Loki713

December 5, 2012

Once again, thank you for your help and your security advisement.

December 4, 2012

Hey there,

I just finished both of the updates you asked me to do and my computer seems to be running Malware clean. I'd like to thank you for your continued help over the past couple of days because I couldn't of fixed it without you.

Thank you very much,

Loki713

December 4, 2012

Hey there, I just ran the next batch of programs you requested and have attached the logs.

AdwCleanerS1.txt

ESETSCAN.txt

JRT.txt

mbam-log-2012-12-04 (11-01-06).txt

December 3, 2012

Here is the next set of logs, first from FRST64 then ComboFix:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-12-2012

Ran by SYSTEM at 2012-12-03 14:44:58 Run:1

Running from F:\Malware

==============================================

HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.

HKEY_USERS\Loki\Software\Microsoft\Windows\CurrentVersion\Run\\XrbBrutt Value deleted successfully.

HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit Value was restored successfully .

C:\Users\Loki\Start Menu\Programs\Startup\xrbbrutt.exe moved successfully.

C:\Users\Loki\AppData\Local\pljohukd\xrbbrutt.exe moved successfully.

C:\Users\Loki\AppData\Local\ngfuqibh.log moved successfully.

C:\Users\Loki\AppData\Local\lnoxejwe.log moved successfully.

C:\Users\Loki\AppData\Local\ruxksrxf.log moved successfully.

C:\Users\Loki\AppData\Local\blkaebve.log moved successfully.

C:\Users\Loki\AppData\Local\yxnwktlq.log moved successfully.

C:\Users\Loki\AppData\Local\aoukgqsn.log moved successfully.

C:\Users\Loki\AppData\Local\ehirmmci.log moved successfully.

C:\Users\Loki\AppData\Local\wmapvqjd.log moved successfully.

C:\Users\Loki\AppData\Local\tfdkgdhj.log moved successfully.

C:\Users\Loki\AppData\Local\pljohukd moved successfully.

C:\Users\All Users\myvriisr.log moved successfully.

C:\Users\Loki\AppData\Local\uxqvytuk.log moved successfully.

C:\Users\Loki\AppData\Local\bdcgwwec.log moved successfully.

==== End of Fixlog ====

ComboFix 12-12-02.01 - Loki 03/12/2012 14:54:55.2.4 - x64

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.61.1033.18.16367.13914 [GMT 11:00]

Running from: c:\users\Loki\Desktop\ComboFix.exe

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Loki\AppData\Local\Temp\_MEI25282\_ctypes.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\_elementtree.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\_hashlib.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\_socket.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\_ssl.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\pyexpat.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\pysqlite2._sqlite.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\python26.dll

c:\users\Loki\AppData\Local\Temp\_MEI25282\pythoncom26.dll

c:\users\Loki\AppData\Local\Temp\_MEI25282\PyWinTypes26.dll

c:\users\Loki\AppData\Local\Temp\_MEI25282\select.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\unicodedata.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32api.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32com.shell.shell.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32crypt.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32event.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32file.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32inet.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32pdh.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32process.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32profile.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32security.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\win32ts.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\windows._cacheinvalidation.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\wx._controls_.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\wx._core_.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\wx._gdi_.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\wx._html2.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\wx._misc_.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\wx._windows_.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\wx._wizard.pyd

c:\users\Loki\AppData\Local\Temp\_MEI25282\wxbase293u_net_vc.dll

c:\users\Loki\AppData\Local\Temp\_MEI25282\wxbase293u_vc.dll

c:\users\Loki\AppData\Local\Temp\_MEI25282\wxmsw293u_adv_vc.dll

c:\users\Loki\AppData\Local\Temp\_MEI25282\wxmsw293u_core_vc.dll

c:\users\Loki\AppData\Local\Temp\_MEI25282\wxmsw293u_html_vc.dll

c:\users\Loki\AppData\Local\Temp\_MEI25282\wxmsw293u_webview_vc.dll

.

((((((((((((((((((((((((( Files Created from 2012-11-03 to 2012-12-03 )))))))))))))))))))))))))))))))

.

2012-12-03 22:10 . 2012-12-03 22:10 -------- d-----w- C:\FRST

2012-12-03 04:07 . 2012-12-03 04:07 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-12-02 11:25 . 2012-12-02 11:25 -------- d-----w- c:\users\Loki\AppData\Roaming\SUPERAntiSpyware.com

2012-12-02 11:25 . 2012-12-02 11:26 -------- d-----w- c:\program files\SUPERAntiSpyware

2012-12-02 11:25 . 2012-12-02 11:25 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2012-12-02 11:13 . 2012-12-02 22:05 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2012-12-02 11:13 . 2012-12-02 20:52 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy

2012-12-02 10:59 . 2012-12-02 10:59 -------- d-----w- c:\users\Loki\AppData\Roaming\Malwarebytes

2012-12-02 10:59 . 2012-12-02 20:52 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-12-02 10:59 . 2012-12-02 10:59 -------- d-----w- c:\programdata\Malwarebytes

2012-12-02 10:59 . 2012-09-29 08:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-11-30 23:32 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D9F745B-26D4-443B-9CDA-AC59B53D4297}\mpengine.dll

2012-11-30 05:59 . 2012-11-30 05:59 -------- d-----w- c:\users\Default\AppData\Local\Google

2012-11-29 09:35 . 2012-11-29 20:42 -------- d-----w- c:\users\Loki\AppData\Roaming\GetRightToGo

2012-11-27 07:36 . 2012-11-27 07:36 -------- d-----w- c:\programdata\ATI

2012-11-27 07:35 . 2012-11-27 07:35 -------- d-----w- c:\program files (x86)\AMD AVT

2012-11-27 07:35 . 2012-11-27 07:35 -------- d-----w- c:\program files (x86)\AMD APP

2012-11-27 07:35 . 2012-11-27 07:35 -------- d-----w- c:\program files\Common Files\ATI Technologies

2012-11-27 07:35 . 2012-11-27 07:35 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies

2012-11-27 07:32 . 2012-11-27 07:32 -------- d-----w- c:\program files\ATI

2012-11-27 07:31 . 2012-11-27 07:31 -------- d-----w- C:\AMD

2012-11-27 05:38 . 2012-11-27 05:38 -------- d-----w- c:\users\Loki\AppData\Roaming\ASUS

2012-11-27 05:29 . 2011-03-10 07:44 2725376 ----a-w- c:\windows\system32\drivers\cmudaxp.sys

2012-11-27 05:29 . 2007-04-19 07:12 32768 ----a-w- c:\windows\system32\cmudaxp.dll

2012-11-27 05:29 . 2004-04-14 03:28 315392 ----a-w- c:\windows\SysWow64\CmiFltr.dll

2012-11-27 05:29 . 2004-04-14 03:28 315392 ----a-w- c:\windows\system\CmiFltr.dll

2012-11-27 05:28 . 2006-10-05 21:45 524768 ----a-r- c:\windows\difxapi.dll

2012-11-26 05:38 . 2012-11-26 05:38 -------- d-----w- c:\users\Loki\AppData\Roaming\Warner Bros. Interactive Entertainment

2012-11-26 05:31 . 2012-11-26 05:36 -------- d-----w- c:\program files (x86)\LEGO Lord Of The Rings

2012-11-24 08:36 . 2012-11-24 08:36 -------- d-----w- c:\users\Loki\AppData\Local\Sony Online Entertainment

2012-11-22 22:03 . 2012-11-22 22:03 -------- d-----w- c:\program files (x86)\Eidos

2012-11-22 22:01 . 2012-11-22 22:01 -------- d-----w- c:\program files (x86)\WB Games

2012-11-21 21:28 . 2012-11-21 21:28 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll

2012-11-21 21:18 . 2004-10-21 15:18 749568 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll

2012-11-21 21:18 . 2004-10-21 15:17 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll

2012-11-21 21:18 . 2004-10-21 15:17 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll

2012-11-21 21:18 . 2004-10-21 15:16 180224 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll

2012-11-21 21:18 . 2004-10-21 15:16 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe

2012-11-21 21:18 . 2012-11-21 21:18 323716 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll

2012-11-21 21:18 . 2012-11-21 21:18 192644 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll

2012-11-21 08:56 . 2012-11-21 09:03 -------- d-----w- c:\users\Loki\.ps_inception

2012-11-21 08:53 . 2012-11-21 08:53 -------- d-----w- c:\windows\.mpr_file_store_32

2012-11-21 08:53 . 2012-11-21 08:53 -------- d-----w- c:\users\Loki\.moparscape4

2012-11-20 01:20 . 2012-11-20 01:20 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi

2012-11-19 20:09 . 2012-11-19 20:09 -------- d-----w- c:\users\Loki\AppData\Roaming\Assassin's Creed III

2012-11-19 19:58 . 2012-11-19 20:38 -------- d-----w- c:\program files (x86)\Assassin's Creed III

2012-11-14 11:24 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2012-11-14 11:24 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

2012-11-14 11:24 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

2012-11-14 11:24 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

2012-11-14 11:16 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

2012-11-14 11:16 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

2012-11-14 11:16 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

2012-11-14 11:16 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

2012-11-14 11:16 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

2012-11-14 11:16 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

2012-11-14 11:16 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

2012-11-14 05:25 . 2012-10-18 18:18 3147264 ----a-w- c:\windows\system32\win32k.sys

2012-11-14 05:21 . 2012-09-25 22:39 95744 ----a-w- c:\windows\system32\synceng.dll

2012-11-14 05:21 . 2012-09-25 21:55 78336 ----a-w- c:\windows\SysWow64\synceng.dll

2012-11-12 09:44 . 2012-11-12 09:44 -------- d-----w- c:\users\Loki\AppData\Local\Torch

2012-11-09 07:58 . 2012-11-09 07:58 -------- d-----w- c:\program files (x86)\RAR Password Recovery Magic

2012-11-04 08:26 . 2012-11-04 08:26 -------- d-----w- c:\program files (x86)\EA Games

2012-11-04 03:59 . 2012-11-04 03:59 -------- d-----w- c:\users\Loki\AppData\Local\SCE

2012-11-04 03:59 . 2012-11-04 03:59 -------- d-----w- C:\Crash

2012-11-04 03:59 . 2012-11-04 03:59 -------- d-----w- c:\users\Public\Sony Online Entertainment

2012-11-03 09:14 . 2012-11-03 09:14 -------- d-----w- c:\users\Loki\AppData\Roaming\Autodesk

2012-11-03 09:08 . 2012-11-03 09:11 -------- d-----w- c:\programdata\FLEXnet

2012-11-03 09:08 . 2012-11-03 09:08 -------- d-----w- c:\users\Loki\AppData\Local\Autodesk

2012-11-03 09:04 . 2012-11-03 09:04 -------- d-----w- c:\program files\Common Files\Macrovision Shared

2012-11-03 09:03 . 2012-11-03 09:04 -------- d-----w- c:\program files (x86)\Common Files\Autodesk Shared

2012-11-03 09:03 . 2012-11-03 09:04 -------- d-----w- c:\program files\Common Files\Autodesk Shared

2012-11-03 09:01 . 2012-11-03 09:14 -------- d-----w- c:\programdata\Autodesk

2012-11-03 09:01 . 2012-11-03 09:05 -------- d-----w- c:\program files\Autodesk

2012-11-03 09:01 . 2012-11-03 09:01 -------- d-----w- c:\program files (x86)\Autodesk

2012-11-03 09:01 . 2008-07-11 21:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll

2012-11-03 09:01 . 2008-07-11 21:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll

2012-11-03 09:01 . 2008-07-11 21:18 540688 ----a-w- c:\windows\system32\d3dx10_39.dll

2012-11-03 09:01 . 2008-07-11 21:18 1942552 ----a-w- c:\windows\system32\D3DCompiler_39.dll

2012-11-03 09:01 . 2008-07-11 21:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll

2012-11-03 09:01 . 2008-07-11 21:18 4992520 ----a-w- c:\windows\system32\D3DX9_39.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-02 01:17 . 2012-02-03 05:47 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

2012-12-02 01:17 . 2012-02-03 05:47 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

2012-12-01 07:42 . 2012-02-03 05:47 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

2012-11-29 20:30 . 2012-02-03 05:47 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe

2012-11-14 11:18 . 2012-01-07 09:38 66395536 ----a-w- c:\windows\system32\MRT.exe

2012-11-09 06:04 . 2012-09-04 06:09 30568 ----a-w- c:\windows\system32\drivers\avgtpx64.sys

2012-10-30 22:51 . 2011-12-25 11:25 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2012-10-30 22:51 . 2011-12-25 11:26 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys

2012-10-30 22:51 . 2011-12-25 11:25 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-10-30 22:51 . 2011-12-25 11:25 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2012-10-30 22:51 . 2011-12-25 11:26 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2012-10-30 22:51 . 2011-12-25 11:24 41224 ----a-w- c:\windows\avastSS.scr

2012-10-30 22:50 . 2011-12-25 11:24 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe

2012-10-30 22:50 . 2011-12-25 11:25 285328 ----a-w- c:\windows\system32\aswBoot.exe

2012-10-29 02:19 . 2012-10-29 02:19 148480 ----a-w- c:\windows\SysWow64\rztouchdll.dll

2012-10-29 02:18 . 2012-10-29 02:18 617472 ----a-w- c:\windows\SysWow64\rzdevicedll.dll

2012-10-29 02:18 . 2012-10-29 02:18 165888 ----a-w- c:\windows\SysWow64\rzaudiodll.dll

2012-10-25 02:18 . 2012-10-25 02:18 22016 ----a-w- c:\windows\system32\drivers\rzendpt.sys

2012-10-25 02:18 . 2012-10-25 02:18 113664 ----a-w- c:\windows\system32\drivers\rzudd.sys

2012-10-16 21:20 . 2012-11-28 05:23 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 21:20 . 2012-11-28 05:23 347648 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 20:34 . 2012-11-28 05:23 559104 ----a-w- c:\windows\apppatch\AcLayers.dll

2012-10-15 15:59 . 2012-02-25 09:43 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

2012-09-28 04:37 . 2012-09-28 04:37 221696 ----a-w- c:\windows\system32\clinfo.exe

2012-09-28 04:36 . 2012-09-28 04:36 75776 ----a-w- c:\windows\system32\OpenVideo64.dll

2012-09-28 04:36 . 2012-09-28 04:36 65536 ----a-w- c:\windows\SysWow64\OpenVideo.dll

2012-09-28 04:36 . 2012-09-28 04:36 63488 ----a-w- c:\windows\system32\OVDecode64.dll

2012-09-28 04:36 . 2012-09-28 04:36 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll

2012-09-28 04:36 . 2012-09-28 04:36 32635904 ----a-w- c:\windows\system32\amdocl64.dll

2012-09-28 04:32 . 2012-09-28 04:32 27341824 ----a-w- c:\windows\SysWow64\amdocl.dll

2012-09-28 02:23 . 2012-09-28 02:23 5557928 ----a-w- c:\windows\SysWow64\atiumdag.dll

2012-09-28 02:21 . 2012-09-28 02:21 10697216 ----a-w- c:\windows\system32\drivers\atikmdag.sys

2012-09-28 02:05 . 2012-09-28 02:05 70144 ----a-w- c:\windows\system32\coinst_9.002.dll

2012-09-28 02:03 . 2012-09-28 02:03 163840 ----a-w- c:\windows\system32\atiapfxx.exe

2012-09-28 02:02 . 2012-09-28 02:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll

2012-09-28 02:02 . 2012-09-28 02:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll

2012-09-28 02:02 . 2012-09-28 02:02 44544 ----a-w- c:\windows\system32\aticalcl64.dll

2012-09-28 02:02 . 2012-09-28 02:02 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll

2012-09-28 02:02 . 2012-09-28 02:02 16082432 ----a-w- c:\windows\system32\aticaldd64.dll

2012-09-28 01:59 . 2012-09-28 01:59 23825920 ----a-w- c:\windows\system32\atio6axx.dll

2012-09-28 01:57 . 2012-09-28 01:57 13703168 ----a-w- c:\windows\SysWow64\aticaldd.dll

2012-09-28 01:43 . 2012-09-28 01:43 935424 ----a-w- c:\windows\SysWow64\aticfx32.dll

2012-09-28 01:41 . 2011-10-26 02:04 1120768 ----a-w- c:\windows\system32\aticfx64.dll

2012-09-28 01:41 . 2012-09-28 01:41 19624960 ----a-w- c:\windows\SysWow64\atioglxx.dll

2012-09-28 01:39 . 2012-09-28 01:39 6536192 ----a-w- c:\windows\SysWow64\atidxx32.dll

2012-09-28 01:39 . 2012-09-28 01:39 442368 ----a-w- c:\windows\system32\atidemgy.dll

2012-09-28 01:39 . 2012-09-28 01:39 538112 ----a-w- c:\windows\system32\atieclxx.exe

2012-09-28 01:38 . 2012-09-28 01:38 239616 ----a-w- c:\windows\system32\atiesrxx.exe

2012-09-28 01:36 . 2012-09-28 01:36 120320 ----a-w- c:\windows\system32\atitmm64.dll

2012-09-28 01:36 . 2012-09-28 01:36 21504 ----a-w- c:\windows\system32\atimuixx.dll

2012-09-28 01:36 . 2012-09-28 01:36 59392 ----a-w- c:\windows\system32\atiedu64.dll

2012-09-28 01:36 . 2012-09-28 01:36 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll

2012-09-28 01:31 . 2012-09-28 01:31 3127296 ----a-w- c:\windows\system32\atiumd6a.dll

2012-09-28 01:25 . 2012-09-28 01:25 6704640 ----a-w- c:\windows\system32\atiumd64.dll

2012-09-28 01:22 . 2011-10-26 01:46 7167488 ----a-w- c:\windows\system32\atidxx64.dll

2012-09-28 01:22 . 2012-09-28 01:22 2691584 ----a-w- c:\windows\SysWow64\atiumdva.dll

2012-09-28 01:13 . 2012-09-28 01:13 595456 ----a-w- c:\windows\system32\atiadlxx.dll

2012-09-28 01:13 . 2012-09-28 01:13 405504 ----a-w- c:\windows\SysWow64\atiadlxy.dll

2012-09-28 01:13 . 2012-09-28 01:13 17920 ----a-w- c:\windows\system32\atig6pxx.dll

2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll

2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\system32\atiglpxx.dll

2012-09-28 01:13 . 2012-09-28 01:13 41984 ----a-w- c:\windows\system32\atig6txx.dll

2012-09-28 01:13 . 2012-09-28 01:13 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll

2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\atimpc64.dll

2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\amdpcom64.dll

2012-09-28 01:12 . 2012-09-28 01:12 460288 ----a-w- c:\windows\system32\drivers\atikmpag.sys

2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll

2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll

2012-09-28 01:11 . 2012-09-28 01:11 129536 ----a-w- c:\windows\system32\atiuxp64.dll

2012-09-28 01:11 . 2012-09-28 01:11 109568 ----a-w- c:\windows\SysWow64\atiuxpag.dll

2012-09-28 01:11 . 2012-09-28 01:11 103424 ----a-w- c:\windows\system32\atiu9p64.dll

2012-09-28 01:10 . 2012-09-28 01:10 82944 ----a-w- c:\windows\SysWow64\atiu9pag.dll

2012-09-28 01:09 . 2012-09-28 01:09 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

2012-09-14 19:23 . 2012-10-10 03:17 2048 ----a-w- c:\windows\system32\tzres.dll

2012-09-14 18:30 . 2012-10-10 03:17 2048 ----a-w- c:\windows\SysWow64\tzres.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2012-01-09 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7600.16385] .. c:\windows\system32\user32.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\prxtbVuz0.dll" [2011-05-09 176936]

"{7473b6bd-4691-4744-a82b-7854eb3d70b6}"= "c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

.

[HKEY_CLASSES_ROOT\clsid\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]

2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-11-09 06:04 1796552 ----a-w- c:\program files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\Vuze_Remote\prxtbVuz0.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files (x86)\Vuze_Remote\prxtbVuz0.dll" [2011-05-09 176936]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll" [2012-11-09 1796552]

"{7473b6bd-4691-4744-a82b-7854eb3d70b6}"= "c:\program files (x86)\uTorrentControl_v2\prxtbuTor.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_CLASSES_ROOT\clsid\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]

@="{C5994560-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]

@="{C5994561-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]

@="{C5994562-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]

@="{C5994563-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]

@="{C5994564-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]

@="{C5994565-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]

@="{C5994566-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]

@="{C5994567-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]

@="{C5994568-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]

2011-06-12 23:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files (x86)\Steam\steam.exe" [2012-11-30 1354736]

"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]

"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2012-11-08 16070136]

"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-12-02 5629312]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"XFastUsb"="c:\program files (x86)\XFastUsb\XFastUsb.exe" [2011-12-25 4942336]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-07 336384]

"Diamondback"="c:\program files (x86)\Razer\Diamondback 3G\razerhid.exe" [2010-04-28 228352]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]

"SPIRunE"="SPIRunE.dll" [2009-03-05 18432]

"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520]

"BigDogPath"="c:\windows\VM301Snap.exe" [2007-03-27 49152]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-11 1523360]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760]

"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2010-10-25 821144]

"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-11-09 997320]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2012-11-15 336304]

"ROC_ROC_JULY_P1"="c:\program files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" [2012-09-04 1022048]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-11-19 2254768]

.

c:\users\Loki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2012-1-9 107720]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"UacDisableNotify"=dword:00000001

"ANTIVIRUSDISABLENOTIFY"=dword:00000001

"FIREWALLDISABLENOTIFY"=dword:00000001

"UPDATESDISABLENOTIFY"=dword:00000001

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-07-12 8704]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-14 160944]

R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-12-25 79360]

R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-12-25 79360]

R3 DCamUSBVM;Lenovo Q350 USB PC Camera;c:\windows\system32\Drivers\usbVM31b.sys [2007-04-04 1495936]

R3 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe [2012-03-21 131912]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-11-03 1030600]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]

R3 Razerlow;Razer Pro|Solutions;c:\windows\system32\drivers\DB3G.sys [2005-11-07 21120]

R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800]

R3 RivaTuner64;RivaTuner64;c:\program files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys [2012-01-07 19952]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-06-23 344680]

R3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2011-12-25 79360]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 t3;Sound Blaster X-Fi Xtreme Audio;c:\windows\system32\drivers\t3.sys [2009-05-05 639512]

R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe [2012-07-19 738152]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

R3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM10864.sys [2009-12-21 1308160]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-07 1255736]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-08 55280]

S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 15368]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2012-11-09 30568]

S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2011-12-25 15936]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-28 239616]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]

S2 ET Master Server Proxy;ET Master Server Proxy Service;c:\program files (x86)\Rudi Visser\ET Master Server Proxy Service\ETMSProxy.exe [2012-01-21 9728]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-11-19 2462128]

S2 mi-raysat_3dsmax2010_64;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 64-bit 64-bit;c:\program files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe [2009-03-12 86016]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]

S2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [2012-11-09 711112]

S3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys [2011-11-28 33872]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]

S3 cmudaxp;ASUS Xonar DG Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2011-03-10 2725376]

S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-02-08 39936]

S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-02-08 64512]

S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2012-01-11 66728]

S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [2011-12-25 31808]

S3 MonitorFunction;Driver for Monitor;c:\windows\system32\DRIVERS\TVMonitor.sys [2011-12-16 16376]

S3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys [2012-10-25 22016]

S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys [2012-10-25 113664]

S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-15 31232]

.

Contents of the 'Scheduled Tasks' folder

.

2012-12-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-02 09:44]

.

2012-12-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-02 09:44]

.

2012-12-02 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 3a6a128f-10b8-4271-b364-4bb2e69466c0.job

- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

.

2012-12-03 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 9c74c53f-daff-434d-a5d8-8bdfcd5f1db4.job

- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-10-30 22:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]

@="{C5994560-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]