Page 3 of 5 FirstFirst 12345 LastLast
Results 21 to 30 of 43

Thread: Laptop realy slow and wont load most sites AVG not running as well!!!

  1. 2013-08-16, 23:29 #21
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Lets do this first, AVG is gone, just some leftover stuff causing you problems

    You will need the 64 bit version


    Download and Run SystemLook

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    64 Bit Version

    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      :folderfind
AVG
:filefind
AVG
:regfind
AVG
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  2. 2013-08-17, 01:29 #22
    fatcodycat
    fatcodycat is offline
    Member fatcodycat's Avatar
    Join Date
    Dec 2008
    Posts
    56

    Default

    system lock log! 1st part

    "File"="avgvva.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1D58F8ED3EF8D745952788E5502E49A]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\avgvvx.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1D58F8ED3EF8D745952788E5502E49A\AA8E9FF4455D7EC4989F6BD9AAA5E189]
    "File"="avgvvx.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F23211A50A7D05C419A71F174EAFB381]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\ProgramData\AVG2013\log\avgss.cfg"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2D4F2DCECB7373458FC26FDAAAF3CA0]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files\Windows Sidebar\Shared Gadgets\AVG.Gadget\fr\localize.js"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F325D7BB7989D8F4D876651E5811E2A6]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="02:\SOFTWARE\AVG\AVG2013\SetupFlags\FF_WD2"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F37254A0CBD8F9541B80E791020606D1]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\3rd_party\licenses\boost.txt"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F4D782571CE12024B84AA31D22136EF5]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\avgchclx.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F4D782571CE12024B84AA31D22136EF5\AA8E9FF4455D7EC4989F6BD9AAA5E189]
    "File"="avgchclx.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F51AF4ADB0547454CB4949C8C335876B]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\avgntdumpx.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F51AF4ADB0547454CB4949C8C335876B\AA8E9FF4455D7EC4989F6BD9AAA5E189]
    "File"="avgntdumpx.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F57C8C66B6368A24D964E7CEA0FB76B8]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="02:\SOFTWARE\AVG\AVG2013\AvgAddons"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F5B5A5037B19F1547A2CA4DBE7807A32]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\3rd_party\licenses\curl.txt"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F5D2DBB4F91C46543BC47161133ACA85]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files\Windows Sidebar\Shared Gadgets\AVG.Gadget\images\twitter-logo.png"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F630609201243F74387E1C6E15247B8A]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\personalise_us.htm"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F88CAF2FAFCC5C942BA5CF677A776A14]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\awacs\techbuddy\component\content.dat"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F90F221982E38F54C94EA836D167B4F5]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files\Windows Sidebar\Shared Gadgets\AVG.Gadget\de\localize.js"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA803F8E5B429B349A444DBFCAEDBE4B]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\Tuneup\TUDiskCleaner.dat"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FAB9DCF931C3F164DBC573B06C1F16C1]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\avgwdwsc.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FAB9DCF931C3F164DBC573B06C1F16C1\AA8E9FF4455D7EC4989F6BD9AAA5E189]
    "File"="avgwdwsc.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB7B93F636C3C3348963342CD4E0762A]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\avglngx.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB7B93F636C3C3348963342CD4E0762A\AA8E9FF4455D7EC4989F6BD9AAA5E189]
    "File"="avglngx.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FEE4EBBD3F1EBC4488E444E5AFBC41DA]
    "AA8E9FF4455D7EC4989F6BD9AAA5E189"="C:\Program Files (x86)\AVG\AVG2013\avgsecapia.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FEE4EBBD3F1EBC4488E444E5AFBC41DA\AA8E9FF4455D7EC4989F6BD9AAA5E189]
    "File"="avgsecapia.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6D331B1297950F74EBC16F6A3B4096F3\InstallProperties]
    "Publisher"="AVG Technologies"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7212A61D729B97341B35D3CE90E1E4BE\Features]
    "WIFI_Software"="-6cH%bCi-=E]LST]o(su0UWZrF@W{874uOHPF^XfF9!b3P1@0=,w}$oy5%bhzwkTec'xH9wa*]!DKPh^8^cX]4M=q?x9P,XVXlVl&}+dwJgxFA3sXJL,+QtvGQzb[ygN_=fXkY(K'4uu?*VWxUe7p8t1GZFpv+duU@M[EMVwN?IvH~j4_]Vz_APL]=(=*?Y`+o+uMN@mB?G&1KA5g@2RsWxYPy`,J!LtpF~yP9umy$z(-Pii{jlJ!'o599Wh+vG-e]hiF_'-7-q84?cZvQ^CZCRAQtE+,?w9n9A*+@7vbT~*U3O6pM{))=Tns?VxVxjLjwUCDe^)(@_cG&JeYm^FTNxAw8V0y9m$+5JQ}_?Wz74AYZPTb8Jt@}3]i+-9eeEZTEziW=wumxg1I$8TkbRY4m+y}=m'rw@%R~Z=nL&(%!WYZ=^t_TV&*uXJ]G~]e}!5P?EYP.7T3y@Ao0[0gxS4D?rylk*Mzvryg_w}Ow`qX9K0m}uI&cgfUSCNJ7lSv?CsJ3WcpM}5WcdqzIxY[@s1qbKr(oN8Jvm-x7Hj0=4QPp0M)kx0O'iKb].Py?WlRgJv62$L9)+'2b]!7?1KDQ'1^,!1{yA*JJkn==(~kJ9!Oa'5E+JpcJ(U[@J^n5?BnCS.tE3a7!3)i?Zn%gCx.Qd&KhZIb[Mjm@,KFGkhHwY3Hp4.gZ,_!?z{pQD=AdAqdq-)gs`q[=Mooy.6QtO=q%JC.c{O+@Kt2gpBPZrzZf$JF]nd5?6(TnKSI&K[K2{BT)I%%@Khb-^o~}Mke4^C@c0sz8[`@B$Bc+EbNSi5Mb,D89&cP'84XFEtPT2Z&Zl=O@UMq,S'cf!_]OZwiui(p=KD-D)R[x30(X?S
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\Features]
    "fea_Toolbar"="[@0p5xW@s@6Mnn]uFI@,ml%HRS*Ol=Y.]DAS[`KNAvgAddonsFea"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\Features]
    "AvgAddonsFea"="$%z%I3J$L9xLg!u6lImTMainFea"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\Features]
    "fea_GUI__Gadg"="}nT~r`0g99wurBqWQro&)zf&-$P_W?Nkyyx,F$3f=Xz+g+w^]?V&bg0xJF{e+TQfOCM,69G4`,uaKD)@*9)F(b&[T=+kbzRtaF%5t$jz+*&f!=x)3+x`?-R?}_ESn!13M9g(^eAuR0GTnUHcAV@n`9*ePo`tGy=$iGlo1zEAJ@txcEypF^d1uvP80McV_9?F.79N-uO2zVfvr4a{A9YFddV$f%$&RF?phei'QArk@j1Bj)yz+ZDD+?OJ`@&'C)SKNXH?Ns[{Mk@I=922q=M5BU+vN5.Vu?]Rh(MZUg(t3MzYI^%GgJP2@9QQtZ5w=D$K4NF[y'[0FATZ?_tFt$yTiw+E@.9iA=UbR+*W?QRD9}eI'os&W@gahQFtzLMZ?5lA8GO!_?76WM*~Zq^CpC[!1W3Z(=@3ll^e8plYmA{_Vx'RQ=BFI~GgWE^F@XVP7!o5n?1o1,XH45p689'ml[xX(A_rB=``wzN*~2J)dl?G09aL0i.2+QD%LlKyj$^cb9kw`lpFg+O&Vxl_hkcoJ=(Lt{1J)Gi6RY_HAsuR3@7[@Bi$GZhkzdg1PZ*3c9Xm&KSWK38b$VYsi8g2r=^SuLtcl*UpLFyC[*Ejw=HRcvN-Wg@cHx(I]gq'9AD7(MdiB3^[(+Q37!PtH9KQmZ+!z-0zojtIMR!bt9SB2RSr5[9!wvpPoS6?09xXPxo{D+g$G&B}@WJCQ@{I}yg3lY1naXw4J%NSr@A?U,h&1tRe3-ReHe`dv@zwkbE,+(II_{BJouB.ZA98,E]4(?pjET,*yD,Md8(D-4Qk(&f)`bb8rCGi{?=x3!w_sNlZUuU60DGW]?.Sp]A03B2Me(~!cH4R*9S-OHV'T`FCAvg
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\InstallProperties]
    "DisplayName"="AVG 2013"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\InstallProperties]
    "URLInfoAbout"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\InstallProperties]
    "Publisher"="AVG Technologies"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\InstallProperties]
    "InstallSource"="C:\ProgramData\AVG2013\SetupBackup\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\InstallProperties]
    "HelpLink"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AA8E9FF4455D7EC4989F6BD9AAA5E189\InstallProperties]
    "Contact"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\AD1A8EF66AC81084FBF0F0F2DE41F34F\Features]
    "SmartWare"="p0-R,P[`&@W6]_]Ayr^TfwqgPk(Sy@@XIyp4W}x]HX`K[TIi5AJO[Yj9)3cDP=-Ts0%cD@jqo~,g=V``YBwW-PF5L?U@~9o5TY1@IC&URvoPS9D!9?9jJ[8T=ZRPp5sKN?$NWn.rIH5]aW$0mbg*6?o.HlCiL~lbt$64M@iCeAX19dYeW_keqQX2d{lQG@]qEHyj@Yts3TIP1UVYC@BDGi1HF.CTt&1Z9nu`bAv`Rz*jmd&jw=?Q?*xoL?~F}i$stCQhZG'Wa$w-N=GwI)VaQ^a^&d=-5!D@v@5*~Ouf+ljY4fba'!1cI9Gi)Lnlzg8YZq.*K6s[E908^'6fHawK*q?Adk^$?=rv_sQf3?G7qfb-8ew~l9x{yaeBoest?1?Fn+R4l9-BcbA'zu4h?~YHYYXNx9nK=Xlm%qs_[e=%.XvWy8FGU[-f*-Z66@dY9wZ&X9_KyDm]X85(7YGu[=u)=9aoW?(G`Y4Jw[XB,!R$x99J)^]vBS{M(cLIh=d@+@MVW]ZK+aokVPmUlfBx_9EF@kHB)'LkY?8b,hyaCAU6sbceq=1DpzbRN^(=DARCZDDsFGfskX+DMcxnD?,w,$*X)4u3yV1Bo,H3N9JrY&^M@@~J&fU-!]DTQ@F,*b=9kBhi-E3`ocu$S9hkfSH]L^6.jyMI_URz?=H)K.+Dqm8l&b)y,hMec@639XbcccZCN!grsaK[,9]Rv[cShhLeT[!gRwQDs?*qDX!G'=I3BL=8y=uAS?,?k[O)4zvX2e_L7o7v)=9W&H9Epy@qoV&tyg}e(@c8&jd=u.FK7wi5ZH]L(9eYjEqpblVwWS`*v'Z~v=u)*UHb3?&7ooydmkfZr9,~bRUtT!G!+Ro2-Agb
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C38FB47E5AC2FE8409F15939907E9DCE\InstallProperties]
    "Contact"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C38FB47E5AC2FE8409F15939907E9DCE\InstallProperties]
    "HelpLink"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C38FB47E5AC2FE8409F15939907E9DCE\InstallProperties]
    "InstallSource"="C:\ProgramData\AVG2013\SetupBackup\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C38FB47E5AC2FE8409F15939907E9DCE\InstallProperties]
    "Publisher"="AVG Technologies"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C38FB47E5AC2FE8409F15939907E9DCE\InstallProperties]
    "URLInfoAbout"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C38FB47E5AC2FE8409F15939907E9DCE\InstallProperties]
    "DisplayName"="AVG 2013"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-for-free.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-secure.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg-download.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg.org]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\www.avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\official-avg-download-now.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\www.avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-for-free.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-secure.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg-download.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg.org]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\www.avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\official-avg-download-now.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\www.avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG Find Extension"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG Shell Extension"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG]
    "UninstallString"=""C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe" /AppMode=SETUP /Uninstall"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG]
    "ModifyPath"=""C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe" /AppMode=DOWNLOADMANAGER"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG]
    "Publisher"="AVG Technologies"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG]
    "DisplayName"="AVG 2013"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG]
    "DisplayIcon"=""C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe""
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{21B133D6-5979-47F0-BE1C-F6A6B304693F}]
    "Publisher"="AVG Technologies"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FF9E8AA-D554-4CE7-89F9-B69DAA5A1E98}]
    "DisplayName"="AVG 2013"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FF9E8AA-D554-4CE7-89F9-B69DAA5A1E98}]
    "URLInfoAbout"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FF9E8AA-D554-4CE7-89F9-B69DAA5A1E98}]
    "Publisher"="AVG Technologies"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FF9E8AA-D554-4CE7-89F9-B69DAA5A1E98}]
    "InstallSource"="C:\ProgramData\AVG2013\SetupBackup\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FF9E8AA-D554-4CE7-89F9-B69DAA5A1E98}]
    "HelpLink"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FF9E8AA-D554-4CE7-89F9-B69DAA5A1E98}]
    "Contact"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E74BF83C-2CA5-48EF-901F-959309E7D9EC}]
    "Contact"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E74BF83C-2CA5-48EF-901F-959309E7D9EC}]
    "HelpLink"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E74BF83C-2CA5-48EF-901F-959309E7D9EC}]
    "InstallSource"="C:\ProgramData\AVG2013\SetupBackup\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E74BF83C-2CA5-48EF-901F-959309E7D9EC}]
    "Publisher"="AVG Technologies"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E74BF83C-2CA5-48EF-901F-959309E7D9EC}]
    "URLInfoAbout"="http://www.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E74BF83C-2CA5-48EF-901F-959309E7D9EC}]
    "DisplayName"="AVG 2013"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync Data Maps/s
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread tha
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013]
    "InstallationResult"="@AVGMSI_Error1922"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013]
    "UISTART_SHORTCUT"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG\AVG 2013.lnk"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013]
    "AVG_ProdCode"="{4FF9E8AA-D554-4CE7-89F9-B69DAA5A1E98}"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013]
    "AvgAllUsersDir"="C:\ProgramData\AVG2013\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013]
    "AvgDir"="C:\Program Files (x86)\AVG\AVG2013\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013]
    "AvgAddons"="dummy"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013]
    "AvgMainFea"="dummy"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013\LinkScanner]
    "ControlFile"="C:\Program Files (x86)\AVG\AVG2013\cf.dat"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013\LinkScanner]
    "LocalIcons"="C:\Program Files (x86)\AVG\AVG2013\Icons\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013\LinkScanner]
    "AppPath"="C:\Program Files (x86)\AVG\AVG2013\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013\LinkScanner\Prevalence]
    "DAILYOPURL"="http://mmi.cloud.avg.com/d.aspx"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013\LinkScanner\Prevalence]
    "EVENTOPURL"="http://mmi.cloud.avg.com/e.aspx"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013\LinkScanner\Prevalence]
    "LocalPath"="C:\ProgramData\AVG2013\lsdb\prev\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013\LinkScanner\SiteBlocker]
    "BLSigFile"="C:\Program Files (x86)\AVG\AVG2013\sb.dat"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Avg\Avg2013\LinkScanner\SploitChecker]
    "SigFile"="C:\Program Files (x86)\AVG\AVG2013\sc.dat"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\AVG Secure Search]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
    "DllName"="avgssie.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\avgui_RASAPI32]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\avgui_RASMANCS]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-for-free.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-secure.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg-download.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg.org]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\www.avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\official-avg-download-now.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\www.avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-for-free.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-secure.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg-download.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg.org]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\www.avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\official-avg-download-now.com]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\www.avg]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "AVG_UI"=""C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG Find Extension"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG Shell Extension"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL]
    "Help1"="Scan against viruses with AVG"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL]
    "Menu1"="Scan with &AVG"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL]
    @="C:\PROGRA~2\AVG\AVG2013\avgsea.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "
  3. 2013-08-17, 01:29 #23
    fatcodycat
    fatcodycat is offline
    Member fatcodycat's Avatar
    Join Date
    Dec 2008
    Posts
    56

