LocalSystemNetworkRestricted high memory usage

ImInfectedIThink · May 21, 2012

Hi,

I have in some time know seen this svchost.exe -k LocalSystemNetworkRestricted have a high memory usage, is it normal ?

And is there a way to make it use less ?

Im using Windows 7 Ultimate with Truecrypt encryption.

Thanks in advance.

Attach.txt

DDS.txt

Maurice Naggar · May 25, 2012

Hello,

Did you only recently install MSE on 2012-04-27 ?

What antivirus app was installed before this? Has this system ever been without an antivirus?

Is this running in a VM ?

Step 1

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 2

To show all files:

Go to your Desktop
Double-Click the Computer icon.
From the menu options, Select Tools, then Folder Options.
Next click the View tab.
Locate and uncheck Hide file extensions for known file types.
Locate and uncheck Hide protected operating system files (Recommended).
Locate and click Show hidden files and folders and drives.
Click Apply > OK.

Step 3

Download Random's System Information Tool (RSIT) by random/random from here and save it to your desktop.

Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

Step 4

Download Security Check by screen317 and save it to your Desktop: here or here

Run Security Check
Follow the onscreen instructions inside of the command window.
A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

Step 5

Close all open browsers at this point.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Start Internet Explorer

Using Internet Explorer browser only, go to BitDefender Quickscan website:

http://quickscan.bitdefender.com

and click "Start Scan".

Observe your browser in case it shows a notice/message bar to allow download and installation of a tool.

Allow the download and install of qsax.cab from BitDefender. Right-click the IE info bar and select Install to install the BitDefender quick scan module.

If prompted, reply yes to allow it to run.

Press the Allow button and follow prompts.

Press the "Start Scan" once more.

You'll see the EULA in a pop-up window. Click the I accept & then the OK button

Note: The FAQ is here --> http://quickscan.bitdefender.com/faq/

and that QuickScan has no removal capability.

The site boasts a 60-second scan. Do have patience as it likely will take longer.

It may seem to stall at moments, but have patience; it will move on.

You'll see a progress bar at top right of window.

Hopefully you will see a No infections found in the bar-winddow. Press the View Log button.

The log report will show in your text editor. Save the log.

Do a Select ALL, Copy. Then paste contents into your next reply.

RE-Enable your antivirus program.

Copy & Paste contents of Log.txt & Info.txt & Checkup.txt & log from Bitdefender.

Use separate replies as needed if logs do not fit into one reply box.

Edited May 25, 2012 by Maurice Naggar

ImInfectedIThink · May 27, 2012

No, i've had MSE since i bought the laptop. I think i may have reinstalled it that date because of an update fail.

My system have always had a antivirus system.

And no the pc is not running in a vm.

I could see that if i disabled the Superfetch service the svchost memory usage did fall to 25k, but i also have a problem with my network, my internet is sometime very slow and sometime it is at normal speed, i dont know if it have something to do with the svchost, but both problems occurred at the same time. And i know its not the router or the network, because my other computers works fine.

And after the diabled Superfetch service my pc have cut up to 2 minutes of its booting time.

But all these tests are made with Superfetch turned on.

Log.txt

Logfile of random's system information tool 1.09 (written by random/random)

Run by My at 2012-05-27 22:58:13

Microsoft Windows 7 Ultimate Service Pack 1

System drive C: has 251 GB (53%) free of 477 GB

Total RAM: 12199 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 22:58:28, on 27-05-2012

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16421)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

C:\Program Files\TrueCrypt\TrueCrypt.exe

C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

C:\Program Files (x86)\EazyPrint\EazyPrint.exe

C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe

C:\ExpressGateUtil\VAWinAgent.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Users\My\Local Settings\Apps\F.lux\flux.exe

C:\Program Files (x86)\Xirrus\Xirrus Wi-Fi Inspector\Xirrus Wi-Fi Inspector.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files\trend micro\My.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Microsoft Web Test Recorder 10.0 Helper - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

O4 - HKLM\..\Run: [sonicMasterTray] C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe

O4 - HKLM\..\Run: [FLxHCIm] "C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"

O4 - HKLM\..\Run: [VAWinAgent] C:\ExpressGateUtil\VAWinAgent.exe

O4 - HKLM\..\Run: [iObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostart

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [KeyScrambler] C:\Program Files (x86)\KeyScrambler\keyscrambler.exe /a

O4 - HKLM\..\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

O4 - HKCU\..\Run: [TrueCrypt] "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences /a logon

O4 - HKCU\..\Run: [F.lux] "C:\Users\My\Local Settings\Apps\F.lux\flux.exe" /noshow

O4 - HKUS\S-1-5-21-1990530906-4165506631-22784256-1012\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')

O4 - HKUS\S-1-5-21-1990530906-4165506631-22784256-1012\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')

O4 - Startup: EazyPrint.lnk = C:\Program Files (x86)\EazyPrint\EazyPrint.exe

O4 - Startup: Skærmklipper og startprogram til OneNote 2010.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

O4 - Global Startup: Secunia PSI Tray.lnk = ?

O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: S&end til OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll

O9 - Extra 'Tools' menuitem: &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll

O9 - Extra button: &Sammenkædede OneNote-noter - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Sammenkædede OneNote-noter - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\vsocklib.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: CC679CB8-DC4B-458B-B817-D447B3B6AC31 - vpnweb.cab

O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.3.0.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll

O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

O23 - Service: Atheros Bt&Wlan Coex Agent - Unknown owner - C:\Program Files (x86)\Atheros\Ath_CoexAgent.exe (file missing)

O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Atheros\Bluetooth Suite\adminservice.exe

O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

O23 - Service: Bonjour tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CyberGhost VPN Client (CGVPNCliSrvc) - mobile concepts GmbH - C:\Program Files\CyberGhost VPN\CGVPNCliService.exe

O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe

O23 - Service: Google Update Tjeneste (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Tjeneste (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Autodesk Moldflow Inventor Tool Suite Integration 2012 Job Manager (mitsijm2012) - Autodesk, Inc. - C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe

O23 - Service: Secunia PSI Agent - Secunia - C:\Program Files (x86)\Secunia\PSI\PSIA.exe

O23 - Service: Secunia Update Agent - Secunia - C:\Program Files (x86)\Secunia\PSI\sua.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: Soluto PCGenome Core Service (SolutoService) - Soluto - C:\Program Files\Soluto\SolutoService.exe

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

O23 - Service: Intel® Turbo Boost Technology Monitor (TurboBoost) - Intel® Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: VideAceWindowsService - Unknown owner - C:\ExpressGateUtil\VAWinService.exe

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe

O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

O23 - Service: VMware Workstation Server (VMwareHostd) - Unknown owner - C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe

O23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Unknown owner - C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.21\bin\httpd.exe

O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.20\bin\mysqld.exe

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 15931 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

wininit.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\svchost.exe -k RPCSS

"c:\Program Files\Microsoft Security Client\MsMpEng.exe"

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"

C:\Windows\system32\nvvsvc.exe -session -first

"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe"

"C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe"

"C:\Windows\system32\Dwm.exe"

"C:\Program Files\Soluto\soluto.exe" /userinit

C:\Windows\Explorer.EXE

"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe"

C:\Windows\System32\spoolsv.exe

"taskhost.exe"

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

"C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe"

ATKOSD.exe

taskeng.exe {0DA47BC9-1F80-491A-8D6B-D65DAC482914}

taskeng.exe {1C21ED62-619D-417D-99FD-EFABD9B7E5F9}

"C:\Program Files\P4G\BatteryLife.exe"

"C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe"

WDC.exe

"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1

"C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE"

"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s

"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /SF3

"C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe"

"C:\Program Files\Elantech\ETDCtrl.exe"

"C:\Windows\System32\igfxtray.exe"

"C:\Windows\System32\hkcmd.exe"

"C:\Windows\System32\igfxpers.exe"

"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

"C:\Program Files (x86)\Atheros\Bluetooth Suite\BtvStack.exe"

"C:\Program Files (x86)\Atheros\Bluetooth Suite\AthBtTray.exe"

"C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences /a logon

"C:\Program Files (x86)\Secunia\PSI\psi_tray.exe"

"C:\Program Files (x86)\EazyPrint\EazyPrint.exe"

"C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE" /tsr

"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"

C:\Windows\system32\svchost.exe -k imgsvc

"C:\Program Files\Intel\TurboBoost\TurboBoost.exe"

C:\ExpressGateUtil\VAWinService.exe

"C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"

C:\Windows\SysWOW64\vmnat.exe

C:\Windows\SysWOW64\vmnetdhcp.exe

"C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe"

"C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe"

"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe"

"C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe"

"C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"

"C:\ExpressGateUtil\VAWinAgent.exe"

"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe" /a

"C:\Program Files (x86)\KeyScrambler\x64\KeyScrambler.exe" /n

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\SearchIndexer.exe /Embedding

"C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /systemstart /autostart

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

"C:\Program Files\Elantech\ETDCtrlHelper.exe"

"C:\Program Files\Soluto\SolutoService.exe"

"C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe"

"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

"C:\Program Files (x86)\Skype\Phone\Skype.exe"

"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"

"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=7532.1f1f5030.1072043329 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll" E7CF176E110C211B -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" 7532 "\\.\pipe\gecko-crash-server-pipe.7532" plugin

"C:\Users\My\Local Settings\Apps\F.lux\flux.exe"

"C:\Program Files (x86)\Xirrus\Xirrus Wi-Fi Inspector\Xirrus Wi-Fi Inspector.exe"

"C:\Windows\system32\cmd.exe"

\??\C:\Windows\system32\conhost.exe "1714581121677463541-14741895221564062842-938854446713238358-10180780051288673071

"C:\Program Files\Process Hacker 2\ProcessHacker.exe"

"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=7532.27773200.967098359 "C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll" E7CF176E110C211B -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" 7532 "\\.\pipe\gecko-crash-server-pipe.7532" plugin

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:7052 CREDAT:203011

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:7052 CREDAT:137493

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe21_ Global\UsGthrCtrlFltPipeMssGthrPipe21 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

"C:\Windows\system32\SearchFilterHost.exe" 0 532 536 544 65536 540

"C:\Users\My\Desktop\RSITx64.exe"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1990530906-4165506631-22784256-1000Core.job

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1990530906-4165506631-22784256-1000UA.job

C:\Windows\tasks\SUPERAntiSpyware Scheduled Task fc2e808a-148f-4135-b7c7-9874a743e35c.job

C:\Windows\tasks\SUPERAntiSpyware Scheduled Task fde3b548-7385-447a-b9c1-74fe1b2b19e1.job

=========Mozilla firefox=========

ProfilePath - C:\Users\My\AppData\Roaming\Mozilla\Firefox\Profiles\2ykxi9ee.default

prefs.js - "browser.search.useDBForOrder" - true

prefs.js - "browser.startup.homepage" - "file:///C:/Users/My/Dropbox/Public/EIGHT-firefox%20start%20page+config/index.htm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe® Flash® Player 11.2.202.235 Plugin

"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=]

