View Full Version : Browser windows opening randomly
Browser windows keep opening randomly. I woke up this morning to about 7 windows that opened while the system was idle.
I did "remove threats" found by MalwareBytes, which ended up breaking some programs, but I can fix those once I get this infection cleared up.
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16686 BrowserJavaVersion: 10.25.2
Run by Kim at 15:31:59 on 2013-09-26
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3990.1466 [GMT -4:00]
.
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\AMBSpiE.exe
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files (x86)\Creative\ShareDLL\CADI\NotiMan.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe
C:\Program Files (x86)\MagicDisc\MagicDisc.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.yahoo.com?type=714647&fr=spigot-yhp-ie
uWindow Title = Internet Explorer provided by Dell
uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6080618
mWinlogon: Userinit = userinit.exe,
BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} -
BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Microsoft Web Test Recorder 10.0 Helper: {876d9f09-c6d6-4324-a2cc-04dd9a4de12f} - C:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
EB: Web Test Recorder 10.0: {3142c289-f319-47f5-a594-a827028714c9} -
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Facebook Update] "C:\Users\Kim\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
uRun: [AdobeBridge] <no file>
mRun: [VolPanel] "C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
StartupFolder: C:\Users\Kim\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\FACEBO~1.LNK - C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe
StartupFolder: C:\Users\Kim\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MAGICD~1.LNK - C:\Program Files (x86)\MagicDisc\MagicDisc.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~2\Office15\ONBttnIE.dll/105
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: kucourses.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: NameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{8F71F97F-0E7D-4954-BCB4-1B14771609AE} : DHCPNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{8F71F97F-0E7D-4954-BCB4-1B14771609AE}\253564847457563747 : DHCPNameServer = 172.30.0.5
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
Handler: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.76\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} -
x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL
x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
x64-Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
x64-Run: [QuickSet] c:\Program Files\Dell\QuickSet\QuickSet.exe
x64-Run: [CTMasterOnOffMonitor] Rundll32.exe CTMWatch.dll StartCTMasterOnOffWatch
x64-Run: [RunDLLEntry] C:\Windows\System32\RunDLL32.exe C:\Windows\System32\AmbRunE.dll,RunDLLEntry
x64-Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX3
x64-Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
x64-Handler: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - <orphaned>
x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\
FF - prefs.js: browser.startup.homepage - www.google.com (http://www.google.com)
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=714647&p=
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll
FF - plugin: C:\Users\Kim\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: 2013-09-25 09:51; {ce7e73df-6a44-4028-8079-5927a588c948}; C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions\{ce7e73df-6a44-4028-8079-5927a588c948}.xpi
.
---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.brc -
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
============= SERVICES / DRIVERS ===============
.
R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2013-7-24 30496]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-8-23 55856]
R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\System32\drivers\stdcfltn.sys [2011-8-23 21616]
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1404000.028\symds64.sys [2013-6-11 493656]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1404000.028\symefa64.sys [2013-6-11 1139800]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130924.001\BHDrvx64.sys [2013-9-24 1525848]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\System32\drivers\NISx64\1404000.028\ccsetx64.sys [2013-6-11 169048]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130925.001\IDSviA64.sys [2013-9-25 520280]
R1 nm3;Microsoft Network Monitor 3 Driver;C:\Windows\System32\drivers\nm3.sys [2010-6-9 46392]
R1 nvkflt;nvkflt;C:\Windows\System32\drivers\nvkflt.sys [2013-7-24 284448]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1404000.028\ironx64.sys [2013-6-11 224416]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NISx64\1404000.028\symnets.sys [2013-6-11 433752]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2011-10-2 98208]
R2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2013-3-19 376144]
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2012-11-29 16056]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2013-4-27 72216]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe [2013-6-11 144368]
R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-9-16 3273088]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-6-21 413472]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-8-23 2656280]
R3 Acceler;Accelerometer Service;C:\Windows\System32\drivers\Accelern.sys [2011-8-23 27760]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2011-8-23 176096]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-9-17 140376]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-8-23 317440]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-8-23 82432]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-8-23 181760]
R3 qicflt;upper Device Filter Driver;C:\Windows\System32\drivers\qicflt.sys [2011-8-23 29288]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-7-9 104912]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-7-8 123856]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-6-21 162408]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-8-23 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-8-23 79360]
S3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2011-8-23 158976]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-1 178824]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-5-8 19456]
S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
S3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2011-8-23 79360]
S3 Te.Service;Te.Service;C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [2012-7-25 126976]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-5-8 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-5-8 30208]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-8-31 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== File Associations ===============
.
FileExt: .txt: textfile="C:\Program Files (x86)\Windows NT\Accessories\WORDPAD.EXE" "%1" [UserChoice]
ShellExec: switch.exe: open="C:\Program Files (x86)\NCH Software\Switch\switch" "%L"
.
=============== Created Last 30 ================
.
2013-09-26 09:56:38 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2013-09-26 09:56:38 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-25 23:53:55 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
2013-09-25 23:53:55 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
2013-09-25 23:53:55 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
2013-09-25 23:53:54 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
2013-09-25 23:53:54 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
2013-09-25 23:53:54 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2013-09-25 23:53:54 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2013-09-25 23:53:54 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2013-09-25 23:53:54 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2013-09-25 23:53:54 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2013-09-25 23:52:08 -------- d-----w- C:\Users\Kim\AppData\Local\Apple
2013-09-25 22:29:39 -------- d-----w- C:\Fraps
2013-09-25 14:57:06 -------- d-----w- C:\Users\Kim\AppData\Local\{9092A3A3-F9AB-4A6E-BF4A-A0C9A19181B6}
2013-09-24 20:18:52 -------- d-----w- C:\Users\Kim\AppData\Local\{15677C5E-F1F6-4B48-A631-3CF854222F69}
2013-09-17 16:13:19 91544 ----a-w- C:\Program Files (x86)\Mozilla Firefox\nssdbm3.dll
2013-09-16 16:30:40 4806016 ----a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2013-09-16 16:30:40 4806016 ----a-w- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2013-09-16 12:49:47 -------- d-----w- C:\Users\Kim\AppData\Local\{EE57CFFE-CC38-4686-9697-2A4D7E48AFB9}
2013-09-16 00:49:24 -------- d-----w- C:\Users\Kim\AppData\Local\{39B501D9-679A-435E-A9C1-51F6F97DD4BA}
2013-09-14 03:55:05 3723656 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
2013-09-12 10:50:29 155584 ----a-w- C:\Windows\System32\drivers\ataport.sys
2013-09-06 02:42:55 -------- d-----w- C:\Users\Kim\AppData\Local\{23E0DC4C-FF8E-4D9F-B188-32956A5F0211}
2013-09-03 13:53:52 187248 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2013-08-30 19:31:55 -------- d-----w- C:\Users\Kim\AppData\Local\{C53192D6-B0D4-45E9-8491-264A73C3DC33}
2013-08-28 14:25:04 -------- d-----w- C:\Users\Kim\AppData\Local\{7CC52F59-5B83-41F5-B424-B475AE88C04B}
.
==================== Find3M ====================
.
2013-09-20 11:55:13 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-20 11:55:13 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-08-14 18:00:00 127488 ----a-w- C:\Windows\System32\ff_vfw.dll
2013-08-14 18:00:00 112640 ----a-w- C:\Windows\SysWow64\ff_vfw.dll
2013-08-10 05:22:18 2241024 ----a-w- C:\Windows\System32\wininet.dll
2013-08-10 05:20:59 3959296 ----a-w- C:\Windows\System32\jscript9.dll
2013-08-10 05:20:55 67072 ----a-w- C:\Windows\System32\iesetup.dll
2013-08-10 05:20:55 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2013-08-10 03:59:10 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-08-10 03:58:09 2876928 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-08-10 03:58:06 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-08-10 03:58:06 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-08-10 03:17:38 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-08-10 03:07:50 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-08-10 02:27:59 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-10 02:17:19 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-08-02 17:29:58 256088 ----a-w- C:\Windows\System32\unrar64.dll
2013-08-02 17:29:58 217176 ----a-w- C:\Windows\SysWow64\unrar.dll
2013-07-25 09:25:54 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2013-07-25 08:57:27 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2013-07-24 19:48:59 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-24 19:48:58 867240 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-07-24 19:48:58 789416 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2013-07-19 01:58:42 2048 ----a-w- C:\Windows\System32\tzres.dll
2013-07-19 01:41:01 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2013-07-09 06:03:30 5550528 ----a-w- C:\Windows\System32\ntoskrnl.exe
2013-07-09 05:54:22 1732032 ----a-w- C:\Windows\System32\ntdll.dll
2013-07-09 05:53:12 243712 ----a-w- C:\Windows\System32\wow64.dll
2013-07-09 05:52:52 224256 ----a-w- C:\Windows\System32\wintrust.dll
2013-07-09 05:51:16 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll
2013-07-09 05:46:20 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2013-07-09 05:46:20 1472512 ----a-w- C:\Windows\System32\crypt32.dll
2013-07-09 05:46:20 139776 ----a-w- C:\Windows\System32\cryptnet.dll
2013-07-09 05:03:34 3968960 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2013-07-09 05:03:34 3913664 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2013-07-09 04:53:47 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll
2013-07-09 04:52:33 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2013-07-09 04:52:33 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2013-07-09 04:52:10 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll
2013-07-09 04:46:31 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2013-07-09 04:46:31 1166848 ----a-w- C:\Windows\SysWow64\crypt32.dll
2013-07-09 04:46:31 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2013-07-09 04:45:07 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2013-07-09 02:49:42 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2013-07-09 02:49:41 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2013-07-09 02:49:39 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2013-07-09 02:49:38 2048 ----a-w- C:\Windows\SysWow64\user.exe
2013-07-06 06:03:53 1910208 ----a-w- C:\Windows\System32\drivers\tcpip.sys
.
============= FINISH: 15:33:35.76 ===============
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-09-26 16:10:26
-----------------------------
16:10:26.675 OS Version: Windows x64 6.1.7601 Service Pack 1
16:10:26.675 Number of processors: 4 586 0x2A07
16:10:26.675 ComputerName: KIM7 UserName: Kim
16:10:28.547 Initialize success
16:10:50.449 AVAST engine defs: 13092601
16:10:55.113 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
16:10:55.129 Disk 0 Vendor: ST950042 D005 Size: 476940MB BusType: 3
16:10:55.223 Disk 0 MBR read successfully
16:10:55.223 Disk 0 MBR scan
16:10:55.223 Disk 0 Windows VISTA default MBR code
16:10:55.223 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 101 MB offset 63
16:10:55.238 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 20000 MB offset 212992
16:10:55.254 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 456835 MB offset 41172992
16:10:55.285 Disk 0 scanning C:\Windows\system32\drivers
16:11:06.642 Service scanning
16:11:10.324 Service BHDrvx64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130924.001\BHDrvx64.sys **LOCKED** 5
16:11:13.802 Service eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys **LOCKED** 5
16:11:14.660 Service EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys **LOCKED** 5
16:11:17.578 Service IDSVia64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130925.001\IDSvia64.sys **LOCKED** 5
16:11:24.254 Service NAVENG C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130926.004\ENG64.SYS **LOCKED** 5
16:11:24.426 Service NAVEX15 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130926.004\EX64.SYS **LOCKED** 5
16:11:49.901 Modules scanning
16:11:49.916 Disk 0 trace - called modules:
16:11:49.948 ntoskrnl.exe CLASSPNP.SYS disk.sys stdcfltn.sys ACPI.sys iaStor.sys hal.dll
16:11:49.963 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80049a9060]
16:11:49.979 3 CLASSPNP.SYS[fffff880015c843f] -> nt!IofCallDriver -> [0xfffffa8004858af0]
16:11:49.979 5 stdcfltn.sys[fffff880019f2c52] -> nt!IofCallDriver -> [0xfffffa80046ede40]
16:11:49.979 7 ACPI.sys[fffff88000f9e7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80046ec050]
16:11:54.222 AVAST engine scan C:\Windows
16:11:57.139 AVAST engine scan C:\Windows\system32
16:18:18.107 AVAST engine scan C:\Windows\system32\drivers
16:18:39.698 AVAST engine scan C:\Users\Kim
16:41:17.945 AVAST engine scan C:\ProgramData
16:47:07.885 Scan finished successfully
16:47:20.069 Disk 0 MBR has been saved successfully to "C:\Users\Kim\Desktop\MBR.dat"
16:47:20.069 The log file has been saved successfully to "C:\Users\Kim\Desktop\aswMBR.txt"
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-09-26 16:10:26
-----------------------------
16:10:26.675 OS Version: Windows x64 6.1.7601 Service Pack 1
16:10:26.675 Number of processors: 4 586 0x2A07
16:10:26.675 ComputerName: KIM7 UserName: Kim
16:10:28.547 Initialize success
16:10:50.449 AVAST engine defs: 13092601
16:10:55.113 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
16:10:55.129 Disk 0 Vendor: ST950042 D005 Size: 476940MB BusType: 3
16:10:55.223 Disk 0 MBR read successfully
16:10:55.223 Disk 0 MBR scan
16:10:55.223 Disk 0 Windows VISTA default MBR code
16:10:55.223 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 101 MB offset 63
16:10:55.238 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 20000 MB offset 212992
16:10:55.254 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 456835 MB offset 41172992
16:10:55.285 Disk 0 scanning C:\Windows\system32\drivers
16:11:06.642 Service scanning
16:11:10.324 Service BHDrvx64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130924.001\BHDrvx64.sys **LOCKED** 5
16:11:13.802 Service eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys **LOCKED** 5
16:11:14.660 Service EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys **LOCKED** 5
16:11:17.578 Service IDSVia64 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130925.001\IDSvia64.sys **LOCKED** 5
16:11:24.254 Service NAVENG C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130926.004\ENG64.SYS **LOCKED** 5
16:11:24.426 Service NAVEX15 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130926.004\EX64.SYS **LOCKED** 5
16:11:49.901 Modules scanning
16:11:49.916 Disk 0 trace - called modules:
16:11:49.948 ntoskrnl.exe CLASSPNP.SYS disk.sys stdcfltn.sys ACPI.sys iaStor.sys hal.dll
16:11:49.963 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80049a9060]
16:11:49.979 3 CLASSPNP.SYS[fffff880015c843f] -> nt!IofCallDriver -> [0xfffffa8004858af0]
16:11:49.979 5 stdcfltn.sys[fffff880019f2c52] -> nt!IofCallDriver -> [0xfffffa80046ede40]
16:11:49.979 7 ACPI.sys[fffff88000f9e7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80046ec050]
16:11:54.222 AVAST engine scan C:\Windows
16:11:57.139 AVAST engine scan C:\Windows\system32
16:18:18.107 AVAST engine scan C:\Windows\system32\drivers
16:18:39.698 AVAST engine scan C:\Users\Kim
16:41:17.945 AVAST engine scan C:\ProgramData
16:47:07.885 Scan finished successfully
16:47:20.069 Disk 0 MBR has been saved successfully to "C:\Users\Kim\Desktop\MBR.dat"
16:47:20.069 The log file has been saved successfully to "C:\Users\Kim\Desktop\aswMBR.txt"
16:47:37.727 Disk 0 MBR has been saved successfully to "C:\Users\Kim\Desktop\MBR.dat"
16:47:37.743 The log file has been saved successfully to "C:\Users\Kim\Desktop\aswMBR.txt"
Hi and Welcome!! kimmisc :)
My name is Robybel.
I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.
Vista and Windows 7 users:
These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")
Stay with this topic until I give you the all clean post.
Having said that....Let's get going!! ;)
____________________________
P2P Programs:
P2P programs are a major source of Malware infections.
From your log I see you have uTorrent We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
If you wish to keep the program(s), please do not use them until your computer is cleaned.
Information regarding the risk of using these programs can be found from here (http://malwareremoval.com/p2pindex.php) and here (http://www.internetworldstats.com/articles/art053.htm)
Download Security Check by screen317 from here (http://screen317.spywareinfoforum.org/SecurityCheck.exe) or here (http://screen317.changelog.fr/SecurityCheck.exe).
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Next
http://i.imgur.com/81mYIKe.jpg AdwCleaner
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode and save to your Desktop.
Double click on AdwCleaner.exe to run the tool
Vista/Windows 7/8 users right-click and select Run As Administrator (http://windows.microsoft.com/en-US/windows7/How-do-I-run-an-application-once-with-a-full-administrator-access-token).
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
Copy and paste the contents of that logfile in your next reply.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
Next
http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool (http://thisisudax.org/downloads/JRT.exe) to your desktop.
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
Next
Download RogueKiller (http://www.sur-la-toile.com/RogueKiller/) and save it to your desktop.
Quit all other programs
Start RogueKiller.exe
Wait until the Prescan has finished ...
Click on Scan
http://i1224.photobucket.com/albums/ee362/Essexboy3/RogueKiller/RGKRScan.png
Wait for the end of the scan
A report will be created on your desktop.
Click on the Delete button
http://i1224.photobucket.com/albums/ee362/Essexboy3/RogueKiller/RGKRDelete.png
Next click on the ShortcutsFix
http://i1224.photobucket.com/albums/ee362/Essexboy3/RogueKiller/RGKRShortcutsFix.png
another report will be created on your desktop.
Please post: All RKreport.txt text files located on your desktop.
On your next reply please post :
checkup.txt
AdwCleaner[R0].txt
JRT.txt
All RKreport.txt
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
I got this from downloading Quicktime from a 3rd party site because the download wasn't working on the Apple site. Norton blocked some "attacks" during installation but not all. It's what I get for being impatient. I knew better.
Results of screen317's Security Check version 0.99.73
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
JavaFX 2.1.1
Java 7 Update 25
Visual Studio Extensions for Windows Library for JavaScript
Adobe Flash Player 11.8.800.168
Adobe Reader 10.1.8 Adobe Reader out of Date!
Mozilla Firefox (24.0)
Google Chrome 29.0.1547.66
Google Chrome 29.0.1547.76
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 5%
````````````````````End of Log``````````````````````
# AdwCleaner v3.005 - Report created 29/09/2013 at 15:36:00
# Updated 22/09/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Kim - KIM7
# Running from : C:\Users\Kim\Desktop\pc cleaning\AdwCleaner.exe
# Option : Scan
***** [ Services ] *****
***** [ Files / Folders ] *****
File Found : C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\searchplugins\safesearch.xml
File Found : C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\user.js
Folder Found C:\Program Files (x86)\Common Files\Software Update Utility
Folder Found C:\ProgramData\boost_interprocess
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Found : HKCU\Software\AppDataLow\Software\Crossrider
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
***** [ Browsers ] *****
-\\ Internet Explorer v10.0.9200.16686
-\\ Mozilla Firefox v24.0 (en-US)
[ File : C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\prefs.js ]
Line Found : user_pref("extensions.crossrider.bic", "141578e401e3cc8245799e1a03af37c9");
-\\ Google Chrome v29.0.1547.76
[ File : C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Found : icon_url
Found : search_url
*************************
AdwCleaner[R0].txt - [4204 octets] - [29/09/2013 15:36:00]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4264 octets] ##########
# AdwCleaner v3.005 - Report created 29/09/2013 at 15:40:47
# Updated 22/09/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Kim - KIM7
# Running from : C:\Users\Kim\Desktop\pc cleaning\AdwCleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\Program Files (x86)\Common Files\Software Update Utility
File Deleted : C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\searchplugins\safesearch.xml
File Deleted : C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\user.js
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
***** [ Browsers ] *****
-\\ Internet Explorer v10.0.9200.16686
-\\ Mozilla Firefox v24.0 (en-US)
[ File : C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\prefs.js ]
Line Deleted : user_pref("extensions.crossrider.bic", "141578e401e3cc8245799e1a03af37c9");
-\\ Google Chrome v29.0.1547.76
[ File : C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted : icon_url
Deleted : search_url
*************************
AdwCleaner[R0].txt - [4368 octets] - [29/09/2013 15:36:00]
AdwCleaner[S0].txt - [4156 octets] - [29/09/2013 15:40:47]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4216 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.3 (09.27.2013:1)
OS: Windows 7 Home Premium x64
Ran by Kim on Sun 09/29/2013 at 15:50:15.63
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{009611E2-8A23-41E6-A323-83E8F2128EEF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0317DBFF-54DC-43BA-9147-1DE91D17ACA7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{03C6DCAB-5AC0-4603-89A3-A6F4DCF5B575}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{041264A9-B83D-4E11-B778-8883DFD40CE2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{042299F6-8BA2-4021-AD09-C1BDD4520E1F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{05997B48-B7CB-4DAD-B7E3-4D39CFCA8653}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{05C6B97A-BA93-4F8E-BE88-A71FE1AA3FB6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{065C14DC-D274-4189-AE53-710B797688E0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0715902A-7121-4E6E-AF54-5C0153DA368D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{075B0EBE-8919-42D9-9205-1DC4346BC08F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{078573B8-F9F4-4367-A1A0-72E132CF5BCD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{07BA22C6-8581-498A-9025-8F8D4FBD16C0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{080D6955-4F79-4C2F-B0B7-A4EF5175A855}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0810E5D2-FECE-4581-88AE-57539ED8B810}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{083966EA-DFD8-4121-B8F9-5EF20E6A5C5B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{084ACE86-9D3F-4BC6-BCEB-016B30B45A6E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{08B6C0C0-16E5-4E80-B856-40DA13E11C85}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{08D670D4-F8FC-4468-BF8F-C53664B61B2F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{093B7307-008C-4D6C-8FA6-7A1F15C4E0CC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0972F040-1679-4ABD-BFC2-2D497CEF383C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0A792B07-D767-4745-8384-F37335BED7D7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0B52CF48-10AB-482D-9C98-D2382E9322BB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0B7894A4-92E7-4EF3-81C2-220D36D21D8A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0B81B007-B6FB-477F-95EE-F891B8A8FACE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0BF3F02D-63E3-4944-9CE1-E6EB995BED81}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0CE5F053-A07E-475A-B340-CF5D22F8D462}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0D3CD475-D1A2-4FE4-88B6-3C4CDC165C1E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0EC9AE7F-1A57-46AD-867B-B2C9FB32AC68}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0F4AA5CB-84E6-4F2F-8C3E-F03C35EC3914}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{0F5A4630-0273-4714-820F-576B2A29DA99}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{100EBB3E-DE40-4B05-ACD9-A324E3A2DF1D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{118636A6-5C61-4D8A-AA4D-FAB8A5107B57}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{11EDE4A1-9C90-492A-B5E0-3A14EAAE6C6F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{12168CCC-D965-40D6-BE38-7587A5E7B113}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{12924D45-3F93-4040-86DB-60F8D0549F25}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{12C3C67E-180D-4735-8B11-D5A18383075D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1398C75B-181D-450D-A97C-E7336EBE40FA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{13A32CAA-11DC-4F7D-918C-8885C6847A3D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{13BEB1FE-4DD3-4406-A134-C8087B527445}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{13C10C10-C7B6-438D-B843-5F620C32B6E4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{146B74E1-62DD-4EDA-B1A8-53B536F85F9A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1499F4B4-E2B2-4D19-86D2-8BF6C351B3D8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{149AC1AB-ECF9-4C78-8897-06F8A87CCADA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{14F99A25-7631-4ACD-AD04-C9B2BA0C2BDF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{15677C5E-F1F6-4B48-A631-3CF854222F69}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{15C82283-F649-4B2D-8212-74CE7145612C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{15F7891C-9E05-4088-A4B1-7FEBB674133B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{16047A82-F744-4D27-AB45-3227351CEFF8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{163BA94D-7FC5-4243-8CAC-A62414FFA3D5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1878C422-DB7C-4A15-BF70-7845ADAF225F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{18BCCD33-806E-4B91-995E-EB32C200A003}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1943A4C5-AECB-4252-954F-CD0DCE31CAAE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{19E21625-AF37-4440-BFC7-556D2B14406D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1C09B5A6-122A-4ACE-8ECC-6775B5365A22}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1D28E17C-8230-46D2-8083-80BC65AAF7A3}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1D8F84D4-53CA-4072-8B9A-85DE60FBF058}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1D9B925A-8AC1-4280-A7A7-F0F7B2B2F083}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1EE4ECF1-DB22-4C90-B594-F1B475A99A6F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{1F1B7688-1D20-48C2-B491-1728A42A35C6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2092D574-5099-463C-971F-FC2029CE2854}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2106BD5E-B84E-40F4-88DC-502AB1D5479D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{210F8A97-E56A-4B79-8469-4CE8030E699B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{225A81A0-B4D2-42DC-AA3D-1FC8A75E7B77}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{22FD3032-1516-4C89-8401-F3C4C17879D8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{23DC9BA3-3789-468B-ADAE-2967D31FE1C3}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{23E0DC4C-FF8E-4D9F-B188-32956A5F0211}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2442977B-04F3-4007-A90B-017547B3DC72}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{24BE7F6D-5C65-49D3-B50C-68B36F6B286D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{24DF33E7-E5F5-4DDE-850E-B2BC1ABBBABB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{24FDA7CA-A180-4106-BBCC-CF585280B24C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{254062A5-E7CC-4239-A55C-22A7890FAC95}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2620ACD6-1946-4840-AEF0-76F306A5E28D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{26DA734E-5A41-477D-9A70-C46217831CD7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2771EEAB-61A3-4DCB-884B-DC49B323A11B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{27D08CDE-A1E4-4499-A7D4-9475E262BEF2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{27E0C786-F60B-4039-8A8C-438684122651}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2819F981-06AC-4DDC-9789-14106675D5BD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{283A080A-089F-4612-8819-D9E0EADB3CF0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{294A5604-8FDC-4A57-81A2-A5090BD1DCD7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{297B3425-C073-43C2-A024-33590BE6F2E2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{29D1DB3A-F335-452E-9C4B-70ECBD8D7717}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2B1CBFF7-8AF2-4F87-9EFF-FC6762FD7FE8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2B7F7B73-B9C3-4A99-BD60-74D02FCF78CE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2B8C75BF-ABFA-453C-9173-0DFD0A787A4F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2BA4A8F7-6E35-4909-9F22-03A71E7C09D0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2BD198AE-6FE9-4EA8-8E7A-02FB200A6F6F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2BF10C33-0A02-475D-ADE8-1575C94E4830}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2C7FEF49-C9A3-451B-93C5-43EA8A8BE97D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2C9D6286-D9CA-4DF0-B7C2-C8540635BFA9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2D93B697-ECA2-4C4D-B052-F6AE9D493AD2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2E03BEDB-40DE-41EA-9761-B3D5BCE3AEEC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2E378C50-1CE6-4EB3-849E-F25238C3031F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2E98D28C-DE44-4AA8-9A1D-9FB2D1D0705B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2EE3ABBB-2A39-468B-9321-3E1275C3617B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2F60FC4B-75B6-4E6E-ADD8-FCDD1A573BF2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2F632593-6EF5-4D0E-B944-EC866D8DDAFA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{2F92D832-8468-4254-AA12-0B6185227354}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{305C9A81-0045-4F82-B525-58227F2ADF67}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3065FCA0-2BE1-43AB-90DE-F20AD4937446}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{31072035-DFB2-4C24-8D3E-B0251A02F5BA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{31A58CB0-FDC0-4425-B3CF-E0E79A0942F9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{321E099A-018F-455B-87F1-F7A981460E36}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3255D6DF-4CFF-40D8-BCE3-812DED4CFF55}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3279140D-5ED8-4038-B2CE-6E1192188B5C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{329E1155-AAFE-41B0-9414-9E58FA0CF2B1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{32EA40FE-B888-4FFF-A1F0-A7338553E447}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3344EA0B-15FC-4618-A426-A1232F3CB8AE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3370F510-30A3-4E6B-BD0D-C5A0137A8714}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{351DFE78-F372-460B-B03D-43BD953A3600}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3596431C-FEB2-4180-AB4B-6170F96B632B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{37362334-CA0B-4134-BA7D-B1A98D5C40E4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{37535F38-D6DE-4617-B67E-EC6308A4BBB7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3763E3E7-6904-4686-95D2-1A85CE816362}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3802D0FC-A5F2-4CE7-8593-4457DA78A87A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{388853D6-E034-483D-8B05-2261D4CFF57C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{38A52809-1A7C-4C38-A9A2-FD57F64E5B13}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{397BB643-0E6A-4C51-B53E-330140EF438A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{39B501D9-679A-435E-A9C1-51F6F97DD4BA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3A10A4A6-CAA7-469B-9300-B5367E258CF9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3A8912F9-D5DB-491C-AB4D-006E25DA7A51}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3AFEC8C9-F57C-4296-AE29-FD33D2ABC19C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3B7B5351-E26D-42AC-84AD-B190EAB486C1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3BC5EAA1-D92A-4552-B36F-2C164CBD511F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3BEAA719-5A4F-41C2-AF67-395D2E69B8BF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3C788B11-0D90-487D-B6EB-C26C754D9766}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3D673A92-5BCC-4534-950C-61FE3A26F536}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3D8538EB-0B79-4EBA-907A-E2DA1B6D9E4B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3DD00ED3-0D4D-446A-88EE-FF30DCF5D430}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3DE729A3-A2F2-4C88-B96A-8290F7A01FD7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3E50EBEE-F44B-4A47-9BCB-E07CCF2865FD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{3F019CBA-0806-435E-AB01-3FECADD5779E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{406A85AE-A8A9-45DB-8D0F-27F3C55A0AC1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{406B101B-D484-40D5-9318-5930834BEB3D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{40975749-4CFD-48B6-A085-5F3FAB5E1879}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{41CF6E1C-1FBC-42D2-A5BC-E930B02AF0C5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{428027EB-95A8-4420-931E-60D5FAECCDF0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{428CA4A6-7CB4-49A7-9B12-5341A30A6AA2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{429B980C-F824-409A-BAA2-F568AF9B2705}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4438F04D-41F6-4A12-9576-19D464D08304}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{44833292-17D8-4832-ABDA-1550E369D170}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4559BFAC-1991-4AF2-A3BB-D7FBE344367E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{456280A8-53FF-4F42-9640-4751CFA8A50E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4649E85A-1ACD-4943-8952-EDF111F0467A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{46BEC478-B161-4181-8173-2979149D347F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4799D76C-2184-4617-974E-B52F6CB0F50D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{486306C6-F0AB-4317-A166-17E8ED77A29A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{48CDDAB2-A421-4847-A528-67FFB73F240E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{48D84603-CD6B-4892-9283-9D260A00AB30}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{496580E0-E71E-4F09-A7EC-82E701BB6504}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4A1CB445-6CEF-4166-9137-DCBF4ACF17E8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4A32708C-51EA-4448-AD98-B51AFD9A2E5B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4A88BE2D-4199-431E-8BEC-D0D81155387E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4B249253-DDB2-4611-8327-6F726FCDA389}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4B27979A-C341-493B-8C4B-F8563E73606A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4B9C31BA-6A1C-431E-8CF0-116FC9985C6C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4C405D14-984A-405F-A6E5-262A30D80BBA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4CAB356C-5F34-46C9-AC6F-9D042C04AA90}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4D09E7FC-4F8A-4CF8-9EEC-4EBF4FAA3A25}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4DFB7B93-7F11-45F3-BA59-CDD2E630ABCD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{4E26B4FD-8DFD-4A40-B753-7A8C21600112}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{50228C34-47FE-408C-B598-95E2B4868388}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{505D9C55-CCE9-42AE-BD04-3AD100E3ECA1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{50A29941-4AAA-4EDE-8537-289569652DFF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{50C5C9BF-8FB3-4E5A-BAF7-D63AB8875737}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{516A1F1D-47C2-44F8-85C1-97141B92B2FA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{51F2E757-7C63-491F-A455-1277D036152B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{541CFDF3-A501-45A0-8B0F-54965E14AF9A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5431065E-50DC-4B1A-9B1A-52C65A17D9C6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5538BADB-ECC0-4D2C-8371-1950B84AE83F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{55EDA01A-639F-4924-8E12-547925122101}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5605C566-513F-47F1-801D-1D5E586EBA39}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{576D77AE-97E3-4BA4-B340-898D2B752013}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{57E98D5D-A1E0-4559-AAE4-C0359CB9C17F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{589EFF96-3F0E-470A-975B-C001D16F1544}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{592CE8CF-75FF-4CB1-9147-7AE677DEC5B5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5A4023D6-B8A2-4512-869F-BAD3F994D851}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5A5B6ED4-B405-40E6-BA9E-E967BDC64384}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5A766336-C6E6-4269-B0DD-9A3A54AB9013}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5AE5F302-C6F7-4A20-973C-136C5ACCE30A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5B43248E-9033-4773-9301-85F90544C0AB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5BD14BB4-E25C-412D-970E-118250934CAF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5C651A04-01E3-4AE1-8E9F-64D8B6C689F6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5E52389E-4B09-4D45-AEB6-BC8985C0AFEE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{5E71A5A6-1FC7-4DF8-BB90-BE51723AA6B8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{60B0127A-4610-420E-9083-8C1BB653F5A2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{619401C5-241D-407C-A670-421432C6E47A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{61C951A7-495A-41DB-BE51-B9D0FC85F1D5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{6492AD3B-4A0C-4BB3-A638-FA6DB1EB5ECA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{64F2D8F9-DA71-4E7E-99A5-15C03A0FAC36}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{660F6F14-977E-4C0D-BCD8-2CFBD6E69EC5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{66119A3F-1199-4191-BAB7-067D722C9429}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{665FCA7C-008B-459E-9FD9-D6A41D80B2E4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{669AE720-FD26-42F2-8661-7BDC67E8DA44}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{66BB1229-D82E-422D-98C4-DE6569CE388B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{66FABA89-363A-409D-A761-646D89A7D80A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{67151C44-B8A2-4120-9755-4CB4C24AA8D4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{673F7EB8-0C38-43EB-BC78-33B1AC6E20C8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{67CB2DE3-69D6-4725-9284-715A464D55FA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{67D6B7D6-23B6-44D5-95BC-3361F1FD231D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{686206AC-D1A6-48B0-B30B-4A024A057D83}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{6AE5B3EF-F928-4D17-99E0-51789B66705B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{6B14F2DC-E572-495C-92D7-816EE69FDAA5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{6DA2D410-204B-4361-BDB8-F04A8ED8878C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{6EB83B7C-711B-4AE9-9AA7-02DB63D5E54C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{6EE6AA17-3A90-4075-BB36-E2FD72BED124}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{6F3DE156-F5CE-45DA-8BD7-8C30E469C957}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{6F5FCE1A-0D33-40E3-89A8-4F3FEE9EB14C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{70F83A2B-CEA4-46F1-AF53-BDD623D7DB62}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{711CDC77-2FE3-4C04-A22F-75B8F075904C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{71C17067-6206-4A45-9527-301F802B94F3}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{72E3FD75-B2D2-4D39-B322-FD50173BADAD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7336AE35-DFE3-46E9-9F9C-178B04B6FADF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7363B4EF-6AE9-4956-A412-A80EA3244E5A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7377B691-281B-4127-8EA5-AFD2976E7D65}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{738D73DE-2E87-4B19-9A21-256543968CFA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{74576087-BA18-4F67-AEB3-5C910DCAB75C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{74B07F6B-AA8D-49A1-9EF8-8A2DC2481B32}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{74D9B6C0-F7FA-483D-A6C2-055CCFF2255F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{751C5C68-6FF2-45EE-9C0B-B8C5E1AD4F63}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{763835A7-3C19-4CDD-84EA-459F9E6E338F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{76C23EF2-D675-494A-975F-ABEBA1FDF862}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{785A3BCD-9B3F-43A5-8CEA-059685CC6F46}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{79C71F56-A7EF-445B-95A2-41AB8EF7F303}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{79D0FBC0-6675-4369-A8AD-BBE2F8390594}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7A1F17BB-DE5E-4823-9338-65A42EB1A31A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7A33A005-A09F-4E7A-B950-0E7C535E5171}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7A355AA0-7E27-4DA7-85B7-F21AAD7EB636}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7A7E7D0F-A4DF-4991-8504-F979DC78A5E6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7AB61C1C-62D6-4A38-B7B6-FFCC98F6A7CC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7AB94244-934D-4D53-93C0-0DF41417DDDA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7B5314A7-2A5B-43B5-A489-26C495C06654}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7B5C5C15-0943-4DF6-9874-83E0FFA7846C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7B5F3345-2CBB-4D8D-BBD5-0A8EFB0FFB2E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7B6E3F83-B4D0-4E42-B11B-F49E891D2BCA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7BC09054-FEE4-4035-89B5-7B09FB65211B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7BFAFBCA-356D-4A33-8F78-D7CEFA620BE9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7C7AAB8F-2F65-4955-A908-BB1A425A8CC5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7CC52F59-5B83-41F5-B424-B475AE88C04B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7CCD8551-4C2A-4164-9569-771AACB2B5FC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7D01D487-E662-4A08-BDF8-8C441F3FC8E2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{7FA93B33-7696-4324-B065-5E73D5451CE7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{801985C8-7F97-408A-9E6A-843569DA0784}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{807973F6-CC97-4032-9844-5C94244F61F0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{80CD694B-5D7C-4468-BE26-AD382953C87E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{80D1F3BB-86CA-4A33-AFF2-87F31C678A50}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{815BA8F9-ED00-42C0-91AD-ECA7297CF6E1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8198B819-E7E3-4976-8A14-B7695888055F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{81DE4A0A-8B08-44D7-9ACE-D56E64230BFC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{81FA85BF-E2AA-491D-824D-3F289449A86D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{820D732A-5B4F-4302-BFBB-0CA8249EBB0B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{82152871-E339-4A28-84D0-A83527388268}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{82667BD7-9646-43D1-B9EC-7900C5D3E780}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{82792AA0-668D-47BF-85DD-D015FABD2CF2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{82DB60C6-1E3E-4A42-8699-795F794B2DB2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{83637D48-D6BA-4C77-92DF-62F7E1A74A70}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{83EC24DD-76EB-4DBB-B59A-E96C04FB1E55}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{84E4C570-D9B0-46EE-8D43-F6C97798EB79}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{84ED9D45-8A71-4D10-918C-B3198A4F198B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{85DE2F56-73B4-483F-84E0-E1523C0E9195}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8614720A-5FC4-4D2E-BCAA-6F9961A9F2F0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{86388B6B-AF23-4B9E-9786-19A7C137376A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8689064F-CA50-47C2-B0B9-1F04B53B5EF4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{877F935A-A924-43CB-B269-2DD03842B99B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{87A2C882-40B8-4A8E-9436-A2AF7FBC67B6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{892932CC-F722-421F-B85B-4AE17640FC1C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{89846CA8-B5ED-41AF-9B47-79571BE9449C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8A82932C-A940-4A7B-BB0B-F449336C54B4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8B566091-5E35-4ECF-A275-3579F9BDC15F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8BF1B5F1-183C-4CD0-A77D-1BB1B9F69E0A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8C8E6F3F-471A-41DB-AAD5-E57A1B4EE599}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8CE73B2B-7401-48E4-AC32-BC0B8B9006B2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8CFCCDDB-DF97-4032-80BE-E7006480E362}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8D869A3A-B047-4ABA-85B2-C10B015AD8BA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8D9DC5A3-EF1F-44F1-B1BA-57A082FB3E47}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8DC8CFFB-FD08-4F78-B733-550C09947944}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8E79490C-B338-4F05-92CA-F982CD96076F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8EE63EE8-492C-45E6-9A20-FCD28D538507}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8F026FF7-9B3A-415F-BFF3-ECBCA882D522}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8F0BC00B-5354-4D40-8AB0-730A8D20D746}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8F6CEE20-AF8C-4E5A-9594-9D568EA3E56C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8F7ED55C-7921-407D-B7F4-1537F5C4FE65}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{8FFE70CA-4FE4-40CD-8DBE-525CD6C774FD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9076E345-A2E3-4730-99A4-D0D58135AED0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9092A3A3-F9AB-4A6E-BF4A-A0C9A19181B6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{90E54F70-8FA4-4C72-AAA9-E59A035710E4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{912B5482-FF19-47BB-9134-D72E0BFE790F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{91D78CF1-7E9E-43CC-AD9C-CF096D04E3D0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{91D83568-BA20-4431-A074-90B037695DC7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{92A4BA7E-8433-47BD-9DE9-C43E12788DBD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{934E0A61-7995-4899-850D-D95065F2D1BF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{937EB980-4E9D-4834-B78A-697F13EDA69A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{94406741-7D9A-4F82-AE9C-9C1E48FA29AE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{95FAE92A-097E-4DD0-8B18-F16EC6F39608}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{96B19878-C8E7-43BB-A85C-D8A038F1E1F1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{96E27606-91C0-45C7-98EA-EE1BF3F2542A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{975EAA47-0BCC-4720-8013-799E907DAC53}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{976F9BD8-8672-4274-819E-9D489C4C5320}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{97AB6FA1-EE3C-4BB5-9E4D-510AB77A4DF1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{97B12B3B-92D9-417B-9A3D-CAF2F620F3F3}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{98196E52-F2CB-475B-80A1-EB4604C44CD9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{98ADBED9-53BC-4041-BB95-3C37E1DF6702}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{98FC1E4F-FDEC-4304-AEF4-CE3FCD4E66A3}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{99DBAF3C-2AD4-4CCB-A635-010538F9D14B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{99EA8F3F-FA6D-4532-B658-2CB832883837}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9B1A63A4-5EA5-46DA-944C-7A154D217173}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9B464AA2-4ACB-4893-8BAB-DA8A3E087264}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9B5460B8-2739-405D-92BF-07953F8FC0BF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9B5D415C-42D4-4993-A46B-8F46C7D062C4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9B5EFF49-62BD-4A3D-96A0-0C38EAE7B816}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9B9D0E5E-0286-44A2-941F-F55EA2D8C386}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9BB3039C-7D59-4015-A0FC-A16CFE02C1F5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9BC58E56-BC8F-4737-8C6B-BB69917A7C0B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9BDC1D79-A289-4C6C-A718-0F949EBC8FE1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9BF0E752-8CC8-4FC2-8C33-CE0F5ED5F81A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9C1AC2C5-5CD1-4ECB-B132-151ABAFF9265}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9C3F9E8D-B6B3-462A-ACF0-4EEDD78CDC12}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9CE08620-5940-4421-A8F7-3EC6771E9083}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{9D0AE4BA-69F1-4BA2-8D13-B78676B4B9DD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A02B4363-A3AA-4B0C-ACB5-17D43BCF893E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A02C5E3D-40ED-401B-A04F-F77713B7800A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A05C6748-D190-4481-8B82-24862DC0BB85}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A08ACEFB-CE7F-4E12-B5C4-7DE731A466C8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A095BF97-3A4D-4C30-981A-AB856D994AB0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A113E9BE-B897-4407-B532-BCEEE1DAE6B7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A127544E-2ABD-45E7-8C31-3841D4AF34B7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A1458EF8-472C-427F-B489-CB9156CD8625}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A24AEBDD-7A2E-41DC-AD58-873160BEB083}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A36186C2-B579-4CB0-A3C8-E8B03CBC3342}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A3A7D32A-2075-4961-BE54-065C75AC8730}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A3C0D86C-A8DB-44C9-8A28-E8D92210996C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A3CD732D-B93A-483B-A573-642C69B4A2E3}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A508E30E-E45D-4434-B998-B4978528F728}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A5BFED4E-2149-4CEE-B7CF-8CAA1A38A3F6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A6754D4A-4792-4278-9767-15D8904499D5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A69C7570-F505-46F7-869B-0E07939FE588}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A6F062A1-73B4-4377-A4AF-8C2595F4BBCA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A8AE9A40-DFD8-49C7-8F1C-6151F15A22AC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A8C93FDB-459C-4A5E-9624-919CE70FA36A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A8F1A49D-E106-41E8-9409-A7EE4FBD3E12}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A96390BE-30EF-4FF0-A149-2F88801D9561}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{A985AFF9-7D73-4BCD-8DB9-E02CC2FF23EC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AA2CF6CE-0AA6-4C76-BCBD-944756CF3C14}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AB186475-54B9-42F5-91F7-7D0387F2DE4D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AB9A8BA5-8492-4A56-BE15-1BDB0839BAE7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{ACB08A67-C770-4E21-A774-AE6F5E1904EF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{ACE27F67-B07B-4092-9BBD-B03DE06CF89D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AD317F0B-B069-462E-A4FB-B7A94FCFC471}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{ADA32B47-3B11-4743-BC0F-C4C4E1A051A7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AE695A1E-8696-45F4-A01B-90F75B459B66}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AE9AE818-558C-4909-BF70-400D7DFE8792}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AEBFE97E-1120-4552-A656-1FBD63EBB62E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AF0215D6-9C8B-40BD-9051-0B9F661308EC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AF41BA9D-F800-4930-8A0F-9BC561D9EFE9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AF6F60B0-5DC9-44D4-8B62-4ADF429107D2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{AFAA7050-7111-4769-BA7D-3F983AAEA91E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B063C666-D633-403B-9DD3-5CAE644FE27B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B0763BE7-805D-48FC-BA06-076FA2BF2845}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B09752D6-6001-4A43-9E36-17F4C3008A71}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B0DE5CB4-1860-4EA7-998C-BB5DAC5063F7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B24256ED-106A-4416-AA4F-3E4DC020ED6C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B2712346-5629-41CF-92FA-083314574B72}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B3F90A75-E3B9-4856-8BC9-E852A6C3D413}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B42C525E-B84F-457E-9663-393BB19FA1AF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B713FF6C-4944-4F70-8A97-E6A6AF7D8E2B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B791B248-3C7B-4D35-8654-7F52455C73BD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B8ABD8F3-8A87-45F4-8258-AE709FA48B3F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B9142C95-D994-49F8-8CFA-EDE73D5B03E6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B946BBF5-C27F-4158-AED1-7E4B5ECF4186}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B9D7BC68-D6EA-425E-A47E-AD5D5A298A83}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{B9FB4474-380D-4A7D-962C-5EDC8E2197B9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BB5BDC5D-C953-447C-97D5-4D7D984E0C3D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BBD815AA-C2E3-42B7-9549-41724B25ACA4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BCD8C719-EF32-4191-8686-5DD03A8E64FC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BD4890C2-FE70-4A41-890B-DE2868C4C432}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BD84999D-283E-4677-860B-4302C826EC9F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BDE61D03-F412-4A75-AA4C-4D7064359042}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BDF91D4B-4FD5-4A05-82D0-84411965F90B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BE017525-4A60-4911-822F-6166FCC12BB4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BE64FDDE-70E8-43EC-A3E1-B110C342BB14}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{BEC5FB8B-F44B-44A2-925E-3F930FD6862F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C0D72926-CCA3-4BE7-A685-7CEF75B6F2F7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C1109311-79B2-4BEB-9F03-4DC18CDF4DFC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C1943C15-A709-49EF-AC06-3E76ADF3005D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C1B5DE2E-7A3E-436B-937A-396C201E7B74}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C1C890C3-E9AC-476B-B516-1129863039EE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C233662B-41D0-43ED-B63A-13C0601435B9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C326485C-F157-480A-B5C9-33A52863B767}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C34496CD-280A-4A39-A691-8DC4BE4B1BEF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C3649977-435D-4272-8923-8363935EDF12}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C4037219-51EE-48B3-8FCF-EACF6D69B5CB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C40A7CCE-F4A2-4453-866C-572871B2D39F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C42EF000-03DC-4F28-BEB0-FB9D6089A396}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C4F0FF5C-4EDE-4E89-8DC9-BAE03A47CFE2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C5137697-EB77-4A05-AC72-3144ED40FBE4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C5142CFF-0BED-4E57-8E88-BA7785453ECD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C53192D6-B0D4-45E9-8491-264A73C3DC33}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C638CDB7-9840-4B35-B63D-2332E40A4B88}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C647B7FF-7081-4C2B-86B7-BFE4082171EB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C7B48749-7B30-4795-A850-49AA20AA0717}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C7D475E4-76B4-42CC-8819-B481AFCE92AE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C87E0095-A51C-47F3-AA5E-AA4E6E8DF94F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C8A6F27C-DF6A-450E-9BA0-23548393992E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C8ACCC5F-2B32-4EB1-B63E-CB8876238BD4}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C8FC2EC4-5EF2-46A8-81F1-20DE78925AC7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{C9384BEF-EE28-406A-B281-6B2E8918D1EC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CA7B72F6-75FB-4588-A5B5-DB820D49760D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CAFEBED2-0810-4809-A74E-1E65C65A47F7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CB3F55F3-0508-4AA8-A95D-4DED9485377E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CC71A000-5730-4B1F-A45F-EC3C57A857CD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CCC20AA9-10FD-4364-A91A-0BD415781DBF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CD47EE68-2BCC-404D-8202-2528241CBF15}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CD5BBBC5-0140-4F4C-B6C6-E5428C9916DF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CD8AA171-C1C9-47C2-9FEC-C6C823E9EFE8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CDDC6F9E-4F41-4822-9C20-A0309B98F405}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CDEE0E59-6AF2-4564-8C76-754A00EF0D20}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CE599D62-1C40-4DBB-965F-B6788525C0CE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CE80FE2D-F322-43A8-9C65-062154D4AA99}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CEA42D3B-2E13-45D8-B5AB-2CEF2B074B5C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{CEE7864A-89B6-4387-9319-C6F30C40D5E1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D11BF97E-CFC4-4A99-A69A-FC329FB55B52}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D14403CE-DF7C-420E-B519-71C4448CF05A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D14E1273-5A81-469D-9C23-75482D9DA340}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D16E4D05-1726-48C5-9041-DC7B8DE1EF76}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D27E368A-4052-4A46-9CD1-13C39A51C225}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D2DC89FF-5BBF-4A84-BEE0-5B59504052CD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D352A76D-109D-42C1-ADFC-892BC10F1F99}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D36DBEDA-7A7E-40D8-87E8-3E7F28E70A11}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D440A597-E90A-42D6-ABF0-676BB4A32643}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D44AD7AC-54C9-4665-956D-A75F0B8C13FA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D4C40FA3-968E-4B57-9BBF-68B7C0BE25DB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D5947EA5-AF7C-413C-A6CE-32730A394143}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D70C2905-4347-4885-992D-4279CB6578C0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D73DD2DD-BD59-46F4-A8C6-43FFE411E206}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D84B6783-0E7C-4401-9D65-7A935DD26C67}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D8BDEDBC-E348-4E7F-AE2E-304B72C7BAD6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D91ADFEF-8F73-431E-B79C-503BB0E02B6C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D959047D-598F-4907-B77F-536CD76C9598}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{D969C372-3AD0-4DEF-A35F-E027F85A7A57}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DA4A4F93-2EE2-4460-B750-5D952699B8D8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DA58C671-89C5-4B62-AF1F-3D0863A3B228}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DA699F32-BBC1-4F0D-AC04-AC811F64CAE5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DB98CF7D-B2A6-454B-A5A3-6CC6A855CB03}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DCDA992A-567C-4B3A-B8AF-86E0136DAB2B}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DD87E071-258F-4524-AFBA-EE16F0C96ACE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DD9B32A3-8940-48EA-B3C6-D9CB8DBDC8CD}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DDE2ACCC-4C1D-4D65-908C-22DFB1A1097C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DE59AFD2-79F4-4F23-AB07-D65EDC7EC54C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DEBE9EA1-0DAE-4474-AA24-9425957F91F0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{DF26EC6F-9A06-43A1-97F7-21E8C337756A}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E004F303-2751-4EFE-98F4-17C65A26F5CA}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E0DAD97E-5687-400E-B2BD-A34BFDEDAEFB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E11E8EB3-114D-4385-AE74-71614B9C3C33}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E13B4A76-EB49-4992-8BE2-4C4E2D8C98A9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E1EB9F83-F809-4292-ABFA-283E6C4A62A9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E24083A2-6069-48E7-B966-E29DB2DCFDDC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E2AF36D6-49B1-4382-AA58-3B3C79250CB1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E43F427C-D5B3-45C0-A48A-0BC1326BD7A8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E59F2498-7B94-4F89-824A-6AD82A2ED8EC}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E65F7DE2-7108-4B7E-910F-E11477F423FB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E6727B35-9797-4A10-982D-D4CB4C7542D7}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E6B9D265-F192-481B-BF49-130A7E001FDE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E7395CA4-6FE7-4A07-B257-1585D76DF838}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E76A2FB2-C7D5-4597-8A4E-DCD40859D002}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E7BEC89B-5B16-4904-91D9-D53FFF9EFC2F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E82C2895-2765-46C7-9E74-808D4E25F998}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{E86E7ED4-25F3-4251-8E63-9A6AB9A6D15C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EB1CD903-B3F8-4CEF-B1D2-73C76EA3DB46}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EB4D33E7-8B17-4FB3-9829-B7B5BEED3117}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EBCF95A3-4BC2-4C44-8035-FEE854157FDF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EBFFB2EE-2726-49ED-B839-770C8D234815}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EC14B02F-1A3F-458F-B24E-0935D62D95E2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EC3CC7D1-7176-47BB-A5AD-AE5D50AF8CB8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{ECB6B5C5-DF92-4765-8B1A-A55635726672}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{ECD99F11-A635-4156-BA8A-DA6CE988050F}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EE57CFFE-CC38-4686-9697-2A4D7E48AFB9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EF1A57BE-5461-45D5-A96B-962E50137376}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{EF5FC76B-0474-4305-9178-797E1868831D}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F04D418E-F8B0-468B-9ABD-0E180BC3FF21}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F0EC91ED-E8CB-4C64-9510-84594BF9C066}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F142A4FD-BE7E-404E-8E60-D8E13DF0CAC6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F2972A5E-B13C-4336-BAB6-04A4AEDFE576}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F3E24A14-D3F3-4DA3-9748-DE3A346BD904}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F40EDA1F-9DF6-45ED-931B-087C7DA5F1CF}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F49865F1-1A4B-48C3-A139-48D14BFA5801}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F60D78E4-B48C-46E7-B140-A83BC0307EE1}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F63F2747-40F0-4559-86F1-5995A0A5CEF6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F79256CB-61A0-43C0-B432-598EFAD88BDB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F81B5541-5DA0-482C-9819-F242B707BAD9}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F979D535-A7EC-46DB-8785-D3A898D0D4A8}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F993FEF1-5B1A-4D37-8B0A-9A961DEEA7F5}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{F9D2E273-EF3D-4215-AEB0-88B419C14072}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FA0D6297-C900-4EC2-863E-1DA167011A85}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FAC4B95A-9662-4B14-8F82-FDF90A60B8CB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FB237DD5-7DC2-4DDF-875A-DB31DC88DE83}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FC973E8C-7C56-4C0B-95F1-FD7BBA1AEBD2}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FD72981E-003A-45EA-9570-120D4768114C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FD9BDB93-22B5-4B05-8EFC-494C3F6FE78C}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FDA2A87D-5DA3-45A7-815C-D29F21C889A0}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FDAC2124-E112-4E87-B67F-3911E0609169}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FEAD8D6E-C267-4ED7-8661-418D67572476}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FEB5F7FE-F3C7-47B4-8FB1-36F211E809AB}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FED21912-3FB6-4E89-BA0B-92C9A9AAA38E}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FF5E9D07-A8AC-44C9-92CE-BE0008738389}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FF7D5386-0849-4433-BD55-881132A6A208}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FF829941-1D80-450F-BB31-8C8ED14549EE}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FF9FC8E5-31CD-4347-90E7-E3F41C09E459}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FFC3625F-0AF8-4DE6-A5B2-FB6170EFCAD6}
Successfully deleted: [Empty Folder] C:\Users\Kim\appdata\local\{FFD00D4C-6D9B-455C-9B5A-A3A0A7A05C3D}
~~~ FireFox
Emptied folder: C:\Users\Kim\AppData\Roaming\mozilla\firefox\profiles\pb6397wh.default\minidumps [271 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 09/29/2013 at 15:59:01.12
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
RogueKiller V8.6.12 _x64_ [Sep 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Kim [Admin rights]
Mode : Scan -- Date : 09/29/2013 16:03:17
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 4 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Scheduled tasks : 0 ¤¤¤
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 125.252.224.90
127.0.0.1 125.252.224.91
[...]
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - ST9500420AS +++++
--- User ---
[MBR] 9d490dd7e6adfb6a473e12293cc8b6b4
[BSP] dea9defa67a18cc486b8c709b2ee22f0 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 101 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 212992 | Size: 20000 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 41172992 | Size: 456835 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[0]_S_09292013_160317.txt >>
RogueKiller V8.6.12 _x64_ [Sep 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Kim [Admin rights]
Mode : Remove -- Date : 09/29/2013 16:03:55
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 4 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> DELETED
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Scheduled tasks : 0 ¤¤¤
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 adobeereg.com
127.0.0.1 www.adobeereg.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 125.252.224.90
127.0.0.1 125.252.224.91
[...]