    Default

    2nd part

    Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processo
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1152F8E0-69DB-4935-AFC3-59F8A5A86A30}]
    "LocalizedString"="@C:\Program Files (x86)\AVG\AVG2013\Tuneup\tumicroscanner.exe,-31415"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1152F8E0-69DB-4935-AFC3-59F8A5A86A30}\Elevation]
    "IconReference"="@C:\Program Files (x86)\AVG\AVG2013\Tuneup\tumicroscanner.exe,-27182"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{1152F8E0-69DB-4935-AFC3-59F8A5A86A30}\LocalServer32]
    @="C:\PROGRA~2\AVG\AVG2013\Tuneup\TUMICR~1.EXE"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{86E8C5B0-75B6-4ff2-B04F-6789CC7AE386}\Path]
    "x86"="C:\Program Files (x86)\AVG\AVG2013\avgapix.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}]
    @="AVG Shell Extension Class"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}\InprocServer32]
    @="C:\Program Files (x86)\AVG\AVG2013\avgse.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{EF0BB4CD-81FA-48AF-99B3-AB6C1F079BEC}]
    "url"="fwstats.mtrap.avg.com"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\avgsbg.DLL]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{EFFE7926-4CE7-43A9-8E93-2040AC623858}]
    @="avgsbg"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{66694099-FBD8-4A98-AB9F-F19EAB4144C0}\1.0\0\win32]
    @="C:\Program Files (x86)\AVG\AVG2013\Tuneup\tumicroscanner.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{66694099-FBD8-4A98-AB9F-F19EAB4144C0}\1.0\HELPDIR]
    @="C:\Program Files (x86)\AVG\AVG2013\Tuneup\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{A0869B2C-C907-4DCA-A72B-6D54C1E1B1A2}\1.0]
    @="avgsbg 1.0 Type Library"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{A0869B2C-C907-4DCA-A72B-6D54C1E1B1A2}\1.0\0\win32]
    @="C:\Program Files (x86)\AVG\AVG2013\avgsbga.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{A0869B2C-C907-4DCA-A72B-6D54C1E1B1A2}\1.0\HELPDIR]
    @="C:\Program Files (x86)\AVG\AVG2013"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVER]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVER\0000]
    "Service"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVER\0000]
    "DeviceDesc"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVER\0000\Control]
    "ActiveService"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSHA]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSHA\0000]
    "Service"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSHA\0000]
    "DeviceDesc"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSHA\0000\Control]
    "ActiveService"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX64\0000]
    "Service"="Avgldx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX64\0000]
    "DeviceDesc"="AVG AVI Loader Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX64\0000\Control]
    "ActiveService"="Avgldx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLOGA]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLOGA\0000]
    "Service"="Avgloga"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLOGA\0000]
    "DeviceDesc"="AVG Logging Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLOGA\0000\Control]
    "ActiveService"="Avgloga"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX64\0000]
    "Service"="Avgmfx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX64\0000]
    "DeviceDesc"="AVG Mini-Filter Resident Anti-Virus Shield"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX64\0000\Control]
    "ActiveService"="Avgmfx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX64\0000]
    "Service"="Avgrkx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX64\0000]
    "DeviceDesc"="AVG Anti-Rootkit Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX64\0000\Control]
    "ActiveService"="Avgrkx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIA]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIA\0000]
    "Service"="Avgtdia"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIA\0000]
    "DeviceDesc"="AVG TDI Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIA\0000\Control]
    "ActiveService"="Avgtdia"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg\AVG2013]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg\AVG2013]
    "DriverLogPath"="\systemroot\system32\config\systemprofile\AppData\Local\Avg2013\log"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg\AVG2013]
    "AvgAllUsersDir"="C:\ProgramData\AVG2013\"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg\AVG2013]
    "AvgDir"="C:\Program Files (x86)\AVG\AVG2013\"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent]
    "ImagePath"=""C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe""
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent]
    "DisplayName"="AVGIDSAgent"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent]
    "DependOnService"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver]
    "ImagePath"="system32\DRIVERS\avgidsdrivera.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver]
    "DisplayName"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver]
    "Description"="AVG Technologies IDS Application Activity Monitor Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver\Enum]
    "0"="Root\LEGACY_AVGIDSDRIVER\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA]
    "ImagePath"="system32\DRIVERS\avgidsha.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA]
    "DisplayName"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA\Enum]
    "0"="Root\LEGACY_AVGIDSHA\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64]
    "ImagePath"="system32\DRIVERS\avgldx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64]
    "DisplayName"="AVG AVI Loader Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64\Enum]
    "0"="Root\LEGACY_AVGLDX64\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
    "ImagePath"="system32\DRIVERS\avgloga.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
    "DisplayName"="AVG Logging Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
    "NotifyDrivers"="\Device\AvgTdi \Device\AvgAviLdr \Device\Avg7Rs \Device\AVGIDSErHr \Device\AVGIDS_Ioc2"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga\Enum]
    "0"="Root\LEGACY_AVGLOGA\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64]
    "ImagePath"="system32\DRIVERS\avgmfx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64]
    "DisplayName"="AVG Mini-Filter Resident Anti-Virus Shield"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64\Instances]
    "DefaultInstance"="Avgmf Instance"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64\Instances\Avgmf Instance]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64\Enum]
    "0"="Root\LEGACY_AVGMFX64\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgrkx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgrkx64]
    "ImagePath"="system32\DRIVERS\avgrkx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgrkx64]
    "DisplayName"="AVG Anti-Rootkit Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgrkx64\Enum]
    "0"="Root\LEGACY_AVGRKX64\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgtdia]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgtdia]
    "ImagePath"="system32\DRIVERS\avgtdia.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgtdia]
    "DisplayName"="AVG TDI Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgtdia\Enum]
    "0"="Root\LEGACY_AVGTDIA\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgwd]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgwd]
    "ImagePath"=""C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe""
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgwd]
    "DisplayName"="AVG WatchDog"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgwd]
    "Description"="AVG Watchdog Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{1C378189-1336-46FD-B4E7-E95D6A7E8C28}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{E47399C4-79F2-4A13-BE9F-C606CFAE1752}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{AF9D8C71-B1B3-4544-8F3A-44CECB75A938}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{A48F2AA3-EB2F-456A-8BDE-49E2AAD8F4E0}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{5F2D2596-0B08-41DE-8C43-A8035A5FD521}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{97FAB04F-CD21-443C-AE66-9CE79AA7411F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{D6B280B0-0F31-4F82-9FAB-063D715AEE0D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal E-mail Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{3700F159-C044-4667-B127-69CE76EFF211}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal E-mail Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{AEAFD3FB-7C25-439F-B43F-B0B787919152}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{2FCB9ECA-622D-4495-AA38-28D1CC7DCF90}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{FFB5C093-0728-4391-AE30-EDC793848ABD}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{DEE5BF99-4FCF-4DBE-88C0-42A08C93767E}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{1FECA3C9-B329-4513-B86C-6AC2256A03E6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{BF7C7594-10DE-447E-AF8B-28442D0D693D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{29FC8039-E1EB-4AE2-A91F-679FD56D128A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal Email Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{299FFD1D-731B-4231-855E-3A1F34728BE1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal Email Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVER]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVER\0000]
    "Service"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVER\0000]
    "DeviceDesc"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSHA]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSHA\0000]
    "Service"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSHA\0000]
    "DeviceDesc"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX64\0000]
    "Service"="Avgldx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX64\0000]
    "DeviceDesc"="AVG AVI Loader Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLOGA]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLOGA\0000]
    "Service"="Avgloga"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLOGA\0000]
    "DeviceDesc"="AVG Logging Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX64\0000]
    "Service"="Avgmfx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX64\0000]
    "DeviceDesc"="AVG Mini-Filter Resident Anti-Virus Shield"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX64\0000]
    "Service"="Avgrkx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX64\0000]
    "DeviceDesc"="AVG Anti-Rootkit Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIA]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIA\0000]
    "Service"="Avgtdia"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIA\0000]
    "DeviceDesc"="AVG TDI Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avg]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avg\AVG2013]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avg\AVG2013]
    "DriverLogPath"="\systemroot\system32\config\systemprofile\AppData\Local\Avg2013\log"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avg\AVG2013]
    "AvgAllUsersDir"="C:\ProgramData\AVG2013\"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avg\AVG2013]
    "AvgDir"="C:\Program Files (x86)\AVG\AVG2013\"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSAgent]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSAgent]
    "ImagePath"=""C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe""
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSAgent]
    "DisplayName"="AVGIDSAgent"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSAgent]
    "DependOnService"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSAgent\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSDriver]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSDriver]
    "ImagePath"="system32\DRIVERS\avgidsdrivera.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSDriver]
    "DisplayName"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSDriver]
    "Description"="AVG Technologies IDS Application Activity Monitor Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSDriver\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSHA]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSHA]
