52 | 000,405,504 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3713.40412__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2010/04/20 02:01:52 | 000,106,496 | —- | M] () – C:\windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3713.40523__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2010/04/20 02:01:52 | 000,065,536 | —- | M] () – C:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3713.40520__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2010/04/20 02:01:52 | 000,061,440 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3713.40386__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2010/04/20 02:01:52 | 000,061,440 | —- | M] () – C:\windows\assembly\GAC_MSIL\APM.Server\2.0.3713.40386__90ba9c70f846762e\APM.Server.dll
MOD - [2010/04/20 02:01:52 | 000,057,344 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3713.40388__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2010/04/20 02:01:52 | 000,049,152 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3713.40382__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2010/04/20 02:01:52 | 000,045,056 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Server\2.0.3713.40384__90ba9c70f846762e\AEM.Server.dll
MOD - [2010/04/20 02:01:52 | 000,045,056 | —- | M] () – C:\windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3713.40540__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2010/04/20 02:01:52 | 000,040,960 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3713.40381__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2010/04/20 02:01:52 | 000,040,960 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3713.40395__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2010/04/20 02:01:52 | 000,036,864 | —- | M] () – C:\windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3713.40379__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2010/04/20 02:01:52 | 000,032,768 | —- | M] () – C:\windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2010/04/20 02:01:52 | 000,020,480 | —- | M] () – C:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3713.40380__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2010/04/20 02:01:52 | 000,019,456 | —- | M] () – C:\windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3713.40522__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2010/04/20 02:01:52 | 000,011,776 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3713.40411__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2010/04/20 02:01:52 | 000,010,240 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3713.40395__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2010/04/20 02:01:52 | 000,008,704 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3713.40419__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2010/04/20 02:01:52 | 000,007,168 | —- | M] () – C:\windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3713.40387__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll
MOD - [2010/04/20 02:01:52 | 000,007,168 | —- | M] () – C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3713.40383__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2008/12/19 23:20:50 | 000,063,304 | —- | M] () – C:\Program Files\Lenovo\Energy Management\KbdHook.dll
MOD - [2008/12/19 23:20:08 | 000,051,016 | —- | M] () – C:\Program Files\Lenovo\Energy Management\HookLib.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Running] – C:\Program Files\Spybot – (SBSDWSCService)
SRV - [2013/05/23 19:41:49 | 000,256,904 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/11 18:26:17 | 000,117,144 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2013/05/11 06:37:26 | 000,065,640 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2013/04/04 14:50:32 | 000,701,512 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe – (MBAMScheduler)
SRV - [2012/10/30 19:50:59 | 000,044,808 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\AvastSvc.exe – (avast! Antivirus)
SRV - [2012/04/24 18:01:10 | 001,343,400 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2011/11/14 15:13:36 | 000,563,104 | —- | M] (Affinegy, Inc.) [Auto | Running] – C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe – (AffinegyService)
SRV - [2010/03/04 13:15:22 | 000,160,432 | —- | M] (Digital Delivery Networks, Inc.) [Auto | Running] – C:\Program Files\DDNI\DIBS\DDNIService.exe – (DDNIService)
SRV - [2010/03/03 00:11:58 | 000,172,032 | —- | M] (AMD) [Auto | Running] – C:\Windows\System32\atiesrxx.exe – (AMD External Events Utility)
SRV - [2010/01/21 14:42:02 | 000,172,720 | —- | M] (Digital Delivery Networks, Inc.) [Auto | Running] – C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe – (DDNIMSGService)
SRV - [2009/11/17 11:00:54 | 000,575,304 | —- | M] (Lenovo Group Limited) [On_Demand | Stopped] – C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe – (Lenovo ReadyComm ConnSvc)
SRV - [2009/08/14 10:22:48 | 000,509,192 | —- | M] (Lenovo Group Limited) [On_Demand | Stopped] – C:\Program Files\Lenovo\ReadyComm\AppSvc.exe – (Lenovo ReadyComm AppSvc)
SRV - [2009/07/16 14:12:42 | 000,276,296 | —- | M] (Lenovo Group Limited) [On_Demand | Stopped] – C:\Program Files\Lenovo\ReadyComm\PS_MDP.dll – (PS_MDP)
SRV - [2009/07/15 01:27:26 | 000,038,152 | —- | M] (Lenovo Group Limited) [On_Demand | Stopped] – C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe – (IGRS)
SRV - [2009/07/15 01:27:20 | 000,103,688 | —- | M] (Lenovo Group Limited) [Auto | Running] – C:\Program Files\Lenovo\ReadyComm\common\router.dll – (ReadyComm.DirectRouter)
SRV - [2009/07/13 21:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/01/11 13:50:16 | 000,030,312 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe – (BcmSqlStartupSvc)