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - ST9500420AS +++++
--- User ---
[MBR] 9d490dd7e6adfb6a473e12293cc8b6b4
[BSP] dea9defa67a18cc486b8c709b2ee22f0 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 101 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 212992 | Size: 20000 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 41172992 | Size: 456835 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[0]_D_09292013_160355.txt >>
RKreport[0]_S_09292013_160317.txt
RogueKiller V8.6.12 _x64_ [Sep 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Kim [Admin rights]
Mode : Shortcuts HJfix -- Date : 09/29/2013 16:04:34
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 12 / Fail 0
My documents: Success 1 / Fail 1
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 4 / Fail 0
Backup: [NOT FOUND]
Drives:
[C:] \Device\HarddiskVolume3 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped
[E:] \Device\CdRom1 -- 0x5 --> Skipped
¤¤¤ Infection : ¤¤¤
Finished : << RKreport[0]_SC_09292013_160434.txt >>
RKreport[0]_D_09292013_160355.txt;RKreport[0]_S_09292013_160317.txt
Hi Kimmisc :)
Scan with OTL
Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true /fp
DRIVES
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.
OTL logfile created on: 9/30/2013 5:53:05 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kim\Desktop\pc cleaning
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16686)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.90 Gb Total Physical Memory | 2.01 Gb Available Physical Memory | 51.55% Memory free
7.79 Gb Paging File | 5.83 Gb Available in Paging File | 74.80% Paging File free
Paging file location(s): ?:\pagefile.sys
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 446.13 Gb Total Space | 217.74 Gb Free Space | 48.81% Space Free | Partition Type: NTFS
Computer Name: KIM7 | User Name: Kim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Kim\Desktop\pc cleaning\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
PRC - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
PRC - C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
========== Modules (No Company Name) ==========
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\282243d8da9e6429f9d80edf32d24bf6\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ed8578ec73e1c037f8227244f131aa5c\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\8f7d83126a3cf283e5ac97f2d6d99f12\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\libcef.dll ()
MOD - C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\CefSharp.dll ()
MOD - C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\CefSharp.WinForms.dll ()
MOD - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\wincfi39.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\coprocmanager\detoured.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
MOD - c:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\SQLite352.dll ()
MOD - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
========== Services (SafeList) ==========
SRV:[b]64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (EvtEng) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (AERTFilters) -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (LMIMaint) -- C:\Program Files (x86)\LogMeIn\x64\ramaint.exe (LogMeIn, Inc.)
SRV - (LMIGuardianSvc) -- C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV - (NIS) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe (Symantec Corporation)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (LogMeIn) -- C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (LogMeIn, Inc.)
SRV - (Te.Service) -- C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe (Microsoft Corporation)
SRV - (fussvc) -- C:\Program Files (x86)\Windows Kits\8.0\App Certification Kit\fussvc.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Sound Blaster X-Fi MB Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe (Creative Labs)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (RoxWatch12) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe (Sonic Solutions)
SRV - (RoxMediaDB12OEM) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe (Sonic Solutions)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
========== Driver Services (SafeList) ==========
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (LMIRfsClientNP) -- C:\Windows\SysNative\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symds64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymNetS) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symnets.sys (Symantec Corporation)
DRV:64bit: - (ccSet_NIS) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\ironx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (LMIRfsDriver) -- C:\Windows\SysNative\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV:64bit: - (lmimirr) -- C:\Windows\SysNative\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (nm3) -- C:\Windows\SysNative\drivers\nm3.sys (Microsoft Corporation)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (mcdbus) -- C:\Windows\SysNative\drivers\mcdbus.sys (MagicISO, Inc.)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (BHDrvx64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130924.001\BHDrvx64.sys (Symantec Corporation)
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130930.002\ex64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130930.002\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130927.002\IDSviA64.sys (Symantec Corporation)
DRV - (LMIInfo) -- C:\Program Files (x86)\LogMeIn\x64\rainfo.sys (LogMeIn, Inc.)
DRV - (VSPerfDrv110) -- C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\x64\VSPerfDrv110.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (mcdbus) -- C:\Windows\SysWOW64\drivers\mcdbus.sys (MagicISO, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7DKUS
IE:64bit: - HKLM\..\SearchScopes\{901D1FF8-BB7D-4E5F-96AB-8AF326BA403F}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{901D1FF8-BB7D-4E5F-96AB-8AF326BA403F}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Kim\Desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6080618
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com?type=714647&fr=spigot-yhp-ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\..\SearchScopes\{39C55943-DCB2-48E6-BEC4-B73FBC04C80B}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=714647&p={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7DKUS_en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=714647"
FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledAddons: nishan.naseer.googimagesearch%40gmail.com:0.5
FF - prefs.js..extensions.enabledAddons: LogMeInClient%40logmein.com:1.0.0.1024
FF - prefs.js..extensions.enabledAddons: %7Bce7e73df-6a44-4028-8079-5927a588c948%7D:1.1.2
FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:12.0.0.380%20-%201
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=714647&p="
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Kim\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ [2013/09/29 15:46:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ [2012/10/13 14:37:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/09/25 19:53:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/09/25 19:53:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/09/25 19:53:55 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/09/25 19:53:54 | 000,000,000 | ---D | M]
[2011/08/30 21:59:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kim\AppData\Roaming\Mozilla\Extensions
[2013/09/27 04:29:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions
[2013/06/20 21:53:50 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions\LogMeInClient@logmein.com
[2013/08/09 19:13:29 | 000,313,049 | ---- | M] () (No name found) -- C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi
[2013/01/03 18:49:15 | 000,004,287 | ---- | M] () (No name found) -- C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions\nishan.naseer.googimagesearch@gmail.com.xpi
[2013/09/25 09:51:22 | 000,073,612 | ---- | M] () (No name found) -- C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions\{ce7e73df-6a44-4028-8079-5927a588c948}.xpi
[2013/07/31 14:01:26 | 000,824,302 | ---- | M] () (No name found) -- C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/09/25 18:29:05 | 000,000,915 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\searchplugins\yahoo.xml
[2013/09/17 12:13:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/09/25 03:08:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/09/17 12:13:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/09/25 03:08:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/09/17 12:13:22 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/10/13 14:37:49 | 000,000,000 | ---D | M] (Norton Vulnerability Protection) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPLGN
[2011/04/14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2013/06/13 20:45:42 | 000,034,048 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll
[2013/06/26 16:48:10 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
========== Chrome ==========
CHR - default_search_provider: Norton Safe Search (Enabled)
CHR - default_search_provider: search_url = http://www.google.com
CHR - default_search_provider: suggest_url =
CHR - homepage: http://search.yahoo.com?type=714647&fr=spigot-yhp-ch
CHR - plugin: Shockwave Flash (Disabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Disabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2013 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2013 (Enabled) = C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U15 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Facebook Desktop (Enabled) = C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4651.0\npFbDesktopPlugin.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll
CHR - plugin: Java Deployment Toolkit 7.0.150.3 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Adblock Plus = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4_0\
CHR - Extension: Google Search = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: Gmail = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
O1 HOSTS File: ([2012/04/27 22:27:22 | 000,001,464 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 125.252.224.90
O1 - Hosts: 127.0.0.1 125.252.224.91
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL File not found
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Microsoft Web Test Recorder 10.0 Helper) - {876d9f09-c6d6-4324-a2cc-04dd9a4de12f} - C:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [CTMasterOnOffMonitor] C:\Windows\SysNative\CTMWatch.dll (Creative Technology Ltd)
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [LogMeIn GUI] C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O4:64bit: - HKLM..\Run: [Nvtmru] C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] c:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [Facebook Update] C:\Users\Kim\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: kaplan.edu ([kucampus] http in Trusted sites)
O15 - HKCU\..Trusted Domains: kaplan.edu ([kucampus] https in Trusted sites)
O15 - HKCU\..Trusted Domains: kucourses.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8F71F97F-0E7D-4954-BCB4-1B14771609AE}: DhcpNameServer = 209.18.47.61 209.18.47.62
O18:64bit: - Protocol\Handler\cozi - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\cozi {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll (Cozi Group, Inc.)
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{970a40fe-c31e-11e2-8d1b-14feb5c23393}\Shell - "" = AutoRun
O33 - MountPoints2\{970a40fe-c31e-11e2-8d1b-14feb5c23393}\Shell\AutoRun\command - "" = F:\VZW_Software_upgrade_assistant.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2013/09/29 16:01:43 | 000,000,000 | ---D | C] -- C:\Users\Kim\Desktop\RK_Quarantine
[2013/09/29 15:50:12 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/09/29 15:35:53 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2013/09/29 15:26:08 | 000,000,000 | ---D | C] -- C:\Users\Kim\Desktop\pc cleaning
[2013/09/27 17:04:27 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2013/09/27 17:00:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2013/09/26 19:47:36 | 000,000,000 | ---D | C] -- C:\Sound
[2013/09/26 19:47:36 | 000,000,000 | ---D | C] -- C:\Material
[2013/09/26 19:37:16 | 000,000,000 | ---D | C] -- C:\Users\Kim\.MCReferenceSdk
[2013/09/26 19:19:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightworks
[2013/09/26 19:19:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Geevs
[2013/09/26 19:19:38 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Lightworks
[2013/09/26 19:19:07 | 000,000,000 | ---D | C] -- C:\Program Files\Lightworks
[2013/09/26 16:06:21 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013/09/26 15:34:43 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Kim\Desktop\aswMBR.exe
[2013/09/26 15:30:49 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Kim\Desktop\dds.scr
[2013/09/26 15:29:26 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2013/09/26 15:28:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2013/09/26 15:28:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
[2013/09/26 15:20:32 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Users\Kim\Desktop\erunt-setup.exe
[2013/09/26 08:22:08 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Apple Computer
[2013/09/26 05:56:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/09/26 05:56:38 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/09/26 05:56:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/09/26 05:55:54 | 010,285,040 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Kim\Desktop\mbam-setup-1.75.0.1300.exe
[2013/09/25 20:16:15 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\Adobe
[2013/09/25 19:53:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013/09/25 19:53:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013/09/25 19:53:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2013/09/25 19:52:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2013/09/25 19:52:08 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Apple
[2013/09/25 19:52:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2013/09/25 19:52:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2013/09/25 18:29:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
[2013/09/25 18:29:39 | 000,000,000 | ---D | C] -- C:\Fraps
[2013/09/24 20:29:46 | 000,000,000 | ---D | C] -- C:\Users\Kim\Desktop\MCSkins
[2013/09/18 22:38:51 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/09/18 22:38:51 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/09/18 22:38:50 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/09/18 22:38:50 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/09/18 22:38:50 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/09/18 22:38:50 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/09/18 22:38:50 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/09/18 22:38:50 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/09/18 22:38:50 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/09/18 22:38:50 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/09/18 22:38:50 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/09/18 22:38:49 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/09/18 22:38:49 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/09/18 22:38:49 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/09/18 22:38:48 | 003,959,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/09/17 12:13:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013/09/13 23:55:05 | 003,723,656 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerInstaller.exe
[2013/09/12 06:50:29 | 000,155,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\ataport.sys
[2013/09/12 06:48:00 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/09/30 17:55:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/09/30 17:46:00 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/09/30 16:46:00 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/30 16:28:00 | 000,000,920 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1384195220-919546521-2461916029-1001UA.job
[2013/09/29 22:28:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1384195220-919546521-2461916029-1001Core.job
[2013/09/29 15:52:35 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/09/29 15:52:35 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/09/29 15:49:00 | 000,782,470 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/09/29 15:49:00 | 000,662,634 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/09/29 15:49:00 | 000,122,470 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/09/29 15:46:26 | 005,128,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/09/29 15:43:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/09/29 15:43:17 | 3137,994,752 | -HS- | M] () -- C:\hiberfil.sys
[2013/09/26 19:19:54 | 000,001,756 | ---- | M] () -- C:\Users\Public\Desktop\Lightworks (11.1).lnk
[2013/09/26 16:47:37 | 000,000,512 | ---- | M] () -- C:\Users\Kim\Desktop\MBR.dat
[2013/09/26 16:06:12 | 755,905,231 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/09/26 16:01:55 | 000,004,910 | ---- | M] () -- C:\Users\Kim\Desktop\attach.zip
[2013/09/26 15:34:57 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Kim\Desktop\aswMBR.exe
[2013/09/26 15:30:17 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Kim\Desktop\dds.scr
[2013/09/26 15:28:13 | 000,000,926 | ---- | M] () -- C:\Users\Kim\Desktop\NTREGOPT.lnk
[2013/09/26 15:28:13 | 000,000,907 | ---- | M] () -- C:\Users\Kim\Desktop\ERUNT.lnk
[2013/09/26 15:20:38 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Users\Kim\Desktop\erunt-setup.exe
[2013/09/26 05:56:39 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/26 05:55:54 | 010,285,040 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Kim\Desktop\mbam-setup-1.75.0.1300.exe
[2013/09/25 19:51:19 | 000,000,632 | R-S- | M] () -- C:\Users\Kim\ntuser.pol
[2013/09/25 18:29:40 | 000,000,564 | ---- | M] () -- C:\Users\Public\Desktop\Fraps.lnk
[2013/09/25 18:24:50 | 000,000,829 | ---- | M] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2013/09/24 19:58:41 | 002,161,521 | ---- | M] () -- C:\Users\Kim\Desktop\mcpatcher-4.2.2.exe
[2013/09/20 07:55:13 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/09/20 07:55:13 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/09/20 07:55:04 | 003,723,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerInstaller.exe
[2013/09/15 23:53:02 | 000,000,017 | ---- | M] () -- C:\Users\Kim\AppData\Local\resmon.resmoncfg
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/09/27 17:06:53 | 000,001,037 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2013/09/27 17:05:43 | 000,001,209 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2013/09/27 17:04:35 | 000,000,999 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2013/09/27 17:04:07 | 000,001,171 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2013/09/27 17:02:07 | 000,001,355 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2013/09/27 17:02:01 | 000,001,521 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2013/09/26 19:19:54 | 000,001,756 | ---- | C] () -- C:\Users\Public\Desktop\Lightworks (11.1).lnk
[2013/09/26 16:47:20 | 000,000,512 | ---- | C] () -- C:\Users\Kim\Desktop\MBR.dat
[2013/09/26 16:06:12 | 755,905,231 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013/09/26 16:01:55 | 000,004,910 | ---- | C] () -- C:\Users\Kim\Desktop\attach.zip
[2013/09/26 15:28:13 | 000,000,926 | ---- | C] () -- C:\Users\Kim\Desktop\NTREGOPT.lnk
[2013/09/26 15:28:13 | 000,000,907 | ---- | C] () -- C:\Users\Kim\Desktop\ERUNT.lnk
[2013/09/26 05:56:39 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/25 19:52:05 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2013/09/25 18:29:40 | 000,000,564 | ---- | C] () -- C:\Users\Public\Desktop\Fraps.lnk
[2013/09/24 19:58:47 | 002,161,521 | ---- | C] () -- C:\Users\Kim\Desktop\mcpatcher-4.2.2.exe
[2013/09/15 23:53:02 | 000,000,017 | ---- | C] () -- C:\Users\Kim\AppData\Local\resmon.resmoncfg
[2013/08/15 18:19:26 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2013/08/15 18:19:25 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2013/08/15 18:19:25 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2013/08/15 18:19:24 | 000,217,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2013/08/15 18:19:23 | 000,112,640 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2013/05/28 12:03:14 | 000,041,008 | ---- | C] () -- C:\Windows\SysWow64\RGBAcodec.dll
[2012/12/01 14:36:01 | 000,000,638 | ---- | C] () -- C:\Windows\eReg.dat
[2011/08/30 20:44:32 | 000,000,632 | R-S- | C] () -- C:\Users\Kim\ntuser.pol
[2010/11/17 20:51:10 | 000,000,156 | ---- | C] () -- C:\Users\Kim\IT258_01_KimKennedy_Unit1Project.java
========== ZeroAccess Check ==========
[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/07/25 22:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/07/25 21:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2013/09/29 16:58:58 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\.minecraft
[2013/09/26 20:59:28 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Audacity
[2013/03/02 01:25:57 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011/08/30 15:12:43 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Fingertapps
[2012/05/12 02:01:10 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\FOG Downloader
[2013/07/24 17:53:14 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\FreeAudioPack
[2013/03/06 21:26:56 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\NetBeans
[2013/03/23 02:42:53 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Origin
[2012/06/03 20:21:50 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\PCDr
[2013/03/02 02:07:08 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\PDAppFlex
[2011/11/08 20:42:07 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\SecondLife
[2013/05/11 12:59:19 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Smith Micro
[2011/08/30 15:38:19 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Template
[2013/06/20 21:55:19 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\TuneUp Software
[2013/09/27 16:53:28 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\uTorrent
[2011/09/11 10:58:01 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Windows Live Writer
[2013/05/10 23:05:18 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\xtranormal
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
< MD5 for: EXPLORER.EXE >
[2011/08/23 06:02:48 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/08/23 06:02:48 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/08/23 06:02:48 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/08/23 06:02:48 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 23:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/08/23 06:02:48 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/08/23 06:02:48 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 23:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
< MD5 for: SERVICES.EXE >
[2009/07/13 21:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\SysNative\services.exe
[2009/07/13 21:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
< MD5 for: SVCHOST.EXE >
[2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/13 21:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/13 21:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009/07/13 21:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe
< MD5 for: USERINIT.EXE >
[2010/11/20 23:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 23:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 23:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 23:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
< MD5 for: WINLOGON.EXE >
[2010/11/20 23:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 23:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
< %systemroot%\*. /rp /s >
< %systemdrive%\$Recycle.Bin|@;true;true;true /fp >
========== Drive Information ==========
Physical Drives
---------------
Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST9500420AS
Partitions: 3
Status: OK
Status Info: 0
Partitions
---------------
DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 102.00MB
Starting Offset: 32256
Hidden sectors: 0
DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 20.00GB
Starting Offset: 109051904
Hidden sectors: 0
DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 446.00GB
Starting Offset: 21080571904
Hidden sectors: 0
========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction
[C:\Windows\System32\config\systemprofile\AppData\Local\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction
[C:\Windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction
[C:\Windows\System32\config\systemprofile\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Roaming -> Junction
[C:\Windows\System32\config\systemprofile\Cookies] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies -> Junction
[C:\Windows\System32\config\systemprofile\Documents\My Music] -> C:\Windows\system32\config\systemprofile\Music -> Junction
[C:\Windows\System32\config\systemprofile\Documents\My Pictures] -> C:\Windows\system32\config\systemprofile\Pictures -> Junction
[C:\Windows\System32\config\systemprofile\Documents\My Videos] -> C:\Windows\system32\config\systemprofile\Videos -> Junction
[C:\Windows\System32\config\systemprofile\Local Settings] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction
[C:\Windows\System32\config\systemprofile\My Documents] -> C:\Windows\system32\config\systemprofile\Documents -> Junction
[C:\Windows\System32\config\systemprofile\NetHood] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts -> Junction
[C:\Windows\System32\config\systemprofile\PrintHood] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts -> Junction
[C:\Windows\System32\config\systemprofile\Recent] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent -> Junction
[C:\Windows\System32\config\systemprofile\SendTo] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo -> Junction
[C:\Windows\System32\config\systemprofile\Start Menu] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu -> Junction
[C:\Windows\System32\config\systemprofile\Templates] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates -> Junction
[C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction
[C:\Windows\SysWOW64\config\systemprofile\AppData\Local\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction
[C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Roaming -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Cookies] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Documents\My Music] -> C:\Windows\system32\config\systemprofile\Music -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Documents\My Pictures] -> C:\Windows\system32\config\systemprofile\Pictures -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Documents\My Videos] -> C:\Windows\system32\config\systemprofile\Videos -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Local Settings] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction
[C:\Windows\SysWOW64\config\systemprofile\My Documents] -> C:\Windows\system32\config\systemprofile\Documents -> Junction
[C:\Windows\SysWOW64\config\systemprofile\NetHood] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts -> Junction
[C:\Windows\SysWOW64\config\systemprofile\PrintHood] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Recent] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent -> Junction
[C:\Windows\SysWOW64\config\systemprofile\SendTo] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Start Menu] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu -> Junction
[C:\Windows\SysWOW64\config\systemprofile\Templates] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates -> Junction
< End of report >
OTL Extras logfile created on: 9/30/2013 5:53:05 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kim\Desktop\pc cleaning
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16686)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.90 Gb Total Physical Memory | 2.01 Gb Available Physical Memory | 51.55% Memory free
7.79 Gb Paging File | 5.83 Gb Available in Paging File | 74.80% Paging File free
Paging file location(s): ?:\pagefile.sys
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 446.13 Gb Total Space | 217.74 Gb Free Space | 48.81% Space Free | Partition Type: NTFS
Computer Name: KIM7 | User Name: Kim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[b]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E259BD1-0676-4B99-8A50-21B7C679A481}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{113816D9-6ED4-4BD8-989D-EECCD13EBB02}" = lport=6915 | protocol=6 | dir=in | app=c:\program files (x86)\microsoft visual studio 11.0\common7\ide\devenv.exe |
"{123F30BE-871E-40BA-B502-7DC0E079A594}" = lport=10243 | protocol=6 | dir=in | app=system |
"{17EA7C7B-9986-4DC4-A203-87E8AFF36929}" = lport=6916 | protocol=6 | dir=in | app=c:\program files (x86)\microsoft visual studio 11.0\common7\ide\devenv.exe |
"{2A5294EE-E916-4BDB-9128-1744AA94FD82}" = rport=139 | protocol=6 | dir=out | app=system |
"{2AC307E4-BA98-4411-9C66-C49BF7164E64}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2C2B6DB4-F8E8-4B71-BAD5-C32DC0DB9A21}" = lport=2869 | protocol=6 | dir=in | app=system |
"{353C9C09-6396-4169-80F9-F8E3D4CDAA7A}" = rport=10243 | protocol=6 | dir=out | app=system |
"{3B31E721-4428-478A-AEB0-A724160BF4C7}" = lport=6917 | protocol=6 | dir=in | app=c:\program files (x86)\microsoft visual studio 11.0\common7\ide\devenv.exe |
"{4548E964-EE6D-46D6-9F0F-C378B1491821}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4925ABC1-1929-462F-8D68-A1FD1C9B2592}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office15\outlook.exe |
"{4F657E00-7CDD-40EE-8920-6BE3B4B0D05A}" = lport=6918 | protocol=6 | dir=in | app=c:\program files (x86)\microsoft visual studio 11.0\common7\ide\devenv.exe |
"{5769AB93-F5B3-47DF-B11D-BF77AFA78E3C}" = lport=6919 | protocol=6 | dir=in | app=c:\program files (x86)\microsoft visual studio 11.0\common7\ide\devenv.exe |
"{6000ABBB-AEE4-4F27-8403-FE0F3F19473D}" = lport=445 | protocol=6 | dir=in | app=system |
"{6352583F-4CAE-4106-9250-9E76FF99C989}" = lport=3702 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft visual studio 11.0\common7\ide\devenv.exe |
"{6C23DD15-8501-430B-BCA0-6C97469EE1E8}" = lport=139 | protocol=6 | dir=in | app=system |
"{6C2CC718-AD5F-4659-B3F1-78CCE9AC80B6}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{72AA0575-3604-4E37-BC48-34613F240E0A}" = rport=445 | protocol=6 | dir=out | app=system |
"{76B2B5D5-561C-45FA-9F86-ABFB21B0A068}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{777359B6-C486-4066-B583-FC3F11047959}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7E26F87B-1245-454D-B013-C0217B703CD2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{82449802-80AF-4D67-8A18-3A7FDFC905BB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{944BB7BE-0BCB-4E5E-8B43-ECE73E9A1747}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9525C570-6553-4B35-ADC9-0A7C89AED780}" = lport=6920 | protocol=6 | dir=in | app=c:\program files (x86)\microsoft visual studio 11.0\common7\ide\devenv.exe |
"{960FD0CF-C45D-4602-BB65-C246EDA992FF}" = rport=138 | protocol=17 | dir=out | app=system |
"{A4C6C395-8C55-476F-8A90-DDA867676E0A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A6ABA8D3-D105-485C-B340-1B448EE9A4FC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{ACD414BC-A9B5-41A4-9986-56AD04AB72A3}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{BF1587E9-75C0-41F5-A5D6-63BD04C2A7D6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{DB290519-31AD-49EA-B6ED-3906DCD918AB}" = lport=138 | protocol=17 | dir=in | app=system |
"{DFD37081-7405-43A5-B255-7330D134FEB0}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{E391303C-AD40-4147-9E41-55F484B63313}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E74A4731-8D03-43D0-8CE4-16BE74E0FD78}" = lport=137 | protocol=17 | dir=in | app=system |
"{E923FBA2-2AC0-48F9-BBE4-84644F99C551}" = rport=137 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05C78FE5-59D9-4333-A783-F3B615814FAA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{08CA45E2-4604-440A-93F9-5EE2A404DA8B}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{10526CBF-B65E-4BC7-AC93-5666F0DB1DBD}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe |
"{114B13AA-7095-4D18-AD02-B280EA265850}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{1301847E-E7DF-44FB-89C3-7D8F35535BCD}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{15A709FE-AAB8-4356-8CD3-DE7A27B35A9B}" = protocol=6 | dir=out | app=system |
"{191F1602-65C6-4E1A-BC3A-FF4C771DB13E}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe |
"{1D73EC1B-F118-4E46-807E-F947B34FF8A8}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{1EE09B97-C0AB-4148-8393-830E76B5D667}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe |
"{23332AF3-C744-4174-9EF1-9533C65B017B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{267E5F24-F7F2-4DCA-A62A-F732B978ADF2}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{298A1B7C-EC69-4E97-B521-BEE478A9F1B6}" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.patch.exe |
"{2A561EBF-A551-4F79-9914-E09B65C594F5}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{380F174B-E6E0-4412-A526-0A1072FF895F}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{3A351AAA-177D-4AEC-9734-1FF4C425BFD8}" = protocol=17 | dir=in | app=c:\program files (x86)\xtranormal\desktop\state.exe |
"{44087D86-D2E4-45E2-AD30-65962C5291AC}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe |
"{49DAE204-7AB1-42FF-B540-377606D7DB5B}" = protocol=6 | dir=in | app=c:\program files\lightworks\lightworks.exe |
"{4EF46CB1-6A89-4448-B90F-514EA9A41CB2}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{4F6BB5EC-12EF-4A9E-8252-8137429A59C4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5A2F0A8E-B73A-4392-BBBF-2BBC3CD905D1}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{62A22AC8-EB5E-4C61-A8E7-5B595321C74E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6E95F310-7CB5-41CD-A33B-8830065291BE}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{7129A4B3-7C48-4476-9FDA-228E7E1D9DFF}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{77346B08-6C19-4B16-9964-791F1EE96426}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{79913212-88D4-4F5F-A901-0F6D91BE1A28}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{7B1C17ED-6EA9-4BF8-AE1D-06D1E387A36C}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{7C21AB82-E6D2-4F5B-A0C6-88D307E2EA1C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{838AE69E-51EA-4975-9E2A-DBD2791BF5C8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{8D76397E-7170-449F-846D-6ACF72E4319A}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |
"{8DC42C28-06DC-4719-A5BD-446F0EB0872E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{915CEBB2-38EC-4429-9652-E8AAC2766061}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{91E5F4FF-A23F-482A-B040-DE4E3F752473}" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"{927F3BF5-E789-47D9-AFE7-B4E55A7B89AB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{95D12D24-A697-4BFE-AB40-948BF718BB31}" = dir=in | app=c:\program files\dell stage\musicstage\musicstageengine.exe |
"{97E2FE40-1B76-46AA-BE88-CE228CB96280}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{98C5F782-2794-4449-9524-B79E862E7829}" = protocol=6 | dir=in | app=c:\users\kim\appdata\roaming\utorrent\utorrent.exe |
"{996F0B67-1353-4A18-9591-CC0ACC434A63}" = protocol=17 | dir=in | app=c:\users\kim\appdata\roaming\utorrent\utorrent.exe |
"{99BF140A-7A14-43F2-951A-4DF5A1AED424}" = protocol=6 | dir=in | app=c:\program files\lightworks\ntcardvt.exe |
"{9AFBD7B5-4475-4645-9EAB-450202FA3FD9}" = dir=in | app=c:\program files\dell stage\dell stage\stage_primary.exe |
"{9BE006C3-EFD2-4E34-B72B-FCFCDDD30CD3}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{A12E6C51-1F5D-4B6C-9A6B-ECF3E9F17708}" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"{A88E64D4-B81C-4CBF-859A-A39D6112E8DA}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{ACBC02EC-8453-447B-BF76-F6F7CBAD5A91}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{AF422AA8-E9B9-49D0-814A-F15DF0B2C3D1}" = protocol=17 | dir=in | app=c:\program files\lightworks\lightworks.exe |
"{AFCED4B4-75A6-4CDE-83AF-6DDEA611AAE8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B048F3F2-AA39-4BC3-B2B3-4DDC0D598553}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B20A154A-4A25-4D52-B3AE-AA8E1E6BE130}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B591BF40-D71D-4832-97C3-0567FDE50B38}" = protocol=17 | dir=in | app=c:\program files\lightworks\ntcardvt.exe |
"{B60D8320-769D-4EF5-B769-4699B3727B11}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B96738F6-1E7D-404F-AC30-A5E7975D62E0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{BAE3D3B7-58A7-4CEA-801D-B23F5C1A0712}" = dir=in | app=c:\program files (x86)\dell\videostage\videostage.exe |
"{C02EACCD-51D0-44C2-AAB1-BC96EECFE338}" = protocol=6 | dir=in | app=c:\program files (x86)\xtranormal\desktop\launcher.exe |
"{C5650CED-44BF-4572-867C-CA3A4543D941}" = protocol=6 | dir=in | app=c:\program files (x86)\xtranormal\desktop\state.exe |
"{C988572C-8A05-4E38-9CA9-A11832103674}" = dir=in | app=c:\program files\dell stage\dell stage\accuweather\accuweather.exe |
"{D022206A-F7D2-45BB-A74B-72F005461BD7}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{D6B231A4-5502-4462-AA5B-6EC46DCA4B04}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{E3DF4E05-C8E0-424D-9CBC-397D1F66611E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E616C227-49CF-4C0A-8D7B-DEF846BAD9E7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{E890C596-9C53-46AA-953B-3543C9F428AE}" = protocol=17 | dir=in | app=c:\program files (x86)\xtranormal\desktop\launcher.exe |
"{E8D9E44C-C958-4195-9C46-9DC257CC92B2}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{EDA8557D-2A8A-47AE-97AD-53397031641A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{F2D03FA0-FDF5-4B70-931B-C33ABCE3C185}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\lync.exe |
"{F63E09C6-D1C9-4663-9FFB-FE05C964150D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\lync.exe |
"{F9366A38-F653-4E63-A843-F1A8C171763C}" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.patch.exe |
"{FEE5707A-BE7C-471D-8925-0CC656ECDFB5}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"TCP Query User{022137A7-5873-4358-8C89-9288B696371E}C:\program files (x86)\world of warcraft\temp\wow-4.2.1.2617-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\temp\wow-4.2.1.2617-enus-tools-downloader.exe |
"TCP Query User{2BECF67B-89E1-4380-99E4-207785A72EBC}C:\program files (x86)\runes of magic\launcher.exe" = protocol=6 | dir=in | app=c:\program files (x86)\runes of magic\launcher.exe |
"TCP Query User{3CF89B80-109A-4C08-BDB6-0897352B942B}C:\program files (x86)\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"TCP Query User{450576A9-DB7B-46F1-B16A-B5EC20D2A293}C:\program files (x86)\world of warcraft\temp\wow-4.2.1.2609-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\temp\wow-4.2.1.2609-enus-tools-downloader.exe |
"TCP Query User{5CCA1B3E-4BE1-448B-BA4A-F3EB8D2E3D03}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{63A93864-98CA-4BCF-B83E-84A4CF7E5571}C:\program files (x86)\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\world of warcraft\backgrounddownloader.exe |
"TCP Query User{94A1E3EB-8193-4016-909E-3BA675157E56}C:\users\public\sony online entertainment\installed games\everquest\eqvoiceservice.exe" = protocol=6 | dir=in | app=c:\users\public\sony online entertainment\installed games\everquest\eqvoiceservice.exe |
"TCP Query User{ACCD5F44-F68D-408F-A609-22BBBCC00694}C:\users\kim\desktop\runes_of_magic_4_0_8_2506_full_us.exe" = protocol=6 | dir=in | app=c:\users\kim\desktop\runes_of_magic_4_0_8_2506_full_us.exe |
"TCP Query User{D2BD9AB1-10E2-45BE-851B-A2D042830C89}C:\program files (x86)\runes of magic\client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\runes of magic\client.exe |
"TCP Query User{EE3CC3AC-7AB3-47AA-9EF7-6817A5EA9D92}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{F129AA24-CDDA-458E-8C04-3CD012A330CC}C:\program files (x86)\secondlifeviewer2\slvoice.exe" = protocol=6 | dir=in | app=c:\program files (x86)\secondlifeviewer2\slvoice.exe |
"TCP Query User{F623B005-134C-4932-8EE2-BF90E16647F9}C:\users\public\sony online entertainment\installed games\everquest ii\eq2voiceservice.exe" = protocol=6 | dir=in | app=c:\users\public\sony online entertainment\installed games\everquest ii\eq2voiceservice.exe |
"UDP Query User{01C2EDE9-DEA7-4FA1-8DAD-6443522C1C41}C:\users\public\sony online entertainment\installed games\everquest\eqvoiceservice.exe" = protocol=17 | dir=in | app=c:\users\public\sony online entertainment\installed games\everquest\eqvoiceservice.exe |
"UDP Query User{1A4AD846-4FD6-4F7F-A78A-65AFB8AC5ECE}C:\program files (x86)\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\launcher.exe |
"UDP Query User{1DD7EAD0-A115-43F8-966E-C0A871CBA3F4}C:\program files (x86)\runes of magic\client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\runes of magic\client.exe |
"UDP Query User{63D1E579-6DAD-4B4B-A305-9F77CEDD8FF5}C:\users\public\sony online entertainment\installed games\everquest ii\eq2voiceservice.exe" = protocol=17 | dir=in | app=c:\users\public\sony online entertainment\installed games\everquest ii\eq2voiceservice.exe |
"UDP Query User{652CC9BE-79A7-4B7C-A3D8-3B500D24A4E9}C:\program files (x86)\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\backgrounddownloader.exe |
"UDP Query User{781312BA-7EAC-4125-9BFA-24A5F2C446E5}C:\program files (x86)\secondlifeviewer2\slvoice.exe" = protocol=17 | dir=in | app=c:\program files (x86)\secondlifeviewer2\slvoice.exe |
"UDP Query User{79A5F83A-F04C-4A82-A81A-5BB20005C65C}C:\users\kim\desktop\runes_of_magic_4_0_8_2506_full_us.exe" = protocol=17 | dir=in | app=c:\users\kim\desktop\runes_of_magic_4_0_8_2506_full_us.exe |
"UDP Query User{90A2E540-9D99-4134-8EB1-FCA9A58DC18C}C:\program files (x86)\world of warcraft\temp\wow-4.2.1.2609-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\temp\wow-4.2.1.2609-enus-tools-downloader.exe |
"UDP Query User{B37C12FA-BEA7-4BAD-A87F-852669AEE90D}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{B38CB067-D329-4DC8-A432-C1A09E9D7ED9}C:\program files (x86)\runes of magic\launcher.exe" = protocol=17 | dir=in | app=c:\program files (x86)\runes of magic\launcher.exe |
"UDP Query User{B911AD01-178D-40D2-8F2A-0B3F160FA104}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{D4726AC5-ACE6-4FBB-8A42-3B2F34647CE0}C:\program files (x86)\world of warcraft\temp\wow-4.2.1.2617-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\world of warcraft\temp\wow-4.2.1.2617-enus-tools-downloader.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{034106B5-54B7-467F-B477-5B7DBB492624}" = Microsoft Sync Framework Services v1.0 SP1 (x64)
"{0E8670B8-3965-4930-ADA6-570348B67153}" = Microsoft SQL Server 2012 Transact-SQL ScriptDom
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{13417784-A359-3CDD-8DE1-B7108707D647}" = Visual Studio 2012 Prerequisites - ENU Language Pack
"{13D558FE-A863-402C-B115-160007277033}" = Microsoft SQL Server 2012 Express LocalDB
"{1AB7EDC5-D891-34C5-9FF1-BE6A85ACC44B}" = Microsoft Team Foundation Server 2010 Object Model - ENU
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1D1CEEF8-3741-45BD-8E77-963E1DEBDDD3}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{24F93B56-61F5-415F-85B9-AA444DA34AFC}" = Microsoft Mouse and Keyboard Center
"{26A24AE4-039D-4CA4-87B4-2F86417015FF}" = Java 7 Update 15 (64-bit)
"{27EF252D-800C-ED42-9904-459FE0046225}" = Windows Software Development Kit for Windows Store Apps DirectX x64 Remote
"{28D85F24-B685-3364-BB7C-284C88C2FFE5}" = Microsoft Visual Studio Team Foundation Server 2012 Storyboarding
"{290D4DB2-F1B4-4B8E-918D-D71EF29A001B}" = Intel(R) PROSet/Wireless WiFi Software
"{2B997E80-3BEC-3222-9114-98DBE1182B2E}" = Microsoft Visual C++ 2012 x64 Debug Runtime - 11.0.50727
"{36E619BC-A234-4EC3-849B-779A7C865A45}" = Microsoft SQL Server 2012 Data-Tier App Framework
"{3FA063D7-EDC1-AFA8-54AF-0563C7DEE070}" = Windows App Certification Kit Native Components
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4701DEDE-1888-49E0-BAE5-857875924CA2}" = Microsoft SQL Server System CLR Types (x64)
"{49D665A2-4C2A-476E-9AB8-FCC425F526FC}" = Microsoft SQL Server 2012 Native Client
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{55EFD1A6-ED8E-3A4C-9581-5E1A1FF244CD}" = Microsoft Visual Studio Team Foundation Server 2012 Storyboarding Language Pack - ENU
"{572E796D-C52B-3797-A685-2FB6F895D4BE}" = Microsoft Visual Studio 2010 Office Developer Tools (x64)
"{5FB4C443-6BD6-1514-2717-3827D65AE6FB}" = Windows Software Development Kit DirectX x64 Remote
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{61862D7C-CDBC-48D5-8AE1-3B8BD1E23BC5}" = Visual Studio 2012 Prerequisites
"{633AB014-DDE6-403E-A302-8920CC32C543}" = Microsoft Visual Studio 2012 Performance Collection Tools
"{64A3A4F4-B792-11D6-A78A-00B0D0170150}" = Java SE Development Kit 7 Update 15 (64-bit)
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{68A48EF1-DF03-394F-AF40-1E4FE42BB8DD}" = Microsoft Visual Studio Team Foundation Server 2012 Object Model Language Pack - ENU
"{6AAF4427-3039-4C8A-BE53-D6F01C21AD46}" = Microsoft Visual Studio 2012 IntelliTrace Core amd64
"{6F07A6C2-9068-3673-A120-DC10012468C6}" = Microsoft Visual Studio Team Foundation Server 2012 Object Model
"{78909610-D229-459C-A936-25D92283D3FD}" = Microsoft SQL Server Compact 4.0 SP1 x64 ENU
"{7BF61FA9-BDFB-4563-98AD-FCB0DA28CCC7}" = IIS 8.0 Express
"{8438EC02-B8A9-462D-AC72-1B521349C001}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64)
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C5B5A11-CBF8-451B-B201-77FAB0D0B77D}" = Microsoft Network Monitor 3.4
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010
"{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90150000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2013
"{90150000-0015-0409-1000-0000000FF1CE}" = Microsoft Access MUI (English) 2013
"{90150000-0016-0409-1000-0000000FF1CE}" = Microsoft Excel MUI (English) 2013
"{90150000-0018-0409-1000-0000000FF1CE}" = Microsoft PowerPoint MUI (English) 2013
"{90150000-0019-0409-1000-0000000FF1CE}" = Microsoft Publisher MUI (English) 2013
"{90150000-001A-0409-1000-0000000FF1CE}" = Microsoft Outlook MUI (English) 2013
"{90150000-001B-0409-1000-0000000FF1CE}" = Microsoft Word MUI (English) 2013
"{90150000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - English
"{90150000-001F-040C-1000-0000000FF1CE}" = Outils de vérification linguistique 2013 de Microsoft Office*- Français
"{90150000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - Espańol
"{90150000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2013
"{90150000-0044-0409-1000-0000000FF1CE}" = Microsoft InfoPath MUI (English) 2013
"{90150000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2013
"{90150000-0090-0409-1000-0000000FF1CE}" = Microsoft DCF MUI (English) 2013
"{90150000-00A1-0409-1000-0000000FF1CE}" = Microsoft OneNote MUI (English) 2013
"{90150000-00BA-0409-1000-0000000FF1CE}" = Microsoft Groove MUI (English) 2013
"{90150000-00C1-0000-1000-0000000FF1CE}" = Microsoft Office 32-bit Components 2013
"{90150000-00C1-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2013
"{90150000-00E1-0409-1000-0000000FF1CE}" = Microsoft Office OSM MUI (English) 2013
"{90150000-00E2-0409-1000-0000000FF1CE}" = Microsoft Office OSM UX MUI (English) 2013
"{90150000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2013
"{90150000-0117-0409-1000-0000000FF1CE}" = Microsoft Access Setup Metadata MUI (English) 2013
"{90150000-012B-0409-1000-0000000FF1CE}" = Microsoft Lync MUI (English) 2013
"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64
"{91140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{963E5FEB-1367-46B9-851D-A957F1A3747F}" = Microsoft Network Monitor: NetworkMonitor Parsers 3.4
"{9D573E71-1077-4C7E-B4DB-4E22A5D2B48B}" = Microsoft SQL Server 2012 Command Line Utilities
"{9D6DFAD6-09E5-445E-A4B5-A388FEEBD90D}" = RBVirtualFolder64Inst
"{9f4f4a9b-eec5-4906-92fe-d1f43ccf5c8d}.sdb" = IIS Express Application Compatibility Database for x64
"{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{AA72C306-30BE-4BB1-9E42-59552BAD2CDF}" = Microsoft Web Deploy 3.0
"{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B143BE44-8723-315E-9413-011C55873C0E}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 320.49
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 320.49
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 320.49
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience" = NVIDIA GeForce Experience 1.5
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 320.49
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 4.11.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.13.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 4.11.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.24.2
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BEB0F91E-F2EA-48A1-B938-7857ABF2A93D}" = Microsoft SQL Server 2012 Transact-SQL Compiler Service
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D9F3D00D-E946-3B3D-A4A6-93D5020DB9F7}" = Microsoft Visual C++ 2012 x64 Designtime - 11.0.50727
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E2B8249D-895C-4685-8C83-00F3B1A13028}" = Microsoft Web Platform Installer 4.0
"{F1949145-EB64-4DE7-9D81-E6D27937146C}" = Microsoft System CLR Types for SQL Server 2012 (x64)
"{FA0A244E-F3C2-4589-B42A-3D522DE79A42}" = Microsoft SQL Server 2012 Management Objects (x64)
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"{fdfba1f3-74ae-4255-9c10-a0f552b4610f}.sdb" = IIS Express Application Compatibility Database for x86
"{FE74AC04-F248-4641-B3A9-89C6AA4339CD}" = Microsoft Visual Studio 2012 Performance Collection Tools - ENU
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Mouse and Keyboard Center" = Microsoft Mouse and Keyboard Center
"Microsoft Team Foundation Server 2010 Object Model - ENU" = Microsoft Team Foundation Server 2010 Object Model - ENU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"nbi-nb-base-7.3.0.0.201302132200" = NetBeans IDE 7.3
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Office15.PROPLUS" = Microsoft Office Professional Plus 2013
"PC-Doctor for Windows" = My Dell
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.20 (64-bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00EC8ABC-3C5A-40F8-A8CB-E7DCD5ABFA05}" = Microsoft NuGet - Visual Studio 2012
"{02213A81-CB13-7262-5ABE-1FFA2C75559F}" = Windows App Certification Kit x64
"{0330FC8D-EDB2-455E-A3DC-B56DD107E4BC}" = LogMeIn
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{046806D1-0A38-3FCA-AF84-F71C50A0C363}" = Microsoft Visual Studio Premium 2012
"{08A25478-C5DD-4EA7-B168-3D687CA987FF}" = The Sims™ 3 Master Suite Stuff
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A1A1D48-DB23-443A-BC7B-49255D138020}" = Entity Framework Designer for Visual Studio 2012 - enu
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0BCC836F-0B28-4090-B58A-64883BAA3B2F}" = WCF Data Services 5.0 (for OData v3) Primary Components
"{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}" = Microsoft Sync Framework SDK v1.0 SP1
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1172AC15-080E-30E3-85B0-FF59AD2E6315}" = Microsoft Visual Studio Ultimate 2012 - ENU
"{117B6BF6-82C3-420C-B284-9247C8568E53}" = The Sims™ 3 Outdoor Living Stuff
"{148878BD-A2A5-4CF1-A103-2BA632F41953}" = WCF Data Services Tools for Microsoft Visual Studio 2012
"{1690CE56-2231-4E59-9006-A0876D949EA8}" = Tools for .Net 3.5
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{189AEA94-DAFB-487A-8CEE-F9D3DDE0A748}" = Microsoft Silverlight 4 SDK
"{1948E039-EC79-4591-951D-9867A8C14C90}" = Microsoft .NET Framework 4.5 SDK
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1B9BBB23-65CB-3AEE-BFC6-633E7CA299FD}" = Microsoft Visual Studio Team Foundation Server 2012 Team Explorer Language Pack - ENU
"{1C083A57-EEE2-46D1-8A82-B72FE073D156}" = Xtranormal - TTS Engine
"{1C163D33-33B3-33EB-A617-0D4D852BE8E1}" = Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.50727
"{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43}" = The Sims™ 3 Diesel Stuff
"{1DB43E5A-2F24-4F51-92B0-A2C0EBF5C742}" = Microsoft Report Viewer Add-On for Visual Studio 2012
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1F8E06E2-BA93-40DC-B183-E024CBD853A8}" = Microsoft Visual C++ 2012 Compilers
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{23176E97-26CB-C72A-19EB-BFB21AC1D15A}" = Windows Software Development Kit DirectX x86 Remote
"{246B0F46-F84E-4857-8C47-F2A86B598BC5}" = Microsoft Visual Studio 2012 Preparation
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29F259D7-C517-3EED-84B4-237573CFD39C}" = Microsoft Visual C++ 2012 Microsoft Foundation Class Libraries
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2C0CC01A-DDBC-3AED-AF18-E741242FD727}" = Microsoft Visual Studio Ultimate 2012 XAML UI Designer enu Resources
"{2C76E3DA-BA76-4FAD-B1B1-72B46D639028}" = PreEmptive Analytics Visual Studio Components
"{2F6CE32A-018D-4656-895B-9E5E20D7740A}" = Microsoft ASP.NET MVC 3 - Visual Studio 2012 Tools Update
"{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727
"{3250260C-7A95-4632-893B-89657EB5545B}" = PhotoShowExpress
"{3282FBE1-35FC-48D8-98CA-115A5EF1F9B4}" = NVIDIA PhysX
"{330E5D98-20D2-4CA4-AE51-FCB8AA80F634}" = Microsoft Visual Studio 2012 Devenv
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{3535FBA4-D54E-43B6-B961-D129BA84A8A0}" = Xtranormal State - Voicepack-USEnglish-Nelly22k
"{372D17F6-A54E-4A01-B264-1314890FFE61}" = Dotfuscator and Analytics Community Edition
"{38FC6E9A-F719-431A-A83D-4C86D5FD6555}" = Microsoft Visual Studio 2012 Shell (Minimum) Resources
"{3A523AF9-D32F-4C85-8388-0335731F3405}" = WCF RIA Services V1.0 SP2
"{3DE92282-CB49-434F-81BF-94E5B380E889}" = The Sims™ 3 Seasons
"{400182B4-CA55-46A9-9D88-F8413DCFB36D}" = Blio
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{42F61556-29ED-8122-F39E-6F04EA5FF279}" = Windows Software Development Kit for Windows Store Apps DirectX x86 Remote
"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = The Sims™ 3 Late Night
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.6
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{532DBCC8-9468-435C-AEF6-30B7F50735A2}" = Blend for Visual Studio 2012 ENU resources
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{57D782D7-49FD-48DE-AB47-A690A1519A2D}" = Microsoft ASP.NET Web Pages 2 - Visual Studio 2012 Tools
"{57F20F04-014D-453F-B6A3-AE9485C4DFAB}" = Blend for Visual Studio 2012
"{59D87F40-6C4B-4F80-A42B-FAA0E6EAFAB6}" = Microsoft ASP.NET MVC 4 - Visual Studio 2012 Tools
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
"{5CBFF3F3-2D40-34EE-BCA5-A95BC19E400D}" = Microsoft .NET Framework 4.5 Multi-Targeting Pack
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5E21B617-F52E-BB10-92F9-C8AB2C799A8A}" = Adobe Download Assistant
"{60D5EF2A-4E0C-2C30-38F6-59C26E134F4A}" = Windows Software Development Kit
"{631471BE-DEAB-454B-A9AC-CE3EB42C28B3}" = Microsoft ASP.NET Web Pages
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{6D6D43E5-218C-4B05-92D3-2240810F4760}" = Microsoft SQL Server 2012 T-SQL Language Service
"{6DAB46E3-D017-3E2B-85D8-F57A230384C0}" = Microsoft Visual Studio Team Foundation Server 2012 Team Explorer
"{6F066545-40A2-4C38-A8F7-78581CC5C442}" = Microsoft ASP.NET Web Pages - Visual Studio 2012 Tools
"{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}" = Roxio Creator Starter
"{6FC3B79F-47C6-38AF-B9A9-67DE3C639598}" = Microsoft Visual Studio Premium 2012 - ENU
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = The Sims™ 3 High-End Loft Stuff
"{7204BDEE-1A48-4D95-A964-44A9250B439E}" = Facebook Messenger 2.1.4814.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{731C183B-86A0-3442-BE55-68A7C92581E9}" = Microsoft Visual C++ 2012 Extended Libraries
"{7437A4B9-314F-3B8F-827B-22909146E471}" = Microsoft LightSwitch for Visual Studio 2012 Core
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{759FC370-E77F-4FB0-A1E4-C0628A44BA44}" = Amnesia - The Dark Descent
"{75CE8AF5-0A5E-4A42-BC67-F83591DA9A7D}" = Sound Blaster X-Fi MB
"{7746BFAA-2B5D-4FFD-A0E8-4558F4668105}" = Roxio Burn
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{790E9425-8570-493F-9AE7-81AFC9E46930}" = Microsoft SQL Server Data Tools Build Utilities - enu (11.1.20627.00)
"{7B11296A-F894-449C-8DF6-6AAAA7D4D118}" = The Sims™ 3 Town Life Stuff
"{7FB00B6B-6843-97EC-EED6-78BD6D35370A}" = Zinio Reader 4
"{800F484E-9D69-492D-B656-7BAA32586142}" = Microsoft Visual Studio 2012 Shell (Minimum)
"{820C677A-41B2-48C3-8136-FEE35A052E73}" = Microsoft Visual Studio 2012 Shell (Minimum) Interop Assemblies
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{87434D51-51DB-4109-B68F-A829ECDCF380}" = AccelerometerP11
"{89B4532E-19CE-4FA9-9692-10BFD5A38532}" = Visual Studio Extensions for Windows Library for JavaScript
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = The Sims™ 3 Ambitions
"{9169C939-ED01-446A-BD0C-29873BAF4E48}" = Prerequisites for SSDT
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93489CA8-6656-33A0-A5AC-E0EDEDB17C3E}" = Microsoft Visual Studio Professional 2012
"{942CC691-5B98-42A3-8BC5-A246BA69D983}" = Microsoft ASP.NET MVC 4 Runtime
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9600393b-6ede-469b-a522-689fce1461d1}" = Microsoft Visual Studio Ultimate 2012
"{9A00EC4E-27E1-42C4-98DD-662F32AC8870}" = Sonic CinePlayer Decoder Pack
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A121EEDE-C68F-461D-91AA-D48BA226AF1C}" = Roxio Activation Module
"{A3A6D5EA-B6B5-3C05-BDA8-EAB99C09CDDC}" = Microsoft Visual Studio 2012 SharePoint Developer Tools
"{A4366F69-CE22-4DB7-9C8C-46A5845AF997}" = Microsoft Visual C++ 2012 Compilers - ENU Resources
"{A47FD1BF-A815-4A76-BE65-53A15BD5D25D}" = Microsoft SQL Server System CLR Types
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7A34FC9-DF24-4A36-00AD-D4EFE94CC116}" = SimCity 4 Deluxe
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA31EA7B-7917-4000-949B-38E91F848A25}" = Internet Explorer
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.8) MUI
"{AD1AEE2A-D9C0-3FAC-8D6B-B5E07B47257B}" = Microsoft Visual C++ 2012 Core Libraries
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{B1465D1D-6427-4CA1-AE29-8B699209E663}" = Microsoft Visual Studio 2012 Devenv Resources
"{B3533B84-A8DF-4A7A-8E95-B15F08B26E96}" = Microsoft Visual Studio 2012 IntelliTrace Core x86
"{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}" = The Sims™ 3 Supernatural
"{B5DA9D49-9BD8-0F2F-52FC-C7E66BC8D944}" = LocalESPCui for en-us
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B96FCD4F-6EDD-4258-8A6D-0FCEA8445E3E}" = Microsoft Web Developer Tools - Visual Studio 2012
"{B9F35D86-242E-3FA4-B9F8-A982E0DF918D}" = Microsoft Visual Studio 2012 SharePoint Developer Tools ENU Language Pack
"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = The Sims™ 3 World Adventures
"{BAD0254F-9BDB-3D14-A5AC-9C0EF51F3D09}" = Microsoft Portable Library Multi-Targeting Pack Language Pack - enu
"{BDBE5D2A-AAB7-77BD-7A0E-5006665CE7C6}" = LocalESPC
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C16A92EF-017B-4839-9C75-FBADB5A1FA27}" = TrustedID
"{C1BE4600-7D15-3D1E-8AA2-B3241DB1D063}" = Microsoft Visual Studio Ultimate 2012 XAML UI Designer Core
"{C4CAD994-6EA2-3121-8352-DA593150B322}" = Microsoft Portable Library Multi-Targeting Pack
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C81452EB-CBCF-B8EB-3124-48C5B3D506B0}" = Windows Runtime Intellisense Content - en-us
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{CFFDC0EC-6924-3347-B047-13339EDBEC28}" = Microsoft Visual Studio Professional 2012 - ENU
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D11F66FF-82B3-DDB8-1146-525370552BE1}" = Windows Software Development Kit for Windows Store Apps
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D971780F-A609-4F78-92AA-B56FBC3955B9}" = Microsoft Visual Studio 2012 IntelliTrace Front End x86
"{DA1C1761-5F4F-4332-AB9D-29EDF3F8EA0A}" = Microsoft SQL Server 2012 Management Objects
"{DB1F8398-426C-41C5-8335-3FC9732721DF}" = Xtranormal State - Voicepack-USEnglish-Ryan22k
"{DCDEC776-BADD-48B9-8F9A-DFF513C3D7FA}" = Microsoft ASP.NET MVC 3
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1868CAE-E3B9-4099-8C18-AA8944D336FD}" = The Sims™ 3 70s, 80s, & 90s Stuff
"{E1FBB3D4-ADB0-4949-B101-855DA061C735}" = Microsoft Silverlight 5 SDK
"{E2082604-4BA5-44BB-BBFB-AF0F3CB8C6AB}" = Microsoft System CLR Types for SQL Server 2012
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4ADE757-7FE9-322D-9CAE-C77D77A2D2BF}" = Microsoft LightSwitch for Visual Studio 2012 CoreRes - ENU
"{E4C33F5B-1B2F-466E-957E-B274F08151A0}" = Microsoft Web Deploy dbSqlPackage Provider - enu
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}" = The Sims™ 3 Generations
"{E818AE7C-244B-4A50-9C86-C0E4A8B69159}" = Microsoft Visual Studio 2012 Tools for SQL Server Compact 4.0 SP1 ENU
"{E94DD4E4-7746-472c-AA7B-1242FED0CFC8}" = Lightworks
"{EA1F3D6C-A6F5-4CDC-B0D3-9C56C06B4D29}" = Cozi
"{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}" = The Sims™ 3 Fast Lane Stuff
"{EF56258E-0326-48C5-A86C-3BAC26FC15DF}" = Roxio Creator Starter
"{EFA87714-E75A-3BFC-A698-A3AABA5A8A0C}" = Microsoft Visual Studio Ultimate 2012
"{F06B5C4C-8D2E-4B24-9D43-7A45EEC6C878}" = Roxio Creator Starter
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}" = The Sims™ 3 University Life
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FA804794-2CCB-4301-954F-2C2894698876}" = Microsoft SQL Server Data Tools - enu (11.1.20627.00)
"{FBA6F90E-36EC-4FC9-9B25-3834E3BD46A8}" = Microsoft SQL Server 2012 Data-Tier App Framework
"{FBBC8076-BB21-4E06-9FA0-309AEF6E35EE}" = Microsoft ASP.NET Web Pages 2 Runtime
"{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FEB375AB-6EEC-3929-8FAF-188ED81DD8B5}" = Microsoft Help Viewer 2.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Anime Studio Pro v9.2 Build 71009.2" = Anime Studio Pro v9.2 Build 7100
"Audacity_is1" = Audacity 2.0.3
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Dell Webcam Central" = Dell Webcam Central
"Diablo III" = Diablo III
"ERUNT_is1" = ERUNT 1.1j
"Fraps" = Fraps (remove only)
"Google Chrome" = Google Chrome
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 10.0.0
"LAME_is1" = LAME v3.99.3 (for Windows)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft Help Viewer 2.0" = Microsoft Help Viewer 2.0
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Mozilla Firefox 24.0 (x86 en-US)" = Mozilla Firefox 24.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NIS" = Norton Internet Security
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Open Codecs" = Xiph.Org Open Codecs 0.85.17777
"Papagayo_is1" = Papagayo 1.2
"SecondLifeViewer" = SecondLifeViewer (remove only)
"Switch" = Switch Sound File Converter
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
"Xtranormal Desktop_is1" = Xtranormal Desktop
"YTdetect" = Yahoo! Detect
"ZinioReader4" = Zinio Reader 4
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"AIM" = AIM for Windows
"SOE-EverQuest II" = EverQuest II
"UnityWebPlayer" = Unity Web Player
"uTorrent" = µTorrent
"webmdshow" = WebM Project Directshow Filters
"Winamp Detect" = Winamp Detector Plug-in
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 9/30/2013 12:32:04 AM | Computer Name = Kim7 | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "c:\Program Files (x86)\Cozi
Express\CoziExpress.exe".Error in manifest or policy file "" on line . A component
version required by the application conflicts with another component version already
active. Conflicting components are:. Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 9/30/2013 3:58:56 AM | Computer Name = Kim7 | Source = Office 2013 Licensing Service | ID = 0
Description =
[ System Events ]
Error - 9/29/2013 5:09:41 PM | Computer Name = Kim7 | Source = DCOM | ID = 10010
Description =
< End of report >
Hi kimmisc :)
Run OTL.exe
Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com?type=714647&fr=spigot-yhp-ie
IE - HKCU\..\SearchScopes\{39C55943-DCB2-48E6-BEC4-B73FBC04C80B}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=714647&p={searchTerms}
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll File not found
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 125.252.224.90
O1 - Hosts: 127.0.0.1 125.252.224.91
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL File not found
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: kaplan.edu ([kucampus] http in Trusted sites)
O15 - HKCU\..Trusted Domains: kaplan.edu ([kucampus] https in Trusted sites)
O15 - HKCU\..Trusted Domains: kucourses.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O18:64bit: - Protocol\Handler\cozi - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O33 - MountPoints2\{970a40fe-c31e-11e2-8d1b-14feb5c23393}\Shell - "" = AutoRun
O33 - MountPoints2\{970a40fe-c31e-11e2-8d1b-14feb5c23393}\Shell\AutoRun\command - "" = F:\VZW_Software_upgrade_assistant.exe
2013/09/27 16:53:28 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\uTorrent
:Files
ipconfig /flushdns /c
:Commands
[EMPTYFLASH]
[REBOOT]
[RESETHOSTS]
[CREATERESTOREPOINT]
Then click the Run Fix button at the top
Let the program run unhindered.
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.
NEXT
Please read through these instructions to familarize yourself with what to expect when this tool runs
Refer to the ComboFix User's Guide (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)
Download ComboFix from one of these locations:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.infospyware.net/antimalware/combofix/)
* IMPORTANT- Save ComboFix.exe to your Desktop
====================================================
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs (http://forums.whatthetech.com/How_to_Disable_your_Security_Programs_t96260.html)
====================================================
Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.
On your next reply please post :
Combofix log
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
OTL wouldn't give me a log. I ran it twice. It rebooted both times but never showed a report.
ComboFix 13-10-01.03 - Kim 10/02/2013 10:12:33.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3990.2339 [GMT -4:00]
Running from: c:\users\Kim\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6308\AddOnDownloaded\0779eca6-695c-444d-8ef3-6621f5a112ee.dll
c:\programdata\PCDr\6308\AddOnDownloaded\244ec244-34e7-4b04-85aa-c16ea08f2533.dll
c:\programdata\PCDr\6308\AddOnDownloaded\394b144a-f70e-44ff-a1ce-7fed69d15b12.dll
c:\programdata\PCDr\6308\AddOnDownloaded\3df85ce4-1732-4e9b-9fee-111cf95d7191.dll
c:\programdata\PCDr\6308\AddOnDownloaded\50441041-9037-4c34-842c-4a8523e700da.dll
c:\programdata\PCDr\6308\AddOnDownloaded\5ec8c7eb-8ac7-4252-bb47-87f22e27e4a9.dll
c:\programdata\PCDr\6308\AddOnDownloaded\646d4422-eb1f-4e32-8b16-f32fc711fbc0.dll
c:\programdata\PCDr\6308\AddOnDownloaded\751275e0-9b7c-49a7-b6d8-eaf73a4eac58.dll
c:\programdata\PCDr\6308\AddOnDownloaded\7ec00d71-b236-42d5-b7d2-aab97a4a1f3d.dll
c:\programdata\PCDr\6308\AddOnDownloaded\8658165e-a29d-4eca-a939-35aff3e05f62.dll
c:\programdata\PCDr\6308\AddOnDownloaded\a7c185b3-39a9-4aaf-9506-7726c68d6350.dll
c:\programdata\PCDr\6308\AddOnDownloaded\aa7c4756-0f94-474f-8589-eb1b0e71c93b.dll
c:\programdata\PCDr\6308\AddOnDownloaded\ad245130-e9e2-4a7e-8912-a540560daf66.dll
c:\programdata\PCDr\6308\AddOnDownloaded\be543d7a-9241-474e-9567-a20b994760c0.dll
c:\programdata\PCDr\6308\AddOnDownloaded\c0c54ea3-e58e-438a-9c4c-778b0979180a.dll
c:\programdata\PCDr\6308\AddOnDownloaded\f39d056b-fbf9-40c5-806d-7d93eacdc251.dll
c:\programdata\Roaming
c:\users\Kim\AppData\Local\assembly\tmp
c:\users\Kim\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A068F7B3-D10F-4038-8DB1-F937F27B7091}.xps
c:\users\Kim\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A1039C55-35E3-4F8E-8D47-2D053BF9BEBA}.xps
c:\users\Kim\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A6D92E41-3D36-4162-8DD9-C4EC85AC11C0}.xps
c:\users\Kim\AppData\Local\Microsoft\Windows\Temporary Internet Files\{CA76B6A3-DE0B-4AE9-AC24-291E06594A01}.xps
c:\users\Kim\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E99FEE07-462C-4BC9-B208-43A2CDFCF3EF}.xps
c:\users\Kim\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EE6A0763-A00B-43F2-BFD1-298528C68AFB}.xps
c:\windows\SysWow64\DEBUG.log
c:\windows\SysWow64\frapsvid.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-09-02 to 2013-10-02 )))))))))))))))))))))))))))))))
.
.
2013-10-02 14:26 . 2013-10-02 14:26 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-10-02 14:26 . 2013-10-02 14:26 -------- d-----w- c:\users\hedev\AppData\Local\temp
2013-10-02 14:26 . 2013-10-02 14:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-10-02 13:36 . 2013-10-02 13:36 -------- d-----w- C:\_OTL
2013-10-02 05:13 . 2013-10-02 05:13 -------- d-----w- c:\program files (x86)\Samsung
2013-10-02 05:11 . 2013-10-02 05:16 -------- d-----w- c:\users\Kim\AppData\Roaming\Verizon
2013-10-02 05:11 . 2013-10-02 05:11 57344 ----a-r- c:\users\Kim\AppData\Roaming\Microsoft\Installer\{2FFBFBA6-8191-45A5-B952-226DB651268E}\NewShortcut11_98798AFA4B0B41FAA9B8FF8835A64952.exe
2013-10-02 05:11 . 2013-10-02 05:11 57344 ----a-r- c:\users\Kim\AppData\Roaming\Microsoft\Installer\{2FFBFBA6-8191-45A5-B952-226DB651268E}\NewShortcut1_3F3768693B314C7692F69858832BE52C.exe
2013-10-02 05:11 . 2013-10-02 05:11 53248 ----a-r- c:\users\Kim\AppData\Roaming\Microsoft\Installer\{2FFBFBA6-8191-45A5-B952-226DB651268E}\ARPPRODUCTICON.exe
2013-10-02 05:11 . 2013-10-02 05:11 -------- d-----w- c:\program files\SAMSUNG
2013-10-02 05:10 . 2013-10-02 05:13 -------- d-----w- c:\programdata\Samsung
2013-10-02 05:10 . 2013-10-02 05:10 -------- d-----w- C:\Verizon_Android
2013-09-29 19:50 . 2013-09-29 19:50 -------- d-----w- c:\windows\ERUNT
2013-09-29 19:35 . 2013-09-29 19:40 -------- d-----w- C:\AdwCleaner
2013-09-27 21:04 . 2013-09-27 21:06 -------- d-----w- c:\program files\Adobe
2013-09-27 21:00 . 2013-09-27 21:06 -------- d-----w- c:\program files\Common Files\Adobe
2013-09-26 23:47 . 2013-09-26 23:47 -------- d-----w- C:\Sound
2013-09-26 23:47 . 2013-09-26 23:47 -------- d-----w- C:\Material
2013-09-26 23:37 . 2013-09-26 23:37 -------- d-----w- c:\users\Kim\.MCReferenceSdk
2013-09-26 23:19 . 2013-09-26 23:19 -------- d-----w- c:\programdata\Geevs
2013-09-26 23:19 . 2013-09-26 23:46 -------- d-----w- c:\program files\Lightworks
2013-09-26 19:28 . 2013-09-26 19:28 -------- d-----w- c:\program files (x86)\ERUNT
2013-09-26 12:22 . 2013-09-26 12:22 -------- d-----w- c:\users\Kim\AppData\Roaming\Apple Computer
2013-09-26 09:56 . 2013-09-26 09:56 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-09-26 09:56 . 2013-04-04 18:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-09-25 23:53 . 2013-09-25 23:53 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-09-25 23:53 . 2013-09-25 23:53 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-09-25 23:53 . 2013-09-25 23:53 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-09-25 23:53 . 2013-09-25 23:53 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-09-25 23:53 . 2013-09-25 23:53 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-09-25 23:53 . 2013-09-25 23:53 -------- d-----w- c:\program files (x86)\QuickTime
2013-09-25 23:53 . 2013-09-25 23:53 -------- d-----w- c:\programdata\Apple Computer
2013-09-25 23:52 . 2013-09-25 23:52 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-09-25 23:52 . 2013-09-25 23:52 -------- d-----w- c:\users\Kim\AppData\Local\Apple
2013-09-25 23:52 . 2013-09-25 23:52 -------- d-----w- c:\programdata\Apple
2013-09-25 23:52 . 2013-09-25 23:52 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-09-25 22:29 . 2013-09-25 23:18 -------- d-----w- C:\Fraps
2013-09-14 03:55 . 2013-09-20 11:55 3723656 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-09-12 10:50 . 2013-08-05 02:25 155584 ----a-w- c:\windows\system32\drivers\ataport.sys
2013-09-12 10:48 . 2013-07-26 02:24 14172672 ----a-w- c:\windows\system32\shell32.dll
2013-09-12 10:48 . 2013-07-26 02:24 197120 ----a-w- c:\windows\system32\shdocvw.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-20 11:55 . 2012-04-10 17:32 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-20 11:55 . 2011-08-23 08:20 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-19 02:35 . 2011-08-31 23:32 79143768 ----a-w- c:\windows\system32\MRT.exe
2013-08-20 11:02 . 2013-08-20 11:02 204568 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
2013-08-20 11:02 . 2013-08-20 11:02 103576 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2013-08-14 18:00 . 2013-08-15 22:19 127488 ----a-w- c:\windows\system32\ff_vfw.dll
2013-08-14 18:00 . 2013-08-15 22:19 112640 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2013-08-02 17:29 . 2013-08-15 22:19 256088 ----a-w- c:\windows\system32\unrar64.dll
2013-08-02 17:29 . 2013-08-15 22:19 217176 ----a-w- c:\windows\SysWow64\unrar.dll
2013-07-25 09:25 . 2013-08-14 23:22 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-14 23:22 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-24 19:48 . 2013-07-24 19:49 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-24 19:48 . 2012-06-03 22:55 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-07-24 19:48 . 2011-08-23 08:28 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-07-19 01:58 . 2013-08-14 23:22 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-14 23:22 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-07-09 06:03 . 2013-08-14 23:22 5550528 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-07-09 05:54 . 2013-08-14 23:22 1732032 ----a-w- c:\windows\system32\ntdll.dll
2013-07-09 05:53 . 2013-08-14 23:22 243712 ----a-w- c:\windows\system32\wow64.dll
2013-07-09 05:52 . 2013-08-14 23:23 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-14 23:22 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-14 23:23 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-14 23:23 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-14 23:23 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-07-09 05:03 . 2013-08-14 23:22 3913664 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-07-09 05:03 . 2013-08-14 23:22 3968960 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-07-09 04:53 . 2013-08-14 23:22 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-07-09 04:52 . 2013-08-14 23:22 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-14 23:22 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-07-09 04:52 . 2013-08-14 23:23 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-14 23:23 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-14 23:23 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-14 23:23 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-07-09 04:45 . 2013-08-14 23:22 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-09 02:49 . 2013-08-14 23:22 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-07-09 02:49 . 2013-08-14 23:22 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-07-09 02:49 . 2013-08-14 23:22 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-07-09 02:49 . 2013-08-14 23:22 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-07-06 06:03 . 2013-08-14 23:22 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2013-07-13 08:43 1724616 ----a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2013-07-13 08:43 1724616 ----a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2013-07-13 08:43 1724616 ----a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Facebook Update"="c:\users\Kim\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-10-13 138096]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" [2009-05-05 241789]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-09-03 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
.
c:\users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Facebook Messenger.lnk - c:\users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe [2013-3-7 248240]
MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2012-12-2 576000]
Verizon Wireless Software Utility Application for Android – Samsung.lnk - c:\users\Kim\AppData\Roaming\Verizon\UA_ar\UA.exe [2013-8-8 877936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [x]
R3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Te.Service;Te.Service;c:\program files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe;c:\program files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys;c:\windows\SYSNATIVE\DRIVERS\stdcfltn.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130924.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130924.001\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20131001.002\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20131001.002\IDSvia64.sys [x]
S1 nm3;Microsoft Network Monitor 3 Driver;c:\windows\system32\DRIVERS\nm3.sys;c:\windows\SYSNATIVE\DRIVERS\nm3.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1404000.028\SYMNETS.SYS [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys;c:\windows\SYSNATIVE\DRIVERS\Accelern.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 qicflt;upper Device Filter Driver;c:\windows\system32\DRIVERS\qicflt.sys;c:\windows\SYSNATIVE\DRIVERS\qicflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-21 02:47 1177552 ----a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.76\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-10-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 11:55]
.
2013-10-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1384195220-919546521-2461916029-1001Core.job
- c:\users\Kim\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-13 02:23]
.
2013-10-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1384195220-919546521-2461916029-1001UA.job
- c:\users\Kim\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-13 02:23]
.
2013-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-24 00:15]
.
2013-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-24 00:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2013-07-13 08:37 2328776 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2013-07-13 08:37 2328776 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2013-07-13 08:37 2328776 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTMasterOnOffMonitor"="CTMWatch.dll StartCTMasterOnOffWatch" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-12 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-12 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-12 418840]
"FreeFallProtection"="c:\program files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe" [2010-12-17 686704]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-12-17 1933584]
"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 17920]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-08-30 7284328]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-08-16 2277480]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2012-11-29 57928]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-05-16 1012000]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
FF - ProfilePath - c:\users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=714647&p=
FF - ExtSQL: 2013-09-25 09:51; {ce7e73df-6a44-4028-8079-5927a588c948}; c:\users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\pb6397wh.default\extensions\{ce7e73df-6a44-4028-8079-5927a588c948}.xpi
.
- - - - ORPHANS REMOVED - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-10-02 10:41:11
ComboFix-quarantined-files.txt 2013-10-02 14:41
.
Pre-Run: 264,153,231,360 bytes free
Post-Run: 266,173,779,968 bytes free
.
- - End Of File - - F44A702D0D57A6C9504C2B1951608F49
Robybel,
I can't view emails in windows live mail now. When I click on them, the preview pane is blank. When I open an email, it is blank.
Hi kimmisc :)
I suggest that you repair your Mail by following these:
Press Windows + R, type AppWiz.cpl, click OK.
Select Windows Live Essentials, click Uninstall/Change-or-Remove.
Click Repair all Windows Essentials Programs.
After that, reconfigure your account to refresh the connection of the account and the email client. Follow the steps here (http://windows.microsoft.com/en-US/windows-live/mail-add-email-account-faq) on how to remove and re-add again the account.
Let me know if work it now
Email is working now. Thanks :)
Hi kimmisc
Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <-- very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
Next
ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan
Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.
Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan (http://www.eset.com/online-scanner-popup/)
Click the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetOnline.png button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
Click on http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
Double click on the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstallDesktopIcon.png icon on your desktop.
Check http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetAcceptTerms.png
Click the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetStart.png button.
Accept any security warnings from your browser.
Check http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetScanArchives.png
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetListThreats.png
Push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetExport.png, and save the file to your desktop using a unique name, such as MyEsetScan. Alternatively, look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt. Include the contents of this report in your next reply.
Push the Back button.
Select Uninstall application on close check box and push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetFinish.png
On your next reply please post :
MBAM log
ESET Report
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
ECET found no threats and produced no log.
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.10.04.06
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
Kim :: KIM7 [administrator]
10/4/2013 7:37:55 AM
mbam-log-2013-10-04 (07-37-55).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 249948
Time elapsed: 4 minute(s), 51 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
Just wanted to let you know some more details I noticed today. The browser windows/tabs are facebook links to pages with odd addresses, and it happens everytime Facebook Messenger launches.
Hi kimmisc
Thanks for letting me know :)
Reset browsers
Mozilla Firefox
■ Go to "Start / Run"
■ Enter the following command:firefox -safe-mode
■ In the open window (upon launching safe mode), select "Reset preferences to default Firefox"
■ Click "Make Changes and Restart"
■ You can now browse properly on Firefox.
Internet Explorer
■ Start Internet Explorer.
■ On the Tools menu, click Internet Options.
■ On the Advanced tab, click Reset under Reset Internet Explorer settings.
■ Check Delete personal settings
■ In the Reset Internet Explorer Settings dialog box, click Reset to confirm.
Google Chrome
■ Exit Google Chrome completely.
■ Enter the keyboard shortcut Windows key + E to open Windows Explorer.
■ In the Windows Explorer window that appears enter the following in the address bar : %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\
Locate the folder called "Default" in the directory window that opens and rename it as "Backup default."
Try opening Google Chrome again. A new "Default" folder is automatically created as you start using the browser.
Next
Re-Run OTL
Open OTL again and click the Quick Scan button
Post the OTL.txt log it produces in your next reply.
OTL logfile created on: 10/6/2013 4:28:08 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kim\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16686)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.90 Gb Total Physical Memory | 2.22 Gb Available Physical Memory | 56.95% Memory free
7.79 Gb Paging File | 5.69 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 446.13 Gb Total Space | 224.68 Gb Free Space | 50.36% Space Free | Partition Type: NTFS
Computer Name: KIM7 | User Name: Kim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Kim\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Users\Kim\AppData\Roaming\Verizon\UA_ar\UA.exe (SAMSUNG Electornics Co., Ltd.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
PRC - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
PRC - C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\ShareDLL\CADI\NotiMan.exe (Creative Technology Ltd.)
========== Modules (No Company Name) ==========
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\wincfi39.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\coprocmanager\detoured.dll ()
MOD - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
MOD - c:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\SQLite352.dll ()
MOD - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
MOD - C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll ()
========== Services (SafeList) ==========
SRV:[b]64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (EvtEng) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (AERTFilters) -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (LMIMaint) -- C:\Program Files (x86)\LogMeIn\x64\ramaint.exe (LogMeIn, Inc.)
SRV - (LMIGuardianSvc) -- C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV - (NIS) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe (Symantec Corporation)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (LogMeIn) -- C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (LogMeIn, Inc.)
SRV - (Te.Service) -- C:\Program Files (x86)\Windows Kits\8.0\Testing\Runtimes\TAEF\Wex.Services.exe (Microsoft Corporation)
SRV - (fussvc) -- C:\Program Files (x86)\Windows Kits\8.0\App Certification Kit\fussvc.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Sound Blaster X-Fi MB Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe (Creative Labs)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (RoxWatch12) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe (Sonic Solutions)
SRV - (RoxMediaDB12OEM) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe (Sonic Solutions)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
========== Driver Services (SafeList) ==========
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (nvkflt) -- C:\Windows\SysNative\drivers\nvkflt.sys (NVIDIA Corporation)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (LMIRfsClientNP) -- C:\Windows\SysNative\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symds64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymNetS) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symnets.sys (Symantec Corporation)
DRV:64bit: - (ccSet_NIS) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\ironx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\drivers\NISx64\1404000.028\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (LMIRfsDriver) -- C:\Windows\SysNative\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV:64bit: - (lmimirr) -- C:\Windows\SysNative\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (nm3) -- C:\Windows\SysNative\drivers\nm3.sys (Microsoft Corporation)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (mcdbus) -- C:\Windows\SysNative\drivers\mcdbus.sys (MagicISO, Inc.)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (BHDrvx64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130924.001\BHDrvx64.sys (Symantec Corporation)
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20131005.007\ex64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20131005.007\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20131004.001\IDSviA64.sys (Symantec Corporation)
DRV - (LMIInfo) -- C:\Program Files (x86)\LogMeIn\x64\rainfo.sys (LogMeIn, Inc.)
DRV - (VSPerfDrv110) -- C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\x64\VSPerfDrv110.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (mcdbus) -- C:\Windows\SysWOW64\drivers\mcdbus.sys (MagicISO, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7DKUS
IE:64bit: - HKLM\..\SearchScopes\{901D1FF8-BB7D-4E5F-96AB-8AF326BA403F}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{901D1FF8-BB7D-4E5F-96AB-8AF326BA403F}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Kim\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ [2013/10/05 14:36:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ [2012/10/13 14:37:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/09/25 19:53:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/09/25 19:53:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/09/25 19:53:55 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/09/25 19:53:54 | 000,000,000 | ---D | M]
[2011/08/30 21:59:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kim\AppData\Roaming\Mozilla\Extensions
[2013/10/06 04:26:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kim\AppData\Roaming\Mozilla\Firefox\Profiles\sykyuyed.default-1381047520594\extensions
[2013/09/17 12:13:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/09/25 03:08:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/09/17 12:13:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/09/25 03:08:29 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/09/17 12:13:22 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011/04/14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2013/06/13 20:45:42 | 000,034,048 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll
[2013/06/26 16:48:10 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - Extension: Google Docs = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\
CHR - Extension: Google Docs = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: YouTube = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Norton Identity Protection = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.3.4_0\
CHR - Extension: Chrome In-App Payments service = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\
CHR - Extension: Gmail = C:\Users\Kim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2013/10/02 10:27:33 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Microsoft Web Test Recorder 10.0 Helper) - {876d9f09-c6d6-4324-a2cc-04dd9a4de12f} - C:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [CTMasterOnOffMonitor] C:\Windows\SysNative\CTMWatch.dll (Creative Technology Ltd)
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [LogMeIn GUI] C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O4:64bit: - HKLM..\Run: [Nvtmru] C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [Facebook Update] C:\Users\Kim\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Kim\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O4 - Startup: C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Verizon Wireless Software Utility Application for Android – Samsung.lnk = C:\Users\Kim\AppData\Roaming\Verizon\UA_ar\UA.exe (SAMSUNG Electornics Co., Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8F71F97F-0E7D-4954-BCB4-1B14771609AE}: DhcpNameServer = 209.18.47.61 209.18.47.62
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013/10/06 04:18:47 | 000,000,000 | ---D | C] -- C:\Users\Kim\Desktop\Old Firefox Data
[2013/10/05 16:10:13 | 000,309,368 | ---- | C] (SummerSoft) -- C:\Users\Kim\Desktop\minecraftdl_166.exe
[2013/10/05 13:37:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ffmpeg For Audacity
[2013/10/05 01:58:59 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\{AE299015-4570-486E-AE79-797D01F7A9D8}
[2013/10/04 14:28:36 | 002,347,384 | ---- | C] (ESET) -- C:\Users\Kim\Desktop\esetsmartinstaller_enu.exe
[2013/10/03 16:17:07 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\{30CEB0CA-AF36-4744-B61C-C80FDDC5C117}
[2013/10/02 11:00:48 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\{867842ED-9057-4E3A-B906-6897E61FC99D}
[2013/10/02 10:52:38 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2013/10/02 10:41:53 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/10/02 10:41:35 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/10/02 10:10:33 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/10/02 10:10:33 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/10/02 10:10:33 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/10/02 10:07:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/10/02 10:00:42 | 005,132,885 | R--- | C] (Swearware) -- C:\Users\Kim\Desktop\ComboFix.exe
[2013/10/02 09:36:54 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/10/02 01:15:14 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2013/10/02 01:13:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung
[2013/10/02 01:12:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Verizon
[2013/10/02 01:11:43 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Verizon2.0_Log
[2013/10/02 01:11:39 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Verizon
[2013/10/02 01:11:39 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Verizon
[2013/10/02 01:11:08 | 000,000,000 | ---D | C] -- C:\Program Files\SAMSUNG
[2013/10/02 01:10:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
[2013/10/02 01:10:12 | 000,000,000 | ---D | C] -- C:\Verizon_Android
[2013/10/02 01:10:10 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Verizon_Android
[2013/10/01 16:01:34 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\{AB0CDE77-4A5D-4B26-8615-75B3C02D616D}
[2013/09/30 17:51:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Kim\Desktop\OTL.exe
[2013/09/29 16:01:43 | 000,000,000 | ---D | C] -- C:\Users\Kim\Desktop\RK_Quarantine
[2013/09/29 15:50:12 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/09/29 15:35:53 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2013/09/29 15:26:08 | 000,000,000 | ---D | C] -- C:\Users\Kim\Desktop\pc cleaning
[2013/09/27 17:04:27 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2013/09/27 17:00:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2013/09/26 19:47:36 | 000,000,000 | ---D | C] -- C:\Sound
[2013/09/26 19:47:36 | 000,000,000 | ---D | C] -- C:\Material
[2013/09/26 19:37:16 | 000,000,000 | ---D | C] -- C:\Users\Kim\.MCReferenceSdk
[2013/09/26 19:19:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightworks
[2013/09/26 19:19:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Geevs
[2013/09/26 19:19:38 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Lightworks
[2013/09/26 19:19:07 | 000,000,000 | ---D | C] -- C:\Program Files\Lightworks
[2013/09/26 16:06:21 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013/09/26 15:29:26 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2013/09/26 15:28:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2013/09/26 15:28:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
[2013/09/26 08:22:08 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Roaming\Apple Computer
[2013/09/26 05:56:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/09/26 05:56:38 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/09/26 05:56:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/09/25 20:16:15 | 000,000,000 | ---D | C] -- C:\Users\Kim\Documents\Adobe
[2013/09/25 19:53:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2013/09/25 19:53:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013/09/25 19:53:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2013/09/25 19:52:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2013/09/25 19:52:08 | 000,000,000 | ---D | C] -- C:\Users\Kim\AppData\Local\Apple
[2013/09/25 19:52:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2013/09/25 19:52:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2013/09/25 18:29:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
[2013/09/25 18:29:39 | 000,000,000 | ---D | C] -- C:\Fraps
[2013/09/24 20:29:46 | 000,000,000 | ---D | C] -- C:\Users\Kim\Desktop\MCSkins
[2013/09/17 12:13:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/10/06 04:28:00 | 000,000,920 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1384195220-919546521-2461916029-1001UA.job
[2013/10/06 03:55:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/10/06 03:46:00 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/10/05 22:28:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1384195220-919546521-2461916029-1001Core.job
[2013/10/05 16:46:01 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/10/05 16:14:43 | 002,161,521 | ---- | M] () -- C:\Users\Kim\Desktop\mcpatcher-4.2.2.exe
[2013/10/05 16:10:13 | 000,309,368 | ---- | M] (SummerSoft) -- C:\Users\Kim\Desktop\minecraftdl_166.exe
[2013/10/05 14:40:54 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/10/05 14:40:54 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/10/05 14:37:25 | 000,782,470 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/10/05 14:37:25 | 000,662,634 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/10/05 14:37:25 | 000,122,470 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/10/05 14:32:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/10/05 14:32:08 | 3137,994,752 | -HS- | M] () -- C:\hiberfil.sys
[2013/10/04 14:28:34 | 002,347,384 | ---- | M] (ESET) -- C:\Users\Kim\Desktop\esetsmartinstaller_enu.exe
[2013/10/02 10:27:33 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013/10/02 10:00:44 | 005,132,885 | R--- | M] (Swearware) -- C:\Users\Kim\Desktop\ComboFix.exe
[2013/10/02 01:11:39 | 000,001,958 | ---- | M] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Verizon Wireless Software Utility Application for Android – Samsung.lnk
[2013/09/30 17:51:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kim\Desktop\OTL.exe
[2013/09/29 15:46:26 | 005,128,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/09/26 19:19:54 | 000,001,756 | ---- | M] () -- C:\Users\Public\Desktop\Lightworks (11.1).lnk
[2013/09/26 16:47:37 | 000,000,512 | ---- | M] () -- C:\Users\Kim\Desktop\MBR.dat
[2013/09/26 16:06:12 | 755,905,231 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/09/26 15:28:13 | 000,000,926 | ---- | M] () -- C:\Users\Kim\Desktop\NTREGOPT.lnk
[2013/09/26 15:28:13 | 000,000,907 | ---- | M] () -- C:\Users\Kim\Desktop\ERUNT.lnk
[2013/09/26 05:56:39 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/25 19:51:19 | 000,000,632 | R-S- | M] () -- C:\Users\Kim\ntuser.pol
[2013/09/25 18:29:40 | 000,000,564 | ---- | M] () -- C:\Users\Public\Desktop\Fraps.lnk
[2013/09/25 18:24:50 | 000,000,829 | ---- | M] () -- C:\Users\Kim\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2013/09/15 23:53:02 | 000,000,017 | ---- | M] () -- C:\Users\Kim\AppData\Local\resmon.resmoncfg
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/10/05 16:14:48 | 002,161,521 | ---- | C] () -- C:\Users\Kim\Desktop\mcpatcher-4.2.2.exe
[2013/10/02 10:10:33 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/10/02 10:10:33 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/10/02 10:10:33 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/10/02 10:10:33 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/10/02 10:10:33 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/10/02 01:11:39 | 000,001,958 | ---- | C] () -- C:\Users\Kim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Verizon Wireless Software Utility Application for Android – Samsung.lnk
[2013/09/27 17:06:53 | 000,001,037 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2013/09/27 17:05:43 | 000,001,209 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
[2013/09/27 17:04:35 | 000,000,999 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2013/09/27 17:04:07 | 000,001,171 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
[2013/09/27 17:02:07 | 000,001,355 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2013/09/27 17:02:01 | 000,001,521 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2013/09/26 19:19:54 | 000,001,756 | ---- | C] () -- C:\Users\Public\Desktop\Lightworks (11.1).lnk
[2013/09/26 16:47:20 | 000,000,512 | ---- | C] () -- C:\Users\Kim\Desktop\MBR.dat
[2013/09/26 16:06:12 | 755,905,231 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013/09/26 15:28:13 | 000,000,926 | ---- | C] () -- C:\Users\Kim\Desktop\NTREGOPT.lnk
[2013/09/26 15:28:13 | 000,000,907 | ---- | C] () -- C:\Users\Kim\Desktop\ERUNT.lnk
[2013/09/26 05:56:39 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/25 19:52:05 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2013/09/25 18:29:40 | 000,000,564 | ---- | C] () -- C:\Users\Public\Desktop\Fraps.lnk
[2013/09/15 23:53:02 | 000,000,017 | ---- | C] () -- C:\Users\Kim\AppData\Local\resmon.resmoncfg
[2013/08/15 18:19:26 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll
[2013/08/15 18:19:25 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2013/08/15 18:19:25 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2013/08/15 18:19:24 | 000,217,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2013/08/15 18:19:23 | 000,112,640 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2013/05/28 12:03:14 | 000,041,008 | ---- | C] () -- C:\Windows\SysWow64\RGBAcodec.dll
[2013/03/07 16:24:10 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2013/03/07 16:24:10 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2013/03/07 16:24:10 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2013/03/07 16:24:10 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012/12/01 14:36:01 | 000,000,638 | ---- | C] () -- C:\Windows\eReg.dat
[2011/08/30 20:44:32 | 000,000,632 | R-S- | C] () -- C:\Users\Kim\ntuser.pol
[2010/11/17 20:51:10 | 000,000,156 | ---- | C] () -- C:\Users\Kim\IT258_01_KimKennedy_Unit1Project.java
========== ZeroAccess Check ==========
[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/07/25 22:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/07/25 21:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2013/10/05 20:14:16 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\.minecraft
[2013/10/05 13:57:21 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Audacity
[2013/03/02 01:25:57 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011/08/30 15:12:43 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Fingertapps
[2012/05/12 02:01:10 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\FOG Downloader
[2013/07/24 17:53:14 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\FreeAudioPack
[2013/03/06 21:26:56 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\NetBeans
[2013/03/23 02:42:53 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Origin
[2012/06/03 20:21:50 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\PCDr
[2013/03/02 02:07:08 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\PDAppFlex
[2011/11/08 20:42:07 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\SecondLife
[2013/05/11 12:59:19 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Smith Micro
[2013/10/02 10:52:38 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/08/30 15:38:19 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Template
[2013/06/20 21:55:19 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\TuneUp Software
[2013/09/27 16:53:28 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\uTorrent
[2011/09/11 10:58:01 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\Windows Live Writer
[2013/05/10 23:05:18 | 000,000,000 | ---D | M] -- C:\Users\Kim\AppData\Roaming\xtranormal
========== Purity Check ==========
< End of report >
Hi,
Robybel will be away until this weekend, hope you dont mind if I take over.
OTL logs look fine, I do see some plugins for FB on Firefox. How is your system behaving now ?
Well, I uninstalled FB Messenger since that was what was triggering the spoofed FB tabs, but overall, some things seem broken. Perhaps that is the result of MalwareBytes and similar programs. For instance, my Minecraft has become unplayable with 7-15 fps in single player mode using default textures. That is very poor performance for this computer. Is it typical to have these issues after a cleanup or does it usually mean the computer isn't clean?
I picked this up by downloading and installing Quicktime from the first result (ad) that comes up when Googling "quicktime." (Such a shameful and stupid thing for me to do.) During the install, Norton blocked an attack but Norton's log showed a lot of activity that wasn't blocked, such as hundreds of firewall rule changes. Should I uninstall that Quicktime? I assumed the malware or virus came *with* it rather than in it, but I don't know.
Hi,
You had some P2P programs that you where using , there bad news. That update you did may have caused this all, some of them are fake.
Why dont you uninstall Minecraft and reinstall it and see if it makes a difference
The tools we use today are very reliable and updated quite often, I doubt after running any of the removal programs that it caused any damage
Actually when working on the problem today, a Java update fixed the MC problem.
Great :bigthumb:
Any other issues ?
Everything seems normal now. Thanks for the help :)
Thats good to hear, looks like Robybel did all the work and did a great job, you also for following all his instructions.
Click START then RUN
Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.
http://i526.photobucket.com/albums/cc345/MPKwings/CF-Uninstall.png
If you have problems with this you can drag CF to the trash, if you ever need it again in the future we can download a fresh new updated copy
Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups, any programs that where not removed you can just drag to the trash.
Malwarebytes is the free version and yours to keep and will not be removed
How did I get infected in the first place ?
Read these links and find out how to prevent getting infected again.
Tutorial for System Restore (http://www.bleepingcomputer.com/tutorials/tutorial56.html) <-- Do this first to prevent yourself from being reinfected.
WhattheTech (http://forums.whatthetech.com/index.php?showtopic=57817)
Grinler BleepingComputer (http://www.bleepingcomputer.com/forums/topic2520.html)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)
Safe Surfn
Ken
Since this issue is resolved this thread is now closed. If you need help in the future please start a new topic