    "ImagePath"="system32\DRIVERS\avgidsha.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSHA]
    "DisplayName"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSHA]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\AVGIDSHA\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgldx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgldx64]
    "ImagePath"="system32\DRIVERS\avgldx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgldx64]
    "DisplayName"="AVG AVI Loader Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgldx64]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgloga]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgloga]
    "ImagePath"="system32\DRIVERS\avgloga.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgloga]
    "DisplayName"="AVG Logging Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgloga]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgloga]
    "NotifyDrivers"="\Device\AvgTdi \Device\AvgAviLdr \Device\Avg7Rs \Device\AVGIDSErHr \Device\AVGIDS_Ioc2"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgmfx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgmfx64]
    "ImagePath"="system32\DRIVERS\avgmfx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgmfx64]
    "DisplayName"="AVG Mini-Filter Resident Anti-Virus Shield"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgmfx64]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgmfx64\Instances]
    "DefaultInstance"="Avgmf Instance"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgmfx64\Instances\Avgmf Instance]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgrkx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgrkx64]
    "ImagePath"="system32\DRIVERS\avgrkx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgrkx64]
    "DisplayName"="AVG Anti-Rootkit Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgtdia]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgtdia]
    "ImagePath"="system32\DRIVERS\avgtdia.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Avgtdia]
    "DisplayName"="AVG TDI Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\avgwd]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\avgwd]
    "ImagePath"=""C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe""
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\avgwd]
    "DisplayName"="AVG WatchDog"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\avgwd]
    "Description"="AVG Watchdog Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{1C378189-1336-46FD-B4E7-E95D6A7E8C28}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{E47399C4-79F2-4A13-BE9F-C606CFAE1752}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{AF9D8C71-B1B3-4544-8F3A-44CECB75A938}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{A48F2AA3-EB2F-456A-8BDE-49E2AAD8F4E0}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{5F2D2596-0B08-41DE-8C43-A8035A5FD521}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{97FAB04F-CD21-443C-AE66-9CE79AA7411F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{D6B280B0-0F31-4F82-9FAB-063D715AEE0D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal E-mail Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{3700F159-C044-4667-B127-69CE76EFF211}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal E-mail Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{AEAFD3FB-7C25-439F-B43F-B0B787919152}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{2FCB9ECA-622D-4495-AA38-28D1CC7DCF90}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{FFB5C093-0728-4391-AE30-EDC793848ABD}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{DEE5BF99-4FCF-4DBE-88C0-42A08C93767E}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{1FECA3C9-B329-4513-B86C-6AC2256A03E6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{BF7C7594-10DE-447E-AF8B-28442D0D693D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{29FC8039-E1EB-4AE2-A91F-679FD56D128A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal Email Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{299FFD1D-731B-4231-855E-3A1F34728BE1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal Email Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVER]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVER\0000]
    "Service"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVER\0000]
    "DeviceDesc"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVER\0000\Control]
    "ActiveService"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSHA]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSHA\0000]
    "Service"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSHA\0000]
    "DeviceDesc"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSHA\0000\Control]
    "ActiveService"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX64\0000]
    "Service"="Avgldx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX64\0000]
    "DeviceDesc"="AVG AVI Loader Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX64\0000\Control]
    "ActiveService"="Avgldx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLOGA]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLOGA\0000]
    "Service"="Avgloga"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLOGA\0000]
    "DeviceDesc"="AVG Logging Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLOGA\0000\Control]
    "ActiveService"="Avgloga"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX64\0000]
    "Service"="Avgmfx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX64\0000]
    "DeviceDesc"="AVG Mini-Filter Resident Anti-Virus Shield"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX64\0000\Control]
    "ActiveService"="Avgmfx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX64]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX64\0000]
    "Service"="Avgrkx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX64\0000]
    "DeviceDesc"="AVG Anti-Rootkit Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX64\0000\Control]
    "ActiveService"="Avgrkx64"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIA]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIA\0000]
    "Service"="Avgtdia"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIA\0000]
    "DeviceDesc"="AVG TDI Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIA\0000\Control]
    "ActiveService"="Avgtdia"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avg]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avg\AVG2013]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avg\AVG2013]
    "DriverLogPath"="\systemroot\system32\config\systemprofile\AppData\Local\Avg2013\log"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avg\AVG2013]
    "AvgAllUsersDir"="C:\ProgramData\AVG2013\"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avg\AVG2013]
    "AvgDir"="C:\Program Files (x86)\AVG\AVG2013\"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSAgent]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSAgent]
    "ImagePath"=""C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe""
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSAgent]
    "DisplayName"="AVGIDSAgent"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSAgent]
    "DependOnService"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSAgent\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSDriver]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSDriver]
    "ImagePath"="system32\DRIVERS\avgidsdrivera.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSDriver]
    "DisplayName"="AVGIDSDriver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSDriver]
    "Description"="AVG Technologies IDS Application Activity Monitor Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSDriver\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSDriver\Enum]
    "0"="Root\LEGACY_AVGIDSDRIVER\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSHA]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSHA]
    "ImagePath"="system32\DRIVERS\avgidsha.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSHA]
    "DisplayName"="AVGIDSHA"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSHA]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSHA\Parameters]
    "NamePrefix"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AVGIDSHA\Enum]
    "0"="Root\LEGACY_AVGIDSHA\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgldx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgldx64]
    "ImagePath"="system32\DRIVERS\avgldx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgldx64]
    "DisplayName"="AVG AVI Loader Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgldx64]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgldx64\Enum]
    "0"="Root\LEGACY_AVGLDX64\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgloga]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgloga]
    "ImagePath"="system32\DRIVERS\avgloga.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgloga]
    "DisplayName"="AVG Logging Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgloga]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgloga]
    "NotifyDrivers"="\Device\AvgTdi \Device\AvgAviLdr \Device\Avg7Rs \Device\AVGIDSErHr \Device\AVGIDS_Ioc2"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgloga\Enum]
    "0"="Root\LEGACY_AVGLOGA\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgmfx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgmfx64]
    "ImagePath"="system32\DRIVERS\avgmfx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgmfx64]
    "DisplayName"="AVG Mini-Filter Resident Anti-Virus Shield"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgmfx64]
    "Group"="AVG"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgmfx64\Instances]
    "DefaultInstance"="Avgmf Instance"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgmfx64\Instances\Avgmf Instance]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgmfx64\Enum]
    "0"="Root\LEGACY_AVGMFX64\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgrkx64]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgrkx64]
    "ImagePath"="system32\DRIVERS\avgrkx64.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgrkx64]
    "DisplayName"="AVG Anti-Rootkit Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgrkx64\Enum]
    "0"="Root\LEGACY_AVGRKX64\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgtdia]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgtdia]
    "ImagePath"="system32\DRIVERS\avgtdia.sys"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgtdia]
    "DisplayName"="AVG TDI Driver"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Avgtdia\Enum]
    "0"="Root\LEGACY_AVGTDIA\0000"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\avgwd]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\avgwd]
    "ImagePath"=""C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe""
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\avgwd]
    "DisplayName"="AVG WatchDog"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\avgwd]
    "Description"="AVG Watchdog Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{1C378189-1336-46FD-B4E7-E95D6A7E8C28}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{E47399C4-79F2-4A13-BE9F-C606CFAE1752}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{AF9D8C71-B1B3-4544-8F3A-44CECB75A938}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{A48F2AA3-EB2F-456A-8BDE-49E2AAD8F4E0}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{5F2D2596-0B08-41DE-8C43-A8035A5FD521}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{97FAB04F-CD21-443C-AE66-9CE79AA7411F}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{D6B280B0-0F31-4F82-9FAB-063D715AEE0D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal E-mail Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{3700F159-C044-4667-B127-69CE76EFF211}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal E-mail Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{AEAFD3FB-7C25-439F-B43F-B0B787919152}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{2FCB9ECA-622D-4495-AA38-28D1CC7DCF90}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe|Name=Online Shield|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{FFB5C093-0728-4391-AE30-EDC793848ABD}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{DEE5BF99-4FCF-4DBE-88C0-42A08C93767E}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgdiagex.exe|Name=AVG Diagnostics 2013|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{1FECA3C9-B329-4513-B86C-6AC2256A03E6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{BF7C7594-10DE-447E-AF8B-28442D0D693D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe|Name=AVG Installer|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{29FC8039-E1EB-4AE2-A91F-679FD56D128A}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal Email Scanner|"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{299FFD1D-731B-4231-855E-3A1F34728BE1}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AVG\AVG2013\avgemca.exe|Name=Personal Email Scanner|"
    [HKEY_USERS\.DEFAULT\AppEvents\EventLabels\avguiRSAlert]
    [HKEY_USERS\.DEFAULT\AppEvents\EventLabels\avguiScanFinished]
    [HKEY_USERS\.DEFAULT\AppEvents\EventLabels\avguiScanFinishedThreatFound]
    [HKEY_USERS\.DEFAULT\AppEvents\EventLabels\avguiScanStarted]
    [HKEY_USERS\.DEFAULT\AppEvents\EventLabels\avguiUpdEnd]
    [HKEY_USERS\.DEFAULT\AppEvents\EventLabels\avguiUpdEndFail]
    [HKEY_USERS\.DEFAULT\AppEvents\EventLabels\avguiUpdStart]
    [HKEY_USERS\.DEFAULT\AppEvents\EventLabels\avguiWSAlert]
    [HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\avgui]
    [HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\avgui]
    @="AVG"
    [HKEY_USERS\.DEFAULT\Software\Avg]
    [HKEY_USERS\.DEFAULT\Software\Avg\Avg2013]
    [HKEY_USERS\.DEFAULT\Software\Avg\Avg2013\Avgdiag]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\01gEorGwmHAs7jrsxdZ9dHmw]
    "Request Wednesday, November 28, 2012 17:38:20"="AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtqenofn060SsgC8/VW0djQQAAAACAAAAAAAQZgAAAAEAACAAAABXk8Bi+nerJyk1Dm5VEMeEzC1NEVtRbUNdeeHYADesuAAAAAAOgAAAAAIAACAAAAD7r9py45WAfI1BK3Fl3p0+sGbu5IGyTCQ9zU5UNg06+eALAADVoS5hrvoYii6wamVxkgDAW9cB/gkMHfNWBp4Iywbp/QIwsjQUDjSh7qUwOQh2LiCC8xAUToXldPTSq35jlMeiSQ8dY0g6hxEi5xb6T4MyB31rq9G/lRnhuEwoKsUK41OA/CGz50sHbz2UP6eU3Xwi/JgCyftd/yxjPnSEnLvj8oBRy5XL/MM9zZRUELAMErZh8lM1Iqkq8VZbvRv/aPqLhvR5s32RSyy8kwQjPvIN8VDI8rUOUNkB3/QzfSPbO/CUtdZ431gKZ5RH9qfHph1ravgpcSEqDDiov9j+6XZK1XzDzshm2r7LtDKaqcRHPnpkxggYbrgrQG405d6ZCVmc9XXtBe/sCj5UyjaWrs0srkNGTvM4+toGw+NOp5DeM35vi3rMHiYvlnpDVaRlCfwMQRXqE5quc68wobCvO03hi7+Rt8vxiKRDZgHGzRfig0oKYFSNw27CuK20BHQ9Xj3gQ8LgzVKjUUyuIcB36Cp2GME8NnNj1iows40rf6NaE6pTqTUWd+Ot5BRxHaNDInceGUKcW6Oa7JgbbYPm1VBVFxLJS7+KG9RKZ3sgAm8amjEgE5JA3aRJKDmW7u/KYFgXgJzoIwwor66LqCkDJ15KSjekiiDJ9iTIuGtMHlq1Y1ERqO+KTQkYFmFOFSx7Ly5I36dL3Y4
    [HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\01gEorGwmHAs7jrsxdZ9dHmw]
    "Response Wednesday, November 28, 2012 17:38:20"="AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtqenofn060SsgC8/VW0djQQAAAACAAAAAAAQZgAAAAEAACAAAAC/Wx2iYvTpDHsse6qvhKgasnsPY5UTw/+JGvBnNgjv+wAAAAAOgAAAAAIAACAAAADvdk2trs8XTEBVFMnUc8P2lInY2w7nicgrHQfqkbISTTAFAACw9hLMhkVbcuy7Y0V107PAvGUVs5PK6y4YFdV21KAnwo3sQ0SnyPlZqz+q4k2qtIuqFUiRqUZG0WMGakEnGEH/uih1VaSOiNVDz2VeE9ca/Q+2sguI4E01gRCe20ZqkB/Oso6qEFXrVgQYYtwbkf5hop115xpJaDb0Q09hiEvqRAdsQOYxqhS685NxG08cOa03YnLYXEKQRpDPEpyfiYRXnz0Ff7Kdv3CCkFUnhwhBCUyVrsWPRZ/CMQE+USbSYSv6S5vjH3z2tLhekRBBOG9tkAbP5rLeO/DRkzDfkZjpz64Coay95CVxzSre4Wn6ohqtwQSPaC+pO2mGplYTJzQaD3eMxUceh5ZXvBHTZ/ArQU42+fWITSQbzOiwY6C+f5EykaVVdMwc2aY0rnUOK/XZ0Nj02JeHbbQDcuTW65txf02AZQF2bSRp7Ph5XOhhJyOOmGUz+HsHGwN3optWX+eeXlzMcS8jew5jUZF5dl7H+/PSWkGJV28GeJ+1ooOl/GAV5uIs8v3NBHrz75lK1LzRa2oqaVeDhCpU2eC1IXXVgUwKNyJnT/r320MjJOo+k5xBFRK1djLu1ywxpbpIo+us8ZX2yP1czkfyZBqj2h1F47RBNmhsp173unJUj9fPGL5UXBLzQ3dE8FEhdC1LHBIrCgurZk
    [HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-4293206663-3280212633-2623293166-1000\02iorntuyqja]
    "DeviceId"="<Data><User username="02IORNTUYQJA"><Pwd Det="false">AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtqenofn060SsgC8/VW0djQQAAAACAAAAAAAQZgAAAAEAACAAAAB3l9JBw+VoIsLAiSPWwgdFVcQ6OECt09MLex+uDLsNnwAAAAAOgAAAAAIAACAAAADuZYqcAweH4JgN2QHHA8WIhFM7QL4v6+u087ajtZJozTAAAAACtU8/+tfIHpCwgztRvol68LekfS1njB5oSzSjVhXuGSOK6FDkqBgu1FtUVIDTqXhAAAAATCr9GSNQc6rIVFb63ln/WlWrviY4qHyEbdjChgeBArtvEQ/m0eOuKGHiHfR3iEzmCH6AotUL3+X8oJqtdi26QA==</Pwd><Certificate targetname="WindowsLive:(cert):name=02iorntuyqja;serviceuri=msn-messenger-didc" keyword="Microsoft_WindowsLive:certificate:" type="1">PABDAGUAcgB0AEkAbgBmAG8APgA8AEsAZQB5AHAAYQBpAHIAPgBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAVgBXAGUAQQBnAEIAcgBkAEEAVQBPAGgASQBDAHcAdwBaACsAUQA0AFcAUQBRAEEAQQBBAEEAQwBBAEEAQQBBAEEAQQBBAFEAWgBnAEEAQQBBAEEARQBBAEEAQwBBAEEAQQBBAEEARABCAFEAaAB0AGoAaABrAE4AeQBPACsAagBlADMA
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-for-free.com]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-secure.com]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg-download.com]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg.org]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\avg]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\www.avg]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\official-avg-download-now.com]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\avg]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\www.avg]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-for-free.com]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-secure.com]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg-download.com]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg.org]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\avg]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\www.avg]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\official-avg-download-now.com]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\avg]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\www.avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Adobe\Acrobat Reader\11.0\AVGeneral]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Avg\Avg2013]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Avg\Avg2013\Avgdiag]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Avg\Avg2013\Dialogs\WindowsPos\AvgUiAdvWnd]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-for-free.com]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-secure.com]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg-download.com]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg.org]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\www.avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\official-avg-download-now.com]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\www.avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-for-free.com]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-secure.com]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg-download.com]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg.org]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\www.avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\official-avg-download-now.com]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\www.avg]
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
    "C:\Program Files (x86)\AVG\AVG2013\avgui.exe"="AVG User Interface"
    [HKEY_USERS\S-1-5-21-4293206663-3280212633-2623293166-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
    "C:\Program Files (x86)\AVG\AVG2013\avgui.exe"="AVG User Interface"
    [HKEY_USERS\S-1-5-18\AppEvents\EventLabels\avguiRSAlert]
    [HKEY_USERS\S-1-5-18\AppEvents\EventLabels\avguiScanFinished]
    [HKEY_USERS\S-1-5-18\AppEvents\EventLabels\avguiScanFinishedThreatFound]
    [HKEY_USERS\S-1-5-18\AppEvents\EventLabels\avguiScanStarted]
    [HKEY_USERS\S-1-5-18\AppEvents\EventLabels\avguiUpdEnd]
    [HKEY_USERS\S-1-5-18\AppEvents\EventLabels\avguiUpdEndFail]
    [HKEY_USERS\S-1-5-18\AppEvents\EventLabels\avguiUpdStart]
    [HKEY_USERS\S-1-5-18\AppEvents\EventLabels\avguiWSAlert]
    [HKEY_USERS\S-1-5-18\AppEvents\Schemes\Apps\avgui]
    [HKEY_USERS\S-1-5-18\AppEvents\Schemes\Apps\avgui]
    @="AVG"
    [HKEY_USERS\S-1-5-18\Software\Avg]
    [HKEY_USERS\S-1-5-18\Software\Avg\Avg2013]
    [HKEY_USERS\S-1-5-18\Software\Avg\Avg2013\Avgdiag]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\01gEorGwmHAs7jrsxdZ9dHmw]
    "Request Wednesday, November 28, 2012 17:38:20"="AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtqenofn060SsgC8/VW0djQQAAAACAAAAAAAQZgAAAAEAACAAAABXk8Bi+nerJyk1Dm5VEMeEzC1NEVtRbUNdeeHYADesuAAAAAAOgAAAAAIAACAAAAD7r9py45WAfI1BK3Fl3p0+sGbu5IGyTCQ9zU5UNg06+eALAADVoS5hrvoYii6wamVxkgDAW9cB/gkMHfNWBp4Iywbp/QIwsjQUDjSh7qUwOQh2LiCC8xAUToXldPTSq35jlMeiSQ8dY0g6hxEi5xb6T4MyB31rq9G/lRnhuEwoKsUK41OA/CGz50sHbz2UP6eU3Xwi/JgCyftd/yxjPnSEnLvj8oBRy5XL/MM9zZRUELAMErZh8lM1Iqkq8VZbvRv/aPqLhvR5s32RSyy8kwQjPvIN8VDI8rUOUNkB3/QzfSPbO/CUtdZ431gKZ5RH9qfHph1ravgpcSEqDDiov9j+6XZK1XzDzshm2r7LtDKaqcRHPnpkxggYbrgrQG405d6ZCVmc9XXtBe/sCj5UyjaWrs0srkNGTvM4+toGw+NOp5DeM35vi3rMHiYvlnpDVaRlCfwMQRXqE5quc68wobCvO03hi7+Rt8vxiKRDZgHGzRfig0oKYFSNw27CuK20BHQ9Xj3gQ8LgzVKjUUyuIcB36Cp2GME8NnNj1iows40rf6NaE6pTqTUWd+Ot5BRxHaNDInceGUKcW6Oa7JgbbYPm1VBVFxLJS7+KG9RKZ3sgAm8amjEgE5JA3aRJKDmW7u/KYFgXgJzoIwwor66LqCkDJ15KSjekiiDJ9iTIuGtMHlq1Y1ERqO+KTQkYFmFOFSx7Ly5I36dL3Y4
    [HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\01gEorGwmHAs7jrsxdZ9dHmw]
    "Response Wednesday, November 28, 2012 17:38:20"="AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtqenofn060SsgC8/VW0djQQAAAACAAAAAAAQZgAAAAEAACAAAAC/Wx2iYvTpDHsse6qvhKgasnsPY5UTw/+JGvBnNgjv+wAAAAAOgAAAAAIAACAAAADvdk2trs8XTEBVFMnUc8P2lInY2w7nicgrHQfqkbISTTAFAACw9hLMhkVbcuy7Y0V107PAvGUVs5PK6y4YFdV21KAnwo3sQ0SnyPlZqz+q4k2qtIuqFUiRqUZG0WMGakEnGEH/uih1VaSOiNVDz2VeE9ca/Q+2sguI4E01gRCe20ZqkB/Oso6qEFXrVgQYYtwbkf5hop115xpJaDb0Q09hiEvqRAdsQOYxqhS685NxG08cOa03YnLYXEKQRpDPEpyfiYRXnz0Ff7Kdv3CCkFUnhwhBCUyVrsWPRZ/CMQE+USbSYSv6S5vjH3z2tLhekRBBOG9tkAbP5rLeO/DRkzDfkZjpz64Coay95CVxzSre4Wn6ohqtwQSPaC+pO2mGplYTJzQaD3eMxUceh5ZXvBHTZ/ArQU42+fWITSQbzOiwY6C+f5EykaVVdMwc2aY0rnUOK/XZ0Nj02JeHbbQDcuTW65txf02AZQF2bSRp7Ph5XOhhJyOOmGUz+HsHGwN3optWX+eeXlzMcS8jew5jUZF5dl7H+/PSWkGJV28GeJ+1ooOl/GAV5uIs8v3NBHrz75lK1LzRa2oqaVeDhCpU2eC1IXXVgUwKNyJnT/r320MjJOo+k5xBFRK1djLu1ywxpbpIo+us8ZX2yP1czkfyZBqj2h1F47RBNmhsp173unJUj9fPGL5UXBLzQ3dE8FEhdC1LHBIrCgurZk
    [HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-4293206663-3280212633-2623293166-1000\02iorntuyqja]
    "DeviceId"="<Data><User username="02IORNTUYQJA"><Pwd Det="false">AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAtqenofn060SsgC8/VW0djQQAAAACAAAAAAAQZgAAAAEAACAAAAB3l9JBw+VoIsLAiSPWwgdFVcQ6OECt09MLex+uDLsNnwAAAAAOgAAAAAIAACAAAADuZYqcAweH4JgN2QHHA8WIhFM7QL4v6+u087ajtZJozTAAAAACtU8/+tfIHpCwgztRvol68LekfS1njB5oSzSjVhXuGSOK6FDkqBgu1FtUVIDTqXhAAAAATCr9GSNQc6rIVFb63ln/WlWrviY4qHyEbdjChgeBArtvEQ/m0eOuKGHiHfR3iEzmCH6AotUL3+X8oJqtdi26QA==</Pwd><Certificate targetname="WindowsLive:(cert):name=02iorntuyqja;serviceuri=msn-messenger-didc" keyword="Microsoft_WindowsLive:certificate:" type="1">PABDAGUAcgB0AEkAbgBmAG8APgA8AEsAZQB5AHAAYQBpAHIAPgBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAVgBXAGUAQQBnAEIAcgBkAEEAVQBPAGgASQBDAHcAdwBaACsAUQA0AFcAUQBRAEEAQQBBAEEAQwBBAEEAQQBBAEEAQQBBAFEAWgBnAEEAQQBBAEEARQBBAEEAQwBBAEEAQQBBAEEARABCAFEAaAB0AGoAaABrAE4AeQBPACsAagBlADMA
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-for-free.com]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\avg-secure.com]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg-download.com]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free-avg.org]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\avg]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grab-it-today.net\www.avg]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\official-avg-download-now.com]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\avg]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\softwarecenterz.com\www.avg]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-for-free.com]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\avg-secure.com]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg-download.com]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\free-avg.org]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\avg]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grab-it-today.net\www.avg]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\official-avg-download-now.com]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\avg]
    [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\softwarecenterz.com\www.avg]

    -= EOF =-
  4. 2013-08-17, 02:04 #24
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Lets try this first

    Backup the Registry:

    Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

    • Please download the installer for Registry Backup from here or here and save to your desktop.
    • Right-click on tweaking.com_registry_backup_setup.exe and select Run as Administrator >> Follow the prompts for a default installation
    • Ensure the option Open "Tweaking.com - Registry Backup" When Install Completes is selected >> Next > >> Finish
    • Once the GUI(graphical user interface) has appeared/loaded:-



    • Click on Backup Now >> once the process is complete the below will be displayed in the GUI:-



    • Close Tweaking.com - Registry Backup

    Note: There will now be a folder at the root of the Hard-Drive named C:\RegBackup, do not delete this as it is the actual backup just created.

    A tutorial for Registry Backup explaining the various features be viewed here.






    REGEDIT4

    [-HKEY_LOCAL_MACHINE\Software\AVG]
    [-HKEY_CURRENT_USER\Software\AVG]
    Copy the entire contents inside the Quote box and Paste it into Notepad ( this will only work with Notepad ) name the file Regfix.reg and in the drop down box, save it as All Files. Save it to your desktop. Then Rightclick on the Regfix.reg file and click on Merge, when it asks you to merge with the Registry, say yes.

    If you saved the file correctly it should look like this


    Then run SystemLook again with just this script

    :regfind
    AVG
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  5. 2013-08-17, 02:23 #25
    fatcodycat
    fatcodycat is offline
    Member fatcodycat's Avatar
    Join Date
    Dec 2008
    Posts
    56

    Default

    hello

    Done all that

    System look log below

    SystemLook 30.07.11 by jpshortstuff
    Log created at 01:22 on 17/08/2013 by steves
    Administrator - Elevation successful

    ========== regfind ==========

    Searching for " AVG"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avgdi\shell\AvgDxOpenVerb]
    @="Open AVG diag file"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avgdx\shell\AvgDxOpenVerb]
    @="Open AVG diag file"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL]
    "Help1"="Scan against viruses with AVG"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync Data Maps/s
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread tha
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL]
    "Help1"="Scan against viruses with AVG"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processo

    -= EOF =-
  6. 2013-08-17, 03:31 #26
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    REGEDIT4

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avgdi]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avgdx]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL]
    Copy the entire contents inside the Quote box and Paste it into Notepad ( this will only work with Notepad ) name the file Regfix.reg and in the drop down box, save it as All Files. Save it to your desktop. Then Rightclick on the Regfix.reg file and click on Merge, when it asks you to merge with the Registry, say yes.

    If you saved the file correctly it should look like this

    Run SystemLook again with the same script
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  7. 2013-08-17, 11:46 #27
    fatcodycat
    fatcodycat is offline
    Member fatcodycat's Avatar
    Join Date
    Dec 2008
    Posts
    56

    Default

    Done, system look log below

    SystemLook 30.07.11 by jpshortstuff
    Log created at 10:45 on 17/08/2013 by steves
    Administrator - Elevation successful

    ========== regfind ==========

    Searching for " AVG"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync Data Maps/s
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread tha
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps/sec 90 Sync
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Counter"="1 1847 2 System 4 Memory 6 % Processor Time 10 File Read Operations/sec 12 File Write Operations/sec 14 File Control Operations/sec 16 File Read Bytes/sec 18 File Write Bytes/sec 20 File Control Bytes/sec 24 Available Bytes 26 Committed Bytes 28 Page Faults/sec 30 Commit Limit 32 Write Copies/sec 34 Transition Faults/sec 36 Cache Faults/sec 38 Demand Zero Faults/sec 40 Pages/sec 42 Page Reads/sec 44 Processor Queue Length 46 Thread State 48 Pages Output/sec 50 Page Writes/sec 52 Browser 54 Announcements Server/sec 56 Pool Paged Bytes 58 Pool Nonpaged Bytes 60 Pool Paged Allocs 64 Pool Nonpaged Allocs 66 Pool Paged Resident Bytes 68 System Code Total Bytes 70 System Code Resident Bytes 72 System Driver Total Bytes 74 System Driver Resident Bytes 76 System Cache Resident Bytes 78 Announcements Domain/sec 80 Election Packets/sec 82 Mailslot Writes/sec 84 Server List Requests/sec 86 Cache 88 Data Maps
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\CurrentLanguage]
    "Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processo

    -= EOF =-
  8. 2013-08-17, 12:20 #28
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hi,

    I think those registry entries are harmless but I want to get another opinion . The AVG files and folders appear to be gone so you should be ok.

    In the meantime run a new scan with OTL and let me take another look for any AVG leftovers and we can deal with removing Combofix also.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  9. 2013-08-17, 14:53 #29
    fatcodycat
    fatcodycat is offline
    Member fatcodycat's Avatar
    Join Date
    Dec 2008
    Posts
    56

    Default

    OTL log below!

    OTL logfile created on: 17/08/2013 13:29:17 - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\steves\Downloads
    64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
    Internet Explorer (Version = 9.10.9200.16660)
    Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

    3.93 Gb Total Physical Memory | 1.66 Gb Available Physical Memory | 42.18% Memory free
    7.87 Gb Paging File | 5.07 Gb Available in Paging File | 64.43% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 698.54 Gb Total Space | 113.59 Gb Free Space | 16.26% Space Free | Partition Type: NTFS
    Drive E: | 7.39 Gb Total Space | 6.64 Gb Free Space | 89.79% Space Free | Partition Type: FAT32

    Computer Name: STEVES-PC | User Name: steves | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Users\steves\Downloads\OTL.exe (OldTimer Tools)
    PRC - C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE (Microsoft Corporation)
    PRC - C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
    PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
    PRC - C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe (Google Inc.)
    PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
    PRC - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
    PRC - C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
    PRC - C:\Users\steves\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
    PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
    PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
    PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
    PRC - C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe ()
    PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
    PRC - C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe (Nero AG)
    PRC - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe ()
    PRC - C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe (Western Digital )
    PRC - C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe (Western Digital )
    PRC - C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe (Western Digital Technologies, Inc.)
    PRC - C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe (Western Digital)
    PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
    PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
    PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
    PRC - C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe (ArcSoft, Inc.)
    PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
    PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
    PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
    PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


    ========== Modules (No Company Name) ==========

    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0149e914e4cfbde7da65d4558af19ce0\IAStorUtil.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\8dc1c182cd1f10cd2abcfecd01fe9eeb\System.Web.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e06dbdafb38c38517aef61ac41e2fd9d\System.Runtime.Remoting.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\28ea347a952d20959ac6ae02d7457d39\System.Windows.Forms.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1f6f220f9efe936d1158c79b9d4b451f\WindowsBase.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\8f7d83126a3cf283e5ac97f2d6d99f12\System.Configuration.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll ()
    MOD - C:\Program Files\Microsoft Office 15\root\office15\1033\GrooveIntlResource.dll ()
    MOD - C:\Program Files\Microsoft Office 15\root\office15\c2r32.dll ()
    MOD - C:\Program Files (x86)\Steam\bin\chromehtml.dll ()
    MOD - C:\Program Files (x86)\Steam\bin\libcef.dll ()
    MOD - C:\Program Files\Microsoft Office 15\root\office15\appvisvstream32.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
    MOD - C:\Program Files (x86)\Steam\SDL2.dll ()
    MOD - C:\Program Files (x86)\Steam\bin\avcodec-53.dll ()
    MOD - C:\Program Files (x86)\Steam\bin\avformat-53.dll ()
    MOD - C:\Program Files (x86)\Steam\bin\avutil-51.dll ()
    MOD - C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe ()
    MOD - C:\Windows\SysWOW64\msjetoledb40.dll ()
    MOD - C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\AbilisWinUsb.dll ()
    MOD - C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\VendorCmdRW.dll ()
    MOD - C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\uPiApi.dll ()


    ========== Services (SafeList) ==========

    SRV:64bit: - (NisSrv) -- c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
    SRV:64bit: - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
    SRV:64bit: - (OfficeSvc) -- C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe (Microsoft Corporation)
    SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
    SRV:64bit: - (EvtEng) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
    SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
    SRV:64bit: - (RegSrvc) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
    SRV:64bit: - (AERTFilters) -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
    SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
    SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
    SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
    SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
    SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
    SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
    SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
    SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
    SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
    SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
    SRV - (HTCMonitorService) -- C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe (Nero AG)
    SRV - (PassThru Service) -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe ()
    SRV - (WDRulesService) -- C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe (Western Digital )
    SRV - (WDBackup) -- C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe (Western Digital )
    SRV - (WDDriveService) -- C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe (Western Digital)
    SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
    SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
    SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
    SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
    SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - (Avgloga) -- C:\Windows\SysNative\drivers\avgloga.sys (AVG Technologies CZ, s.r.o.)
    DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys (AVG Technologies CZ, s.r.o.)
    DRV:64bit: - (AVGIDSHA) -- C:\Windows\SysNative\drivers\avgidsha.sys (AVG Technologies CZ, s.r.o.)
    DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
    DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
    DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
    DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
    DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
    DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
    DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
    DRV:64bit: - (htcnprot) -- C:\Windows\SysNative\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider)
    DRV:64bit: - (WDC_SAM) -- C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies)
    DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
    DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
    DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
    DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
    DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
    DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
    DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
    DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
    DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
    DRV:64bit: - (IT9135BDA) -- C:\Windows\SysNative\drivers\IT9135BDA.sys (ITE )
    DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
    DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
    DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
    DRV:64bit: - (NETw5s64) -- C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
    DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
    DRV:64bit: - (HTCAND64) -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys (HTC, Corporation)
    DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
    DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
    DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
    DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
    DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
    DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
    DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
    DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
    DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\..\SearchScopes,DefaultScope = {70903C48-6C44-4F6E-AAD9-9BC8BB1D4FAD}
    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\..\SearchScopes\{70903C48-6C44-4F6E-AAD9-9BC8BB1D4FAD}: "URL" = http://uk.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>


    ========== FireFox ==========

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
    FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Users\steves\AppData\Local\Roblox\Versions\version-7cb7ff22d9334da0\\NPRobloxProxy.dll ()



    O1 HOSTS File: ([2013/08/15 22:14:31 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
    O1 - Hosts: 127.0.0.1 localhost
    O1 - Hosts: ::1 localhost
    O2:64bit: - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
    O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
    O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
    O2:64bit: - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
    O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
    O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL (Microsoft Corporation)
    O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
    O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
    O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation)
    O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
    O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
    O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
    O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
    O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
    O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
    O4 - HKLM..\Run: [WD Quick View] C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe (Western Digital Technologies, Inc.)
    O4 - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000..\Run: [Akamai NetSession Interface] C:\Users\steves\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
    O4 - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000..\Run: [IomegaEncryption] C:\Program Files\Iomega\Iomega Encryption\Iomega Encryption.exe (PLX Technology)
    O4 - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O4 - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
    O4 - Startup: C:\Users\steven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk = File not found
    O4 - Startup: C:\Users\steves\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 [2013/05/16 22:24:08 | 000,000,000 | ---D | M]
    O9:64bit: - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
    O9:64bit: - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
    O9:64bit: - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
    O9:64bit: - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
    O9:64bit: - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
    O9:64bit: - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
    O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
    O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
    O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O1364bit: - gopher Prefix: missing
    O13 - gopher Prefix: missing
    O15 - HKU\S-1-5-21-4293206663-3280212633-2623293166-1000\..Trusted Domains: dell.com ([]* in Trusted sites)
    O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/ge...sh/swflash.cab (Shockwave Flash Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5087DAA1-1A4D-4468-8C96-F797F176D1D6}: DhcpNameServer = 192.168.1.254
    O18:64bit: - Protocol\Handler\livecall - No CLSID value found
    O18:64bit: - Protocol\Handler\msnim - No CLSID value found
    O18:64bit: - Protocol\Handler\osf - No CLSID value found
    O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
    O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
    O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
    O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll File not found
    O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
    O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O32 - HKLM CDRom: AutoRun - 1
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/08/17 01:15:50 | 000,000,000 | ---D | C] -- C:\RegBackup
    [2013/08/17 01:14:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
    [2013/08/17 01:14:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tweaking.com
    [2013/08/16 22:04:48 | 000,000,000 | ---D | C] -- C:\Users\steves\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
    [2013/08/16 22:04:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
    [2013/08/16 19:05:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
    [2013/08/16 19:05:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
    [2013/08/16 19:04:52 | 000,867,240 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
    [2013/08/16 19:04:52 | 000,789,416 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
    [2013/08/16 19:04:52 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
    [2013/08/16 19:04:43 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
    [2013/08/16 19:04:43 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
    [2013/08/16 19:04:43 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    [2013/08/16 19:04:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
    [2013/08/16 19:03:54 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
    [2013/08/16 09:52:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
    [2013/08/16 09:52:52 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
    [2013/08/15 07:17:13 | 000,000,000 | ---D | C] -- C:\Users\steves\AppData\Roaming\Malwarebytes
    [2013/08/15 07:16:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2013/08/15 07:16:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2013/08/15 07:16:52 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
    [2013/08/15 07:16:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    [2013/08/15 07:04:43 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
    [2013/08/14 20:59:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
    [2013/08/14 20:59:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT
    [2013/08/14 11:59:52 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
    [2013/08/14 11:59:52 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
    [2013/08/14 11:59:51 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
    [2013/08/14 11:59:51 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
    [2013/08/14 11:59:51 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
    [2013/08/14 11:59:51 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
    [2013/08/14 11:59:51 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
    [2013/08/14 11:59:51 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
    [2013/08/14 11:59:51 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
    [2013/08/14 11:59:51 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
    [2013/08/14 11:59:51 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
    [2013/08/14 11:59:50 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
    [2013/08/14 11:59:49 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
    [2013/08/14 11:59:49 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
    [2013/08/14 11:59:49 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
    [2013/08/14 11:38:09 | 001,472,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
    [2013/08/14 11:38:09 | 000,224,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
    [2013/08/14 11:38:07 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
    [2013/08/14 11:37:41 | 001,888,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL
    [2013/08/14 11:37:41 | 001,620,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL
    [2013/08/14 11:37:41 | 001,217,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll
    [2013/08/14 11:37:40 | 003,913,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
    [2013/08/14 11:37:39 | 003,968,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
    [2013/08/14 11:37:38 | 005,550,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
    [2013/08/14 11:37:38 | 001,732,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
    [2013/08/14 11:37:37 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
    [2013/08/14 11:37:37 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
    [2013/08/14 11:37:36 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
    [2013/08/14 11:37:35 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
    [2013/08/14 11:37:35 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
    [2013/08/14 11:37:34 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
    [2013/08/12 14:28:48 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2013/08/12 13:42:42 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
    [2013/08/12 13:42:39 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
    [2013/08/12 07:52:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
    [2013/08/11 20:37:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
    [2013/08/10 14:11:09 | 000,000,000 | ---D | C] -- C:\Users\steves\Desktop\Kindle books
    [2013/08/07 20:19:40 | 000,000,000 | ---D | C] -- C:\Users\steves\Documents\ArmA 2 OA Demo
    [2013/08/07 20:19:40 | 000,000,000 | ---D | C] -- C:\Users\steves\AppData\Local\ArmA 2 OA DEMO
    [2013/08/06 18:40:15 | 000,000,000 | ---D | C] -- C:\Users\steves\Desktop\MORGAGE
    [2013/08/03 20:57:58 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT
    [2013/07/31 12:02:59 | 000,000,000 | ---D | C] -- C:\Users\steves\Desktop\config
    [2013/07/21 19:15:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    [2013/07/20 01:51:00 | 000,311,608 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgloga.sys
    [2013/07/20 01:50:56 | 000,246,072 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys
    [2013/07/20 01:50:56 | 000,071,480 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgidsha.sys
    [2013/07/20 01:50:50 | 000,206,648 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

    ========== Files - Modified Within 30 Days ==========

    [2013/08/17 13:29:04 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2013/08/17 13:29:04 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2013/08/17 13:16:43 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2013/08/17 13:15:12 | 3168,043,008 | -HS- | M] () -- C:\hiberfil.sys
    [2013/08/17 13:15:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2013/08/17 12:53:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
    [2013/08/17 12:45:28 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2013/08/17 11:43:42 | 000,001,354 | ---- | M] () -- C:\Users\steves\Desktop\ROBLOX Player.lnk
    [2013/08/17 11:43:42 | 000,001,173 | ---- | M] () -- C:\Users\steves\Desktop\ROBLOX Studio 2013.lnk
    [2013/08/17 01:16:58 | 000,000,207 | ---- | M] () -- C:\Windows\tweaking.com-regbackup-STEVES-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
    [2013/08/17 01:14:55 | 000,002,239 | ---- | M] () -- C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
    [2013/08/16 22:04:48 | 000,001,268 | ---- | M] () -- C:\Users\steves\Desktop\Revo Uninstaller.lnk
    [2013/08/16 19:04:32 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    [2013/08/16 19:04:26 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
    [2013/08/16 19:04:26 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
    [2013/08/16 19:04:25 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
    [2013/08/16 19:04:23 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
    [2013/08/16 19:04:23 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
    [2013/08/16 09:53:28 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
    [2013/08/15 22:14:31 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
    [2013/08/15 07:16:59 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/08/14 20:59:44 | 000,001,108 | ---- | M] () -- C:\Users\steves\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2013/08/14 11:56:33 | 000,741,242 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
    [2013/08/14 11:56:33 | 000,620,524 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
    [2013/08/14 11:56:33 | 000,110,712 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
    [2013/08/11 12:46:10 | 000,217,600 | ---- | M] () -- C:\Users\steves\Desktop\jacob-1.17-M2-x64.dll
    [2013/08/11 12:46:10 | 000,176,128 | ---- | M] () -- C:\Users\steves\Desktop\jacob-1.17-M2-x86.dll
    [2013/08/07 19:08:40 | 000,000,221 | ---- | M] () -- C:\Users\steves\Desktop\Arma 2 Operation Arrowhead Demo.url
    [2013/07/30 17:53:52 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
    [2013/07/27 16:04:47 | 000,000,000 | ---- | M] () -- C:\search.sqlite
    [2013/07/26 06:13:58 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
    [2013/07/26 06:12:27 | 000,603,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
    [2013/07/26 06:12:08 | 003,958,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
    [2013/07/26 06:12:08 | 000,855,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
    [2013/07/26 06:12:04 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
    [2013/07/26 06:12:04 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
    [2013/07/26 06:12:03 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
    [2013/07/26 06:12:03 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
    [2013/07/26 04:12:04 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
    [2013/07/26 04:12:00 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
    [2013/07/26 04:12:00 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
    [2013/07/26 04:12:00 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
    [2013/07/26 04:11:59 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
    [2013/07/26 03:39:38 | 000,089,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
    [2013/07/26 02:59:38 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
    [2013/07/25 10:25:54 | 001,888,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL
    [2013/07/25 09:57:27 | 001,620,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL
    [2013/07/21 19:15:27 | 000,002,212 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
    [2013/07/21 16:18:51 | 000,512,825 | ---- | M] () -- C:\Users\steves\Desktop\FTB_Launcher.exe
    [2013/07/21 09:52:03 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
    [2013/07/21 09:52:03 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    [2013/07/20 01:51:00 | 000,311,608 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgloga.sys
    [2013/07/20 01:50:56 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys
    [2013/07/20 01:50:56 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgidsha.sys
    [2013/07/20 01:50:50 | 000,206,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys

    ========== Files Created - No Company Name ==========

    [2013/08/17 01:16:58 | 000,000,207 | ---- | C] () -- C:\Windows\tweaking.com-regbackup-STEVES-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
    [2013/08/17 01:14:55 | 000,002,239 | ---- | C] () -- C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
    [2013/08/16 22:04:48 | 000,001,268 | ---- | C] () -- C:\Users\steves\Desktop\Revo Uninstaller.lnk
    [2013/08/16 09:53:28 | 000,001,945 | ---- | C] () -- C:\Windows\epplauncher.mif
    [2013/08/16 09:53:08 | 000,002,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
    [2013/08/15 07:16:59 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2013/08/14 20:59:44 | 000,001,108 | ---- | C] () -- C:\Users\steves\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2013/08/07 19:08:39 | 000,000,221 | ---- | C] () -- C:\Users\steves\Desktop\Arma 2 Operation Arrowhead Demo.url
    [2013/07/31 12:04:06 | 000,217,600 | ---- | C] () -- C:\Users\steves\Desktop\jacob-1.17-M2-x64.dll
    [2013/07/31 12:04:06 | 000,176,128 | ---- | C] () -- C:\Users\steves\Desktop\jacob-1.17-M2-x86.dll
    [2013/07/30 17:53:52 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
    [2013/07/27 16:04:47 | 000,000,000 | ---- | C] () -- C:\search.sqlite
    [2013/07/21 19:15:27 | 000,002,212 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
    [2013/02/04 19:31:57 | 000,281,288 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
    [2013/02/04 19:31:56 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe

    ========== ZeroAccess Check ==========

    [2009/07/14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
    "" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    "" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

    ========== LOP Check ==========

    [2012/12/09 19:12:04 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software
    [2012/12/09 19:12:04 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software
    [2012/11/25 12:57:38 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\.minecraft
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\AVG2012
    [2012/11/25 12:57:39 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\Azureus
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\CompuClever
    [2012/11/25 12:57:43 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\FreeAudioPack
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\HTC
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\ImgBurn
    [2012/11/25 12:57:43 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\InfraRecorder
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\iScreensaver
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\NCH Swift Sound
    [2012/06/20 19:49:25 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\Outlook
    [2012/11/25 12:57:44 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\SoftGrid Client
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\ssmci
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\Temp
    [2011/03/08 21:51:13 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\TP
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\wargaming.net
    [2012/11/25 12:28:45 | 000,000,000 | ---D | M] -- C:\Users\steven\AppData\Roaming\Windows Live Writer
    [2013/08/11 12:40:07 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\.minecraft
    [2012/11/25 17:59:54 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\AVG2013
    [2013/08/10 22:45:20 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\Azureus
    [2013/02/03 18:00:52 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\Firefly Studios
    [2013/07/21 16:18:52 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\ftblauncher
    [2013/04/05 15:21:05 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\HTC
    [2013/04/05 15:20:49 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\HTC Sync
    [2012/11/25 17:59:16 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\TuneUp Software
    [2013/06/28 19:57:58 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\uTorrent
    [2013/05/28 19:05:40 | 000,000,000 | ---D | M] -- C:\Users\steves\AppData\Roaming\Wargaming.net

    ========== Purity Check ==========



    < End of report >
  10. 2013-08-17, 19:47 #30
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Be back in a few hours, I will be offline until this evening, hang in my friend
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules