Tsurugi Posted November 23, 2012 ID:616453 Share Posted November 23, 2012 Hi,Recently I get Malwarebytes popups from disktray indicating that it has blocked a potentially malicious connection. Like in the title, it usually happens with svchost. Occasionally it would happen with my torrent client as well. At times there would only be a few seconds between new popups. I'm still have 3 days of trial left and not sure whether or not this should go unchecked.dds.txtattach.txt Link to post Share on other sites More sharing options...
TheDarkKnight Posted November 24, 2012 ID:616552 Share Posted November 24, 2012 I am TheDarkKnight and will be assisting you. Please ask questions if anything is unclear. Recently I get Malwarebytes popups from disktray indicating that it has blocked a potentially malicious connection. Like in the title, it usually happens with svchost. Occasionally it would happen with my torrent client as well. Using peer-to-peer programs is risky, and as you have identified can be dangerous. I strongly recommend you uninstall your torrent client. Please follow these instructions to run ComboFix.exe. Please visit this webpage for download links and instructions for running this tool: http://www.bleepingc...to-use-combofix * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix (CF). Please go here to see a list of programs that need to be disabled. **Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall.** **Note 2: If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.** Please include the C:\ComboFix.txt in your next reply for further review. ===== Also, please download Malwarebytes Anti-Rootkit here. Unzip the contents to a folder on the Desktop.Open the folder where the contents were unzipped and run mbar.exe ( right-click and select Run as adminsistrator for Vista and Windows 7).Follow the instructions in the wizard to update and allow the program to scan your computer for threats.Click on the Cleanup button to remove any threats and reboot if prompted to do so.Wait while the system shuts down and the cleanup process is performed.Please post the two logs produced. Please note: This tool is still in BETA mode, so please ensure you have backed up any important files. ===== In your reply please provide the contents of the following logs:ComboFix.txt.Both MBAR logs. How is the computer running? Link to post Share on other sites More sharing options...
Tsurugi Posted November 24, 2012 Author ID:616717 Share Posted November 24, 2012 Sorry it took so long, backup took longer than expected.MBAR detected no issuesWould MBAR be able to detect an infection if the infection isn't running?Computer's running fine though.ComboFix.txtmbar-log-2012-11-24 (11-21-52).txtsystem-log.txt Link to post Share on other sites More sharing options...
TheDarkKnight Posted November 24, 2012 ID:616808 Share Posted November 24, 2012 Hey Tsurugi,Please post the contents of the logs, as malware writers would like nothing more than to infect computers of helpers, such as myself. Thanks! Link to post Share on other sites More sharing options...
Tsurugi Posted November 24, 2012 Author ID:616819 Share Posted November 24, 2012 Here you go.ComboFix 12-11-24.01 - Sihan 11/24/12 10:58:51.1.4 - x64Microsoft Windows 7 Ultimate 6.1.7601.1.1252.2.1033.18.3893.2172 [GMT -5:00]Running from: c:\users\Sihan\Downloads\ComboFix.exeAV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\programdata\6bf8e6b612f139528f8acbe8c85c0705_cc:\programdata\FullRemove.exec:\windows\apppatch\AppLoc.exec:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb..((((((((((((((((((((((((( Files Created from 2012-10-24 to 2012-11-24 )))))))))))))))))))))))))))))))..2012-11-24 16:07 . 2012-11-24 16:07 -------- d-----w- c:\users\Default\AppData\Local\temp2012-11-24 13:37 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1626C5FB-E86A-4D25-8D4A-C59405B05AA1}\mpengine.dll2012-11-23 12:04 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll2012-11-19 18:52 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys2012-11-19 18:52 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys2012-11-19 18:52 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll2012-11-19 18:52 . 2012-08-24 18:04 307200 ----a-w- c:\windows\system32\ncrypt.dll2012-11-19 18:52 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll2012-11-19 18:52 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll2012-11-19 18:52 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll2012-11-19 18:52 . 2012-08-24 16:57 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll2012-11-19 18:52 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll2012-11-16 07:22 . 2012-07-26 08:38 2560 ----a-w- c:\windows\system32\drivers\ja-JP\wdf01000.sys.mui2012-11-16 07:22 . 2012-07-26 07:37 2560 ----a-w- c:\windows\system32\drivers\zh-CN\wdf01000.sys.mui2012-11-16 07:22 . 2012-07-26 05:18 2560 ----a-w- c:\windows\system32\drivers\zh-TW\wdf01000.sys.mui2012-11-16 07:22 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys2012-11-16 07:22 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys2012-11-16 07:22 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui2012-11-16 07:22 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll2012-11-16 07:12 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll2012-11-16 07:12 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll2012-11-16 07:12 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys2012-11-16 07:12 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys2012-11-16 07:12 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll2012-11-16 07:12 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe2012-11-16 07:12 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll2012-11-16 03:00 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll2012-11-16 03:00 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll2012-11-13 00:13 . 2012-11-13 00:13 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll2012-11-13 00:13 . 2012-11-13 00:13 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll2012-11-13 00:13 . 2012-11-13 00:13 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll2012-11-13 00:13 . 2012-11-13 00:13 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll2012-11-13 00:13 . 2012-11-13 00:13 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll2012-11-13 00:13 . 2012-11-13 00:13 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll2012-11-13 00:13 . 2012-11-13 00:13 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll2012-11-12 14:32 . 2012-11-12 14:32 -------- d-----w- c:\program files (x86)\stinger2012-11-12 14:31 . 2012-11-12 14:31 -------- d-----w- c:\users\Sihan\AppData\Roaming\Malwarebytes2012-11-12 14:31 . 2012-11-12 14:31 -------- d-----w- c:\programdata\Malwarebytes2012-11-12 14:31 . 2012-11-12 14:31 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware2012-11-12 14:31 . 2012-09-30 00:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys2012-11-08 20:50 . 2012-11-08 20:50 -------- d-----w- c:\windows\system32\atheros2012-10-31 14:32 . 2012-09-25 03:16 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-11-16 07:13 . 2011-08-02 13:42 66395536 ----a-w- c:\windows\system32\MRT.exe2012-11-09 14:41 . 2012-06-12 22:39 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2012-11-09 14:41 . 2012-06-12 22:39 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2012-10-25 08:12 . 2012-10-25 08:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx2012-10-25 08:12 . 2012-10-25 08:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts2012-10-21 21:32 . 2011-08-04 22:56 466456 ----a-w- c:\windows\system32\wrap_oal.dll2012-10-21 21:32 . 2011-08-04 22:56 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll2012-10-21 21:32 . 2011-08-04 22:56 122904 ----a-w- c:\windows\system32\OpenAL32.dll2012-10-21 21:32 . 2011-08-04 22:56 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll2012-10-21 03:52 . 2012-10-21 03:52 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin2012-10-08 21:24 . 2012-10-08 21:24 10220472 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe2012-09-27 02:14 . 2012-10-19 22:33 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{46D761BA-DFDE-474A-9D41-6C475F95AA37}\gapaengine.dll2012-09-27 02:14 . 2011-10-11 12:59 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll2012-09-24 16:42 . 2011-12-03 09:20 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll2012-09-24 16:42 . 2011-12-03 09:20 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll2012-09-14 19:19 . 2012-10-10 13:34 2048 ----a-w- c:\windows\system32\tzres.dll2012-09-14 18:28 . 2012-10-10 13:34 2048 ----a-w- c:\windows\SysWow64\tzres.dll2012-09-13 05:44 . 2012-10-13 20:05 17936 ----a-w- c:\windows\system32\nitrolocalui2.dll2012-09-13 05:44 . 2012-10-13 20:05 29712 ----a-w- c:\windows\system32\nitrolocalmon2.dll2012-09-01 00:16 . 2012-06-11 22:59 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll2012-09-01 00:16 . 2011-08-28 22:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll2012-08-31 18:19 . 2012-10-10 13:34 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys2012-08-31 02:03 . 2012-08-31 02:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys2012-08-31 02:03 . 2011-04-27 19:25 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys2012-08-30 18:03 . 2012-10-10 13:34 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe2012-08-30 17:12 . 2012-10-10 13:34 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe2012-08-30 17:12 . 2012-10-10 13:34 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2011-10-31 21:02 94208 ----a-w- c:\users\Sihan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2011-10-31 21:02 94208 ----a-w- c:\users\Sihan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2011-10-31 21:02 94208 ----a-w- c:\users\Sihan\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-10-09 39408]"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]"Xvid"="c:\program files (x86)\Xvid\CheckUpdate.exe" [2011-01-17 8192].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-10 421776]"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-09-24 296096]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]"aux3"=wdmaud.drv.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@="".[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]@="Service".R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]R2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2012-09-07 100864]R2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [x]R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-10-02 3064000]R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-02 1255736]R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-08-01 41704]S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2010-10-07 13824]S2 DSUDiskOptimizer;DSUDiskOptimizer;c:\program files (x86)\Disk Speedup\DSUDefragSrv64.exe [2012-02-16 690488]S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432]S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936]S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [2012-10-23 103472]S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2012-09-13 229392]S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2010-12-23 11576]S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-04-01 136192]S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976]S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-08-30 289280]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-30 25928]S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264]..Contents of the 'Scheduled Tasks' folder.2012-11-24 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-12 14:41].2012-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-09 02:59].2012-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-09 02:59].2012-11-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2942724973-3254444484-952029406-1000Core.job- c:\users\Sihan\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-09 22:31].2012-11-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2942724973-3254444484-952029406-1000UA.job- c:\users\Sihan\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-09 22:31].2012-11-23 c:\windows\Tasks\RegClean Pro_DEFAULT.job- c:\program files (x86)\RegClean Pro\RegCleanPro.exe [2011-11-17 20:37].2012-11-22 c:\windows\Tasks\RegClean Pro_UPDATES.job- c:\program files (x86)\RegClean Pro\RegCleanPro.exe [2011-11-17 20:37]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2011-10-31 21:02 97792 ----a-w- c:\users\Sihan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2011-10-31 21:02 97792 ----a-w- c:\users\Sihan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2011-10-31 21:02 97792 ----a-w- c:\users\Sihan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2011-10-31 21:02 97792 ----a-w- c:\users\Sihan\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-07 10144288]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-11-29 161304]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-11-29 386584]"Persistence"="c:\windows\system32\igfxpers.exe" [2010-11-29 415256]"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2010-12-17 438784]"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]"NCInstallQueue"="netman.dll" [2009-07-14 360448].------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmuStart Page = hxxp://samsung.msn.commStart Page = hxxp://samsung.msn.commLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.localIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000IE: Se&nd to OneNoteIE: Translate this web page with BabylonIE: Translate with BabylonTCP: DhcpNameServer = 192.168.0.1FF - ProfilePath - c:\users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\FF - prefs.js: keyword.URL - hxxp://ca.search.yahoo.com/search?fr=mcafee&p=FF - ExtSQL: 2012-09-24 12:42; {0153E448-190B-4987-BDE1-F256CADA672F}; c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext.- - - - ORPHANS REMOVED - - - -.Toolbar-Locked - (no file)Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exeBHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)Toolbar-Locked - (no file)HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\McAfee]"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2012-11-24 11:10:49ComboFix-quarantined-files.txt 2012-11-24 16:10.Pre-Run: 115,859,075,072 bytes freePost-Run: 117,065,363,456 bytes free.- - End Of File - - C9833BA8191EF47E25AD95D8919C05DA------------------------------------------------------------mbarMalwarebytes Anti-Rootkit 1.1.0.1009www.malwarebytes.orgDatabase version: v2012.11.24.06Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421Sihan :: SIHAN-PC [administrator]11/24/12 11:21:52 AMmbar-log-2012-11-24 (11-21-52).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/ShurikenScan options disabled: PUP | PUM | P2PObjects scanned: 27747Time elapsed: 8 minute(s), 11 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end)---------------------------------------Malwarebytes Anti-Rootkit BETA 1.01.0.1009© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 9.0.8112.16421File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.527000 GHzMemory total: 4081635328, free: 2020954112------------ Kernel report ------------ 11/24/2012 11:13:04------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\DRIVERS\iaStor.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\system32\DRIVERS\MpFilter.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\drivers\disk.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\hssdrv6.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\DRIVERS\termdd.sys\??