"Description"=Registrer iTunes-tilbehør

"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0]

"Description"=

"Path"=C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@canon.com/MycameraPlugin]

"Description"=Canon MycameraPlugin

"Path"=C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]

"Description"=Oracle® Next Generation Java™ Plug-In

"Path"=C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]

"Description"=

"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]

"Description"=Ag Player Plugin

"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]

"Description"=Office Authorization plug-in for NPAPI browsers

"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]

"Description"=Microsoft SharePoint Plug-in for Firefox

"Path"=C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]

"Description"=Google Update

"Path"=C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]

"Description"=Google Update

"Path"=C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.1]

"Description"=VLC Multimedia Plugin

"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@wolfram.com/Mathematica]

"Description"=Wolfram Mathematica Plug-in

"Path"=C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.1.2063897\npmathplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Acrobat]

"Description"=Handles PDFs in-place in Firefox

"Path"=C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe® Flash® Player 11.2.202.235 Plugin

"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]

"Description"=Oracle® Next Generation Java™ Plug-In

"Path"=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]

"Description"=

"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]

"Description"=Ag Player Plugin

"Path"=c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]

"Description"=Office Authorization plug-in for NPAPI browsers

"Path"=C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL

C:\Program Files\UX\extensions\

{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\UX\components\

binary.manifest

browsercomps.dll

C:\Program Files\UX\searchplugins\

amazondotcom.xml

bing.xml

eBay.xml

google.xml

twitter.xml

wikipedia.xml

yahoo.xml

C:\Users\My\AppData\Roaming\Mozilla\Firefox\Profiles\2ykxi9ee.default\extensions\

donottrackplus@abine.com

firefox@ghostery.com

foxmarks@kei.com

foxyproxy@eric.h.jung

https-everywhere@eff.org

support@lastpass.com

{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}

{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

{bb6bc1bb-f824-4702-90cd-35e2fb24f25d}

{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

C:\Users\My\AppData\Roaming\Mozilla\Firefox\Profiles\2ykxi9ee.default\searchplugins\

google-ssl.xml

ImInfectedIThink · May 27, 2012

Still Log.txt

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]

Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-02-16 347424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-02-16 49440]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}]

ContributeBHO Class - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll [2011-03-19 164496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-04-04 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]

Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-02-16 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]

Adobe PDF Conversion Toolbar Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2012-04-04 340384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-02-16 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DDA57003-0068-4ed2-9D32-4D1EC707D94D}]

Microsoft Web Test Recorder 10.0 Helper - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2010-03-19 61360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]

SmartSelect Class - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2012-04-04 340384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]

{517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll [2011-03-19 164496]

{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2012-04-04 340384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-09-16 11485800]

"RtHDVBg"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2011-09-16 2168424]

"AmIcoSinglun64"=C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [2011-09-16 324096]

"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2010-06-10 649608]

"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 112512]

"IntelTBRunOnce"=wscript.exe //b //nologo C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs []

"IgfxTray"=C:\Windows\system32\igfxtray.exe [2012-03-19 170264]

"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2012-03-19 398616]

"Persistence"=C:\Windows\system32\igfxpers.exe [2012-03-19 439064]

"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2012-03-26 1271168]

"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-09-18 499608]

"AtherosBtStack"=C:\Program Files (x86)\Atheros\Bluetooth Suite\BtvStack.exe [2010-07-29 594080]

"AthBtTray"=C:\Program Files (x86)\Atheros\Bluetooth Suite\AthBtTray.exe [2010-07-29 377504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"TrueCrypt"=C:\Program Files\TrueCrypt\TrueCrypt.exe [2012-03-31 1516496]

"F.lux"=C:\Users\My\Local Settings\Apps\F.lux\flux.exe [2009-08-29 966656]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ActivControl]

C:\Program Files\Activ Software\ActivDriver\ActivControl2x64.exe [2009-10-22 1233704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-02-20 59240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-02-13 3481408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileREX Update Checker]

C:\Users\My\AppData\Local\Apps\2.0\APN956N4.WRQ\QOQMJ023.1J9\file..tion_619423b4ec51cb01_0002.0000_745701a5a2e893fa\FileREX.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Livedrive]

C:\Program Files (x86)\Livedrive\Livedrive.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RiccoVPN]

C:\Program Files (x86)\RiccoVPN\RiccoVPN.exe -autorun []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]

"Wireless Console 3"=C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2010-09-23 1601536]

"ATKMEDIA"=C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [2010-10-07 170624]

"HControlUser"=C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [2009-06-19 105016]

"SonicMasterTray"=C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe [2010-07-09 984400]

"FLxHCIm"=C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe [2011-04-08 43008]

"VAWinAgent"=C:\ExpressGateUtil\VAWinAgent.exe [2011-04-07 45448]

"IObit Malware Fighter"=C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe [2012-05-09 4464472]

"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]

"KeyScrambler"=C:\Program Files (x86)\KeyScrambler\keyscrambler.exe [2012-03-08 432952]

""= []

"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

"AdobeCS5.5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [2011-01-12 1523360]

"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]

"Wondershare Helper Compact.exe"=C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Secunia PSI Tray.lnk - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

C:\Users\My\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

EazyPrint.lnk - C:\Program Files (x86)\EazyPrint\EazyPrint.exe

Skærmklipper og startprogram til OneNote 2010.lnk - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="C:\Windows\System32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

C:\Windows\system32\igfxdev.dll [2012-03-19 434688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2011-09-16 249344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2011-06-12 6721936]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2011-06-12 4221328]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SolutoService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SolutoService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=5

"ConsentPromptBehaviorUser"=3

"EnableUIADesktopToggle"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=255

"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"VIDC.UYVY"=msyuv.dll

"VIDC.YUY2"=msyuv.dll

"VIDC.YVYU"=msyuv.dll

"VIDC.IYUV"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"VIDC.YVU9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"MSVideo8"=VfWWDM32.dll

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"wave2"=wdmaud.drv

"mixer2"=wdmaud.drv

"midi2"=wdmaud.drv

"wave3"=wdmaud.drv

"mixer3"=wdmaud.drv

"midi3"=wdmaud.drv

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

.scr - open - C:\Windows\system32\notepad.exe "%1"

.scr - install -

.scr - config -

.cpl - cplopen - %SystemRoot%\SysWow64\control.exe "%1",%*

======List of files/folders created in the last 1 month======

2012-05-27 22:58:13 ----D---- C:\rsit

2012-05-27 22:58:13 ----D---- C:\Program Files\trend micro

2012-05-27 22:56:35 ----D---- C:\Windows\ERDNT

2012-05-27 22:55:34 ----D---- C:\Program Files (x86)\ERUNT

2012-05-27 20:31:51 ----A---- C:\Windows\system32\network.txt

2012-05-27 20:23:58 ----D---- C:\Program Files (x86)\Xirrus

2012-05-27 20:23:02 ----D---- C:\Users\My\AppData\Roaming\Xirrus

2012-05-26 17:16:03 ----D---- C:\ProgramData\Roaming

2012-05-26 03:40:20 ----D---- C:\Program Files\Elantech

2012-05-26 03:33:37 ----A---- C:\Windows\ETDUninst.dll

2012-05-26 03:33:16 ----A---- C:\Windows\system32\drivers\ETD.sys

2012-05-26 03:28:55 ----A---- C:\Windows\system32\drivers\L1C62x64.sys

2012-05-24 02:00:35 ----D---- C:\ProgramData\Kaspersky Lab

2012-05-21 11:07:25 ----D---- C:\Program Files (x86)\Wondershare

2012-05-20 22:20:32 ----D---- C:\Users\My\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

2012-05-20 22:20:09 ----D---- C:\Users\My\AppData\Roaming\com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1

2012-05-20 22:09:37 ----D---- C:\Program Files (x86)\Adobe Story

2012-05-20 22:08:16 ----D---- C:\Users\My\AppData\Roaming\com.adobe.AdobeStory.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

2012-05-20 19:50:54 ----A---- C:\Windows\system32\drivers\vmx86.sys

2012-05-20 19:50:03 ----A---- C:\Windows\SYSWOW64\vmnetdhcp.exe

2012-05-20 19:50:02 ----A---- C:\Windows\SYSWOW64\vmnat.exe

2012-05-20 19:50:01 ----A---- C:\Windows\system32\drivers\vmnetuserif.sys

2012-05-20 19:49:50 ----A---- C:\Windows\system32\vnetlib64.dll

2012-05-20 19:49:47 ----A---- C:\Windows\system32\drivers\VMkbd.sys

2012-05-20 19:49:47 ----A---- C:\Windows\system32\drivers\hcmon.sys

2012-05-20 19:48:30 ----D---- C:\Program Files\Common Files\VMware

2012-05-16 10:08:06 ----D---- C:\ProgramData\Ricoh

2012-05-15 22:39:15 ----A---- C:\Windows\Sandboxie.ini

2012-05-15 22:39:05 ----D---- C:\Program Files\Sandboxie

2012-05-09 23:45:21 ----A---- C:\Windows\SYSWOW64\DWrite.dll

2012-05-09 23:45:21 ----A---- C:\Windows\system32\DWrite.dll

2012-05-09 23:45:10 ----A---- C:\Windows\system32\win32k.sys

2012-05-09 23:45:10 ----A---- C:\Windows\system32\ntoskrnl.exe

2012-05-09 23:45:09 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe

2012-05-09 23:45:08 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe

2012-05-09 23:45:03 ----A---- C:\Windows\system32\drivers\tcpip.sys

2012-05-09 23:44:53 ----A---- C:\Windows\system32\drivers\partmgr.sys

2012-05-05 15:33:33 ----D---- C:\Users\My\AppData\Roaming\ZoomBrowser EX

2012-05-05 15:02:12 ----D---- C:\ProgramData\ZoomBrowser

2012-05-05 15:01:39 ----D---- C:\Program Files (x86)\Canon

2012-04-30 18:26:28 ----A---- C:\Windows\SYSWOW64\vmnc.dll

2012-04-30 17:22:42 ----A---- C:\Windows\system32\vnetinst.dll

2012-04-30 17:22:42 ----A---- C:\Windows\system32\vmnetbridge.dll

2012-04-30 17:22:42 ----A---- C:\Windows\system32\drivers\vmnetbridge.sys

2012-04-30 17:22:42 ----A---- C:\Windows\system32\drivers\vmnetadapter.sys

2012-04-30 17:22:42 ----A---- C:\Windows\system32\drivers\vmnet.sys

2012-04-30 13:08:47 ----D---- C:\Program Files (x86)\EazyPrint

2012-04-29 12:11:54 ----D---- C:\Program Files\Soluto

2012-04-28 00:29:47 ----D---- C:\Program Files (x86)\Microsoft Security Client

======List of files/folders modified in the last 1 month======

2012-05-27 22:58:26 ----D---- C:\Windows\Prefetch

2012-05-27 22:58:13 ----RD---- C:\Program Files

2012-05-27 22:58:03 ----D---- C:\Windows\Temp

2012-05-27 22:56:35 ----D---- C:\Windows

2012-05-27 22:55:34 ----RD---- C:\Program Files (x86)

2012-05-27 22:52:49 ----D---- C:\Users\My\AppData\Roaming\Skype

2012-05-27 21:27:40 ----D---- C:\Windows\system32\config

2012-05-27 20:40:55 ----D---- C:\Windows\System32

2012-05-27 20:40:55 ----D---- C:\Windows\inf

2012-05-27 20:40:55 ----A---- C:\Windows\system32\PerfStringBackup.INI

2012-05-27 20:24:26 ----SHD---- C:\Windows\Installer

2012-05-27 20:24:25 ----D---- C:\Config.Msi

2012-05-27 20:24:22 ----D---- C:\Windows\winsxs

2012-05-27 20:23:16 ----SHD---- C:\System Volume Information

2012-05-27 03:50:58 ----D---- C:\Users\My\AppData\Roaming\vlc

2012-05-27 02:17:34 ----D---- C:\Windows\system32\NDF

2012-05-26 19:13:05 ----D---- C:\Windows\system32\Tasks

2012-05-26 19:11:49 ----D---- C:\ProgramData\VMware

2012-05-26 19:06:13 ----D---- C:\Windows\system32\catroot

2012-05-26 18:56:47 ----D---- C:\Users\My\AppData\Roaming\uTorrent

2012-05-26 18:24:48 ----D---- C:\Users\My\AppData\Roaming\Intel

2012-05-26 18:24:48 ----D---- C:\Program Files\Intel

2012-05-26 18:24:48 ----D---- C:\Program Files (x86)\Cisco

2012-05-26 18:24:47 ----D---- C:\ProgramData

2012-05-26 18:24:47 ----D---- C:\Program Files\Common Files\Intel

2012-05-26 18:24:38 ----D---- C:\Windows\system32\DriverStore

2012-05-26 16:33:05 ----D---- C:\Windows\system32\drivers

2012-05-26 03:36:15 ----D---- C:\Program Files (x86)\Atheros

2012-05-26 03:31:47 ----D---- C:\Windows\system32\zh-TW

2012-05-26 03:31:47 ----D---- C:\Windows\system32\zh-CN

2012-05-26 03:31:47 ----D---- C:\Windows\system32\tr-TR

2012-05-26 03:31:47 ----D---- C:\Windows\system32\sv-SE

2012-05-26 03:31:47 ----D---- C:\Windows\system32\ru-RU

2012-05-26 03:31:47 ----D---- C:\Windows\system32\pt-PT

2012-05-26 03:31:47 ----D---- C:\Windows\system32\pl-PL

2012-05-26 03:31:47 ----D---- C:\Windows\system32\nl-NL

2012-05-26 03:31:47 ----D---- C:\Windows\system32\ko-KR

2012-05-26 03:31:47 ----D---- C:\Windows\system32\ja-JP

2012-05-26 03:31:47 ----D---- C:\Windows\system32\it-IT

2012-05-26 03:31:47 ----D---- C:\Windows\system32\hu-HU

2012-05-26 03:31:47 ----D---- C:\Windows\system32\fr-FR

2012-05-26 03:31:47 ----D---- C:\Windows\system32\fi-FI

2012-05-26 03:31:47 ----D---- C:\Windows\system32\es-ES

2012-05-26 03:31:47 ----D---- C:\Windows\system32\en-US

2012-05-26 03:31:47 ----D---- C:\Windows\system32\el-GR

2012-05-26 03:31:47 ----D---- C:\Windows\system32\de-DE

2012-05-26 03:31:47 ----D---- C:\Windows\system32\da-DK

2012-05-26 03:31:47 ----D---- C:\Windows\system32\cs-CZ

2012-05-26 03:30:37 ----HD---- C:\Program Files (x86)\InstallShield Installation Information

2012-05-26 03:29:49 ----D---- C:\Windows\SysWOW64

2012-05-25 21:24:55 ----D---- C:\Program Files\PeerBlock

2012-05-25 20:08:23 ----D---- C:\Users\My\AppData\Roaming\dvdcss

2012-05-25 15:39:58 ----D---- C:\Windows\system32\catroot2

2012-05-25 08:32:29 ----SD---- C:\ProgramData\Microsoft

2012-05-24 19:32:44 ----D---- C:\Users\My\AppData\Roaming\nbs-irc

2012-05-24 04:01:14 ----D---- C:\Users\My\AppData\Roaming\MediaMonkey

2012-05-24 03:38:17 ----D---- C:\ProgramData\Atheros

2012-05-24 02:46:02 ----SD---- C:\Windows\Fonts

2012-05-24 02:45:52 ----D---- C:\Program Files (x86)\MathType

2012-05-21 17:58:24 ----D---- C:\Users\My\AppData\Roaming\Dropbox

2012-05-21 11:24:12 ----D---- C:\Users\My\AppData\Roaming\Adobe

2012-05-20 22:21:11 ----D---- C:\Program Files (x86)\Adobe

2012-05-20 22:04:21 ----D---- C:\Users\My\AppData\Roaming\VMware

2012-05-20 21:40:19 ----D---- C:\Windows\debug

2012-05-20 19:49:43 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI

2012-05-20 19:49:27 ----D---- C:\Windows\SYSWOW64\drivers

2012-05-20 19:49:05 ----D---- C:\Program Files (x86)\VMware

2012-05-20 19:49:03 ----D---- C:\Program Files (x86)\Common Files

2012-05-20 19:48:30 ----D---- C:\Program Files\Common Files

2012-05-15 22:54:54 ----SD---- C:\Users\My\AppData\Roaming\Microsoft

2012-05-14 13:13:11 ----SHD---- C:\$RECYCLE.BIN

2012-05-10 04:15:42 ----RSD---- C:\Windows\assembly

2012-05-10 04:15:42 ----D---- C:\Windows\Microsoft.NET

2012-05-10 00:13:28 ----D---- C:\Program Files\Microsoft Silverlight

2012-05-10 00:13:26 ----D---- C:\Program Files (x86)\Microsoft Silverlight

2012-05-10 00:01:01 ----D---- C:\ProgramData\Microsoft Help

2012-05-09 23:58:04 ----A---- C:\Windows\system32\MRT.exe

2012-05-09 23:46:44 ----D---- C:\Program Files\Windows Journal

2012-05-09 23:02:43 ----D---- C:\Windows\Tasks

2012-05-09 23:02:34 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

2012-05-09 22:56:52 ----D---- C:\Program Files\UX

2012-05-09 22:45:20 ----D---- C:\Windows\pss

2012-05-09 09:35:26 ----D---- C:\Windows\system32\wdi

2012-05-06 01:56:56 ----D---- C:\Users\My\AppData\Roaming\DAEMON Tools Lite

2012-05-05 21:05:47 ----D---- C:\Program Files (x86)\JDownloader

2012-05-05 00:07:16 ----D---- C:\Program Files (x86)\uTorrent

2012-05-02 22:20:30 ----D---- C:\Program Files\SUPERAntiSpyware

2012-05-01 02:22:01 ----D---- C:\Program Files (x86)\Google

2012-04-29 12:11:56 ----DC---- C:\Windows\system32\DRVSTORE

2012-04-28 00:30:02 ----D---- C:\Program Files\Microsoft Security Client

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2010-09-14 437272]

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2012-03-20 203888]

R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2012-03-01 28992]

R0 PxHlpa64;PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]

R0 Soluto;Soluto; C:\Windows\system32\DRIVERS\Soluto.sys [2012-04-24 54728]

R0 truecrypt;truecrypt; C:\Windows\System32\drivers\truecrypt.sys [2012-03-31 231376]

R1 ATKWMIACPIIO;ATKWMIACPI Driver; \??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]

R1 CbFs;CbFs; \??\C:\Windows\system32\drivers\cbfs.sys [2010-02-16 191960]

R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-03 283200]

R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

R2 ASMMAP64;ASMMAP64; \??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]

R2 DefragFS;DefragFS; C:\Windows\system32\drivers\DefragFS.sys [2011-12-06 140816]

R2 hcmon;VMware hcmon; \??\C:\Windows\system32\drivers\hcmon.sys [2011-08-29 39024]

R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-06-25 35344]

R2 PDFSfilter;PDFsFilter; C:\Windows\system32\DRIVERS\PDFsFilter.sys [2012-02-28 81424]

R2 TurboB;Turbo Boost UI Monitor driver; C:\Windows\system32\DRIVERS\TurboB.sys [2010-04-16 13832]

R3 ActivHidSerMini;Promethean Serial Board Driver; C:\Windows\system32\DRIVERS\activhidsermini.sys [2009-05-05 65152]

R3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2010-07-29 36000]

R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-06-27 2753536]

R3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2010-07-29 295072]

R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2010-07-29 28832]

R3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2010-07-29 201376]

R3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2010-07-29 51872]

R3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2010-07-29 154272]

R3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-01-24 283136]

R3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]

R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]

R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]

R3 cpuz135;cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys []

R3 ETD;ELAN PS/2 Port Input Device; C:\Windows\system32\DRIVERS\ETD.sys [2010-09-08 129024]

R3 FileMonitor;FileMonitor; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2012-01-05 21384]

R3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver; C:\Windows\system32\DRIVERS\FLxHCIc.sys [2011-04-08 177152]

R3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver; C:\Windows\system32\DRIVERS\FLxHCIh.sys [2011-04-08 56320]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 34152]

R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-03-19 14745600]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-09-16 2515432]

R3 IntcDAud;Intel® Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264]

R3 KeyScrambler;KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [2011-12-15 222904]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2010-08-24 76912]

R3 MEIx64;Intel® Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]

R3 PrivacyProtectorMP;PrivacyProtectorMP; C:\Windows\system32\DRIVERS\PPFlt.sys [2012-03-08 27160]

R3 prmvmouse;Promethean HID Mouse Service; C:\Windows\system32\DRIVERS\activmouse.sys [2009-10-05 8152]

R3 RegFilter;RegFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [2012-04-28 33184]

R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]

R3 tap0901;TAP-Win32 Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2010-02-25 29696]

R3 UrlFilter;UrlFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [2012-04-28 21872]

R4 KProcessHacker2;KProcessHacker2; \??\C:\Program Files\Process Hacker 2\kprocesshacker.sys [2011-08-25 36424]

S1 SASDIFSV;SASDIFSV; \??\C:\Users\My\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS []

S3 AmUStor;AM USB Stroage Driver; C:\Windows\system32\drivers\AmUStor.SYS [2011-09-16 44032]

S3 ATHDFU;Atheros Valkyrie USB BootROM; C:\Windows\System32\Drivers\AthDfu.sys [2010-07-29 51872]

S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]

S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]

S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []

S3 CVirtA;Cisco Systems VPN Adapter for 64-bit Windows; C:\Windows\system32\DRIVERS\CVirtA64.sys [2010-02-08 14992]

S3 dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]

S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2010-11-20 19968]

S3 dot4usb;Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]

S3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2012-04-04 24904]

S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 98688]

S3 Passthru;PrivacyProtector Service; C:\Windows\system32\DRIVERS\PPFlt.sys [2012-03-08 27160]

S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]

S3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]

S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]

S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]

S3 SbieDrv;SbieDrv; \??\C:\Program Files\Sandboxie\SbieDrv.sys [2012-04-10 164528]

S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]

S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []

S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2012-02-15 52736]

S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []

S4 DNE;Deterministic Network Enhancer Miniport; C:\Windows\system32\DRIVERS\dne64x.sys [2008-11-16 157968]

S4 RsFx0105;RsFx0105 Driver; C:\Windows\system32\DRIVERS\RsFx0105.sys [2011-09-22 311144]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-10-18 140672]

R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [2009-06-15 84536]

R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [2009-12-15 96896]

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]

R2 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-09-20 1431888]

R2 IMFservice;IMF Service; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2012-01-09 821592]

R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-03-26 12600]

R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2012-02-29 889664]

R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-03-01 2348352]

R2 SolutoService;Soluto PCGenome Core Service; C:\Program Files\Soluto\SolutoService.exe [2012-04-24 584224]

R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2011-09-22 154984]

R2 TurboBoost;Intel® Turbo Boost Technology Monitor; C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-04-16 134928]

R2 VideAceWindowsService;VideAceWindowsService; C:\ExpressGateUtil\VAWinService.exe [2011-03-25 91464]

S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Atheros\Ath_CoexAgent.exe []

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

S2 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [2011-09-22 58345832]

S3 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-02-27 55144]

S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]

S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]

S3 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Atheros\Bluetooth Suite\adminservice.exe [2010-07-29 52896]

S3 Bonjour Service;Bonjour tjeneste; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-31 462184]

S3 CGVPNCliSrvc;CyberGhost VPN Client; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2011-12-06 2430128]

S3 cphs;Intel® Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-03-19 276248]

S3 gupdate;Google Update Tjeneste (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-01 116648]

S3 gupdatem;Google Update Tjeneste (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-01 116648]

S3 iPod Service;iPod-tjeneste; C:\Program Files\iPod\bin\iPodService.exe [2012-03-27 934760]

S3 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]

S3 mitsijm2012;Autodesk Moldflow Inventor Tool Suite Integration 2012 Job Manager; C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe [2010-12-07 848184]

S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-24 129976]

S3 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]

S3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]

S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]

S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

S3 PDAgent;PDAgent; C:\Program Files\Raxco\PerfectDisk\PDAgent.exe [2012-02-29 1890568]

S3 PDEngine;PDEngine; C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe [2012-02-29 3291912]

S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]

S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files (x86)\WinPcap\rpcapd.exe [2010-06-25 117264]

S3 SbieSvc;Sandboxie Service; C:\Program Files\Sandboxie\SbieSvc.exe [2012-04-10 97552]

S3 Secunia PSI Agent;Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [2011-04-19 993848]

S3 Secunia Update Agent;Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [2011-04-19 399416]

S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

S3 TeamViewer7;TeamViewer 7; C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-11-29 2916736]

S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service; c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-22 61976]

S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-09-22 431464]

S4 SQLBrowser;SQL Server Browser; c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2011-09-22 255336]

-----------------EOF-----------------

ImInfectedIThink · May 27, 2012

Info.txt

info.txt logfile of random's system information tool 1.09 2012-05-27 22:58:31

======Uninstall list======

-->"c:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Update Cache\KB2285068\ServicePack\setup.exe" /Action=RemovePatch /AllInstances

-->"c:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Update Cache\KB968369\ServicePack\setup.exe" /Action=RemovePatch /AllInstances

-->MsiExec /X{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}

µTorrent-->"C:\Program Files (x86)\uTorrent\uTorrent.exe" /UNINSTALL

64 Bit HP CIO Components Installer-->MsiExec.exe /I{BC741628-0AFC-405C-8946-DD46D1005A0A}

ActivDriver x64 v5.4.6-->MsiExec.exe /I{F651E81A-6D79-4004-9D49-DB3DA159CDD7}

ActivInspire Help (DNK) v1-->MsiExec.exe /I{F069D2A4-D29D-4E6D-8FDA-3EBE399A3092}

ActivInspire HWR Resources (INT) v1-->MsiExec.exe /I{782E1916-7A78-47F7-9AF3-2233B83026F2}

ActivInspire v1-->MsiExec.exe /I{7970AA03-F817-4916-AE77-80DC801646CC}

Adobe Acrobat X Pro - English, Français, Deutsch-->MsiExec.exe /I{AC76BA86-1033-F400-7760-000000000005}

Adobe AIR-->c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall

Adobe AIR-->MsiExec.exe /I{47FA2C44-D148-4DBC-AF60-B91934AA4842}

Adobe Community Help-->msiexec /qb /x {A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}

Adobe Community Help-->MsiExec.exe /I{A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}

Adobe Content Viewer-->msiexec /qb /x {4E33D05D-76CF-5D3C-4D5D-7727530FA161}

Adobe Content Viewer-->MsiExec.exe /I{4E33D05D-76CF-5D3C-4D5D-7727530FA161}

Adobe Creative Suite 5.5 Master Collection-->C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\core\PDApp.exe --appletID="DWA_UI" --appletVersion="1.0" --mode="Uninstall" --mediaSignature="{D57FC112-312E-4D70-860F-2DB8FB6858F0}"

Adobe Flash Player 11 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe -maintain activex

Adobe Flash Player 11 Plugin 64-bit-->C:\Windows\system32\Macromed\Flash\FlashUtil64_11_2_202_235_Plugin.exe -maintain plugin

Adobe Story-->msiexec /qb /x {C8E6DE88-C7D8-FCD8-CC61-E7805D7A89C4}

Adobe Story-->MsiExec.exe /I{C8E6DE88-C7D8-FCD8-CC61-E7805D7A89C4}

Adobe Widget Browser-->msiexec /qb /x {BDE646E8-86E0-50E1-37BC-0AEBB2185D76}

Adobe Widget Browser-->MsiExec.exe /I{BDE646E8-86E0-50E1-37BC-0AEBB2185D76}

Alcor Micro USB Card Reader-->C:\Program Files (x86)\InstallShield Installation Information\{1F7424F8-F992-48BC-90EF-7C4DB0405E3F}\Setup.exe -runfromtemp -l0x0409

Apple Application Support-->MsiExec.exe /I{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}

Apple Mobile Device Support-->MsiExec.exe /I{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}

Apple Software Update-->MsiExec.exe /I{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}

ASUS Power4Gear Hybrid-->MsiExec.exe /I{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}

ASUS Virtual Camera-->MsiExec.exe /I{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}

ATK Package-->MsiExec.exe /I{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}

Autodesk Design Review 2012-->C:\Program Files (x86)\Autodesk\Autodesk Design Review 2012\Setup\Setup.exe /P {A49BDCBE-590E-43A6-AB77-7C40E499B7C1} /M ADR /language en-US

Autodesk Inventor Content Center Libraries 2012 (Desktop Content)-->MsiExec.exe /X{B46DECD1-1664-4EF1-0000-22D71E81877C}

Autodesk Inventor Fusion 2012 Language Pack-->MsiExec.exe /X{FFF7F80F-929E-497F-A112-B070DE816128}

Autodesk Inventor Fusion 2012-->C:\Program Files\Autodesk\Inventor Fusion 2012\Setup\Setup.exe /P {FFF5619F-6669-4EC5-A85E-9994F70A9E5D} /M INVENTORFUSION /LANG en-US

Autodesk Inventor Fusion 2012-->MsiExec.exe /X{FFF5619F-6669-4EC5-A85E-9994F70A9E5D}

Autodesk Inventor Fusion for Inventor 2012 Add-in Language Pack-->MsiExec.exe /I{4E1A54A9-FFB3-4BE6-B59B-3CC94C3B31D2}

Autodesk Inventor Fusion for Inventor 2012 Add-in-->C:\Program Files\Autodesk\Inventor 2012\Bin\FUSION4INVADDINSSetup\Setup\Setup.exe /P {4E3B47F2-21EB-4F20-87C8-5A0E4D5F3858} /M FUSION4INVADDINS /LANG en-US

Autodesk Inventor Fusion for Inventor 2012 Add-in-->MsiExec.exe /I{4E3B47F2-21EB-4F20-87C8-5A0E4D5F3858}

Autodesk Inventor Professional 2012 English Language Pack-->MsiExec.exe /I{7F4DD591-1664-0409-0001-7107D70F3DB4}

Autodesk Inventor Professional 2012 English-->C:\Program Files\Autodesk\Inventor 2012\Setup\Setup.exe /P {7F4DD591-1664-0409-0000-7107D70F3DB4} /M INVENTOR /LANG en-US

Autodesk Inventor Professional 2012-->MsiExec.exe /I{7F4DD591-1664-0409-0000-7107D70F3DB4}

Autodesk Inventor Publisher 2012 Language Pack-->MsiExec.exe /X{6E542012-DD29-0001-B703-2376D4CC9C8F}

Autodesk Inventor Publisher 2012-->C:\Program Files\Autodesk\Inventor Publisher 2012\Setup\Setup.exe /P {6E542012-DD29-0000-B703-2376D4CC9C8F} /M Inventor_Publisher /LANG en-US

Autodesk Inventor Publisher 2012-->MsiExec.exe /X{6E542012-DD29-0000-B703-2376D4CC9C8F}

Autodesk Material Library 2012-->MsiExec.exe /I{8F0837C2-EE09-4903-88F3-1976FE7FFF4E}

Autodesk Material Library Base Resolution Image Library 2012-->MsiExec.exe /I{65420DC9-306E-4371-905F-F4DC3B418E52}

Autodesk Material Library Low Resolution Image Library 2012-->MsiExec.exe /I{24FF088D-CDCF-480C-8A4B-98F14A54CAA8}

Autodesk Vault 2012 (Client) English Language Pack-->MsiExec.exe /I{266597A9-1664-0000-0100-DCBF2B69166B}

Autodesk Vault 2012 (Client)-->C:\Program Files\Autodesk\Vault 2012\Setup\setup.exe /P {CF526A26-1664-0000-0000-02E95019B628} /M VAULT /language en-US

Autodesk Vault 2012 (Client)-->MsiExec.exe /X{CF526A26-1664-0000-0000-02E95019B628}

Battlefield 3™-->"C:\Program Files (x86)\Common Files\EAInstaller\Battlefield 3\Cleanup.exe" uninstall_game -autologging

Bonjour-->MsiExec.exe /X{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}

CANON iMAGE GATEWAY MyCamera Download Plugin-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\MyCamera Download Plugin\MyCameraPluginUninstall.ini"

CANON iMAGE GATEWAY Task for ZoomBrowser EX-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\CRWUnInstall.ini"

Canon MOV Decoder-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\Canon MOV Decoder\CanonMOVDecoderUnInstall.ini"

Canon MOV Encoder-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\Canon MOV Encoder\CanonMOVEncoderUnInstall.ini"

Canon MovieEdit Task for ZoomBrowser EX-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\MVWUninst.ini"

Canon Utilities EOS Utility-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\EOS Utility\Uninst.ini"

Canon Utilities EOS Video Snapshot Task for ZoomBrowser EX-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\EOS Video Snapshot Task\Uninst.ini"

Canon Utilities PhotoStitch-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\PhotoStitch\Uninst.ini"

Canon Utilities ZoomBrowser EX-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\Uninst.ini"

Canon ZoomBrowser EX Memory Card Utility-->"C:\Program Files (x86)\Common Files\Canon\UIW\1.10.0.0\Uninst.exe" "C:\Program Files (x86)\Canon\ZoomBrowser EX MCU\Uninst.ini"

CCleaner-->"C:\Program Files\CCleaner\uninst.exe"

Chicken Invaders 3 - Revenge of the Yolk - Easter Edition-->"C:\Program Files (x86)\Chicken Invaders 3 - Revenge of the Yolk - Easter Edition\uninstall.exe" "/U:C:\Program Files (x86)\Chicken Invaders 3 - Revenge of the Yolk - Easter Edition\Uninstall\uninstall.xml"

Cisco AnyConnect VPN Client-->MsiExec.exe /X{44257960-C5CC-45BA-8E83-524E4A0F3FD5}

CoreAVC Professional Edition (remove only)-->"C:\Program Files (x86)\CoreCodec\CoreAVC Professional Edition\CoreAVC Professional Edition-uninstall.exe"

CrypTool 1.4.30-->C:\Program Files (x86)\CrypTool\uninstall.exe

Crystal Reports for Visual Studio-->MsiExec.exe /I{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}

CyberGhost VPN-->"C:\Program Files\CyberGhost VPN\unins000.exe"

DAEMON Tools Lite-->C:\Program Files (x86)\DAEMON Tools Lite\uninst.exe

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{946F0E94-3B15-40B5-A04F-16A1C1234040}" "1030" "0"

Defraggler-->"C:\Program Files\Defraggler\uninst.exe"

Diagram Designer-->MsiExec.exe /X{576D94BB-CA4A-4487-BAF1-A2DC7C29BB23}

Dotfuscator Software Services - Community Edition-->MsiExec.exe /X{1AA5BD63-6614-44B2-88A7-605191EDB835}

DriverIdentifier 3.9-->"C:\Program Files (x86)\Driver Identifier\unins000.exe"

DWG TrueView 2012-->C:\Program Files\Autodesk\DWG TrueView 2012\Setup\Setup.exe /P {5783F2D7-A028-0409-0100-0060B0CE6BBA} /M AOEM /language en-US

EAGLE 6.0.0-->cmd.exe /c start "EAGLE Uninstaller" /min "C:\Program Files (x86)\EAGLE-6.0.0\bin\uninstall.bat" C:\Program Files (x86)\EAGLE-6.0.0\bin

EazyPrint 1.0-->C:\Program Files (x86)\EazyPrint\Uninst0.exe

Eco Materials Adviser (x64)-->MsiExec.exe /X{E027C59C-4C47-4BE8-8078-BCD3D2680EC3}

ERUNT 1.1j-->"C:\Program Files (x86)\ERUNT\unins000.exe"

ETDWare PS/2-x64 7.0.5.15_WHQL-->%ProgramFiles%\Elantech\ETDUn_inst.exe

ExpressGateCloud-->"C:\Program Files (x86)\InstallShield Installation Information\{36B0DC39-3282-40EB-8587-B875CE46C3A7}\setup.exe" -runfromtemp -l0x0409 -removeonly

ExpressGateCloud-->MsiExec.exe /X{36B0DC39-3282-40EB-8587-B875CE46C3A7}

FileZilla Client 3.5.3-->C:\Program Files (x86)\FileZilla FTP Client\uninstall.exe

Fresco Logic USB3.0 Host Controller-->MsiExec.exe /X{B1E301A1-C2B4-4B0B-AF31-C71F8A53DCDA}

GeoGebra-->"C:\Program Files (x86)\GeoGebra\uninstaller.exe"

Google Drive-->MsiExec.exe /X{8E3C0F37-2280-4043-BAD0-3C9E5EB723EC}

Google SketchUp 8-->MsiExec.exe /X{47BBA5AA-CA6F-4A41-858D-A7A776F29A8B}

Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

Graphmatica-->MsiExec.exe /X{DAB49042-8178-4BCD-9E56-68CEB3D6EBB7}

HiJackThis-->MsiExec.exe /X{45A66726-69BC-466B-A7A4-12FCBA4883D7}

Hotfix for Microsoft Visual Studio 2010 Ultimate - ENU (KB2522890)-->c:\Windows\SysWOW64\msiexec.exe /package {BC0464FA-A0BA-3E38-85BF-DC5B3A401F48} /uninstall {32DC3D84-B359-3558-9CFF-7EA74EB7F0E3} /qb+ REBOOTPROMPT=""

Hotfix for Microsoft Visual Studio 2010 Ultimate - ENU (KB2529927)-->c:\Windows\SysWOW64\msiexec.exe /package {BC0464FA-A0BA-3E38-85BF-DC5B3A401F48} /uninstall {90A659B3-6BB5-3E0D-ACE4-D72FF8D54783} /qb+ REBOOTPROMPT=""

Hotfix for Microsoft Visual Studio 2010 Ultimate - ENU (KB2542054)-->c:\Windows\SysWOW64\msiexec.exe /package {BC0464FA-A0BA-3E38-85BF-DC5B3A401F48} /uninstall {3EE9D984-E7A6-30B9-8FF5-A1FE2242440A} /qb+ REBOOTPROMPT=""

Hotfix for Microsoft Visual Studio 2010 Ultimate - ENU (KB2548139)-->c:\Windows\SysWOW64\msiexec.exe /package {BC0464FA-A0BA-3E38-85BF-DC5B3A401F48} /uninstall {40BA5965-82C8-3220-BAFA-B247A761053C} /qb+ REBOOTPROMPT=""

Hotfix for Microsoft Visual Studio 2010 Ultimate - ENU (KB2549864)-->c:\Windows\SysWOW64\msiexec.exe /package {BC0464FA-A0BA-3E38-85BF-DC5B3A401F48} /uninstall {FB360275-493B-3BFB-B6EC-79FDB4EB05E2} /qb+ REBOOTPROMPT=""

Hotfix for Microsoft Visual Studio 2010 Ultimate - ENU (KB2635973)-->c:\Windows\SysWOW64\msiexec.exe /package {BC0464FA-A0BA-3E38-85BF-DC5B3A401F48} /uninstall {A003ADF2-C209-378D-959B-4D93E75FD7A5} /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2280741)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2280741)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2284668)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2284668)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2295689)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2295689)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2420513)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2420513)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2452649)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2452649)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2455033)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2455033)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2485545)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB2485545)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB982517)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB982517)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB982721)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB982721)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB983233)-->C:\Windows\SysWOW64\msiexec.exe /package {2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Visual C++ Standard 2010 Beta 1 - ENU (KB983233)-->C:\Windows\SysWOW64\msiexec.exe /package {81455DEB-FC7E-3EE5-85CA-2EBDD9FD61EB} /uninstall /qb+ REBOOTPROMPT=""

Haali Media Splitter-->"C:\Program Files (x86)\Haali\MatroskaSplitter\uninstall.exe"

inSSIDer 2.0-->MsiExec.exe /I{57019733-78E6-43DE-8E6D-55349F0FDE6F}

Intel® Processor Graphics-->C:\Program Files (x86)\Intel\Intel® Processor Graphics\Uninstall\setup.exe -uninstall

Intel® Processor ID Utility-->MsiExec.exe /X{A92A4DB0-CD37-42D1-BE1D-603D53C24328}

Intel® Turbo Boost Teknologi Monitor-->MsiExec.exe /X{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}

IObit Malware Fighter-->"C:\Program Files (x86)\IObit\IObit Malware Fighter\unins000.exe"

iTunes-->MsiExec.exe /I{CF8FFD12-602B-422D-AF1D-511B411E7632}

Java 6 Update 31 (64-bit)-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F86416031FF}

Java 6 Update 31-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216031FF}

JDownloader 0.9-->C:\Program Files (x86)\JDownloader\JDUninstall.exe

KeyScrambler-->C:\Program Files (x86)\KeyScrambler\uninstall.exe

Malwarebytes Anti-Malware version 1.61.0.1400-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"

Mathematica Extras 8.0 (2063897)-->"C:\ProgramData\Mathematica\Applications\Extras\UninstallFiles\Windows\unins000.exe"

MathType 6-->"C:\Program Files (x86)\MathType\Setup.exe" -R

MediaMonkey 4.0-->"C:\Program Files (x86)\MediaMonkey\unins000.exe"

MediaPortal-->C:\Program Files (x86)\Team MediaPortal\MediaPortal\uninstall-mp.exe

Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /x64 /parameterfolder Client

Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}

Microsoft .NET Framework 4 Extended-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\Setup.exe /repair /x86 /x64 /parameterfolder Extended

Microsoft .NET Framework 4 Extended-->MsiExec.exe /X{8E34682C-8118-31F1-BC4C-98CD9675E1C2}

Microsoft .NET Framework 4 Multi-Targeting Pack-->MsiExec.exe /I{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}

Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools-->MsiExec.exe /X{40416836-56CC-4C0E-A6AF-5C34BADCE483}

Microsoft ASP.NET MVC 2-->MsiExec.exe /X{1803A630-3C38-4D2B-9B9A-0CB37243539C}

Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170)-->MsiExec.exe /X{41785C66-90F2-40CE-8CB5-1C94BFC97280}

Microsoft Help Viewer 1.1-->c:\Program Files\Microsoft Help Viewer\v1.0\Microsoft Help Viewer 1.1\install.exe

Microsoft Help Viewer 1.1-->MsiExec.exe /X{E5748D30-7E6D-3A8E-BFE6-C1D02C6DDABB}

Microsoft Mathematics (64-bit)-->MsiExec.exe /X{E57B7E0A-8BE5-42E2-BE60-C07ED680A063}

Microsoft Mathematics Add-in (64-bit)-->MsiExec.exe /X{E2C98732-F973-4985-A9C5-DC06178E16EE}

Microsoft Office 2010 Primary Interop Assemblies-->MsiExec.exe /X{90140000-1105-0000-0000-0000000FF1CE}

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0015-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0016-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0018-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0019-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001B-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0406-1000-0000000FF1CE}" "{54897D82-0CE7-4A90-AEA6-AF0189AA02B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0407-1000-0000000FF1CE}" "{70A3169E-288F-454F-A08D-20DF66639B50}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0409-1000-0000000FF1CE}" "{0242505C-4E90-407F-9299-B5B275F50D86}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-041D-1000-0000000FF1CE}" "{735E1B03-44E8-4D55-A553-EA9E32C96F7C}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-002C-0406-1000-0000000FF1CE}" "{9473C55B-6F52-48FF-B5EE-8E60464B532A}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0043-0000-1000-0000000FF1CE}" "{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0043-0406-1000-0000000FF1CE}" "{FD1730AD-3229-4682-BA0C-0451758B2864}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0044-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-006E-0406-1000-0000000FF1CE}" "{6773C535-2853-4D04-AC06-CEB15C125BFF}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-00A1-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office 2010 Service Pack 1 (SP1)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-00BA-0406-1000-0000000FF1CE}" "{579EB617-2CF7-4C40-BE4F-D1CE35F956B8}" "1030" "0"

Microsoft Office Access MUI (Danish) 2010-->MsiExec.exe /X{90140000-0015-0406-1000-0000000FF1CE}

Microsoft Office Excel MUI (Danish) 2010-->MsiExec.exe /X{90140000-0016-0406-1000-0000000FF1CE}

Microsoft Office Groove MUI (Danish) 2010-->MsiExec.exe /X{90140000-00BA-0406-1000-0000000FF1CE}

Microsoft Office InfoPath MUI (Danish) 2010-->MsiExec.exe /X{90140000-0044-0406-1000-0000000FF1CE}

Microsoft Office Office 32-bit Components 2010-->MsiExec.exe /X{90140000-0043-0000-1000-0000000FF1CE}

Microsoft Office OneNote MUI (Danish) 2010-->MsiExec.exe /X{90140000-00A1-0406-1000-0000000FF1CE}

Microsoft Office Outlook MUI (Danish) 2010-->MsiExec.exe /X{90140000-001A-0406-1000-0000000FF1CE}

Microsoft Office PowerPoint MUI (Danish) 2010-->MsiExec.exe /X{90140000-0018-0406-1000-0000000FF1CE}

Microsoft Office Professional Plus 2010-->MsiExec.exe /X{90140000-0011-0000-1000-0000000FF1CE}

Microsoft Office Professionel Plus 2010-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL

Microsoft Office Proof (Danish) 2010-->MsiExec.exe /X{90140000-001F-0406-1000-0000000FF1CE}

Microsoft Office Proof (English) 2010-->MsiExec.exe /X{90140000-001F-0409-1000-0000000FF1CE}

Microsoft Office Proof (German) 2010-->MsiExec.exe /X{90140000-001F-0407-1000-0000000FF1CE}

Microsoft Office Proof (Swedish) 2010-->MsiExec.exe /X{90140000-001F-041D-1000-0000000FF1CE}

Microsoft Office Proofing (Danish) 2010-->MsiExec.exe /X{90140000-002C-0406-1000-0000000FF1CE}

Microsoft Office Publisher MUI (Danish) 2010-->MsiExec.exe /X{90140000-0019-0406-1000-0000000FF1CE}

Microsoft Office Shared 32-bit MUI (Danish) 2010-->MsiExec.exe /X{90140000-0043-0406-1000-0000000FF1CE}

Microsoft Office Shared MUI (Danish) 2010-->MsiExec.exe /X{90140000-006E-0406-1000-0000000FF1CE}

Microsoft Office Word MUI (Danish) 2010-->MsiExec.exe /X{90140000-001B-0406-1000-0000000FF1CE}

Microsoft Security Client-->MsiExec.exe /X{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}

Microsoft Security Essentials-->C:\Program Files\Microsoft Security Client\Setup.exe /x

Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft SQL Server 2008 (64-bit)-->"c:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Release\x64\SetupARP.exe"

Microsoft SQL Server 2008 Browser-->MsiExec.exe /X{C688457E-03FD-4941-923B-A27F4D42A7DD}

Microsoft SQL Server 2008 Common Files-->MsiExec.exe /I{5340A3B5-3853-4745-BED2-DD9FF5371331}

Microsoft SQL Server 2008 Common Files-->MsiExec.exe /I{893F27E6-D6BE-4B9F-80E6-0ADA694A31A8}

Microsoft SQL Server 2008 Database Engine Services-->MsiExec.exe /I{FA7394B8-CE65-4F9E-AC99-F372AD365424}

Microsoft SQL Server 2008 Database Engine Services-->MsiExec.exe /I{FBD367D1-642F-47CF-B79B-9BE48FB34007}

Microsoft SQL Server 2008 Database Engine Shared-->MsiExec.exe /I{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}

Microsoft SQL Server 2008 Database Engine Shared-->MsiExec.exe /I{DF167CE3-60E7-44EA-99EC-2507C51F37AE}

Microsoft SQL Server 2008 Native Client-->MsiExec.exe /I{2738C4AA-420E-4E13-ADEF-B5AB250E3EF1}

Microsoft SQL Server 2008 R2 Data-Tier Application Framework-->MsiExec.exe /I{BC537AE0-88AF-47ED-B762-33B0D62B5188}

Microsoft SQL Server 2008 R2 Data-Tier Application Project-->MsiExec.exe /I{7A56D81D-6406-40E7-9184-8AC1769C4D69}

Microsoft SQL Server 2008 R2 Management Objects (x64)-->MsiExec.exe /I{EAEBF166-B06A-4D7F-BAF7-6615303D5C7C}

Microsoft SQL Server 2008 R2 Management Objects-->MsiExec.exe /I{77F1F8AD-51B8-4490-AEEC-BF480073E0FC}

Microsoft SQL Server 2008 R2 Transact-SQL Language Service-->MsiExec.exe /I{09C52940-A4D1-4409-A7CC-1AAE630CF578}

Microsoft SQL Server 2008 RsFx Driver-->MsiExec.exe /I{ADBD6E65-46CB-4A97-9AFB-64963FEACC40}

Microsoft SQL Server 2008 Setup Support Files -->MsiExec.exe /X{6292D514-17A4-403F-98F9-E150F10C043D}

Microsoft SQL Server Compact 3.5 SP2 ENU-->MsiExec.exe /I{3A9FC03D-C685-4831-94CF-4EDFD3749497}

Microsoft SQL Server Compact 3.5 SP2 x64 ENU-->MsiExec.exe /I{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}

Microsoft SQL Server Database Publishing Wizard 1.4-->MsiExec.exe /I{ACE28263-76A4-4BF5-B6F4-8BD719595969}

Microsoft SQL Server System CLR Types (x64)-->MsiExec.exe /I{1E6ED082-E32D-4B2B-8B6A-70B094815135}

Microsoft SQL Server System CLR Types-->MsiExec.exe /I{877B76B2-F83F-4F5A-B28D-3F398641ADB6}

Microsoft SQL Server VSS Writer-->MsiExec.exe /I{0826F9E4-787E-481D-83E0-BC6A57B056D5}

Microsoft Sync Framework Runtime v1.0 SP1 (x64)-->MsiExec.exe /I{8438EC02-B8A9-462D-AC72-1B521349C001}

Microsoft Sync Framework SDK v1.0 SP1-->MsiExec.exe /I{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}

Microsoft Sync Framework Services v1.0 SP1 (x64)-->MsiExec.exe /I{034106B5-54B7-467F-B477-5B7DBB492624}

Microsoft Sync Services for ADO.NET v2.0 SP1 (x64)-->MsiExec.exe /I{1D1CEEF8-3741-45BD-8E77-963E1DEBDDD3}

Microsoft Team Foundation Server 2010 Object Model - ENU-->MsiExec.exe /I{1AB7EDC5-D891-34C5-9FF1-BE6A85ACC44B}

Microsoft Team Foundation Server 2010 Object Model - ENU-->MsiExec.exe /X{1AB7EDC5-D891-34C5-9FF1-BE6A85ACC44B}

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053-->MsiExec.exe /X{B6E3757B-5E77-3915-866A-CCFC4B8D194C}

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

Microsoft Visual C++ 2005 Redistributable (x64)-->MsiExec.exe /X{071c9b48-7c32-4621-a0ac-3f809523288f}

Microsoft Visual C++ 2005 Redistributable (x64)-->MsiExec.exe /X{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17-->MsiExec.exe /X{8220EEFE-38CD-377E-8595-13398D740ACE}

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148-->MsiExec.exe /X{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161-->MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161-->MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}

Microsoft Visual C++ 2010 x64 Designtime - 10.0.30319-->MsiExec.exe /X{F5079164-1DB9-3BDA-853B-F78AF67CE071}

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219-->MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7}

Microsoft Visual C++ 2010 x64 Runtime - 10.0.40219-->MsiExec.exe /X{1C7C8AAF-A16D-32E8-89E5-F6D165DE0BCE}

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319-->MsiExec.exe /X{196BB40D-1578-3D01-B289-BEFC77A11A1E}

Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219-->MsiExec.exe /X{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}

Microsoft Visual F# 2.0 Runtime-->MsiExec.exe /X{85467CBC-7A39-33C9-8940-D72D9269B84F}

Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools-->MsiExec.exe /X{14DD7530-CCD2-3798-B37D-3839ED6A441C}

Microsoft Visual Studio 2010 IntelliTrace Collection (x64)-->MsiExec.exe /I{88BAE373-00F4-3E33-828F-96E89E5E0CB9}

Microsoft Visual Studio 2010 Office Developer Tools (x64)-->MsiExec.exe /X{D57519D3-2E37-3E34-94AF-4D59BFAB87E6}

Microsoft Visual Studio 2010 Performance Collection Tools SP1 - ENU-->MsiExec.exe /I{8FF0ACBD-17A5-3637-95F4-D7C69723E2BF}

Microsoft Visual Studio 2010 Service Pack 1-->C:\ProgramData\VS\vs10sp1\SetupCache\Setup.exe

Microsoft Visual Studio 2010 Service Pack 1-->MsiExec.exe /X{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}

Microsoft Visual Studio 2010 SharePoint Developer Tools-->MsiExec.exe /X{0BE273CD-AAB9-361B-8C32-D955EAC929E3}

Microsoft Visual Studio 2010 Tools for Office Runtime (x64)-->c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)\install.exe

Microsoft Visual Studio 2010 Tools for Office Runtime (x64)-->MsiExec.exe /X{C3600AE6-93A0-3DB7-B7AA-45BD58F133B5}

Microsoft Visual Studio 2010 Ultimate - ENU-->C:\Program Files (x86)\Microsoft Visual Studio 10.0\Microsoft Visual Studio 2010 Ultimate - ENU\setup.exe

Microsoft Visual Studio Macro Tools-->msiexec.exe /uninstall {6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}

Microsoft Visual Studio Macro Tools-->MsiExec.exe /X{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}

Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}

Microsoft_VC80_ATL_x86_x64-->MsiExec.exe /I{925D058B-564A-443A-B4B2-7E90C6432E55}

Microsoft_VC80_ATL_x86-->MsiExec.exe /I{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}

Microsoft_VC80_CRT_x86_x64-->MsiExec.exe /I{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}

Microsoft_VC80_CRT_x86-->MsiExec.exe /I{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}

Microsoft_VC80_MFC_x86_x64-->MsiExec.exe /I{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}

Microsoft_VC80_MFC_x86-->MsiExec.exe /I{D1A19B02-817E-4296-A45B-07853FD74D57}

Microsoft_VC80_MFCLOC_x86_x64-->MsiExec.exe /I{1E9FC118-651D-4934-97BE-E53CAE5C7D45}

Microsoft_VC80_MFCLOC_x86-->MsiExec.exe /I{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}

Microsoft_VC90_ATL_x86_x64-->MsiExec.exe /I{8557397C-A42D-486F-97B3-A2CBC2372593}

Microsoft_VC90_ATL_x86-->MsiExec.exe /I{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}

Microsoft_VC90_CRT_x86_x64-->MsiExec.exe /I{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}

Microsoft_VC90_CRT_x86-->MsiExec.exe /I{08D2E121-7F6A-43EB-97FD-629B44903403}

Microsoft_VC90_MFC_x86_x64-->MsiExec.exe /I{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}

Microsoft_VC90_MFC_x86-->MsiExec.exe /I{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}

Microsoft_VC90_MFCLOC_x86_x64-->MsiExec.exe /I{90BF0360-A1DB-4599-A643-95AB90A52C1E}

Microsoft_VC90_MFCLOC_x86-->MsiExec.exe /I{B6D38690-755E-4F40-A35A-23F8BC2B86AC}

MioMore Desktop 2008-->C:\Program Files (x86)\InstallShield Installation Information\{7617FC2E-EA1B-4F07-A0F5-5D5F437CB32D}\Setup.exe -runfromtemp -l0x0006 -removeonly

Mozilla Firefox 12.0 (x86 en-US)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe

Mozilla Maintenance Service-->"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

Notepad++-->C:\Program Files (x86)\Notepad++\uninstall.exe

NVIDIA 3D Vision Controller Driver 296.10-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.NVIRUSB

NVIDIA Graphics Driver 296.10-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.Driver

NVIDIA PhysX System Software 9.12.0213-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.PhysX

NVIDIA PhysX-->MsiExec.exe /X{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}

NVIDIA Update 1.7.11-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.0\NVI2.DLL",UninstallPackage Display.Update

Origin-->C:\Program Files (x86)\Origin\OriginUninstall.exe

PDF Settings CS5-->MsiExec.exe /I{A78FE97A-C0C8-49CE-89D0-EDD524A17392}

PeerBlock 1.1 (r518)-->"C:\Program Files\PeerBlock\unins000.exe"

PerfectDisk 12.5 Professional-->MsiExec.exe /I{FD310764-B3E5-430F-980E-D6C0016B2660}

Process Hacker 2.27 (r4957)-->"C:\Program Files\Process Hacker 2\unins000.exe"

ProxySwitcher Standard-->"C:\Program Files (x86)\Proxy Switcher Standard\unins000.exe"

PxMergeModule-->MsiExec.exe /I{024521CF-C07E-4F8E-8481-0D75695E03AF}

Python 2.7.2 (64-bit)-->MsiExec.exe /I{2E295B5B-1AD4-4D36-97C2-A316084722C0}

Quick Uninstall Tool for Autodesk Inventor 2012-->MsiExec.exe /X{D25FF5C1-1664-469A-9794-69309387C193}

Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.exe" -removeonly

Sandboxie 3.68 (64-bit)-->"C:\Windows\Installer\SandboxieInstall64.exe" /remove

SDFormatter-->MsiExec.exe /X{A5355F15-F98B-4704-9BAE-E53B9FE48F48}

Secunia PSI (2.0.0.3003)-->"C:\Program Files (x86)\Secunia\PSI\uninstall.exe"

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {B5BD3CA1-11AB-35A6-B22A-6A219DC0668E} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E720AD01-93D5-3E8E-BB8D-E4EF5AF4E5DD} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {BCD37DCB-F479-3D4D-A90E-A0F7575549C4} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {FF811680-AECE-3F35-A98C-1B84B6E09168} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {6AF6C62E-4E3D-33BF-A591-9E4D53BDF22F} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {5D45782A-1099-317E-ABCC-FF63D5B21386} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E59B2174-E924-311F-8549-AD714C14664D} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {FDD13F1E-9C6B-311E-A0D9-D6E172FC28FF} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7B82A51A-768B-3A7B-ADFA-F777097A8079} /parameterfolder Client

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)-->c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {3162617C-537F-3BB6-8D0C-C6021F442391} /parameterfolder Extended

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)-->c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {9D621E6E-E010-3C80-A055-135891134750} /parameterfolder Extended

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)-->c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {E59B2174-E924-311F-8549-AD714C14664D} /parameterfolder Extended

Security Update for Microsoft Excel 2010 (KB2597166) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{B8512624-C19C-49C0-ABFB-572ADF5F4972}" "1030" "0"

Security Update for Microsoft Office 2010 (KB2553091)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{527AC538-7A51-40A5-89D7-5C1FEBBEA4C3}" "1030" "0"

Security Update for Microsoft Office 2010 (KB2553096)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{C4BF81CC-3786-4CE4-9D9F-DD393678B9EC}" "1030" "0"

Security Update for Microsoft Office 2010 (KB2553371) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{0F6C4F72-6084-437B-9B35-F59B09E3C1B0}" "1030" "0"

Security Update for Microsoft Office 2010 (KB2589320) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{297E6E47-5F6E-4DD8-B880-75944B5C1C7C}" "1030" "0"

Security Update for Microsoft PowerPoint 2010 (KB2553185) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{3E112FB8-14E5-4088-80AC-574FC376BCFE}" "1030" "0"

Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{97C3086D-D78B-43ED-9E13-1ED4704298FB}" "1030" "0"

Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0043-0000-1000-0000000FF1CE}" "{97C3086D-D78B-43ED-9E13-1ED4704298FB}" "1030" "0"

Security Update for Microsoft Visio Viewer 2010 (KB2597981) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{C37E7477-0E37-465F-81B8-6085454CFEE2}" "1030" "0"

Security Update for Microsoft Visual Studio 2010 Ultimate - ENU (KB2645410)-->c:\Windows\SysWOW64\msiexec.exe /package {BC0464FA-A0BA-3E38-85BF-DC5B3A401F48} /uninstall {3A02AD1D-6903-3E0E-8EA9-A9121A0B06ED} /qb+ REBOOTPROMPT=""

Security Update for Microsoft Visual Studio Macro Tools (KB2669970)-->c:\Windows\SysWOW64\msiexec.exe /package {6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3} /uninstall {CA6C4E8E-CE86-4C78-B4BC-1E083E8E613A} /qb+ REBOOTPROMPT=""

Service Pack 3 for SQL Server 2008 (KB2546951) (64-bit)-->"c:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Update Cache\KB2546951\ServicePack\setup.exe" /Action=RemovePatch /AllInstances

Skype™ 5.8-->MsiExec.exe /X{1845470B-EB14-4ABC-835B-E36C693DC07D}

Soluto-->MsiExec.exe /X{012C87CF-282E-4142-84F8-DCDD07F54182}

SonicMaster-->MsiExec.exe /I{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}

Spybot - Search & Destroy-->"C:\Program Files (x86)\Spybot - Search & Destroy\unins000.exe"

Sql Server Customer Experience Improvement Program-->MsiExec.exe /I{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}

SUPER © v2012.build.50 (February 21st, 2012) version v2012.buil-->"C:\Program Files (x86)\eRightSoft\SUPER\unins000.exe"

SUPERAntiSpyware-->"C:\Program Files\SUPERAntiSpyware\Uninstall.exe"

System Requirements Lab for Intel-->MsiExec.exe /I{C5DA59CF-2BB8-48D5-8E5B-17F2E0F0FEE4}

System Requirements Lab-->C:\Program Files (x86)\SystemRequirementsLab\Uninstall.exe

TeamViewer 7-->C:\Program Files (x86)\TeamViewer\Version7\uninstall.exe

TI-Nspire CAS Student Software-->C:\Program Files (x86)\TI Education\TI-Nspire CAS Student Software\Uninstall.exe

TmNationsForever-->"C:\Program Files (x86)\TmNationsForever\unins000.exe"

tools-freebsd-->MsiExec.exe /X{003BFBBD-6C67-419E-A24D-0DCAFC3A5249}

tools-linux-->MsiExec.exe /X{D102611A-6466-4101-A51D-51069303AC65}

tools-netware-->MsiExec.exe /X{197597A7-AD33-4898-9D8E-73066818B464}

tools-solaris-->MsiExec.exe /X{AB1C87CB-1807-4CF0-B4C2-CEE14C18CDB4}

tools-windows-->MsiExec.exe /X{FFD9383C-01D5-4897-A954-43AF599AED30}

tools-winPre2k-->MsiExec.exe /X{AE0F62A7-A1A2-407F-9F4C-48939BD9AD8D}

Total Commander (Remove or Repair)-->C:\Program Files (x86)\totalcmd\tcuninst.exe

TreeSize Free V2.7-->"C:\Program Files (x86)\JAM Software\TreeSize Free\unins000.exe"

TrueCrypt-->"C:\Program Files\TrueCrypt\TrueCrypt Setup.exe" /u

TunnelBear 1.0.28-->C:\Program Files (x86)\TunnelBear\uninst.exe

Unit Conversion Tool 5.1-->"C:\Program Files (x86)\Unit Conversion Tool\unins000.exe"

Unlocker 1.9.1-x64-->C:\Program Files\Unlocker\uninst.exe

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {29C7BE97-DE59-37A2-A687-2ADD5321948A} /parameterfolder Client

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {A45DD0BE-3CD9-3F1E-B233-B90C6983AE77} /parameterfolder Client

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7D799A81-5661-3159-BF92-754161CED6E6} /parameterfolder Client

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {4DFA8287-EA36-3469-99FE-F568FEC81653} /parameterfolder Client

Update for Microsoft .NET Framework 4 Extended (KB2468871)-->c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {29C7BE97-DE59-37A2-A687-2ADD5321948A} /parameterfolder Extended

Update for Microsoft .NET Framework 4 Extended (KB2533523)-->c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {7D799A81-5661-3159-BF92-754161CED6E6} /parameterfolder Extended

Update for Microsoft .NET Framework 4 Extended (KB2600217)-->c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {4DFA8287-EA36-3469-99FE-F568FEC81653} /parameterfolder Extended

Update for Microsoft Office 2010 (KB2494150)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{428CB7A0-1068-4CE1-8835-39C7ECD297ED}" "1030" "0"

Update for Microsoft Office 2010 (KB2553065)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{57CEB66B-DD29-4883-92A2-671331657B52}" "1030" "0"

Update for Microsoft Office 2010 (KB2553092)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{E636FE63-842B-4F4B-9884-DA189ACC0B91}" "1030" "0"

Update for Microsoft Office 2010 (KB2553092)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0044-0406-1000-0000000FF1CE}" "{E636FE63-842B-4F4B-9884-DA189ACC0B91}" "1030" "0"

Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{E24F10E6-7D9B-4E3A-B6CF-4C3257A382CD}" "1030" "0"

Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0043-0000-1000-0000000FF1CE}" "{E24F10E6-7D9B-4E3A-B6CF-4C3257A382CD}" "1030" "0"

Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{3E381AC3-30C3-41D7-9B27-B3F3E17BDCB8}" "1030" "0"

Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0406-1000-0000000FF1CE}" "{785E375A-880E-439C-9717-FDC2275E772B}" "1030" "0"

Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0407-1000-0000000FF1CE}" "{74D7080E-57AC-419D-9AA0-D277114D213F}" "1030" "0"

Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-0409-1000-0000000FF1CE}" "{4EB7D2FF-CC3E-4FC1-B4DB-CE3DCCCC8559}" "1030" "0"

Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001F-041D-1000-0000000FF1CE}" "{2EC07C22-E2AA-465E-8E56-F64FDB66B8A1}" "1030" "0"

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{16E045BF-8CE5-4F20-A0DA-F7F495D239D0}" "1030" "0"

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0043-0000-1000-0000000FF1CE}" "{16E045BF-8CE5-4F20-A0DA-F7F495D239D0}" "1030" "0"

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-006E-0406-1000-0000000FF1CE}" "{EDBC6672-1C74-44B1-87F5-DF947B3E0A9E}" "1030" "0"

Update for Microsoft Office 2010 (KB2553385) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{1AD9A591-B1A3-4B57-91A8-8E0CEDE538C1}" "1030" "0"

Update for Microsoft Office 2010 (KB2566458)-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0043-0000-1000-0000000FF1CE}" "{A6C194EA-C6CB-4314-9E43-AD1F4A1E9D74}" "1030" "0"

Update for Microsoft Office 2010 (KB2597091) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{BC9AC000-70B4-4941-AE86-AF12D036E076}" "1030" "0"

Update for Microsoft Office 2010 (KB2597091) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0043-0000-1000-0000000FF1CE}" "{BC9AC000-70B4-4941-AE86-AF12D036E076}" "1030" "0"

Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-00A1-0406-1000-0000000FF1CE}" "{633A0AAE-85AB-40F9-AED1-AED642C1E530}" "1030" "0"

Update for Microsoft OneNote 2010 (KB2589345) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{93235108-E80B-4BFE-9BD2-176E5F14DCCF}" "1030" "0"

Update for Microsoft OneNote 2010 (KB2589345) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0043-0000-1000-0000000FF1CE}" "{93235108-E80B-4BFE-9BD2-176E5F14DCCF}" "1030" "0"

Update for Microsoft Outlook 2010 (KB2553248) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{ABC643B5-0ADF-4511-B521-D99D9A822AD2}" "1030" "0"

Update for Microsoft Outlook 2010 (KB2553248) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0406-1000-0000000FF1CE}" "{69D1C8D4-D28E-4C37-9693-35B1BB6B3A0C}" "1030" "0"

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0011-0000-1000-0000000FF1CE}" "{7861C766-2AA2-4A50-AB75-A57D451CEA76}" "1030" "0"

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-001A-0406-1000-0000000FF1CE}" "{A195F773-B89C-48FA-8355-530A8C286AD4}" "1030" "0"

UX 15.0a1 (x64 en-US)-->C:\Program Files\UX\uninstall\helper.exe

Visual Studio 2010 Prerequisites - English-->MsiExec.exe /X{662014D2-0450-37ED-ABAE-157C88127BEB}

Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU-->MsiExec.exe /X{112C23F2-C036-4D40-BED4-0CB47BF5555C}

VLC media player 2.0.1-->C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe

VmciSockets-->MsiExec.exe /I{2BE3C45C-B0E3-4061-A3C5-C6ED9639C813}

VMware Workstation-->C:\ProgramData\VMware\VMware Workstation\Uninstaller\uninstall.exe -x -S "C:\ProgramData\VMware\VMware Workstation\Uninstaller\"

VMware Workstation-->MsiExec.exe /I{0D94F75A-0EA6-4951-B3AF-B145FA9E05C6}

WampServer 2.2-->"c:\wamp\unins000.exe"

WCF RIA Services V1.0 SP1-->MsiExec.exe /X{D9E6001A-5DC3-4620-AF7A-80B6CD48645D}

Web Deployment Tool-->MsiExec.exe /I{0F37D969-1260-419E-B308-EF7D29ABDE20}

WinFlash-->MsiExec.exe /X{8F21291E-0444-4B1D-B9F9-4370A73E346D}

WinPcap 4.1.2-->C:\Program Files (x86)\WinPcap\uninstall.exe

WinRAR 4.00 (64-bit)-->C:\Program Files\WinRAR\uninstall.exe

Wireless Console 3-->MsiExec.exe /I{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}

Wireshark 1.6.6-->"C:\Program Files\Wireshark\uninstall.exe"

Wolfram Mathematica 8 (M-WIN-L 8.0.1 2063990)-->"C:\Program Files\Wolfram Research\Mathematica\8.0\SystemFiles\UninstallFiles\Windows\unins000.exe"

Wondershare PDF to Word (Build 3.6.0)-->"C:\Program Files (x86)\Wondershare\PDFtoWord\unins000.exe"

Xirrus Wi-Fi Inspector-->MsiExec.exe /I{BBB21AB1-2C45-435D-A05A-B563072E7B9B}

======Hosts File======

127.0.0.1 activate.adobe.com

127.0.0.1 practivate.adobe.com

127.0.0.1 swupmf.adobe.com # added after Fiddler sniff

127.0.0.1 www.wip.adobe.com

127.0.0.1 www.wip1.adobe.com

127.0.0.1 www.wip2.adobe.com

127.0.0.1 www.wip3.adobe.com

127.0.0.1 www.wip4.adobe.com

127.0.0.1 *.google-analytics.com

127.0.0.1 199.7.52.190

======System event log======

Computer Name: My-PC

Event Code: 3

Message: A command sent to the adapter has timed out. The adapter did not respond.

Record Number: 60171

Source Name: BTHUSB

Time Written: 20120110110459.975609-000

Event Type: Warning

User:

Computer Name: My-PC

Event Code: 2001

Message: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 1.117.2495.0

Update Source: Microsoft Update Server

Update Stage: Search

Source Path: http://www.microsoft.com

Signature Type: AntiVirus

Update Type: Full

User: NT AUTHORITY\SYSTEM

Current Engine Version:

Previous Engine Version: 1.1.7903.0

Error code: 0x80244017

Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

Record Number: 60155

Source Name: Microsoft Antimalware

Time Written: 20120110073703.000000-000

Event Type: Error

User:

Computer Name: My-PC

Event Code: 36888

Message: The following fatal alert was generated: 10. The internal error state is 10.

Record Number: 60142

Source Name: Schannel

Time Written: 20120110072938.703384-000

Event Type: Error

User: NT AUTHORITY\SYSTEM

Computer Name: My-PC

Event Code: 36888

Message: The following fatal alert was generated: 10. The internal error state is 10.

Record Number: 60141

Source Name: Schannel

Time Written: 20120110072936.503780-000

Event Type: Error

User: NT AUTHORITY\SYSTEM

Computer Name: My-PC

Event Code: 3002

Message: Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.

Feature: Behavior Monitoring

Error Code: 0x80004005

Error description: Unspecified error

Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

Record Number: 60134

Source Name: Microsoft Antimalware

Time Written: 20120110072849.000000-000

Event Type: Error

User:

=====Application event log=====

Computer Name: My-PC

Event Code: 1530

Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -

6 user registry handles leaked from \Registry\User\S-1-5-21-1990530906-4165506631-22784256-1000:

Process 1308 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1990530906-4165506631-22784256-1000\Software

Process 1308 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1990530906-4165506631-22784256-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Process 1308 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1990530906-4165506631-22784256-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Process 1308 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1990530906-4165506631-22784256-1000\Software\Microsoft\Internet Explorer\Main

Process 1308 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1990530906-4165506631-22784256-1000\Software\Policies

Record Number: 23732

Source Name: Microsoft-Windows-User Profiles Service

Time Written: 20111129142510.729904-000

Event Type: Warning

User: NT AUTHORITY\SYSTEM

Computer Name: My-PC

Event Code: 1000

Message: Faulting application name: SSUPDATE64.EXE, version: 1.0.0.1072, time stamp: 0x4e456f7e

Faulting module name: SSUPDATE64.EXE, version: 1.0.0.1072, time stamp: 0x4e456f7e

Exception code: 0xc0000005

Fault offset: 0x0000000000023498

Faulting process id: 0x1e10

Faulting application start time: 0x01ccae99a687f40f

Faulting application path: C:\Program Files\SUPERAntiSpyware\SSUPDATE64.EXE

Faulting module path: C:\Program Files\SUPERAntiSpyware\SSUPDATE64.EXE

Report Id: eb40d1ff-1a8c-11e1-ba0e-005056c00008

Record Number: 23729

Source Name: Application Error

Time Written: 20111129132035.000000-000

Event Type: Error

User:

Computer Name: My-PC

Event Code: 1000

Message: Faulting application name: Skype.exe, version: 5.5.0.124, time stamp: 0x4e96a02b

Faulting module name: RPCRT4.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba59

Exception code: 0xc0000005

Fault offset: 0x0003b565

Faulting process id: 0x1030

Faulting application start time: 0x01ccaddae2bbd8b0

Faulting application path: C:\Program Files (x86)\Skype\Phone\Skype.exe

Faulting module path: C:\Windows\syswow64\RPCRT4.dll

Report Id: 2c27bc3d-19da-11e1-ba0e-005056c00008

Record Number: 23644

Source Name: Application Error

Time Written: 20111128160104.000000-000

Event Type: Error

User:

Computer Name: My-PC

Event Code: 0

Message:

Record Number: 23577

Source Name: TurboBoost

Time Written: 20111128143248.000000-000

Event Type: Oplysninger

User:

Computer Name: My-PC

Event Code: 0

Message:

Record Number: 23459

Source Name: TurboBoost

Time Written: 20111128073907.000000-000

Event Type: Oplysninger

User:

=====Security event log=====

Computer Name: My-PC

Event Code: 4672

Message: Special privileges assigned to new logon.

Subject:

Security ID: S-1-5-18

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege

SeTcbPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

SeAuditPrivilege

SeSystemEnvironmentPrivilege

SeImpersonatePrivilege

Record Number: 29282

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20120128205409.597247-000

Event Type: Audit Success

User:

Computer Name: My-PC

Event Code: 4624

Message: An account was successfully logged on.

Subject:

Security ID: S-1-5-18

Account Name: MY-PC$

Account Domain: WORKGROUP

Logon ID: 0x3e7

Logon Type: 5

New Logon:

Security ID: S-1-5-18

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3e7

Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:

Process ID: 0x304

Process Name: C:\Windows\System32\services.exe

Network Information:

Workstation Name:

Source Network Address: -

Source Port: -

Detailed Authentication Information:

Logon Process: Advapi

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.

- Transited services indicate which intermediate services have participated in this logon request.

- Package name indicates which sub-protocol was used among the NTLM protocols.

- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Record Number: 29281

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20120128205409.597247-000

Event Type: Audit Success

User:

Computer Name: My-PC

Event Code: 4672

Message: Special privileges assigned to new logon.

Subject:

Security ID: S-1-5-18

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege

SeTcbPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeBackupPrivilege

SeRestorePrivilege

SeDebugPrivilege

SeAuditPrivilege

SeSystemEnvironmentPrivilege

SeImpersonatePrivilege

Record Number: 29280