========== Driver Services (SafeList) ==========

DRV - [2013/04/04 14:50:32 | 000,022,856 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\mbam.sys – (MBAMProtector)
DRV - [2012/10/30 19:51:58 | 000,738,504 | —- | M] (AVAST Software) [File_System | System | Running] – C:\windows\System32\drivers\aswSnx.sys – (aswSnx)
DRV - [2012/10/30 19:51:58 | 000,361,032 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\windows\System32\drivers\aswSP.sys – (aswSP)
DRV - [2012/10/30 19:51:58 | 000,054,232 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\windows\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2012/10/30 19:51:57 | 000,058,680 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswMonFlt.sys – (aswMonFlt)
DRV - [2012/10/30 19:51:56 | 000,021,256 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\windows\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2012/10/15 12:59:28 | 000,044,784 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswRdr2.sys – (aswRdr)
DRV - [2010/11/20 06:24:41 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/03/11 23:23:14 | 000,189,984 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\RtsUStor.sys – (RSUSBSTOR)
DRV - [2010/03/03 00:22:26 | 005,340,160 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atipmdag.sys – (amdkmdag)
DRV - [2010/03/02 23:07:16 | 000,152,064 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmpag.sys – (amdkmdap)
DRV - [2010/01/18 05:45:00 | 000,514,104 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\CHDRT32.sys – (CnxtHdAudService)
DRV - [2009/12/21 22:26:36 | 000,030,392 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\usbfilter.sys – (usbfilter)
DRV - [2009/11/13 05:47:50 | 000,058,368 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\L1C62x86.sys – (L1C)
DRV - [2009/10/16 14:37:30 | 000,171,776 | —- | M] (SMI) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SMIksdrv.sys – (usbsmi)
DRV - [2009/09/14 14:04:28 | 000,217,136 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2009/09/03 06:16:14 | 000,021,256 | —- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AcpiVpc.sys – (ACPIVPC)
DRV - [2009/08/23 18:55:32 | 000,014,392 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\AtiPcie.sys – (AtiPcie)
DRV - [2009/07/28 17:09:36 | 000,063,240 | —- | M] (Lenovo) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\wdbridge.sys – (Bridge0)
DRV - [2009/07/21 17:14:58 | 000,081,704 | —- | M] (CyberLink) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\wsvd.sys – (wsvd)
DRV - [2009/07/16 08:37:14 | 000,011,792 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\WDMirror.sys – (wdmirror)
DRV - [2009/07/13 19:45:33 | 000,083,456 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\serial.sys – (Serial)
DRV - [2009/07/13 18:02:51 | 004,231,168 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\netw5v32.sys – (netw5v32)
DRV - [2009/07/13 18:02:49 | 000,229,888 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\k57nd60x.sys – (k57nd60x)
DRV - [2008/08/06 08:34:16 | 000,128,104 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\WimFltr.sys – (WimFltr)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-2742486753-408597114-3825370978-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKU\S-1-5-21-2742486753-408597114-3825370978-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com/
IE - HKU\S-1-5-21-2742486753-408597114-3825370978-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2742486753-408597114-3825370978-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKU\S-1-5-21-2742486753-408597114-3825370978-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2742486753-408597114-3825370978-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.msn.com"
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:7.0.1474
FF - prefs.js..extensions.enabledAddons: socialfixer%40mattkruse.com:7.321
FF - prefs.js..extensions.enabledAddons: support%40safemonitorapp.com:2.6.15
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/11/10 17:33:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/05/24 23:05:48 | 000,000,000 | —D | M] (No name found) – C:\Users\cici\AppData\Roaming\Mozilla\Extensions
[2013/05/30 06:09:00 | 000,000,000 | —D | M] (No name found) – C:\Users\cici\AppData\Roaming\Mozilla\Firefox\Profiles\hw3kguv7.default\extensions
[2013/05/28 03:59:44 | 000,000,000 | —D | M] (SafeMonitor) – C:\Users\cici\AppData\Roaming\Mozilla\Firefox\Profiles\hw3kguv7.default\extensions\[removed]
[2012/12/12 08:59:22 | 000,160,219 | —- | M] () (No name found) – C:\Users\cici\AppData\Roaming\Mozilla\Firefox\Profiles\hw3kguv7.default\extensions\[removed]
[2013/05/23 21:19:45 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/30 06:13:16 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/11/10 17:33:05 | 000,000,000 | —D | M] (avast! WebRep) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

O1 HOSTS File: ([2012/06/02 06:22:21 | 000,442,883 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 www.123fporn.info
O1 - Hosts: 15214 more lines…
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2742486753-408597114-3825370978-1003\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [Energy Management] C:\Program Files\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4 - HKLM..\Run: [EnergyUtility] C:\Program Files\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4 - HKLM..\Run: [IdeaNotesUser] C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe (Digital Delivery Networks, Inc.)
O4 - HKLM..\Run: [InstaLAN] C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files\Lenovo\VeriFace\PManage.exe File not found
O4 - HKLM..\Run: [YouCam Mirror Tray icon] C:\Program Files\Lenovo\YouCam\YouCamTray.exe (CyberLink Corp.)
O4 - HKU\S-1-5-21-2742486753-408597114-3825370978-1003..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] C:\windows\System32\SPReview\SPReview.exe (Microsoft Corporation)
O4 - HKU\S-1-5-18..\RunOnce: [SPReview] C:\windows\System32\SPReview\SPReview.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Create Astra Gift puzzle - C:\Program Files\Astra Gift Maker\gm.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8C279F4E-917E-4CD2-8DF0-D9C73C0CE763} http://zone.msn.com/bingame/zpagames/zpa_wof.cab55579.cab (ZPA_WheelOfFortune Object)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…k.cab102118.cab (MSN Games - Installer)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/popcaploader_v10.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E63F6D5D-B86B-4B92-A7CF-FE4A198C2EBA}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/06/10 06:41:10 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\cici\Desktop\OTL.exe
[2013/06/09 17:33:49 | 000,000,000 | —D | C] – C:\Users\cici\Desktop\RK_Quarantine
[2013/05/30 06:13:18 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2013/05/30 06:09:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flash Player Pro
[2013/05/30 06:09:21 | 000,000,000 | —D | C] – C:\Users\cici\Documents\Flash Player Pro
[2013/05/30 06:09:21 | 000,000,000 | —D | C] – C:\Program Files\Flash Player Pro
[2013/05/28 03:59:43 | 000,000,000 | —D | C] – C:\Program Files\SafeMonitor
[2013/05/27 11:59:25 | 000,000,000 | —D | C] – C:\Users\cici\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Desktop Taipei
[2013/05/27 11:59:21 | 000,000,000 | —D | C] – C:\Program Files\Desktop Taipei
[2013/05/24 11:18:50 | 000,000,000 | —D | C] – C:\windows\Minidump
[2013/05/24 10:47:07 | 000,000,000 | —D | C] – C:\windows\System32\SPReview
[2013/05/24 10:46:17 | 000,000,000 | —D | C] – C:\windows\System32\EventProviders
[2013/05/23 21:19:24 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/05/23 19:50:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth

========== Files - Modified Within 30 Days ==========

[2013/06/10 21:12:09 | 000,662,068 | —- | M] () – C:\windows\System32\perfh009.dat
[2013/06/10 21:12:09 | 000,121,224 | —- | M] () – C:\windows\System32\perfc009.dat
[2013/06/10 21:07:09 | 000,000,878 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/10 21:06:34 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2013/06/10 21:06:26 | 2211,606,528 | -HS- | M] () – C:\hiberfil.sys
[2013/06/10 20:50:54 | 000,009,920 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/10 20:50:54 | 000,009,920 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/10 06:41:10 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\cici\Desktop\OTL.exe
[2013/06/10 06:28:28 | 000,000,882 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/10 06:22:44 | 000,648,201 | —- | M] () – C:\Users\cici\Desktop\adwcleaner.exe
[2013/06/10 06:17:00 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/06/09 17:33:27 | 000,816,128 | —- | M] () – C:\Users\cici\Desktop\RogueKiller.exe
[2013/05/31 08:52:36 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/30 06:29:32 | 000,001,061 | —- | M] () – C:\Users\cici\Desktop\Flash Player Pro.lnk
[2013/05/30 06:13:22 | 000,001,105 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/05/30 06:09:32 | 000,418,464 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\FlashPlayerApp.exe
[2013/05/30 06:09:32 | 000,070,304 | —- | M] (Adobe Systems Incorporated) – C:\windows\System32\FlashPlayerCPLApp.cpl
[2013/05/27 11:59:26 | 000,001,000 | —- | M] () – C:\Users\cici\Desktop\Desktop Taipei.lnk
[2013/05/24 11:43:36 | 000,000,983 | —- | M] () – C:\Users\Public\Desktop\Astra Jigsaw Art III.lnk
[2013/05/24 11:18:43 | 326,115,507 | —- | M] () – C:\windows\MEMORY.DMP
[2013/05/24 11:05:50 | 000,429,840 | —- | M] () – C:\windows\System32\FNTCACHE.DAT
[2013/05/24 10:55:48 | 000,152,576 | —- | M] (Microsoft Corporation) – C:\windows\System32\msclmd.dll
[2013/05/24 08:40:41 | 000,000,294 | —- | M] () – C:\Users\cici\Desktop\httpwww.nobelprize.orgprogphptellfriendtell.phphead=1&top=1&url=nobel_prizespeacenominationindex.html.URL
[2013/05/23 19:50:13 | 000,002,170 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk

========== Files Created - No Company Name ==========

[2013/06/10 06:22:35 | 000,648,201 | —- | C] () – C:\Users\cici\Desktop\adwcleaner.exe
[2013/06/09 17:33:27 | 000,816,128 | —- | C] () – C:\Users\cici\Desktop\RogueKiller.exe
[2013/05/30 06:13:21 | 000,001,117 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013/05/30 06:13:21 | 000,001,105 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/05/30 06:09:24 | 000,001,061 | —- | C] () – C:\Users\cici\Desktop\Flash Player Pro.lnk
[2013/05/27 11:59:26 | 000,001,000 | —- | C] () – C:\Users\cici\Desktop\Desktop Taipei.lnk
[2013/05/24 11:18:43 | 326,115,507 | —- | C] () – C:\windows\MEMORY.DMP
[2013/05/24 08:40:41 | 000,000,294 | —- | C] () – C:\Users\cici\Desktop\httpwww.nobelprize.orgprogphptellfriendtell.phphead=1&top=1&url=nobel_prizespeacenominationindex.html.URL
[2013/05/23 19:50:13 | 000,002,170 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2012/07/25 19:50:23 | 000,001,152 | —- | C] () – C:\windows\System32\windrv.sys

========== ZeroAccess Check ==========

[2009/07/14 00:42:31 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 00:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 08:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2009/07/13 21:16:17 | 000,342,528 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2009/07/13 21:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2010/04/19 17:47:45 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2010/04/19 17:45:44 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2010/04/19 17:45:44 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2010/04/19 17:47:45 | 002,614,272 | —- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/13 21:14:36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\System32\services.exe
[2009/07/13 21:14:36 | 000,259,072 | —- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 – C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\System32\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\System32\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/04/19 17:47:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2010/04/19 17:47:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\System32\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | —- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/13 21:14:45 | 000,285,696 | —- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: FUJITSU MJA2160BH G2 ATA Device
Partitions: 4
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 200.00MB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 105.00GB
Starting Offset: 210763776
Hidden sectors: 0


DeviceID: Disk #0, Partition #2
PartitionType: Extended w/Extended Int 13
Bootable: False
BootPartition: False
PrimaryPartition: False
Size: 29.00GB
Starting Offset: 113063755776
Hidden sectors: 0


DeviceID: Disk #0, Partition #3
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 15.00GB
Starting Offset: 144199122944
Hidden sectors: 0


========== Alternate Data Streams ==========

@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:E5D4F1EB
@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:B0B6888E

< End of report >

OTL Extras logfile created on: 6/10/2013 9:09:56 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\cici\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.75 Gb Total Physical Memory | 1.71 Gb Available Physical Memory | 62.13% Memory free
5.49 Gb Paging File | 4.31 Gb Available in Paging File | 78.50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 105.10 Gb Total Space | 78.23 Gb Free Space | 74.43% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 8.25 Gb Free Space | 28.44% Space Free | Partition Type: NTFS

Computer Name: CICI-PC | User Name: cici | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2742486753-408597114-3825370978-1003\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0615B650-83C3-404E-BADA-1115C0295CFA}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{09AA6BF2-8F80-47C4-8FD2-C1AE0BCDFCD9}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{0C3044AA-378C-4142-85F9-60979E661CE2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0C328014-075B-41AB-90CC-9DF2E3BCE112}" = lport=138 | protocol=17 | dir=in | app=system |
"{0D33CF22-409C-4C86-BE6A-BE63C8F4A0F9}" = rport=445 | protocol=6 | dir=out | app=system |
"{11F57055-C1B6-428C-9920-A1A71190817D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2B6E573D-95F9-4F34-BDC2-2628763BB5FC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3DF8BADC-DB09-4F8F-B8FE-D08326F1CDFD}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{4858D11E-EABA-4117-B547-63E71DB7F590}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4AF00EC0-FC79-49E0-ADE4-050A187B2DE1}" = lport=2869 | protocol=6 | dir=in | app=system |
"{5DDEA6DC-926D-4057-99D6-0A5D3C96428B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6B8CDA75-E1C2-4E06-A5E2-DA05A25328F6}" = lport=139 | protocol=6 | dir=in | app=system |
"{6D4F4E92-CC59-4EC8-8791-7EC91C9A40DD}" = lport=137 | protocol=17 | dir=in | app=system |
"{709556FA-1793-4650-8FAB-07AA81F21C8F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{80C40D26-BBFB-43A8-92FB-A42CA673E995}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8FE98431-6EF6-4775-B797-77EB87460C5A}" = rport=137 | protocol=17 | dir=out | app=system |
"{970D9605-CA72-4D51-8F7C-41B3A2ED80E1}" = lport=10243 | protocol=6 | dir=in | app=system |
"{AE0A98C6-B00B-4181-B6AB-592059EE115F}" = rport=138 | protocol=17 | dir=out | app=system |
"{B381BBC8-3BF7-4E71-927A-E454FE767574}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CB6B0B93-33DD-4E5D-BDF5-3E23EDE8EEE6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CFF5721E-A2E8-4DF3-BB88-0FDC109D2290}" = lport=445 | protocol=6 | dir=in | app=system |
"{D5626207-1774-409C-8152-1E9AF9678A31}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DB793FD7-4066-4BB1-9481-337649ADB24F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F1891B57-C110-46E7-BCC8-68686776D8F1}" = rport=139 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C62DF29-4B75-4A2D-850A-A7AF3A285EC3}" = protocol=6 | dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{17DF9ACE-A94D-4DE5-8E6E-970867D6E83E}" = dir=out | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{188AF6A2-EEB0-41F7-BAAF-20451ED05DF9}" = dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{1C151213-C34D-4321-B4B2-B9FAF05BEF2D}" = dir=in | app=c:\program files\lenovo\readycomm\connsvc.exe |
"{1F01144E-8C20-4584-8DE4-AFF12EC4D68E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{287ED241-EA87-40AE-A218-40158505F64C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2E40D03A-D0BF-4EBB-906E-B55BD3F57BAA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{3768CC6A-08DC-4BD9-ACB9-8B7F889CF1ED}" = dir=out | app=c:\program files\lenovo\readycomm\readycomm.exe |
"{4A7FA1C2-AB1B-4FC0-B61A-C420EBAB2C3B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{58BCBD5F-A83F-4283-A245-2917ADC04541}" = dir=out | app=c:\program files\lenovo\readycomm\projectionist.exe |
"{5B4C6C94-C1C2-4BFE-8DC7-A0FB06A1377D}" = dir=in | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{5C2B2814-056C-467E-8882-9E0D145B4264}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6D7BDB17-1D79-4318-9024-E82D4D2B21BA}" = dir=out | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{6F20511C-0C0D-4E0C-BAB7-ACE58C317C7E}" = protocol=6 | dir=out | app=system |
"{73E53FD1-5483-4411-85D3-26E64B2658A3}" = protocol=6 | dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{7BAB7F16-7F95-413E-AEB0-DBFBC9A83F04}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{812E9D62-0183-4E25-87C6-A8F57C74EF5C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{89899C06-343F-4B63-B625-D8C687086DAB}" = dir=in | app=c:\windows\system32\igrssvcs.exe |
"{8DF19678-4FEB-4D91-BDB1-8144EE177066}" = dir=out | app=c:\program files\lenovo\readycomm\connsvc.exe |
"{90ECE989-8250-4255-A1FA-F530DD761F23}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{92018098-EB2C-4FA1-BDD6-B397FC06891D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{93EA952E-EB92-4B06-854D-F3D6E03BB5CB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A6773C09-50A1-44AB-8F95-87F03BB9CF6F}" = dir=out | app=c:\program files\lenovo\readycomm\appsvc.exe |
"{A8D782AD-4E21-4836-B20D-4773C7C29324}" = dir=in | app=c:\program files\lenovo\readycomm\appsvc.exe |
"{AA53377F-40F7-4DBD-918B-2E39AB1006F6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{ABAA6E9E-C2E2-464E-A092-6EB7DFE2552D}" = protocol=17 | dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{B2BC477A-99C6-4FD7-9268-CA52E67E77E5}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{BAD47F26-2A94-42CC-B69A-5C40E12990AD}" = dir=in | app=c:\program files\lenovo\readycomm\projectionist.exe |
"{BE35A2C3-833A-49DC-B503-F26F0AEDDE46}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BF637916-7152-4840-B8B5-7878A5B33DCB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C07ED0CF-0740-4CA8-A670-D9B2B872B597}" = protocol=17 | dir=in | app=c:\program files\belkin\router setup and monitor\belkinsetup.exe |
"{C1E7FA82-CBD3-45BB-A053-495FC7EC1BEB}" = dir=in | app=c:\program files\lenovo\readycomm\common\igrs.exe |
"{D00A8731-09D0-4067-B284-AE896F4EF909}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{D5EAC206-391E-4360-8ECB-7EADFC06DC26}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E2A5F5C5-4600-417B-BD9A-29907A46A32E}" = dir=in | app=c:\program files\lenovo\readycomm\readycom.exe |
"{F4371E75-B349-42B6-A994-F5B53BB8C782}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{F8C57C85-DE86-4655-A82E-58C1A70319BE}" = dir=out | app=c:\windows\system32\igrssvcs.exe |
"{FBE448DF-C861-4EB2-A846-17AF5772CB07}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{17542DBF-E17C-4562-BC4D-FA3EF3076C45}" = Lenovo ReadyComm 5
"{1755A94E-CA3D-056D-6EBF-F56CBAAA690C}" = CCC Help Portuguese
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23E45635-6E09-B210-BA84-F0A8A4330539}" = Catalyst Control Center Localization All
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3A41C53D-EE2B-9347-D41D-A59AEB302C53}" = CCC Help Chinese Standard
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{3E692081-0878-8C80-6AA6-F4B8E5EB9BE3}" = CCC Help Finnish
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4229CF5A-95F2-023E-690F-BB5572544BA4}" = CCC Help Hungarian
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F1E50D8-D105-7A9E-ACF6-A713447975C7}" = CCC Help Thai
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{520F7B12-0792-AD52-29DD-7B9E93FB1A2B}" = CCC Help Chinese Traditional
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{59DF04B0-A502-0031-C829-0A99D7D25502}" = Catalyst Control Center InstallProxy
"{62AFBC6C-70D4-7E8C-3BC4-FDB060A98DFC}" = CCC Help Dutch
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{69291733-6411-C3F7-7B9C-77D75A7AF58B}" = CCC Help Norwegian
"{6FCBA778-04AA-23B0-1279-42B85CA24C43}" = CCC Help Swedish
"{7064B255-EC91-7EC1-6640-A84C123508E9}" = Catalyst Control Center Graphics Light
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{76C66170-C538-4E77-B54D-48E136B5B533}" = Lenovo ReadyComm 5.0 Service
"{76D68A9E-5939-41F2-D22E-6C0045590A00}" = CCC Help Czech
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86B2FD80-64BB-E002-ECF3-1C1E6105320C}" = CCC Help Turkish
"{8871F50A-D92D-07BE-6BB8-EB6D6B03ACBB}" = ccc-utility
"{8991E763-21F5-4DEA-A938-5D9D77DCB488}" = Broadcom 802.11 Wireless Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{962C911E-70BB-3530-1349-A31BEDD5515C}" = CCC Help Italian
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{987B04C4-B5AC-4AD6-A7E9-8D681085B850}" = AMD USB Filter Driver
"{9A7124E8-7C79-F2CC-0B4C-44859C384DD4}" = CCC Help Greek
"{9BA1808F-4C75-BDFB-E798-755B4F3F22A2}" = CCC Help Japanese
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D5740C5-02C8-3C0E-C4BB-A8C2A82C6A52}" = CCC Help Danish
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A06E1854-1580-4157-AD70-72734D324DEA}" = Lenovo Idea Notes
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A5090413-2251-C33A-6359-CEE203950A5F}" = CCC Help Polish
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A919F9D2-0F0E-C3B3-7ACF-343B46CFF804}" = CCC Help Spanish
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{ABD43020-578D-26E4-2D96-04E0A7E44526}" = CCC Help German
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.03)
"{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management
"{B2164CCB-C002-4B80-8550-7535D80DF237}" = Lenovo DirectShare
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C7FB1A71-D808-4CD2-997D-837B39EA7EB0}" = DIBS
"{D31C5DD0-00AD-3643-CFD2-BE37C8840528}" = CCC Help French
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DAD1693D-3C1B-5D29-E44F-96D2362738F3}" = ATI Catalyst Install Manager
"{DB01AC75-7AA5-2F83-D72B-3A914321A030}" = ccc-core-static
"{DCBD3FBC-56C8-24E0-C82E-1ECB0AEB172E}" = CCC Help Korean
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E30378BA-E43E-E4F8-0D35-53C9C0B2A96A}" = Catalyst Control Center Graphics Full Existing
"{E606D21C-225C-D58E-3497-671288A31AF0}" = CCC Help Russian
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{E9388FCD-B25B-D45B-EFDB-954DE076A417}" = CCC Help English
"{ECB1C736-4151-6B4D-7CF0-A54B65430461}" = Catalyst Control Center Core Implementation
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F2602F16-02D1-4F1C-99A5-E246C522A59D}" = Lenovo First Boot
"{F542E678-739D-FFCC-A8D1-E42AE775BFFE}" = Catalyst Control Center Graphics Previews Common
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}" = Lenovo EasyCamera
"{FFBEBE24-6961-C161-22CD-EFD23F50DF65}" = Catalyst Control Center Graphics Full New
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Astra Gift Maker_is1" = Astra Gift Maker version 1.2
"Astra Jigsaw Americas_is1" = Astra Jigsaw Americas version 1.23
"Astra Jigsaw Art Edition_is1" = Astra Jigsaw Art Edition version 1.21
"Astra Jigsaw Art II_is1" = Astra Jigsaw Art II version 1.21
"Astra Jigsaw Art III_is1" = Astra Jigsaw Art III version 1.25
"Astra Jigsaw Asian Holidays_is1" = Astra Jigsaw Asian Holidays version 1.25
"Astra Jigsaw Europe Tour_is1" = Astra Jigsaw Europe Tour version 1.21
"Astra Jigsaw France and UK_is1" = Astra Jigsaw France and UK version 1.21
"Astra Jigsaw India_is1" = Astra Jigsaw India version 1.22
"Astra Jigsaw Italy and Spain_is1" = Astra Jigsaw Italy and Spain version 1.21
"Astra Jigsaw Japan_is1" = Astra Jigsaw Japan version 1.21
"Astra Jigsaw Landmarks Edition_is1" = Astra Jigsaw Landmarks Edition version 1.21
"Astra Jigsaw My Favorite Things II_is1" = Astra Jigsaw My Favorite Things II version 1.26
"Astra Jigsaw My Favorite Things_is1" = Astra Jigsaw My Favorite Things version 1.21
"Astra Jigsaw Tropical Edition_is1" = Astra Jigsaw Tropical Edition version 1.21
"Astra Jigsaw USA Edition_is1" = Astra Jigsaw USA Edition version 1.21
"avast" = avast! Free Antivirus
"Belkin Setup and Router Monitor_is1" = Belkin Setup and Router Monitor
"BFG-Bricks of Atlantis" = Bricks of Atlantis
"BFG-Bricks of Egypt 2" = Bricks of Egypt 2
"BFGC" = Big Fish Games: Game Manager
"BigJig_is1" = BigJig version 8.2
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Desktop Taipei_is1" = Desktop Taipei version 2.3.1
"Flash Player Pro_is1" = Flash Player Pro V5.4
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{B2164CCB-C002-4B80-8550-7535D80DF237}" = Lenovo DirectShare
"Lenovo Idea Central" = Lenovo Idea Central
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 21.0 (x86 en-US)" = Mozilla Firefox 21.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PROHYBRIDR" = 2007 Microsoft Office system
"SafeMonitor" = SafeMonitor
"WinLiveSuite_Wave3" = Windows Live Essentials

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2742486753-408597114-3825370978-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 2/3/2013 8:16:02 PM | Computer Name = cici-PC | Source = Windows Backup | ID = 4104
Description =

Error - 2/11/2013 6:10:44 AM | Computer Name = cici-PC | Source = Windows Backup | ID = 4104
Description =

Error - 2/17/2013 8:04:52 PM | Computer Name = cici-PC | Source = Windows Backup | ID = 4104
Description =

Error - 2/21/2013 7:16:58 PM | Computer Name = cici-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 2/21/2013 7:19:51 PM | Computer Name = cici-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 2/21/2013 7:19:55 PM | Computer Name = cici-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\silicon
motion\lenovo easycamera\driverpackage\DPInst64.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2/22/2013 4:50:53 PM | Computer Name = cici-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 2/22/2013 4:53:35 PM | Computer Name = cici-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 2/22/2013 4:53:41 PM | Computer Name = cici-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\silicon
motion\lenovo easycamera\driverpackage\DPInst64.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/23/2013 7:52:31 PM | Computer Name = cici-PC | Source = Windows Backup | ID = 4104
Description =

[ Media Center Events ]
Error - 9/4/2012 1:49:40 PM | Computer Name = cici-PC | Source = MCUpdate | ID = 0
Description = 1:49:40 PM - Error connecting to the internet. 1:49:40 PM - Unable
to contact server..

Error - 9/4/2012 1:49:52 PM | Computer Name = cici-PC | Source = MCUpdate | ID = 0
Description = 1:49:46 PM - Error connecting to the internet. 1:49:46 PM - Unable
to contact server..

[ System Events ]
Error - 6/9/2013 5:34:28 PM | Computer Name = cici-PC | Source = volsnap | ID = 393232
Description = The shadow copies of volume D: were aborted because volume D:, which
contains shadow copy storage for this shadow copy, was force dismounted.

Error - 6/9/2013 5:35:28 PM | Computer Name = cici-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort0.

Error - 6/9/2013 5:35:28 PM | Computer Name = cici-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort0.

Error - 6/10/2013 6:20:44 AM | Computer Name = cici-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort0.

Error - 6/10/2013 6:34:47 AM | Computer Name = cici-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort0.

Error - 6/10/2013 8:43:33 PM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 6:42:52 AM on ?6/?10/?2013 was unexpected.

Error - 6/10/2013 8:44:14 PM | Computer Name = cici-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the MBAMService service.

Error - 6/10/2013 8:51:50 PM | Computer Name = cici-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort0.

Error - 6/10/2013 9:06:35 PM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 9:05:22 PM on ?6/?10/?2013 was unexpected.

Error - 6/10/2013 9:15:36 PM | Computer Name = cici-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort0.


< End of report >

# AdwCleaner v2.303 - Logfile created 06/10/2013 at 21:31:20 # Updated 08/06/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (32 bits) # User : cici - CICI-PC # Boot Mode : Normal # Running from : C:\Users\cici\Desktop\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16448 [OK] Registry is clean. -\\ Mozilla Firefox v21.0 (en-US) File : C:\Users\cici\AppData\Roaming\Mozilla\Firefox\Profiles\hw3kguv7.default\prefs.js Found : user_pref("extensions.dynconff.cache.www.google.com.content", "