\C:\windows\system32\Drivers\SABI.sys\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\DRIVERS\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\DRIVERS\HDAudBus.sys\SystemRoot\system32\DRIVERS\athrx.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\DRIVERS\yk62x64.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\i8042prt.sys\SystemRoot\system32\DRIVERS\kbdclass.sys\SystemRoot\system32\DRIVERS\ETD.sys\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\DRIVERS\Impcd.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\DRIVERS\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\rdpbus.sys\SystemRoot\system32\DRIVERS\swenum.sys\SystemRoot\system32\DRIVERS\ks.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\IntcDAud.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_iaStor.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\System32\Drivers\usbvideo.sys\SystemRoot\system32\DRIVERS\hidusb.sys\SystemRoot\system32\DRIVERS\HIDCLASS.SYS\SystemRoot\system32\DRIVERS\HIDPARSE.SYS\SystemRoot\system32\DRIVERS\LHidFilt.Sys\SystemRoot\system32\DRIVERS\mouhid.sys\SystemRoot\system32\DRIVERS\LMouFilt.Sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\??\C:\windows\system32\drivers\mbam.sys\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\system32\drivers\npf.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\DRIVERS\srvnet.sys\??\C:\windows\system32\Drivers\SSPORT.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\DRIVERS\asyncmac.sys\??\C:\windows\system32\Drivers\PROCEXP113.SYS\??\C:\windows\system32\drivers\mbamchameleon.sys\??\C:\windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\user32.dll\Windows\System32\msctf.dll\Windows\System32\nsi.dll\Windows\System32\ole32.dll\Windows\System32\clbcatq.dll\Windows\System32\sechost.dll\Windows\System32\lpk.dll\Windows\System32\difxapi.dll\Windows\System32\iertutil.dll\Windows\System32\kernel32.dll\Windows\System32\comdlg32.dll\Windows\System32\usp10.dll\Windows\System32\imm32.dll\Windows\System32\shell32.dll----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa8004496060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IAAStorageDevice-1\Lower Device Object: 0xfffffa8004350050Lower Device Driver Name: \Driver\iaStor\Driver name found: iaStorDriverEntry returned 0x0Function returned 0x0Downloaded database version: v2012.11.24.06Downloaded database version: v2012.11.19.01Initializing...Done!Scanning directory: C:\windows\system32\drivers...<<<2>>>Device number: 0, partition: 3Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa8004496060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8004496b90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8004496060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8004350050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\------------ End ----------Upper DeviceData: 0xfffff8a00d24b820, 0xfffffa8004496060, 0xfffffa8004151790Lower DeviceData: 0xfffff8a01121bd10, 0xfffffa8004350050, 0xfffffa80082f21f0<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: BDC35F75Partition information: Partition 0 type is Other (0x27) Partition is NOT ACTIVE. Partition starts at LBA: 2048 Numsec = 41943040 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 41945088 Numsec = 204800 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 42149888 Numsec = 484442112 Partition 3 type is Extended with LBA (0xf) Partition is NOT ACTIVE. Partition starts at LBA: 526592000 Numsec = 723668992Disk Size: 640135028736 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-2047-1250243728-1250263728)...Done!Performing system, memory and registry scan...Done!Scan finished=======================================---------------------------------------Malwarebytes Anti-Rootkit BETA 1.01.0.1009© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 9.0.8112.16421File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.527000 GHzMemory total: 4081635328, free: 1510436864------------ Kernel report ------------ 11/24/2012 12:16:29------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\DRIVERS\iaStor.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\system32\DRIVERS\MpFilter.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\drivers\disk.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\hssdrv6.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\DRIVERS\termdd.sys\??\C:\windows\system32\Drivers\SABI.sys\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\DRIVERS\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\DRIVERS\HDAudBus.sys\SystemRoot\system32\DRIVERS\athrx.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\DRIVERS\yk62x64.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\i8042prt.sys\SystemRoot\system32\DRIVERS\kbdclass.sys\SystemRoot\system32\DRIVERS\ETD.sys\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\DRIVERS\Impcd.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\DRIVERS\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\rdpbus.sys\SystemRoot\system32\DRIVERS\swenum.sys\SystemRoot\system32\DRIVERS\ks.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\IntcDAud.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_iaStor.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\System32\Drivers\usbvideo.sys\SystemRoot\system32\DRIVERS\hidusb.sys\SystemRoot\system32\DRIVERS\HIDCLASS.SYS\SystemRoot\system32\DRIVERS\HIDPARSE.SYS\SystemRoot\system32\DRIVERS\LHidFilt.Sys\SystemRoot\system32\DRIVERS\mouhid.sys\SystemRoot\system32\DRIVERS\LMouFilt.Sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\??\C:\windows\system32\drivers\mbam.sys\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\system32\drivers\npf.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\DRIVERS\srvnet.sys\??\C:\windows\system32\Drivers\SSPORT.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\DRIVERS\asyncmac.sys\??\C:\windows\system32\Drivers\PROCEXP113.SYS\SystemRoot\system32\DRIVERS\NisDrvWFP.sys\??\C:\windows\system32\drivers\mbamchameleon.sys\??\C:\windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\user32.dll\Windows\System32\msctf.dll\Windows\System32\nsi.dll\Windows\System32\ole32.dll\Windows\System32\clbcatq.dll\Windows\System32\sechost.dll\Windows\System32\lpk.dll\Windows\System32\difxapi.dll\Windows\System32\iertutil.dll\Windows\System32\kernel32.dll\Windows\System32\comdlg32.dll\Windows\System32\usp10.dll\Windows\System32\imm32.dll\Windows\System32\shell32.dll----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa8004496060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IAAStorageDevice-1\Lower Device Object: 0xfffffa8004350050Lower Device Driver Name: \Driver\iaStor\Device already Exists: 0xfffffa80082f21f0Downloaded database version: v2012.11.24.07Initializing...Done!Scanning directory: C:\windows\system32\drivers...<<<2>>>Device number: 0, partition: 3Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa8004496060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8004496b90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8004496060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8004350050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\------------ End ----------Upper DeviceData: 0xfffff8a00723c950, 0xfffffa8004496060, 0xfffffa8004151790Lower DeviceData: 0xfffff8a003c16ed0, 0xfffffa8004350050, 0xfffffa80082f21f0<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: BDC35F75Partition information: Partition 0 type is Other (0x27) Partition is NOT ACTIVE. Partition starts at LBA: 2048 Numsec = 41943040 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 41945088 Numsec = 204800 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 42149888 Numsec = 484442112 Partition 3 type is Extended with LBA (0xf) Partition is NOT ACTIVE. Partition starts at LBA: 526592000 Numsec = 723668992Disk Size: 640135028736 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-2047-1250243728-1250263728)...Done!Performing system, memory and registry scan...Done!Scan finished=======================================---------------------------------------Malwarebytes Anti-Rootkit BETA 1.01.0.1009© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 9.0.8112.16421File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.527000 GHzMemory total: 4081635328, free: 2992607232 Link to post Share on other sites More sharing options...
TheDarkKnight Posted November 24, 2012 ID:616829 Share Posted November 24, 2012 Hello Tsurugi,Thank you for the logs. Nothing of concern there.Please download OTL.exe by OldTimer to your Desktop.Close all windows and double click OTL.exe.In the "Custom Scans/Fixes" window (under the light green bar) paste the following in bold:netsvcsdrivers32%SYSTEMDRIVE%\*.*%systemroot%\*. /mp /sCREATERESTOREPOINTHKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AUHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rsClick Run Scan and let the program run uninterrupted.When the scan completes, it will open two Notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL. Post both logs in this thread.You may need to use two posts to get it all.How is your computer running? Link to post Share on other sites More sharing options...
Tsurugi Posted November 25, 2012 Author ID:617025 Share Posted November 25, 2012 OTL logfile created on: 11/25/2012 9:12:19 AM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sihan\Desktop64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.0.8112.16421)Locale: 00000409 | Country: Canada | Language: ENC | Date Format: M/dd/yy3.80 Gb Total Physical Memory | 2.10 Gb Available Physical Memory | 55.30% Memory free7.60 Gb Paging File | 5.79 Gb Available in Paging File | 76.22% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 231.00 Gb Total Space | 108.52 Gb Free Space | 46.98% Space Free | Partition Type: NTFSDrive D: | 345.07 Gb Total Space | 110.62 Gb Free Space | 32.06% Space Free | Partition Type: NTFSComputer Name: SIHAN-PC | User Name: Sihan | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current user | Include 64bit ScansCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ==========PRC - [2012/11/25 01:53:47 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sihan\Desktop\OTL.exePRC - [2012/10/02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exePRC - [2012/09/29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exePRC - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exePRC - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exePRC - [2012/09/24 11:42:11 | 000,296,096 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exePRC - [2012/09/07 14:37:04 | 000,100,864 | ---- | M] (Freemake) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exePRC - [2012/07/27 15:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exePRC - [2011/12/20 14:52:04 | 002,783,312 | ---- | M] (Samsung Electronics) -- C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exePRC - [2011/09/04 11:45:26 | 003,398,736 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exePRC - [2011/07/28 18:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exePRC - [2011/02/24 20:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXEPRC - [2010/06/08 02:39:00 | 000,847,360 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exePRC - [2010/02/10 09:29:52 | 000,719,360 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exePRC - [2010/01/18 21:34:48 | 002,201,192 | ---- | M] (SEC) -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exePRC - [2010/01/15 07:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exePRC - [2008/09/29 13:09:20 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe========== Modules (No Company Name) ==========MOD - [2011/07/28 18:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dllMOD - [2011/07/28 18:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exeMOD - [2011/06/24 21:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dllMOD - [2011/06/24 21:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dllMOD - [2006/08/11 22:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll========== Services (SafeList) ==========SRV:64bit: - [2012/09/13 00:44:42 | 000,229,392 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe -- (NitroReaderDriverReadSpool2)SRV:64bit: - [2012/09/12 20:21:48 | 000,368,896 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)SRV:64bit: - [2012/09/12 20:21:48 | 000,022,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)SRV:64bit: - [2011/09/27 14:04:08 | 000,359,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)SRV:64bit: - [2010/09/22 04:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)SRV - [2012/11/22 20:02:52 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)SRV - [2012/11/09 09:41:58 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)SRV - [2012/10/23 15:35:40 | 000,103,472 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe -- (McAfee SiteAdvisor Service)SRV - [2012/10/02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)SRV - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)SRV - [2012/09/07 14:37:04 | 000,100,864 | ---- | M] (Freemake) [Auto | Running] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)SRV - [2012/07/27 15:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)SRV - [2012/07/13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)SRV - [2012/02/16 18:32:06 | 000,690,488 | ---- | M] (Systweak Inc., (www.systweak.com)) [Auto | Running] -- C:\Program Files (x86)\Disk Speedup\DSUDefragSrv64.exe -- (DSUDiskOptimizer)SRV - [2011/03/01 07:23:36 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)SRV - [2011/02/24 20:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)SRV - [2010/06/25 12:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd)SRV - [2010/06/01 01:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)SRV - [2008/09/29 13:09:20 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)========== Driver Services (SafeList) ==========DRV:64bit: - [2012/09/29 19:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)DRV:64bit: - [2012/08/30 21:03:48 | 000,128,456 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)DRV:64bit: - [2012/08/23 09:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)DRV:64bit: - [2012/08/23 09:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)DRV:64bit: - [2012/08/23 09:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)DRV:64bit: - [2012/08/21 12:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:64bit: - [2012/08/01 13:13:42 | 000,041,704 | ---- | M] (AnchorFree Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\hssdrv6.sys -- (HssDRV6)DRV:64bit: - [2012/08/01 13:13:40 | 000,038,632 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)DRV:64bit: - [2012/07/09 12:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)DRV:64bit: - [2011/09/02 01:30:36 | 000,060,696 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)DRV:64bit: - [2011/09/02 01:30:24 | 000,066,840 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2010/12/23 01:06:56 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.SYS -- (SSPORT)DRV:64bit: - [2010/11/23 02:12:00 | 001,579,520 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)DRV:64bit: - [2010/11/20 22:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2010/10/06 21:59:00 | 000,013,824 | ---- | M] (SAMSUNG ELECTRONICS) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SABI.sys -- (SABI)DRV:64bit: - [2010/08/30 06:17:36 | 000,289,280 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)DRV:64bit: - [2010/08/25 14:36:02 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)DRV:64bit: - [2010/06/25 12:07:26 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)DRV:64bit: - [2010/04/27 02:57:04 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)DRV:64bit: - [2010/03/31 19:25:14 | 000,136,192 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)DRV:64bit: - [2010/02/26 18:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)DRV:64bit: - [2009/09/28 04:22:00 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2009/06/10 15:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)DRV - [2011/05/25 18:17:46 | 000,015,144 | ---- | M] (Windows ® 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\rtport.sys -- (rtport)DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)DRV - [2004/11/19 10:13:02 | 000,018,848 | ---- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\MLPTDR_Q.SYS -- (MLPTDR_Q)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRCIE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7'>http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://samsung.msn.comIE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBoxIE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7'>http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://samsung.msn.comIE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}IE - HKCU\..\SearchScopes\{09CA4078-966F-4599-B9B1-3C7ECDA33A34}: "URL" = http://ca.search.yahoo.com/search?fr=mcafee&p={SearchTerms}IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7'>http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGHP_enCA452IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local========== FireFox ==========FF - prefs.js..extensions.enabledAddons: clean_and_close@csb7.com:2.5.1FF - prefs.js..extensions.enabledAddons: flashkiller@joli.clic:1.3FF - prefs.js..extensions.enabledAddons: linkalert.conlan@addons.mozilla.com:1.0.2FF - prefs.js..extensions.enabledAddons: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.2.3FF - prefs.js..extensions.enabledAddons: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.4.8.6FF - prefs.js..extensions.enabledAddons: {7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}:1.2.1FF - prefs.js..extensions.enabledAddons: {cd617375-6743-4ee8-bac4-fbf10f35729e}:2.8.9FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10FF - prefs.js..extensions.enabledAddons: {dc572301-7619-498c-a57d-39143191b318}:0.4.0.3FF - prefs.js..extensions.enabledAddons: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:6.3.0.11079FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145FF - prefs.js..extensions.enabledAddons: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.6.2FF - prefs.js..extensions.enabledAddons: {4ED1F68A-5463-4931-9384-8FFF5ED91D92}:3.6.0FF - prefs.js..keyword.URL: "http://ca.search.yahoo.com/search?fr=mcafee&p="FF - user.js - File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.0: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll ( )FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Sihan\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Sihan\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012/10/07 00:00:26 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012/11/06 08:34:44 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/09/24 11:42:40 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/08/03 19:52:59 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/09/24 11:42:40 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/11/22 22:28:26 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/11/22 20:02:36 | 000,000,000 | ---D | M][2011/08/02 07:56:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Extensions[2012/11/24 18:43:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions[2012/11/09 09:39:24 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}[2011/08/02 08:23:46 | 000,004,312 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\clean_and_close@csb7.com.xpi[2012/11/01 20:03:57 | 002,042,908 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\firebug@software.joehewitt.com.xpi[2011/08/02 08:23:46 | 000,028,950 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\flashkiller@joli.clic.xpi[2011/08/02 08:23:46 | 000,101,213 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\linkalert.conlan@addons.mozilla.com.xpi[2012/11/09 09:39:24 | 000,342,379 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi[2012/11/23 06:55:46 | 000,530,519 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi[2012/10/31 06:08:51 | 007,704,305 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}.xpi[2012/11/24 18:43:14 | 000,345,047 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{7CA9CF31-1C73-46CD-8377-85AB71EA771F}.xpi[2012/01/22 11:31:52 | 000,061,700 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{cd617375-6743-4ee8-bac4-fbf10f35729e}.xpi[2012/11/24 00:30:47 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi[2011/10/29 12:11:52 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi[2012/07/23 09:06:26 | 000,702,524 | ---- | M] () (No name found) -- C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi[2012/11/22 22:28:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions[2012/11/22 20:02:35 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}[2012/08/03 19:52:59 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5[2012/11/06 08:34:44 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES (X86)\MCAFEE\SITEADVISOR[2012/10/24 12:50:58 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll[2011/04/14 13:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll[2012/09/24 11:42:24 | 000,129,176 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll[2012/10/24 12:50:17 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml[2012/07/31 08:26:52 | 000,002,027 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\McSiteAdvisor.xml[2012/10/24 12:50:17 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml========== Chrome ==========CHR - homepage: http://www.google.com/CHR - default_search_provider: McAfee (Enabled)CHR - default_search_provider: search_url = http://ca.search.yahoo.com/search?fr=mcafee&p={searchTerms}CHR - default_search_provider: suggest_url =CHR - homepage: http://www.google.com/CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewerCHR - plugin: Native Client (Enabled) = C:\Users\Sihan\AppData\Local\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dllCHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Sihan\AppData\Local\Google\Chrome\Application\23.0.1271.64\pdf.dllCHR - plugin: Shockwave Flash (Enabled) = C:\Users\Sihan\AppData\Local\Google\Chrome\Application\23.0.1271.64\gcswf32.dllCHR - plugin: Shockwave Flash (Disabled) = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dllCHR - plugin: Shockwave Flash (Enabled) = C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dllCHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dllCHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dllCHR - plugin: Freemake np-plugin for google chrome (Enabled) = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0\npFreemake.dllCHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dllCHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dllCHR - plugin: Java Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dllCHR - plugin: RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dllCHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dllCHR - plugin: RealPlayer HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dllCHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dllCHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dllCHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLLCHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLLCHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dllCHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dllCHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dllCHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dllCHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dllCHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dllCHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dllCHR - plugin: RealNetworks Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dllCHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dllCHR - Extension: YouTube = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\CHR - Extension: Google Search = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\CHR - Extension: SiteAdvisor = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.123.1_0\CHR - Extension: Freemake Video Converter = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0\CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_1\CHR - Extension: Skype Click to Call = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\CHR - Extension: Gmail = C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\O1 HOSTS File: ([2012/11/24 11:08:01 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL File not foundO2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)O2:64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found.O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not foundO2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O4:64bit: - HKLM..\Run: [CDAServer] C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe ()O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [igfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)O4 - HKCU..\Run: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe ()O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O8:64bit: - Extra context menu item: Se&nd to OneNote - Reg Error: Value error. File not foundO8:64bit: - Extra context menu item: Translate this web page with Babylon - Reg Error: Value error. File not foundO8:64bit: - Extra context menu item: Translate with Babylon - Reg Error: Value error. File not foundO8 - Extra context menu item: Se&nd to OneNote - Reg Error: Value error. File not foundO8 - Extra context menu item: Translate this web page with Babylon - Reg Error: Value error. File not foundO8 - Extra context menu item: Translate with Babylon - Reg Error: Value error. File not foundO9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O13 - gopher Prefix: missingO16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Reg Error: Key error.)O16:64bit: - DPF: {CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Reg Error: Key error.)O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab (Reg Error: Key error.)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 10.9.2)O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D525E533-2567-4706-84E8-116156EA7EF1}: DhcpNameServer = 192.168.0.1O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)O18:64bit: - Protocol\Handler\livecall - No CLSID value foundO18:64bit: - Protocol\Handler\msnim - No CLSID value foundO18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)O18:64bit: - Protocol\Handler\skype4com - No CLSID value foundO18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value foundO18:64bit: - Protocol\Handler\wlpg - No CLSID value foundO18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O18 - Protocol\Handler\ms-help - No CLSID value foundO18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O32 - HKLM CDRom: AutoRun - 1O34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = ComFile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)Drivers32:64bit: vidc.ffds - ff_vfw.dll ()Drivers32:64bit: vidc.lags - lagarith.dll ( )Drivers32:64bit: vidc.XVID - xvidvfw.dll ()Drivers32: msacm.divxa32 - C:\windows\SysWow64\DivXa32.acm (Packed With Joy !)Drivers32: msacm.l3acm - C:\windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)Drivers32: msacm.lameacm - C:\windows\SysWow64\lameACM.acm (http://www.mp3dev.org/)Drivers32: vidc.cvid - C:\windows\SysWow64\iccvid.dll (Radius Inc.)Drivers32: vidc.DIVX - C:\windows\SysWow64\DivX.dll (DivX, Inc.)Drivers32: vidc.lags - C:\windows\SysWow64\Lagarith.dll ( )Drivers32: vidc.XVID - C:\windows\SysWow64\xvidvfw.dll ()Drivers32: vidc.yv12 - C:\windows\SysWow64\DivX.dll (DivX, Inc.)CREATERESTOREPOINTRestore point Set: OTL Restore Point========== Files/Folders - Created Within 30 Days ==========[2012/11/25 01:53:45 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Sihan\Desktop\OTL.exe[2012/11/24 16:48:56 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN[2012/11/24 11:10:52 | 000,000,000 | ---D | C] -- C:\windows\temp[2012/11/24 10:57:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe[2012/11/24 10:57:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe[2012/11/24 10:57:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe[2012/11/24 10:56:15 | 000,000,000 | ---D | C] -- C:\Qoobox[2012/11/24 10:56:01 | 000,000,000 | ---D | C] -- C:\windows\erdnt[2012/11/23 14:05:51 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Sihan\Desktop\dds.scr[2012/11/22 20:02:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox[2012/11/19 13:54:08 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\RdpGroupPolicyExtension.dll[2012/11/19 13:54:08 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll[2012/11/19 13:54:08 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe[2012/11/19 13:54:06 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\TsUsbGD.sys[2012/11/19 13:54:06 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\rdpvideominiport.sys[2012/11/19 13:54:05 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\TsUsbFlt.sys[2012/11/19 13:54:04 | 000,322,560 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\aaclient.dll[2012/11/19 13:54:04 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\aaclient.dll[2012/11/19 13:54:04 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\rdpendp_winip.dll[2012/11/19 13:54:04 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\MsRdpWebAccess.dll[2012/11/19 13:54:04 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\tsgqec.dll[2012/11/19 13:54:04 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\TsUsbGDCoInstaller.dll[2012/11/19 13:54:04 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\tsgqec.dll[2012/11/19 13:54:04 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\wksprtPS.dll[2012/11/19 13:54:04 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\wksprtPS.dll[2012/11/19 13:54:03 | 003,174,912 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\rdpcorets.dll[2012/11/19 13:54:03 | 001,123,840 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mstsc.exe[2012/11/19 13:54:03 | 001,048,064 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mstsc.exe[2012/11/19 13:54:03 | 000,384,000 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\wksprt.exe[2012/11/19 13:54:03 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\rdpudd.dll[2012/11/19 13:54:03 | 000,228,864 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\rdpendp_winip.dll[2012/11/19 13:54:03 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\TSWbPrxy.exe[2012/11/19 13:54:03 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\MsRdpWebAccess.dll[2012/11/19 13:54:02 | 005,773,824 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mstscax.dll[2012/11/19 13:54:02 | 004,916,224 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mstscax.dll[2012/11/19 13:52:38 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ncrypt.dll[2012/11/19 13:52:37 | 001,448,448 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\lsasrv.dll[2012/11/19 13:43:01 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\javaws.exe[2012/11/16 07:11:33 | 000,000,000 | ---D | C] -- C:\Users\Sihan\Desktop\Browsers & Misc[2012/11/16 02:22:51 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\drivers\WdfLdr.sys[2012/11/16 02:22:50 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\Wdfres.dll[2012/11/16 02:16:56 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mshtmled.dll[2012/11/16 02:16:56 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mshtmled.dll[2012/11/16 02:16:54 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieui.dll[2012/11/16 02:16:54 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\url.dll[2012/11/16 02:16:54 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\url.dll[2012/11/16 02:16:54 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieui.dll[2012/11/16 02:16:54 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieUnatt.exe[2012/11/16 02:16:54 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieUnatt.exe[2012/11/16 02:16:53 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript9.dll[2012/11/16 02:16:53 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\inetcpl.cpl[2012/11/16 02:16:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\inetcpl.cpl[2012/11/16 02:16:53 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msfeeds.dll[2012/11/16 02:16:51 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript.dll[2012/11/16 02:16:51 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\jscript.dll[2012/11/16 02:16:51 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\vbscript.dll[2012/11/16 02:12:43 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\WUDFPlatform.dll[2012/11/16 02:12:42 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\WUDFCoinstaller.dll[2012/11/16 02:12:41 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\WUDFx.dll[2012/11/16 02:12:41 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\WUDFHost.exe[2012/11/15 22:01:26 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\dhcpcore6.dll[2012/11/15 22:01:26 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\dhcpcore6.dll[2012/11/15 22:01:26 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\dhcpcsvc6.dll[2012/11/15 22:01:18 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\netcorehc.dll[2012/11/15 22:01:18 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ncsi.dll[2012/11/15 22:01:18 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ncsi.dll[2012/11/15 22:01:17 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\netcorehc.dll[2012/11/15 22:01:17 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\netevent.dll[2012/11/15 22:01:17 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\netevent.dll[2012/11/15 22:00:05 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\synceng.dll[2012/11/15 22:00:05 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\synceng.dll[2012/11/12 09:32:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\stinger[2012/11/12 09:31:28 | 000,000,000 | ---D | C] -- C:\Users\Sihan\AppData\Roaming\Malwarebytes[2012/11/12 09:31:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware[2012/11/12 09:31:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes[2012/11/12 09:31:18 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys[2012/11/12 09:31:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware[2012/11/08 15:50:25 | 000,000,000 | ---D | C] -- C:\windows\SysNative\atheros[2012/10/31 09:32:37 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\javaw.exe[2012/10/31 09:32:37 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\java.exe[2012/10/31 09:32:37 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\windows\SysWow64\WindowsAccessBridge-32.dll========== Files - Modified Within 30 Days ==========[2012/11/25 09:12:59 | 000,026,336 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2012/11/25 09:12:59 | 000,026,336 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2012/11/25 09:05:34 | 000,000,892 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job[2012/11/25 09:05:12 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat[2012/11/25 09:05:04 | 3061,223,424 | -HS- | M] () -- C:\hiberfil.sys[2012/11/25 01:53:47 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sihan\Desktop\OTL.exe[2012/11/25 01:24:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job[2012/11/25 01:01:00 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2942724973-3254444484-952029406-1000UA.job[2012/11/25 00:59:00 | 000,000,896 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job[2012/11/24 15:01:20 | 000,000,276 | ---- | M] () -- C:\windows\tasks\RegClean Pro_DEFAULT.job[2012/11/24 15:01:00 | 000,000,856 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2942724973-3254444484-952029406-1000Core.job[2012/11/24 11:08:01 | 000,000,027 | ---- | M] () -- C:\windows\SysNative\drivers\etc\hosts[2012/11/24 00:31:46 | 002,160,772 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI[2012/11/24 00:31:46 | 000,628,874 | ---- | M] () -- C:\windows\SysNative\perfh009.dat[2012/11/24 00:31:46 | 000,401,384 | ---- | M] () -- C:\windows\SysNative\perfh011.dat[2012/11/24 00:31:46 | 000,390,736 | ---- | M] () -- C:\windows\SysNative\prfh0404.dat[2012/11/24 00:31:46 | 000,374,634 | ---- | M] () -- C:\windows\SysNative\prfh0804.dat[2012/11/24 00:31:46 | 000,111,026 | ---- | M] () -- C:\windows\SysNative\perfc011.dat[2012/11/24 00:31:46 | 000,111,026 | ---- | M] () -- C:\windows\SysNative\perfc009.dat[2012/11/24 00:31:46 | 000,108,886 | ---- | M] () -- C:\windows\SysNative\prfc0804.dat[2012/11/24 00:31:46 | 000,103,972 | ---- | M] () -- C:\windows\SysNative\prfc0404.dat[2012/11/23 14:05:56 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Sihan\Desktop\dds.scr[2012/11/21 21:50:47 | 000,000,284 | ---- | M] () -- C:\windows\tasks\RegClean Pro_UPDATES.job[2012/11/17 13:11:48 | 000,001,221 | ---- | M] () -- C:\Users\Sihan\Desktop\TreeSize Free.lnk[2012/11/16 07:08:28 | 000,424,816 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT[2012/11/12 09:31:19 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk[2012/11/09 09:41:58 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerApp.exe[2012/11/09 09:41:58 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl========== Files Created - No Company Name ==========[2012/11/24 10:57:08 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe[2012/11/24 10:57:08 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe[2012/11/24 10:57:08 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe[2012/11/24 10:57:08 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe[2012/11/24 10:57:08 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe[2012/11/16 02:22:55 | 000,000,003 | ---- | C] () -- C:\windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf[2012/11/16 02:12:41 | 000,000,003 | ---- | C] () -- C:\windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf[2012/11/12 09:31:19 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk[2012/04/22 15:12:22 | 004,424,704 | ---- | C] () -- C:\windows\SysWow64\ffmpeg.dll[2012/04/08 18:39:46 | 000,260,608 | ---- | C] () -- C:\windows\SysWow64\TomsMoComp_ff.dll[2012/04/08 18:39:32 | 000,158,720 | ---- | C] () -- C:\windows\SysWow64\ff_unrar.dll[2012/04/08 18:39:32 | 000,099,840 | ---- | C] () -- C:\windows\SysWow64\ff_wmv9.dll[2012/04/08 18:39:30 | 001,525,248 | ---- | C] () -- C:\windows\SysWow64\ff_samplerate.dll[2012/04/08 18:39:30 | 000,146,944 | ---- | C] () -- C:\windows\SysWow64\ff_libmad.dll[2012/04/08 18:39:28 | 000,212,480 | ---- | C] () -- C:\windows\SysWow64\ff_libdts.dll[2012/04/08 18:39:28 | 000,115,200 | ---- | C] () -- C:\windows\SysWow64\ff_liba52.dll[2012/04/08 18:39:26 | 000,328,704 | ---- | C] () -- C:\windows\SysWow64\ff_libfaad2.dll[2012/03/29 09:21:26 | 000,172,032 | ---- | C] () -- C:\windows\SysWow64\libbluray.dll[2012/03/29 09:21:18 | 006,582,226 | ---- | C] () -- C:\windows\SysWow64\avcodec-lav-54.dll[2012/03/29 09:21:18 | 001,152,365 | ---- | C] () -- C:\windows\SysWow64\avformat-lav-54.dll[2012/03/29 09:21:18 | 000,374,152 | ---- | C] () -- C:\windows\SysWow64\swscale-lav-2.dll[2012/03/29 09:21:18 | 000,207,872 | ---- | C] () -- C:\windows\SysWow64\avutil-lav-51.dll[2012/03/29 09:21:18 | 000,144,523 | ---- | C] () -- C:\windows\SysWow64\avfilter-lav-2.dll[2012/02/18 21:46:48 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat[2011/12/07 14:32:24 | 000,216,064 | ---- | C] ( ) -- C:\windows\SysWow64\Lagarith.dll[2011/10/31 20:49:44 | 000,000,095 | ---- | C] () -- C:\windows\Wininit.INI[2011/10/31 20:27:04 | 000,000,044 | ---- | C] () -- C:\Users\Sihan\jagex_cl_runescape_LIVE.dat[2011/10/28 11:47:03 | 000,000,142 | ---- | C] () -- C:\Users\Sihan\AppData\Roaming\default.rss[2011/10/04 06:35:33 | 002,197,330 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI[2011/09/08 09:00:52 | 000,150,528 | ---- | C] () -- C:\windows\SysWow64\mkx.dll[2011/09/08 09:00:48 | 000,142,336 | ---- | C] () -- C:\windows\SysWow64\mp4.dll[2011/09/08 09:00:42 | 000,123,392 | ---- | C] () -- C:\windows\SysWow64\ogm.dll[2011/09/08 09:00:38 | 000,249,856 | ---- | C] () -- C:\windows\SysWow64\dxr.dll[2011/09/08 09:00:34 | 000,113,152 | ---- | C] () -- C:\windows\SysWow64\dsmux.exe[2011/09/08 09:00:24 | 000,154,624 | ---- | C] () -- C:\windows\SysWow64\ts.dll[2011/09/08 09:00:10 | 000,137,728 | ---- | C] () -- C:\windows\SysWow64\mkv2vfr.exe[2011/09/08 09:00:06 | 000,358,400 | ---- | C] () -- C:\windows\SysWow64\gdsmux.exe[2011/09/08 08:59:54 | 000,080,384 | ---- | C] () -- C:\windows\SysWow64\mkzlib.dll[2011/09/08 08:59:52 | 000,024,576 | ---- | C] () -- C:\windows\SysWow64\mkunicode.dll[2011/08/19 19:55:28 | 000,000,231 | ---- | C] () -- C:\windows\ACTIVEJP.INI[2011/05/30 08:42:50 | 000,240,640 | ---- | C] () -- C:\windows\SysWow64\xvidvfw.dll[2011/05/23 02:46:30 | 000,645,632 | ---- | C] () -- C:\windows\SysWow64\xvidcore.dll[2011/04/28 20:29:43 | 000,870,560 | ---- | C] () -- C:\windows\SysWow64\igkrng575.bin[2011/04/28 20:29:43 | 000,208,896 | ---- | C] () -- C:\windows\SysWow64\iglhsip32.dll[2011/04/28 20:29:43 | 000,143,360 | ---- | C] () -- C:\windows\SysWow64\iglhcp32.dll[2011/04/28 20:29:43 | 000,104,796 | ---- | C] () -- C:\windows\SysWow64\igfcg575m.bin[2011/04/28 20:29:42 | 000,127,868 | ---- | C] () -- C:\windows\SysWow64\igcompkrng575.bin[2011/04/28 06:25:04 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe[2011/04/28 05:43:41 | 000,000,378 | ---- | C] () -- C:\windows\HotFixList.ini[2011/03/03 06:39:56 | 000,109,568 | ---- | C] () -- C:\windows\SysWow64\avi.dll[2011/03/03 06:38:10 | 000,097,792 | ---- | C] () -- C:\windows\SysWow64\avs.dll[2011/03/03 06:37:50 | 000,093,184 | ---- | C] () -- C:\windows\SysWow64\avss.dll========== ZeroAccess Check ==========[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32][HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32][HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 00:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 22:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]========== Custom Scans ==========< %SYSTEMDRIVE%\*.* >[2011/11/16 03:32:26 | 001,391,104 | ---- | M] () -- C:\apploc.msi[2012/11/24 11:10:50 | 000,024,250 | ---- | M] () -- C:\ComboFix.txt[2012/07/29 08:49:29 | 000,000,000 | ---- | M] () -- C:\extensions.sqlite[2012/11/25 09:05:04 | 3061,223,424 | -HS- | M] () -- C:\hiberfil.sys[2012/11/24 04:46:12 | 000,000,040 | ---- | M] () -- C:\log.txt[2012/11/25 09:05:08 | 4081,635,328 | -HS- | M] () -- C:\pagefile.sys[2011/04/28 05:12:43 | 000,002,162 | ---- | M] () -- C:\RHDSetup.log[2011/04/28 05:20:16 | 000,000,191 | ---- | M] () -- C:\Setup.log< %systemroot%\*. /mp /s >< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >========== Files - Unicode (All) ==========[2012/03/04 22:10:09 | 000,000,000 | ---D | M](C:\Users\Sihan\AppData\Roaming\????) -- C:\Users\Sihan\AppData\Roaming\ヤブサメ[2012/03/04 22:10:09 | 000,000,000 | ---D | M](C:\Users\Sihan\AppData\Roaming\????) -- C:\Users\Sihan\AppData\Roaming\ヤブサメ[2011/11/16 11:05:06 | 000,000,000 | ---D | M](C:\Users\Sihan\Documents\?????????) -- C:\Users\Sihan\Documents\セイバーフィッシュ[2011/11/16 11:05:06 | 000,000,000 | ---D | C](C:\Users\Sihan\Documents\?????????) -- C:\Users\Sihan\Documents\セイバーフィッシュ(C:\Users\Sihan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Legend of Shadow (?????)) -- C:\Users\Sihan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Legend of Shadow (小影の伝説)(C:\Users\Sihan\AppData\Roaming\????) -- C:\Users\Sihan\AppData\Roaming\ヤブサメ========== Alternate Data Streams ==========@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:793ABD2B@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:532B5694< End of report > Link to post Share on other sites More sharing options...
Tsurugi Posted November 25, 2012 Author ID:617026 Share Posted November 25, 2012 OTL Extras logfile created on: 11/25/2012 9:12:19 AM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sihan\Desktop64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.0.8112.16421)Locale: 00000409 | Country: Canada | Language: ENC | Date Format: M/dd/yy3.80 Gb Total Physical Memory | 2.10 Gb Available Physical Memory | 55.30% Memory free7.60 Gb Paging File | 5.79 Gb Available in Paging File | 76.22% Paging File freePaging file location(s): ?:\pagefile.sys [binary data]%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 231.00 Gb Total Space | 108.52 Gb Free Space | 46.98% Space Free | Partition Type: NTFSDrive D: | 345.07 Gb Total Space | 110.62 Gb Free Space | 32.06% Space Free | Partition Type: NTFSComputer Name: SIHAN-PC | User Name: Sihan | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current user | Include 64bit ScansCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Extra Registry (SafeList) ==================== File Associations ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation).url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation).html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)========== Shell Spawning ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 1"FirewallDisableNotify" = 0"AntiVirusDisableNotify" = 0"UpdatesDisableNotify" = 064bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 064bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]========== System Restore Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0========== Firewall Settings ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile][HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile][HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"EnableFirewall" = 1"DisableNotifications" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DisableNotifications" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"EnableFirewall" = 1"DisableNotifications" = 0========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]========== Vista Active Open Ports Exception List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{0DA7A5A1-E67E-4AE2-874B-FD21AA692BF2}" = rport=137 | protocol=17 | dir=out | app=system |"{0DB41C0D-F678-4E67-AF15-D1716579E424}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |"{18531B6B-E8E3-4EE5-91E2-9C91F3AF12F6}" = lport=139 | protocol=6 | dir=in | app=system |"{2C9CAA7E-5C3C-4CC9-A994-398A910061F6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |"{2D9E9E55-D25C-451D-9073-451E34C4854A}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |"{324C6D3A-5949-4157-93EE-F90F5DA1999E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |"{359577F1-529E-44DD-9582-BBE640C07444}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |"{3D73469C-7847-4046-9AAC-0CAA412F3B9B}" = lport=138 | protocol=17 | dir=in | app=system |"{414097D5-CCA2-4714-8509-282F046CFDC4}" = rport=138 | protocol=17 | dir=out | app=system |"{6088D693-C9DF-4499-923B-B0DA75B2C070}" = lport=2869 | protocol=6 | dir=in | app=system |"{648132BC-5F00-4A67-AED4-C5DE84912DA6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |"{66F83125-9AAF-4CCA-B91E-508ECFE800C6}" = rport=139 | protocol=6 | dir=out | app=system |"{6E48DDD8-A5E9-45E0-A824-C3F3C5F7655C}" = rport=445 | protocol=6 | dir=out | app=system |"{75D9DA22-8CFC-46FE-9171-82C7C4177498}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |"{76F1B915-5F22-477F-A362-5586D6605117}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |"{77E175B9-661D-4EDB-9083-63DFD00F0170}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |"{88E706D2-FC03-47C3-8D23-338352EC8C62}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |"{8FD6E7BD-02D0-4D49-BF36-216D582EEA65}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |"{90C892EC-B799-4195-9B67-208F2779CCFC}" = rport=10243 | protocol=6 | dir=out | app=system |"{A70AC22A-73CB-473E-BE41-5A98C8E3EB2D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |"{C9C50E35-0432-434E-80AF-C19E0A4D0AAE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |"{CBA57FED-E72C-4D68-A4B5-E5D5C23B1415}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |"{DBAAA0D3-039A-4C5D-B540-AB3E4BF41B25}" = lport=137 | protocol=17 | dir=in | app=system |"{FCFF4E9F-D28E-43BA-9AE7-8DE5CF196FF9}" = lport=445 | protocol=6 | dir=in | app=system |"{FE42C5A2-8D32-4910-BA81-88A2612371FD}" = lport=10243 | protocol=6 | dir=in | app=system |========== Vista Active Application Exception List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{043CCFFD-1276-48CA-A9A8-964A36EB8724}" = protocol=6 | dir=in | app=c:\users\sihan\appdata\roaming\dropbox\bin\dropbox.exe |"{04687D24-5570-4A29-9B38-A783D52E46B1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{0B5FB10F-A757-4D6B-AD6E-667EB8DF7FCB}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\idsalert.exe |"{1DC120B6-71DC-4FB8-B270-F718E652E545}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |"{22E2D08C-D36A-473E-9E2F-E78C405440E3}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |"{2480673D-1F6D-4F9F-9D1F-5DFB4041341D}" = protocol=6 | dir=in | app=d:\microsoft games\age of empires iii\age3.exe |"{398F3CC3-60CF-47DE-8CB8-3DD1CE8A3502}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |"{39E97806-D119-4B9E-BF94-6ED5239CCCF2}" = protocol=6 | dir=in | app=c:\program files\common files\common desktop agent\cdasrv.exe |"{3FC2A5A6-FA08-4DB9-8C71-3AEEFF8FECA8}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\ordersupplies.exe |"{4127CA20-101A-4403-8FB1-AC5D51482785}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |"{4172EE45-AB29-4B7B-9610-06F67800506D}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |"{508EF7D1-D020-4FE5-94E0-26B865AF8501}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |"{51CF42FF-6A01-490E-9DEA-CEAF79D79A7A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |"{5592CDBF-3AC4-4414-80E8-3ABE0600E70C}" = protocol=6 | dir=in | app=d:\microsoft games\age of empires iii\age3y.exe |"{56352B48-74D0-4D6C-A222-4AD2AE4E0ECE}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |"{568D131B-5813-4055-8074-5C306324EA82}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\ids.application.exe |"{5CBACF9F-21B9-4ABB-AAF3-D38214EA2532}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |"{6A1E6B71-9DD4-41EC-887B-4819E5D1C75B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |"{6FC645F8-778C-49BF-BEE5-A6AE3B2978E8}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\cdas2pc\cdas2pc.exe |"{774216B1-5830-476D-A6DD-E5B29A848BD5}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\ids.application.exe |"{7B7B35B9-FF13-450E-9231-2194C8DEC6E3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{7E7D19F3-EBB3-4172-B8E5-E68EEA036B4F}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |"{811DC6EE-9F0B-47D6-9E13-96E74C00A18F}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |"{8190716F-FC7B-475A-BAC0-6B36E1C1181C}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |"{843AC6D9-79CD-4841-911D-4F2E9621ACE3}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |"{861AFC6A-F5E3-4D25-BDCD-872389439932}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |"{8F59C895-C6BB-4267-A6CF-29F1D1C7EB56}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |"{92BBFE7C-C069-4363-8D24-A27950470D9E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |"{92E23467-38C1-4C66-9DCA-14B64D63E928}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |"{95AB8386-4A98-403D-A253-5AD44C8B9A2F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |"{986F75AD-74F3-43D9-93F7-C3AC9CE1800B}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\ordersupplies.exe |"{9B03B731-CC9D-46D1-A519-0361D85D1515}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |"{9E266ADA-7CBE-451B-A395-B776903F6BA9}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |"{A86FCD20-0125-4FA9-871A-994BA2EC7789}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |"{AA184FF5-B926-4576-BB53-30BCFF5F0A8E}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |"{AC1DC0A7-EE66-43C3-AAC7-51FCCC968264}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |"{AFA5BDCC-080B-46FC-9B05-BCEA8F6225D6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{B3632882-792D-4E47-900F-AE60A0FBA337}" = protocol=17 | dir=in | app=c:\users\sihan\appdata\roaming\dropbox\bin\dropbox.exe |"{BBDBA239-0A72-4D7A-B9B5-26D8DFEC951E}" = protocol=6 | dir=out | app=system |"{BE028CF4-F6EF-4831-B621-04505A0B132D}" = protocol=17 | dir=in | app=c:\program files\common files\common desktop agent\cdasrv.exe |"{C0CF283D-5483-47E0-81C7-AE0C4BC9CFAF}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |"{C3A48168-B2C2-4828-BE0B-F68516E27726}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |"{C6FA7DB0-5511-4B32-AC07-FE73240DF112}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |"{C8528C02-9AE3-40BB-A042-F7D28C6770C6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |"{CE35158E-806C-44B5-B95D-1D31D8641FA8}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\cdas2pc\cdas2pc.exe |"{E1163E31-CFC1-4DE5-8EAE-E396AEFDBA07}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |"{E1871C6D-178F-4A86-939D-721922FA69C3}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\idsalert.exe |"{E445B151-F41B-446B-9886-AC4EF4056FB7}" = dir=in | app=c:\program files (x86)\common files\mcafee\mna\mcnasvc.exe |"{E6C5D5F8-D92A-41E3-B619-A455F2FFE16E}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |"{E6CE1C2C-F5CF-4E6F-9C46-D78E9BF0B8F9}" = protocol=17 | dir=in | app=d:\microsoft games\age of empires iii\age3.exe |"{F4C6601A-B8A1-4E99-8D24-DF9EC221D3EF}" = protocol=17 | dir=in | app=d:\microsoft games\age of empires iii\age3y.exe |"TCP Query User{21910F2D-6D9D-4C94-BEF7-8C29A488F8FA}C:\program files (x86)\tixati\tixati.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tixati\tixati.exe |"TCP Query User{785488AF-F74C-49C5-A996-A5FA9A90CCBC}C:\users\sihan\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe" = protocol=6 | dir=in | app=c:\users\sihan\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe |"TCP Query User{89BB8332-7F8F-4931-BD53-4B3D534B9CE8}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |"TCP Query User{912C42EA-CFFF-47B2-9376-AADF357A58E7}C:\program files (x86)\tixati\tixati.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tixati\tixati.exe |"TCP Query User{9E3C20A6-7987-4FE7-B9B9-D3D4A6C69CA0}C:\users\sihan\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\sihan\appdata\roaming\dropbox\bin\dropbox.exe |"TCP Query User{A17C41A9-CDCE-4ACC-8621-89D5AA109887}C:\users\public\documents\winds pro\emu\desmume\desmume.exe" = protocol=6 | dir=in | app=c:\users\public\documents\winds pro\emu\desmume\desmume.exe |"TCP Query User{AB73DCD9-7CDB-40D0-98C6-AB32567645C9}C:\users\sihan\appdata\local\temp\rarsfx0\hl.exe" = protocol=6 | dir=in | app=c:\users\sihan\appdata\local\temp\rarsfx0\hl.exe |"TCP Query User{E4718CAC-822A-4674-9599-79E2142B6D97}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |"UDP Query User{083EF790-0716-47A5-B148-A6065F51DD39}C:\users\sihan\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe" = protocol=17 | dir=in | app=c:\users\sihan\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe |"UDP Query User{65AA98A5-A656-4239-906A-5E24D42693BC}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |"UDP Query User{75D4B91F-6E5E-4C5A-B8F1-45B9F8D85527}C:\users\public\documents\winds pro\emu\desmume\desmume.exe" = protocol=17 | dir=in | app=c:\users\public\documents\winds pro\emu\desmume\desmume.exe |"UDP Query User{8BB0679B-AEA8-40C5-B8D7-AED2106B3387}C:\users\sihan\appdata\local\temp\rarsfx0\hl.exe" = protocol=17 | dir=in | app=c:\users\sihan\appdata\local\temp\rarsfx0\hl.exe |"UDP Query User{B17B80A1-8574-41C2-98D4-17F798490DF2}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |"UDP Query User{CCA6B571-E1CB-4443-A32C-73F584A7E2C8}C:\program files (x86)\tixati\tixati.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tixati\tixati.exe |"UDP Query User{F2FC4202-7CB7-4A2F-9517-3DECC27668BE}C:\users\sihan\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\sihan\appdata\roaming\dropbox\bin\dropbox.exe |"UDP Query User{FA1D78BF-3439-47E5-96DE-3D3E7577FADB}C:\program files (x86)\tixati\tixati.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tixati\tixati.exe |========== HKEY_LOCAL_MACHINE Uninstall List ==========64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{031A0E14-0413-4C97-9772-2639B782F46F}" = Common Desktop Agent"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes"{1685AE50-97ED-485B-80F6-145071EE14B0}" = Windows Live Remote Service Resources"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources"{206BD2C5-DE08-4577-A0D7-D441A79D5A3A}" = Windows Live Remote Client Resources"{22AB5CFD-B3DB-414E-9F99-4D024CCF1DA6}" = Windows Live Remote Client Resources"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources"{27F3F8DE-AC95-4E10-90A6-EBA999DDBCAF}" = Windows Live Remote Service Resources"{29CFD07F-4971-41B0-B14D-621ACCC264AC}" = Windows Live Remote Service Resources"{2C1A6191-9804-4FDC-AB01-6F9183C91A13}" = Windows Live Remote Client Resources"{2F304EF4-0C31-47F4-8557-0641AAE4197C}" = Windows Live Remote Client Resources"{34384A2A-2CA2-4446-AB0E-1F360BA2AAC5}" = Windows Live Remote Service Resources"{350FD0E7-175A-4F86-84EF-05B77FCD7161}" = Windows Live Remote Service Resources"{3921492E-82D2-4180-8124-E347AD2F2DB4}" = Windows Live Remote Client Resources"{4237FF56-4BD0-481E-BD44-C1A8DDA9C753}_is1" = WinDS PRO 2012.10.2"{456FB9B5-AFBC-4761-BBDC-BA6BAFBB818F}" = Windows Live Remote Client Resources"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources"{4BC310C4-B898-46E2-B5FB-B85A30AA7142}" = iCloud"{4C2E49C0-9276-4324-841D-774CCCE5DB48}" = Windows Live Remote Client Resources"{4C9845D5-9FAD-4C52-B389-CAEF0F216215}" = Windows Live Remote Client Resources"{5141AA6E-5FAC-4473-BFFB-BEE69DDC7F2B}" = Windows Live Remote Service Resources"{5151E2DB-0748-4FD1-86A2-72E2F94F8BE7}" = Windows Live Remote Service Resources"{57F2BD1C-14A3-4785-8E48-2075B96EB2DF}" = Windows Live Remote Service Resources"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources"{5F44A3A1-5D24-4708-8776-66B42B174C64}" = Windows Live Remote Client Resources"{5FCD6EFE-C2E7-4D77-8212-4BA223D8DF8E}" = Windows Live Remote Client Resources"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources"{61407251-7F7D-4303-810D-226A04D5CFF3}" = Windows Live Remote Service Resources"{641B32DB-8226-4250-86C9-34671162F5D5}" = Windows Live Remote Client Resources"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources"{6A2482BC-733A-404A-939A-2D5BC636E6F9}" = Windows Live Remote Service Resources"{6C9D3F1D-DBBE-46F9-96A0-726CC72935AF}" = Windows Live Remote Service Resources"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources"{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}" = MobileMe Control Panel"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support"{78654366-5889-4A70-90D9-04B00709EEE0}" = Windows Live Remote Client Resources"{7AEC844D-448A-455E-A34E-E1032196BBCD}" = Windows Live Remote Service Resources"{811D5159-D798-491F-B9C6-9BDBF6B02D06}" = Windows Live Remote Service Resources"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources"{850B8072-2EA7-4EDC-B930-7FE569495E76}" = Windows Live Remote Client Resources"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010"{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010"{90140000-0016-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010"{90140000-0018-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010"{90140000-0019-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010"{90140000-001A-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010"{90140000-001B-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUSR_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010"{90140000-001F-0C0A-1000-0000000FF1CE}_Office14.PROPLUSR_{1779650B-2E44-4A19-8DF6-3866D645764A}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010"{90140000-002C-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{270CA0B9-9881-44DB-BC3B-37C7E66A044A}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010"{90140000-0043-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{FCD1C311-8B02-4DBD-BA46-1079C629577E}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010"{90140000-0044-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010"{90140000-006E-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010"{90140000-00A1-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010"{90140000-00BA-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010"{90140000-0115-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{516CA4A9-98E6-4F77-A863-CBD8487368E4}" = Microsoft Office 2010 Service Pack 1 (SP1)"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010"{90140000-0117-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" = Microsoft Office 2010 Service Pack 1 (SP1)"{91140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010"{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{97A295A7-8840-4B35-BB61-27A8F4512CA3}" = Windows Live Remote Service Resources"{9E9C960F-7F47-46D5-A95D-950B354DE2B8}" = Windows Live Remote Service Resources"{A060182D-CDBE-4AD6-B9B4-860B435D6CBD}" = Windows Live Remote Client Resources"{A508D5A2-3AC1-4594-A718-A663D6D3CF11}" = Windows Live Remote Service Resources"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)"{AE91E0F3-C49A-4EF4-8B98-A07BD409EB90}" = Windows Live Remote Service Resources"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources"{B680A663-1A15-47A5-A07C-7DF9A97558B7}" = Windows Live Remote Client Resources"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources"{C30BB9AD-F9E4-4506-B416-57C03702998D}" = Nitro Reader 2"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources"{C78D3032-9DFD-41D0-9DE9-58EAE750CBA4}" = Microsoft Security Client"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources"{CFF3C688-2198-4BC3-A399-598226949C39}" = Windows Live Remote Client Resources"{D1C1556C-7FF3-48A3-A5D6-7126F0FAFB66}" = Windows Live Remote Client Resources"{D3E4F422-7E0F-49C7-8B00-F42490D7A385}" = Windows Live Remote Service Resources"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources"{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb" = Microsoft Windows Application Compatibility Database"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service"{E34002C7-8CE7-3F76-B36C-09FA973BC4F6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729"{ED421F97-E1C3-4E78-9F54-A53888215D58}" = Windows Live Remote Client Resources"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources"{F0793412-6407-4870-9A8C-6FE198A4EB12}" = Windows Live Remote Client Resources"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile"{F6CB2C5F-B2C1-4DF1-BF44-39D0DC06FE6F}" = Windows Live Remote Service Resources"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources"Broadcom 802.11 Network Adapter" = Broadcom 802.11 Network Adapter"Elantech" = ETDWare PS/2-x64 7.0.7.0_WHQL"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile"Microsoft Security Client" = Microsoft Security Essentials"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010"sp6" = Logitech SetPoint 6.32"WinRAR archiver" = WinRAR 4.01 beta 1 (64-bit)[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{000F2A10-9CDF-47BF-9CF2-9AC87567B433}" = Windows Live Photo Common"{00884F14-05BD-4D8E-90E5-1ABF78948CA4}" = Windows Live Mesh"{0119B342-476F-4F5A-B712-144B5CFA781F}" = Windows Live Movie Maker"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam"{03241D8D-2217-42F7-9FCB-6A68D141C14D}" = Windows Live 软件包"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack"{062E4D94-8306-46D5-81B6-45E6AD09C799}" = Windows Live Messenger"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common"{066219C8-4BE6-46D7-9E01-60FCFA6B32DC}" = Messenger Companion"{0711500B-9912-4D60-9A49-C577B4503D42}" = Nero Recode Help"{073F306D-9851-4969-B828-7B6444D07D55}" = Windows Live Photo Common"{07E15DDE-CAD9-434D-B24D-35708E3BEA09}" = Windows Live 필수 패키지"{07FF7593-9DEA-40B5-9F87-F557E65BBF60}" = Nero Recode"{082E37F5-3924-4168-A69A-1B6B1FEA587C}" = Messenger Companion"{09922FFE-D153-44AE-8B60-EA3CB8088F93}" = Windows Live UX Platform Language Pack"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack"{0C975FCC-A06E-4CB6-8F54-A9B52CF37781}" = Windows Liven sähköposti"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live"{10186F1A-6A14-43DF-A404-F0105D09BB07}" = Windows Live Mail"{110668B7-54C6-47C9-BAC4-1CE77F156AF5}" = Windows Live Mesh"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1"{1122AAC4-AAAA-43BF-B2D4-3C8C12378952}" = Nero InfoTool"{11417707-1F72-4279-95A3-01E0B898BBF5}" = Windows Live Mesh"{11778DA1-0495-4ED9-972F-F9E0B0367CD5}" = Windows Live Writer"{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM"{1203DC60-D9BD-44F9-B372-2B8F227E6094}" = Windows Live Temel Parçalar"{122800FE-3AAF-4974-9FBD-54B023FA756A}" = „Windows Live Messenger“"{12345674-DE9A-677A-CCEE-666356D89777}" = Nero BurnRights"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack"{133D9D67-D475-4407-AC3C-D558087B2453}" = Windows Live Movie Maker"{142D8CA7-2C6F-45A7-83E3-099AAFD99133}" = Samsung Update Plus"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager"{17835B63-8308-427F-8CF5-D76E0D5FE457}" = Windows Live Essentials"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer"{19ADD3BF-C42B-47DC-81C6-5E9731B668C4}" = „Windows Live Essentials“"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker"{1A72337E-D126-4BAF-AC89-E6122DB71866}" = Windows Liven valokuvavalikoima"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer"{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger"{1D6C2068-807F-4B76-A0C2-62ED05656593}" = Windows Live Writer"{1DA6D447-C54D-4833-84D4-3EA31CAECE9B}" = Windows Live UX Platform Language Pack"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources"{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}" = Bing Bar"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update"{1FC83EAE-74C8-4C72-8400-2D8E40A017DE}" = Windows Live Writer"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions"{220C7F8C-929D-4F71-9DC7-F7A6823B38E4}" = Windows Live UX Platform Language Pack"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{249EE21B-8EDD-4F36-8A23-E580E9DBE80A}" = Windows Live Mail"{24DF33E0-F924-4D0D-9B96-11F28F0D602D}" = Windows Live UX Platform Language Pack"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail"{25CD4B12-8CC5-433E-B723-C9CB41FA8C5A}" = Windows Live Writer"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources"{2720009D-9566-45A7-A370-0E6DAC313F3F}" = „Windows Live Mail“"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program"{28B9D2D8-4304-483F-AD71-51890A063A74}" = Windows Live Photo Common"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger"{2BA5FD10-653F-4CAF-9CCD-F685082A1DC1}" = Windows Live Writer"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh"{2CC0789D-D31B-445F-8970-6E058BE39754}" = Windows Live UX Platform Language Pack"{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart"{2D3E034E-F76B-410A-A169-55755D2637BB}" = Windows Live Mesh"{2D49C296-BCCA-4800-BAF6-A0269EBDCF74}" = Windows Live Messenger"{2DDC70C1-C77A-4D08-89D2-9AB648504533}" = Easy Content Share"{2E50E321-4747-4EB5-9ECB-BBC6C3AC0F31}" = Windows Live Writer Resources"{2F54E453-8C93-4B3B-936A-233C909E6CAC}" = Windows Live Messenger"{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax"{3125D9DE-8D7A-4987-95F3-8A42389833D8}" = Windows Live Writer Resources"{317D56AC-0DB3-48F5-929A-42032DAC9AD7}" = Windows Live Writer"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor"{368BEC2C-B7A2-4762-9213-2D8465D533CA}" = Windows Live UX Platform Language Pack"{3705D53F-BB01-4BEE-8585-289E71CAC4B4}" = Компаньон Messenger"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack"{3889988F-762B-4B85-AB17-71C9CC3AE445}" = Messenger Companion"{394BE3D9-7F57-4638-A8D1-1D88671913B7}" = Microsoft AppLocale"{39F95B0B-A0B7-4FA7-BB6C-197DA2546468}" = Windows Live Mesh"{3A09ED0F-8DDF-47BB-B53D-841AB9D1D3A7}" = Complemento Messenger"{3B72C1E0-26A1-40F6-8516-D50C651DFB3C}" = Windows Live Essentials"{3B8F240C-B75E-4A1E-BDCC-6C7F033078A3}" = Windows Live UX Platform Language Pack"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg"{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh"{3FD1CB9F-807F-451B-926C-9D19C84CFC61}" = Messenger Suradnik"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack"{410DF0AA-882D-450D-9E1B-F5397ACFFA80}" = Windows Live Essentials"{4264C020-850B-4F08-ACBE-98205D9C336C}" = Windows Live Writer"{429DF1A0-3610-4E9E-8ACE-3C8AC1BA8FCA}" = Windows Live Photo Gallery"{43B43577-2514-4CE0-B14A-7E85C17C0453}" = Windows Live Essentials"{442032CB-900C-49C7-B4B4-2B76525DD403}" = Windows Live Photo Common"{443B561F-DE1B-4DEF-ADD9-484B684653C7}" = Windows Live Messenger"{4444F27C-B1A8-464E-9486-4C37BAB39A09}" = Фотогалерия на Windows Live"{458F399F-62AC-4747-99F5-499BBF073D29}" = Windows Live Writer Resources"{4664ED39-C80A-48F7-93CD-EBDCAFAB6CC5}" = Windows Live Writer Resources"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4A04DB63-8F81-4EF4-9D09-61A2057EF419}" = Windows Live Essentials"{4A331D24-A9E8-484F-835E-1BA7B139689C}" = EasyBatteryManager"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer"{4B744C85-DBB1-4038-B989-4721EB22C582}" = Windows Live Messenger"{4C378B16-46B7-4DA1-A2CE-2EE676F74680}" = Windows Live UX Platform Language Pack"{4D141929-141B-4605-95D6-2B8650C1C6DA}" = Windows Live UX Platform Language Pack"{4D42353B-533F-4306-AD0B-7FEF292ADE04}" = Nero CoverDesigner Help"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter"{4F35DF91-F834-41F7-A287-0E377D55C486}" = Windows Live Photo Common"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion"{517EAAB9-C35E-4949-B8C2-20C241162BBB}" = Windows Live Pošta"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module"{51FFAC89-B6B0-4E6E-B76F-6D4E2E83086A}" = Windows Live 메일"{523DF2BB-3A85-4047-9898-29DC8AEB7E69}" = Windows Live UX Platform Language Pack"{5275D81E-83AD-4DE4-BC2B-6E6BA3A33244}" = Windows Live Writer Resources"{542DA303-FB91-4731-9F37-6E518368D3B9}" = Windows Live Messenger"{545192D4-E817-4EAA-834D-623EA50CF268}" = Windows Live UX Platform Language Pack"{548F99E0-14CC-4D53-A7D6-4A62A5F2C748}" = Nero PhotoSnap"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml"{56D42B00-572C-4AE9-BCFB-CD45A3B5D0E1}" = Messenger Assistent"{57660847-B1F7-35BD-9118-F62EB863A598}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack"{588CE0C0-860B-49A8-AFCF-3C69465B345F}" = Windows Live Mesh"{5A62A775-A29A-4CE1-BBC2-4A9CD0B211EF}" = Nero Live Help"{5AE12194-3EAA-40DF-B2BF-FE1D6B78BBF4}" = Nero Vision"{5C2E8A0F-80E2-4C68-8CC0-D8D16E7196BF}" = Nero RescueAgent Help"{5C2F5C1B-9732-4F81-8FBF-6711627DC508}" = Windows Live Fotogalleri"{5C42EAB8-54F9-423A-948C-1CBEF25F8DB4}" = Nero PhotoSnap Help"{5C9BB0B3-E830-4814-BBA4-D93535E1C7B9}" = Nero Live"{5CF5B1A5-CBC3-42F0-8533-5A5090665862}" = Windows Live Mesh"{5D163056-96B7-440F-A836-89BA5D3CFF2F}" = Windows Live Photo Common"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker"{5D2E7BD7-4B6F-4086-BA8A-E88484750624}" = Windows Live Writer Resources"{5DA7D148-D2D2-4C67-8444-2F0F9BD88A06}" = Windows Live Writer"{5E627606-53B9-42D1-97E1-D03F6229E248}" = Windows Live UX Platform Language Pack"{60C3C026-DB53-4DAB-8B97-7C1241F9A847}" = Windows Live Movie Maker"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM"{61506B53-EE02-46CE-8464-3F806947978F}" = Windows Live Mesh"{622DE1BE-9EDE-49D3-B349-29D64760342A}" = 適用遠端連線的 Windows Live Mesh ActiveX 控制項"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources"{63CF7D0C-B6E7-4EE9-8253-816B613CC437}" = Windows Live Mail"{640798A0-A4FB-4C52-AC72-755134767F1E}" = Windows Live Movie Maker"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live"{644063FA-ABA3-42AC-A8AC-3EDC0706018B}" = Windows Live Mesh"{6491AB99-A11E-41FD-A5E7-32DE8A097B8E}" = Windows Live Essentials"{64B2D6B3-71AC-45A7-A6A1-2E07ABF58341}" = Windows Live Movie Maker"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE"{69C9C672-400A-43A0-B2DE-9DB38C371282}" = Windows Live Writer"{69CAC24D-B1DC-4B97-A1BE-FE21843108FE}" = Windows Live Writer Resources"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack"{6A67578E-095B-4661-88F7-0B199CEC3371}" = Windows Live Messenger"{6ABE832B-A5C7-44C1-B697-3E123B7B4D5B}" = Windows Live Mesh"{6B3BAE39-4ED1-4EEB-9769-A3AA0AA58CB4}" = Windows Live Movie Maker"{6B556C37-8919-4991-AC34-93D018B9EA49}" = Windows Live Photo Common"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker"{6D2F0A26-ECEA-49CE-833C-9A6125F3D5E8}" = Doplnok programu Messenger"{6DCE9C3E-3DB7-4C3C-8B80-BC55781BB7B6}" = Windows Live Writer Resources"{6DD3B54B-F0D0-4A69-8344-F52033225A02}" = Messenger Companion"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker"{6E5324C1-84FC-4F76-9A3A-C65E07F80EE6}" = Complément Messenger"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger"{6EF2BE2C-3121-48B7-B7A6-C56046B3A588}" = Windows Live Movie Maker"{6F37D92B-41AA-44B7-80D2-457ABDE11896}" = Windows Live Photo Common"{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{7115EEBC-DA7B-434C-B81C-EA5B26EA9A94}" = Windows Live Writer Resources"{71684DFF-CDED-450C-AF0C-4A1A6438A1A5}" = Windows Live Essentials"{71A81378-79D5-40CC-9BDC-380642D1A87F}" = Windows Live Writer"{71C95134-F6A9-45E7-B7B3-07CA6012BF2A}" = Windows Live Mesh"{7272F232-A7E0-4B2B-A5D2-71B7C5E2379C}" = Windows Live Fotótár"{7327080F-6673-421F-BBD9-B618F357EEB3}" = Windows Live UX Platform Language Pack"{734104DE-C2BF-412F-BB97-FCCE1EC94229}" = Windows Live Writer Resources"{7373E17D-18E0-44A7-AC3A-6A3BFB85D3B3}" = Windows Live Movie Maker"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack"{75321954-2589-11DC-DDCC-E98356D81493}" = Nero DriveSpeed"{753973C4-B961-43BF-B2D4-3C8C92F7216E}" = Nero DriveSpeed"{753F0A72-59C3-41CE-A36A-F2DF2079275C}" = Windows Live Mail"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime"{7780682A-47C9-480D-90BE-247539342595}" = Windows Live UX Platform Language Pack"{77BC9EAF-14C7-4338-9B1C-D5A3E142C0B8}" = Windows Live Photo Common"{77DAF553-291A-4471-988C-5677D90DB57E}" = Windows Live Writer Resources"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live"{781E0319-15CD-4A4C-A47E-D9FFF697E7A1}" = Messenger Companion"{78523651-D8B1-11DC-CCEE-741589645873}" = Nero DiscSpeed"{78906B56-0E81-42A7-AC25-F54C946E1538}" = Windows Live Photo Common"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh"{78DBE8CE-61F6-4D6C-806C-A0FFF65F5E1D}" = Windows Live Messenger"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live"{7ADFA72D-2A9F-4DEC-80A5-2FAA27E23F0F}" = Windows Live Photo Common"{7AF8E500-B349-4A77-8265-9854E9A47925}" = Windows Live Movie Maker"{7B982EBD-D017-4527-BF1A-FC489EC6B100}" = Windows Live 照片库"{7BA19818-F717-4DFB-BC11-FAF17B2B8AEE}" = Pošta Windows Live"{7C2A3479-A5A0-412B-B0E6-6D64CBB9B251}" = Windows Live Photo Common"{7CB529B2-6C74-4878-9C3F-C29C3C3BBDC6}" = Windows Live Writer Resources"{7D0DE76C-874E-4BDE-A204-F4240160693E}" = Windows Live Photo Common"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer"{7E274911-32ED-4489-9B04-4EF100D0E4D3}" = „Messenger“ pagalbinė priemonė"{7E90B133-FF47-48BB-91B8-36FC5A548FE9}" = Windows Live Writer Resources"{7F061FA8-5A87-4758-876B-17EE28B358D0}" = Messenger 浏览器插件"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources"{804a0708-3b79-4cb5-96c2-ccc53b87535e}" = Nero 9"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer"{80E8C65A-8F70-4585-88A2-ABC54BABD576}" = Windows Live Mesh"{8142D25E-028A-4563-86ED-5755783C8029}" = Messenger Companion"{827D3E4A-0186-48B7-9801-7D1E9DD40C07}" = Windows Live Essentials"{82803FF3-563F-414F-A403-8D4C167D4120}" = Windows Live Mail"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110109903}" = Flip Words"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110160733}" = Slingo"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110245793}" = Insaniquarium Deluxe"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110521483}" = Gem Shop"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111768557}" = Bonbon Quest"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113128447}" = Daycare Nightmare"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform"{83D2FFB0-E378-49FE-8A53-580CA7B5761F}" = Windows Live Messenger"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh"{84267681-BF16-40B6-9564-27BC57D7D71C}" = Windows Live Photo Common"{847C879C-1467-4924-A491-1302B4C58F70}" = Messenger Companion"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials"{85373DA7-834E-4850-8AF5-1D99F7526857}" = Windows Live Photo Common"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer"{861B1145-7762-4794-B40C-3FF0A389DFE6}" = Windows Live Photo Gallery"{86E6D3A7-3ADC-44C0-B94E-85D2A9DD36B0}" = Windows Live Writer"{8732818E-CA78-4ACB-B077-22311BF4C0E4}" = Easy Network Manager"{885F1BCD-C344-4758-85BD-09640CF449A5}" = Windows Live Photo Gallery"{8909CFA8-97BF-4077-AC0F-6925243FFE08}" = Windows Liven asennustyökalu"{8C654BD0-1949-43DE-84F2-EC2A1ABB0CB4}" = Nero ShowTime"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime"{8CF5D47D-27B7-49D6-A14F-10550B92749D}" = Windows Live UX Platform Language Pack"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger"{902585EB-8FA3-43A5-AD1C-5C9821A77114}" = Messenger Pratilac"{903EDF14-4E28-4463-AA5E-4AEE71C0263B}" = Windows Live Movie Maker"{924B4D82-1B97-48EB-8F1E-55C4353C22DB}" = Windows Live Mail"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195"{939C80FA-96C9-44A6-B318-8E7D8BD8481B}" = Messenger Companion"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources"{943CC0C0-2253-4FE0-9493-DD386F7857FD}" = Nero Express"{948FFAAE-C57F-447B-9B07-3721E950BFDC}" = Nero ShowTime"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6"{961D53EA-40DC-4156-AD74-25684CE05F81}" = Nero Installer"{96403552-88D1-429F-9C92-388B814B885E}" = Messenger Companion"{97F77D62-5110-4FA3-A2D3-410B92D31199}" = Windows Live Fotogaléria"{99BE7F5D-AB52-4404-9E03-4240FFAA7DE9}" = Windows Live Mesh"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail"{9DA3F03B-2CEE-4344-838E-117861E61FAF}" = Windows Live Mail"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker"{9E771D5B-C429-4CBC-8730-3EBD9EC99E4C}" = Windows Live Movie Maker"{9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}" = Advertising Center"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh"{A101F637-2E56-42C0-8E08-F1E9086BFAF3}" = Windows Live Movie Maker"{A1668729-C4D2-49AE-877B-FB608362FFF1}" = Windows Live Essentials"{A199DB88-E22D-4CE7-90AC-B8BE396D7BF4}" = Windows Live Movie Maker"{A3389C72-1782-4BB4-BBAA-33345DE52E3F}" = Windows Live Messenger"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery"{A7056D45-C63A-4FE4-A69D-FB54EF9B21BB}" = Windows Live Messenger"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer"{A73BEC3C-40A0-480E-87EF-EFCD33629088}" = NeroExpress"{A8399F58-234A-48C6-BA55-30C15738BF3C}" = Nero CoverDesigner"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common"{AAA12554-2589-11DC-92EF-E98356D81493}" = Nero InfoTool"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer"{AABBCC54-D8B1-11DC-92EF-E98356D81493}" = Nero DiscSpeed"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer"{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor"{AB067785-9646-456B-91C3-E71228132A4C}" = Messenger 사이트 공유"{AB0B2113-5B96-4B95-8AD1-44613384911F}" = Windows Live Mesh"{AB5977C5-11AE-4003-BA7D-261C48F2BC35}" = מסייע Messenger"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger"{AB78C965-5C67-409B-8433-D7B5BDB12073}" = Windows Live Writer Resources"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials"{ABE2F2AA-7ADC-4717-9573-BF3F83C696AC}" = Windows Live Mail"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.4)"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh"{AD001A69-88CC-4766-B2DB-3C1DFAB9AC72}" = Windows Live Mesh"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime"{B0AD205F-60D0-4084-AFB8-34D9A706D9A8}" = Windows Live Essentials"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common"{B2C12C8D-65DC-40BD-B309-5ADB0C6C8D8F}" = Nero WaveEditor"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger"{B33B61FE-701F-425F-98AB-2B85725CBF68}" = Windows Live Photo Common"{B3BE54A4-8DFE-4593-8E66-56AB7133B812}" = Windows Live Writer"{B44F3823-52DD-45CA-A916-8B320778715D}" = Messenger Companion"{B4712CB7-27D7-4F61-8805-BCF9BE1CFC4A}" = Windows Live Writer Resources"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call"{B7B67AA5-12DA-4F01-918D-B1BF66779D8A}" = Windows Live Writer Resources"{B81722D3-0A95-4BDE-AA1A-A2A5D12FCDB2}" = Windows Live Foto-galerija"{B96C2601-52F5-4D5D-816A-63469EA311EF}" = "Nero SoundTrax Help"{B9B66F77-9D00-4CA4-BDF1-BBA8236B4DB6}" = Windows Live Writer"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger"{BCD82AB5-670D-4242-90FA-1F97103C16CD}" = Movie Templates - Starter Kit"{BD0C3887-64E6-41D8-9A38-BC6F34369352}" = Windows Live Messenger"{BD4EBDB5-EB14-4120-BB04-BE0A26C7FB3E}" = Windows Live Photo Common"{BD695C2F-3EA0-4DA4-92D5-154072468721}" = Windows Live Fotoğraf Galerisi"{BD8DA595-F501-4ABE-85A0-5C23E82472A0}" = Pomocnik Messenger"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh"{BFC47A0B-D487-4DF0-889E-D6D392DF31E0}" = Windows Live Messenger"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live"{C01FCACE-CC3D-49A2-ADC2-583A49857C58}" = Windows Live Essentials"{C08D5964-C42F-48EE-A893-2396F9562A7C}" = Windows Live Mesh"{C1C9D199-B4DD-4895-92DD-9A726A2FE341}" = Windows Live Writer"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties"{C454280F-3C3E-4929-B60E-9E6CED5717E7}" = Windows Live Mail"{C4582EED-A3FB-4358-8F3F-8C994460DF28}" = EasyFileShare"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari"{C7DAD22D-29D4-438F-B986-03B9ED582EA4}" = Messenger Companion"{C8421D85-CA0E-4E93-A9A9-B826C4FB88EA}" = Windows Live Mail"{C877E454-FA36-409A-A00E-1240CEC61BBD}" = „Windows Live“ fotogalerija"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common"{C8A2793D-EFF2-4069-95BF-A28192E39DEB}" = Windows Live Writer"{C95A5A77-622F-45CA-9540-84468FCB18B1}" = Windows Live Messenger"{C99C89A3-119A-45E6-B26E-DD5643CAA0C5}" = Menu Templates - Starter Kit"{C9E1343D-E21E-4508-A1BE-04A089EC137D}" = Windows Live Messenger"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live"{CB66242D-12B1-4494-82D2-6F53A7E024A3}" = Galerie foto Windows Live"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker"{CBFD061C-4B27-4A89-ADD8-210316EEFA11}" = Windows Live Messenger"{CD1826A5-CFCC-4C6E-9F9D-E181876162EA}" = Nero Rescue Agent"{CD442136-9115-4236-9C14-278F6A9DCB3F}" = Windows Live Movie Maker"{CD7CB1E6-267A-408F-877D-B532AD2C882E}" = Windows Live Photo Common"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform"{CF088261-BC81-4FB9-9BA0-7B5B9602D01A}" = Messenger 分享元件"{CF671BFE-6BA3-44E7-98C1-500D9C51D947}" = Windows Live Photo Gallery"{CF936193-C584-458C-B793-15FA945621AF}" = Windows Live fotoattēlu galerija"{CF9DEFAA-12CD-4D04-AA45-F9F667D21E2E}" = Windows Live Movie Maker"{D06F10C5-3EDD-4B29-A3B5-16BBB9A047F8}" = Windows Live Mesh"{D07B1FDA-876B-4914-9E9A-309732B6D44F}" = Windows Live Mail"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64"{D1F6FBBB-B204-459A-9BF8-D06FFAB96CCC}_is1" = Game Pack"{D27DF849-C8C7-4892-A7F1-E0B381A1BD01}" = Windows Live Writer"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack"{D31169F2-CD71-4337-B783-3E53F29F4CAD}" = Windows Live Mail"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform"{D47C66BE-0EB5-4587-93FE-D1E176C4B25C}" = Windows Live Messenger"{D4F81B27-4054-4AD6-A588-265508BAA17C}" = Messenger Companion"{D57D43BF-699A-429F-AF8C-AF1867222800}" = Windows Live 사진 갤러리"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail"{D58E381C-DE02-46A9-B9D1-A2CB807D2676}" = Messenger Companion"{D657CCB5-9F2F-4D3C-B93D-F77EBEF79B66}" = Messenger-kumppani"{D6CBB3B2-F510-483D-AE0D-1CF3F43CF1EE}" = Windows Live Writer Resources"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack"{D7C206B6-1A63-4389-A8B1-8F607D0BFF1F}" = Nero StartSmart Help"{D987098B-3AD4-4E88-B80E-CF27A32D1955}" = Windows Live Writer Resources"{D9DEFFCD-524F-4101-A8B5-041F42D8EC30}" = Sniffy Lite"{DA29F644-2420-4448-8128-1331BE588999}" = Windows Live Writer"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker"{DB1208F4-B2FE-44E9-BFE6-8824DBD7891B}" = Windows Live Movie Maker"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail"{DCAB6BA7-6533-44BF-9235-E5BF33B7431C}" = Windows Live Writer"{DDC1E1BD-7615-4186-89E1-F5F43F9B6491}" = Windows Live Movie Maker"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials"{DF71ABBB-B834-41C0-BB58-80B0545D754C}" = Windows Live UX Platform Language Pack"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10"{E4A8DD87-A746-4443-BF25-CAF99CED6767}" = Nero Disc Copy Gadget"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker"{E5377D46-83C5-445A-A1F1-830336B42A10}" = Windows Live Galerija fotografija"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer"{E59969EA-3B5B-4B24-8B94-43842A7FBFE9}" = Fotogalerija Windows Live"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger"{E5DD4723-FE0B-436E-A815-DC23CF902A0B}" = Windows Live UX Platform Language Pack"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live"{E8524B28-3BBB-4763-AC83-0E83FE31C350}" = Windows Live Writer"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live"{E86156E5-9859-440D-8876-26CED1349802}" = Nero WaveEditor Help"{E8C3CF7A-9E8F-4C5D-8EC7-FF5A495E178C}" = VitalSource Bookshelf"{E9AD2143-26D5-4201-BED1-19DCC03B407D}" = Windows Live Messenger"{E9D98402-21AB-4E9F-BF6B-47AF36EF7E97}" = Windows Live Writer Resources"{EA777812-4905-4C08-8F6E-13BDCC734609}" = Windows Live UX Platform Language Pack"{EA9FFE54-D8B1-11DC-92EF-E98356D81493}" = Nero BurnRights"{EAB1BDF2-734A-4D44-9169-7615D185C974}" = Windows Live Mesh"{EC20FB81-9B5E-4B97-92A2-8DC52548EFCE}" = Windows Live Mesh"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver"{F0F9505B-3ACF-4158-9311-D0285136AA00}" = Windows Live Essentials"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver"{F14F9EE9-9B68-42B4-90F7-0924F7619281}" = Spremljevalec Messenger"{F2979AAA-FDD7-4CB3-93BC-5C24D965D679}" = Windows Live Messenger"{F35DC85A-E96B-496B-ABE7-F04192824856}" = Windows Live Messenger"{F3ECEB0A-82A0-4DB9-BB44-393A66BA0871}" = Messenger kísérő"{F4BEA6C1-AAC3-4810-AAEA-588E26E0F237}" = Windows Live UX Platform Language Pack"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources"{F53F6769-AC46-49E3-ABE3-2C8AFD39D0DD}" = Nero Vision"{F66430D8-08E6-4C96-B9B7-90E66E27D58C}" = Windows Live Mail"{F687E657-F636-44DF-8125-9FEEA2C362F5}" = Samsung Support Center 1.0"{F783464C-C7C6-4E9B-AC40-BC90E5414BAF}" = Windows Live Messenger"{F7A46527-DF1F-4B0F-9637-98547E189442}" = Windows Live Galeria de Fotos"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials"{F992409C-9D10-4AE2-BAEB-B5409AD3785E}" = 用于远程连接的 Windows Live Mesh ActiveX 控件(简体中文)"{FA20D803-14E5-4B00-8F03-B519D46F9D4A}" = Windows Live Messenger"{FA6CF94F-DACF-4FE7-959D-55C421B91B17}" = Windows Live Mail"{FB3D07AE-73D0-47A9-AC12-6F50BF8B6202}" = Windows Live Movie Maker"{FB79FDB7-4DE1-453D-99FE-9A880F57380E}" = Windows Live Fotogalerie"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live"{FC7E771F-8170-4573-825D-EDB6723C804F}_is1" = Disk Speedup"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR"{FE62C88B-425B-4BDE-8B70-CD5AE3B83176}" = Windows Live Essentials"{FEA0181F-3758-46DA-B7EC-F3CDFA7E0CE7}" = Помощник на Messenger"{FEEF7F78-5876-438B-B554-C4CC426A4302}" = Windows Live Essentials"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker"{FF737490-5A2D-4269-9D82-97DB2F7C0B09}" = Windows Live Movie Maker"{FFD0E594-823B-4E2B-B680-720B3C852588}" = BatteryLifeExtender"{FFFA0584-8E3D-4195-8283-CCA3AD73C746}" = Windows Live Messenger"‚Ó‚½‚È‚è‚Á–º ‹¦—ƒƒNƒŠƒGƒCƒVƒ‡ƒ“" = ‚Ó‚½‚È‚è‚Á–º ‹¦—ƒƒNƒŠƒGƒCƒVƒ‡ƒ“"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin"DivX Setup" = DivX Setup"Freemake Video Converter_is1" = Freemake Video Converter version 3.1.2"HANI_KOKUSYOKU_is1" = ‚Í‚É‚í‚èI¹–ë‰Ø‚¨ì—l`Š´õ‚·‚éŒÒŠÔ‚Ì‘å‚«‚ȃ‚ƒm` DL”Å"IDEDIDJDIDHEIDECIBJMIDGCIDGHIDFIIDGHIDIJIDGHIDFIIBEAIBGAJHIOICLPICLBICNKICOKICMJICOGICOJJFJMIPFBIKMEILNGJHMLJAEKIMIAIBGA" = ƒCƒ“ƒtƒBœƒbƒgƒXƒgƒ‰ƒgƒX@`—Ž‚¿‚±‚Ú‚ê‚É‚æ‚é•œQŠÄ‹Ö—ËJŒ€`"IDGOIDIBJFPKJBOIIBEJJGLDJGEAJCGOJBNBICMIIPEDIKHHJHLHINHD" = ƒnƒ•ú‘èI–³–@’n‘Ñ‚ÈCŠw—·s"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam"InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}" = Age of Empires III"InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.1.1000"Marvell Miniport Driver" = Marvell Miniport Driver"McAfee Security Scan" = McAfee Security Scan Plus"Mozilla Firefox 16.0.2 (x86 en-US)" = Mozilla Firefox 16.0.2 (x86 en-US)"MozillaMaintenanceService" = Mozilla Maintenance Service"OpenAL" = OpenAL"PHOENIX DRIVE" = PHOENIX DRIVE"PrimoPDF" = PrimoPDF -- brought to you by Nitro PDF Software"RealPlayer 15.0" = RealPlayer"RegClean Pro_is1" = RegClean Pro"Samsung Easy Printer Manager" = Samsung Easy Printer Manager"Samsung ML-1670 Series" = Samsung ML-1670 Series"Samsung Printer Live Update" = Samsung Printer Live Update"Swiff Player_is1" = Swiff Player 1.7.2"Switch" = Switch Sound File Converter"tixati" = Tixati"TreeSize Free_is1" = TreeSize Free V2.7"vis_uni" = Visit Academic Systems"VLC media player" = VLC media player 2.0.2"Windows 7 - Codec Pack" = Windows 7 Codec Pack 4.0.3"WinLiveSuite" = Windows Live Essentials"WinPcapInst" = WinPcap 4.1.2"Xvid Video Codec 1.3.2" = Xvid Video Codec========== HKEY_CURRENT_USER Uninstall List ==========[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"Dropbox" = Dropbox"Google Chrome" = Google Chrome"小影の伝説" = 小影の伝説========== Last 20 Event Log Errors ==========[ Application Events ]Error - 5/15/2012 11:32:34 PM | Computer Name = Sihan-PC | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 1045Error - 5/15/2012 11:34:38 PM | Computer Name = Sihan-PC | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: Continuously busy for more than a secondError - 5/15/2012 11:34:38 PM | Computer Name = Sihan-PC | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 125362Error - 5/15/2012 11:34:38 PM | Computer Name = Sihan-PC | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 125362Error - 5/16/2012 9:49:16 AM | Computer Name = Sihan-PC | Source = WinMgmt | ID = 10Description =Error - 5/16/2012 10:55:42 AM | Computer Name = Sihan-PC | Source = Customer Experience Improvement Program | ID = 1008Description =Error - 5/16/2012 11:05:24 AM | Computer Name = Sihan-PC | Source = Customer Experience Improvement Program | ID = 1008Description =Error - 5/16/2012 4:30:45 PM | Computer Name = Sihan-PC | Source = SideBySide | ID = 16842832Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero 9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest".Error in manifest or policy file "" on line . A component version required by the application conflicts with another component version already active. Conflicting components are:. Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.Error - 5/16/2012 4:30:45 PM | Computer Name = Sihan-PC | Source = SideBySide | ID = 16842832Description = Activation context generation failed for "C:\Program Files (x86)\Nero\Nero 9\Nero Recode\Recode.exe.Manifest".Error in manifest or policy file "" on line. A component version required by the application conflicts with another component version already active. Conflicting components are:. Component 1: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.Component 2: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.Error - 5/17/2012 9:50:58 AM | Computer Name = Sihan-PC | Source = WinMgmt | ID = 10Description =[ System Events ]Error - 11/23/2012 7:51:30 AM | Computer Name = Sihan-PC | Source = Service Control Manager | ID = 7002Description = The MLPTDR_Q service depends on the Parallel arbitrator group andno member of this group started.Error - 11/24/2012 9:25:57 AM | Computer Name = Sihan-PC | Source = Service Control Manager | ID = 7002Description = The MLPTDR_Q service depends on the Parallel arbitrator group andno member of this group started.Error - 11/24/2012 11:56:04 AM | Computer Name = Sihan-PC | Source = Service Control Manager | ID = 7034Description = The Freemake Improver service terminated unexpectedly. It has done this 1 time(s).Error - 11/24/2012 11:56:04 AM | Computer Name = Sihan-PC | Source = Service Control Manager | ID = 7034Description = The Skype C2C Service service terminated unexpectedly. It has done this 1 time(s).Error - 11/24/2012 12:05:05 PM | Computer Name = Sihan-PC | Source = Service Control Manager | ID = 7030Description = The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.Error - 11/24/2012 12:07:17 PM | Computer Name = Sihan-PC | Source = Application Popup | ID = 1060Description = \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible versionof the driver.Error - 11/24/2012 12:08:03 PM | Computer Name = Sihan-PC | Source = Service Control Manager | ID = 7030Description = The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.Error - 11/24/2012 4:45:53 PM | Computer Name = Sihan-PC | Source = BROWSER | ID = 8032Description =Error - 11/24/2012 5:47:01 PM | Computer Name = Sihan-PC | Source = Service Control Manager | ID = 7002Description = The MLPTDR_Q service depends on the Parallel arbitrator group andno member of this group started.Error - 11/25/2012 10:05:20 AM | Computer Name = Sihan-PC | Source = Service Control Manager | ID = 7002Description = The MLPTDR_Q service depends on the Parallel arbitrator group andno member of this group started.< End of report >As for my system, running slower than usual Link to post Share on other sites More sharing options...
TheDarkKnight Posted November 26, 2012 ID:617252 Share Posted November 26, 2012 Hello Tsurugi,Please run OTL.exe.Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)::OTLO2:64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found.O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8:64bit: - Extra context menu item: Translate this web page with Babylon - Reg Error: Value error. File not foundO8:64bit: - Extra context menu item: Translate with Babylon - Reg Error: Value error. File not foundO8 - Extra context menu item: Translate this web page with Babylon - Reg Error: Value error. File not foundO8 - Extra context menu item: Translate with Babylon - Reg Error: Value error. File not found@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:793ABD2B@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:532B5694:Commands[EmptyTemp]Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.Click the red Run Fix button.A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.Close OTL.exeIf a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.=====Then, please download AdwCleaner by Xplode onto your Desktop. Double click on AdwCleaner.exe to run the tool.Click on Search.A logfile will automatically open after the scan has finished.Please post the content of that logfile in your reply.You can find the logfile at C:\AdwCleaner[R1].txt as well.=====In your reply I would like to see the contents of the following please:OTL fix log.AdwCleaner[R1].txt.Any improvement? Link to post Share on other sites More sharing options...
Tsurugi Posted November 26, 2012 Author ID:617351 Share Posted November 26, 2012 All processes killed========== OTL ==========64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}\ deleted successfully.64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}\ deleted successfully.Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon\ deleted successfully.64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon\ deleted successfully.Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon\ not found.Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon\ not found.ADS C:\ProgramData\Temp:793ABD2B deleted successfully.ADS C:\ProgramData\Temp:532B5694 deleted successfully.========== COMMANDS ==========[EMPTYTEMP]User: All UsersUser: Default->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 0 bytes->Flash cache emptied: 56475 bytesUser: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 0 bytes->Flash cache emptied: 0 bytesUser: Public->Temp folder emptied: 0 bytesUser: Sihan->Temp folder emptied: 664632 bytes->Temporary Internet Files folder emptied: 121270026 bytes->Java cache emptied: 44952830 bytes->FireFox cache emptied: 229178395 bytes->Google Chrome cache emptied: 94556388 bytes->Apple Safari cache emptied: 158201856 bytes->Flash cache emptied: 26318 bytes%systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 0 bytes%systemroot%\System32 .tmp files removed: 0 bytes%systemroot%\System32 (64bit) .tmp files removed: 0 bytes%systemroot%\System32\drivers .tmp files removed: 0 bytesWindows Temp folder emptied: 19618 bytes%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytesRecycleBin emptied: 0 bytesTotal Files Cleaned = 619.00 mbOTL by OldTimer - Version 3.2.69.0 log created on 11262012_092333Files\Folders moved on Reboot...C:\Users\Sihan\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.PendingFileRenameOperations files...Registry entries deleted on Reboot...# AdwCleaner v2.009 - Logfile created 11/26/2012 at 09:31:05# Updated 24/11/2012 by Xplode# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)# User : Sihan - SIHAN-PC# Boot Mode : Normal# Running from : C:\Users\Sihan\Downloads\adwcleaner.exe# Option [search]***** [services] ********** [Files / Folders] *****Folder Found : C:\Program Files\BabylonFolder Found : C:\Users\Sihan\AppData\Roaming\OpenCandy***** [Registry] *****Key Found : HKCU\Software\ConduitKey Found : HKLM\SOFTWARE\Classes\Prod.capKey Found : HKLM\Software\ConduitKey Found : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCSKey Found : HKLM\Software\PrimoPDF\OpenCandyKey Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb***** [internet Browsers] *****-\\ Internet Explorer v9.0.8112.16421[OK] Registry is clean.-\\ Mozilla Firefox v16.0.2 (en-US)Profile name : defaultFile : C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\prefs.jsFound : user_pref("extensions.adapter@babylontc.com.install-event-fired", true);Found : user_pref("extensions.basicscan.init", true);Found : user_pref("extensions.ocr@babylon.com.install-event-fired", true);-\\ Google Chrome v23.0.1271.64File : C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Preferences[OK] File is clean.*************************AdwCleaner[R1].txt - [1504 octets] - [26/11/2012 09:31:05]########## EOF - C:\AdwCleaner[R1].txt - [1564 octets] ##########Think computer's running alright. Link to post Share on other sites More sharing options...
TheDarkKnight Posted November 26, 2012 ID:617450 Share Posted November 26, 2012 Good morning Tsurugi,Think computer's running alright. What are some current issues you are noticing?===== Please close all open programs and internet browsers.Double click on adwcleaner.exe to run the tool.Click on Delete.Confirm each time with OK.Your computer will be rebooted automatically. A text file will open after the restart.Please post the content of that logfile in your reply.You can find the logfile at C:\AdwCleaner[s1].txt as well.=====Also, please run a free online scan with the ESET Online Scanner.Note: You can use Internet Explorer or Mozilla Firefox for this scan.Tick the box next to YES, I accept the Terms of Use.Click Start.When asked, allow the ActiveX control to install.Click Start.Make sure that the option Remove found threats is unchecked and the option Scan unwanted applications is checked.Click Scan.Wait for the scan to finish.Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt.Copy and paste that log as a reply to this topic.=====In your reply please provide the logs from AdwCleaner and ESET. Link to post Share on other sites More sharing options...
Tsurugi Posted November 27, 2012 Author ID:617561 Share Posted November 27, 2012 # AdwCleaner v2.009 - Logfile created 11/26/2012 at 18:02:19# Updated 24/11/2012 by Xplode# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)# User : Sihan - SIHAN-PC# Boot Mode : Normal# Running from : C:\Users\Sihan\Desktop\adwcleaner.exe# Option [Delete]***** [services] ********** [Files / Folders] *****Folder Deleted : C:\Program Files\BabylonFolder Deleted : C:\Users\Sihan\AppData\Roaming\OpenCandy***** [Registry] *****Key Deleted : HKCU\Software\ConduitKey Deleted : HKLM\SOFTWARE\Classes\Prod.capKey Deleted : HKLM\Software\ConduitKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCSKey Deleted : HKLM\Software\PrimoPDF\OpenCandyKey Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb***** [internet Browsers] *****-\\ Internet Explorer v9.0.8112.16421[OK] Registry is clean.-\\ Mozilla Firefox v16.0.2 (en-US)Profile name : defaultFile : C:\Users\Sihan\AppData\Roaming\Mozilla\Firefox\Profiles\yk8xn03m.default\prefs.jsDeleted : user_pref("extensions.adapter@babylontc.com.install-event-fired", true);Deleted : user_pref("extensions.basicscan.init", true);Deleted : user_pref("extensions.ocr@babylon.com.install-event-fired", true);-\\ Google Chrome v23.0.1271.64File : C:\Users\Sihan\AppData\Local\Google\Chrome\User Data\Default\Preferences[OK] File is clean.*************************AdwCleaner[R1].txt - [1633 octets] - [26/11/2012 09:31:05]AdwCleaner[s1].txt - [1586 octets] - [26/11/2012 18:02:19]########## EOF - C:\AdwCleaner[s1].txt - [1646 octets] ##########ESETSmartInstaller@High as downloader log:all ok# version=7# OnlineScannerApp.exe=1.0.0.1# OnlineScanner.ocx=1.0.0.6583# api_version=3.0.2# EOSSerial=303c5109b4cdc24d80758c93fe4db67a# end=finished# remove_checked=false# archives_checked=true# unwanted_checked=true# unsafe_checked=false# antistealth_checked=true# utc_time=2012-11-27 04:19:57# local_time=2012-11-26 11:19:57 (-0500, Eastern Standard Time)# country="Canada"# lang=1033# osver=6.1.7601 NT Service Pack 1# compatibility_mode=5893 16776574 100 94 31025990 105515444 0 0# compatibility_mode=8192 67108863 100 0 0 0 0 0# scanned=456260# found=0# cleaned=0# scan_time=18003As for issues, think that running out of space is a cause of problems Link to post Share on other sites More sharing options...
TheDarkKnight Posted November 27, 2012 ID:617574 Share Posted November 27, 2012 Hey Tsurugi,At the moment your logs look fine. Perhaps try freeing up your hard drive and see if you see some improvements.Please download Security Check by screen317 from here or here.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document. Link to post Share on other sites More sharing options...
Tsurugi Posted November 27, 2012 Author ID:617759 Share Posted November 27, 2012 Results of screen317's Security Check version 0.99.56 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` McAfee SiteAdvisor Malwarebytes Anti-Malware version 1.65.1.1000 JavaFX 2.1.1 Java 7 Update 9 Adobe Flash Player 11.5.502.110 Adobe Reader 10.1.4 Adobe Reader out of Date! Mozilla Firefox 16.0.2 Firefox out of Date! Google Chrome 21.0.1180.83 Google Chrome 21.0.1180.89 Google Chrome 22.0.1229.79 Google Chrome 22.0.1229.92 Google Chrome 22.0.1229.94 Google Chrome 23.0.1271.64 ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe Symantec Norton Online Backup NOBuAgent.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 2%````````````````````End of Log``````````````````````Gonna try to dump some files onto an expansion drive afterschool Link to post Share on other sites More sharing options...
Tsurugi Posted November 28, 2012 Author ID:617822 Share Posted November 28, 2012 I think my computer is ok now, adobe reader was updated, and I'm running older version of FF to allow for an add-on to run Link to post Share on other sites More sharing options...
TheDarkKnight Posted November 28, 2012 ID:617914 Share Posted November 28, 2012 Hey Tsurugi,A little housekeeping to uninstall ComboFix:Please click Start>Run and copy/paste the following text, including the space between "ComboFix and "/uninstall", into the Run box and click OK:ComboFix /uninstallNote: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.Right-click the Recycle Bin and please select Empty Recycle Bin.For OTL:Double click OTL.exe.Click the CleanUp button.Select Yes when the "Begin cleanup Process?" prompt appears.If you are prompted to reboot during the cleanup, select Yes.The tool will delete itself once it finishes.Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.And AdwCleaner:Please double click on adwcleaner.exe to run the tool.Click on Uninstall.Confirm with Yes.=====Please consider using these ideas to help secure your computer. While there is no way to guarantee safety when you use a computer, these steps will make it much less likely that you will need to endure another infection. While we really like to help people, we would rather help you protect yourself so that you won't need that help in the future. :thumbup:IMPORTANT: Please enable Automatic Updates under Start > Control Panel > Automatic Updates to ensure your Windows updates regularly. This is extremely important in ensuring you remain protected against vulnerabilities and infections. This is a crucial security measure.As a minimum, you need at least an antivirus, firewall and some type of anti-spyware program.Please consider installing and running the following program (there is a free version available):SpywareBlasterA tutorial on using SpywareBlaster to prevent malware from ever installing on your computer may be found here.Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster, can be run with any of them. Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure and looking for anti-spyware programs, you may be able to find out if it is a rogue here:http://www.spywarewarrior.com/rogue_anti-spyware.htmA similar category of programs is now called "scareware." Scareware programs are active infections that will pop-up on your computer and tell you that you are infected. If you look closely, it will usually have a name that looks like it might be legitimate, but it is NOT one of the programs you installed. It tells you to click and install it right away. If you click on any part of it, including the 'X' to close it, you may actually help it infect your computer further. Keeping protection updated and running resident protection can help prevent these infections. If it happens anyway, get offline as quickly as you can. Pull the internet connection cable or shut down the computer if you have to. Contact someone to help by using another computer if possible. These programs are also sometimes called 'rogues', but they are different than the older version of rogues mentioned above.Please consider using an alternate browser. Mozilla's Firefox browser is a very good alternative. In addition to being generally more secure than Internet Explorer, it has a very good built-in popup blocker and Add-ons, like Adblock Plus and NoScript, can make it even more secure. To avoid dangerous sites Web of Trust or McAfee SiteAdvisor can be installed. Google Chrome or Opera are other good options.Two useful programs for keeping your programs up-to-date are FileHippo or Secunia PSI. Running one of these regularly will help you obtain the latest program updates.Please also read Tony Klein's excellent article: How did I get infected in the first place.Hopefully these steps will help to keep you error free. If you run into more difficulty, we will certainly do what we can to help. Link to post Share on other sites More sharing options...
Maurice Naggar Posted November 28, 2012 ID:618080 Share Posted November 28, 2012 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts