Windows 7 zero access rootkit

Hellsing · July 3, 2013

First off I have a triple team going on my system right now. I have the Fbi scam virus keeping me from doing anything. I can only keep the computer UN stuck by booting in safe mode with command window. I also have the internet security virus waiting and a suspected zero access rootkit as told by the rkill program. I need some help fixing this thing.

D-FRED-BROWN · July 3, 2013

Hello Hellsing and welcome to Malwarebytes!

I am D-FRED-BROWN and I will be helping you.

Please start off by doing the following:

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select English as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select English as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
Select Command Prompt
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Let me know how things go. If you at any point have trouble using FRST, please stop and post back here to let me know.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Note:

Please make sure you are subscribed to this topic: Click on the "Follow This Topic" Button (at the top right of this page), make sure that the "Receive notification" box is checked and that it is set to "Instantly"

-------> Your topic will be closed if you haven't replied within 3 days! <--------

(If I don't respond within 24 hours, please send me a PM)

-DFB

Hellsing · July 3, 2013

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-07-2013
Ran by Austin (administrator) on 03-07-2013 00:40:20
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\cmd.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1684264 2009-02-06] (Synaptics Incorporated)
HKLM\...\Run: [AlienFX Controller] "C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe" [52480 2009-04-24] (Alienware Corporation)
HKLM\...\Run: [OSD CC] %ProgramFiles%\OSD\Launch_CC.exe [20480 2009-02-19] (Alienware Corporation)
HKLM\...\Run: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray64.exe [462848 2009-03-19] (IDT, Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [499608 2011-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [jEdit Server] "C:\Program Files\jEdit\jedit.exe" -background -nogui --l4j-dont-wait [42496 2012-01-30] (Contributors)
HKLM\...\Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe" [57928 2012-11-29] (LogMeIn, Inc.)
HKLM\...\Run: [MRT] "C:\Windows\system32\MRT.exe" /R [75825640 2013-06-13] (Microsoft Corporation)
HKLM\...\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)
HKCU\...\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [steam] "c:\program files (x86)\steam\steam.exe" -silent [1641896 2013-06-06] (Valve Corporation)
HKCU\...\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED [742264 2012-03-30] (BitTorrent, Inc.)
HKCU\...\Run: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US [x]
HKCU\...\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3077528 2011-09-27] ()
HKCU\...\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000 [67456 2011-11-07] (Uniblue Systems Limited)
HKCU\...\Run: [Temp] rundll32 "C:\Users\Austin\AppData\Local\Amazon\Temp\fbiadppl.dll",DllRegisterServer [1810944 2013-06-23] () <===== ATTENTION
HKCU\...\Run: [Fraps3] rundll32.exe C:\Users\Austin\AppData\Local\Fraps3\garmgewv.dll,JXhHYSSCCEqMdWIlJVRUWCnVUqS [593408 2013-06-23] (?????????? ??????????) <===== ATTENTION
HKCU\...\Run: [Adobe CSS5.1 Manager] C:\Users\Austin\AppData\Local\adaa6f88-ff87-4fc9-b22e-35a108e2205aad\adaaffffcbeaeaad.exe [172544 2013-06-30] () <===== ATTENTION
HKCU\...\Run: [Akamai NetSession Interface] [x]
HKCU\...\Run: [svidete] rundll32.exe "C:\Users\Austin\AppData\Local\achzFamg.dll",Startup [x]
HKCU\...\RunOnce: [Adobe CSS5.1 Manager] C:\Users\Austin\AppData\Local\adaa6f88-ff87-4fc9-b22e-35a108e2205aad\adaaffffcbeaeaad.exe [172544 2013-06-30] () <===== ATTENTION
HKCU\...\Winlogon: [shell] C:\Users\Austin\AppData\Roaming\dbu32.ocx,explorer.exe <==== ATTENTION
HKCR\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}\n. ATTENTION! ====> ZeroAccess?
MountPoints2: {1c1a6c67-9403-11de-b5da-0025643a50d8} - E:\LaunchU3.exe -a
MountPoints2: {b6401647-eabf-11de-ae7c-806e6f6e6963} - D:\DVDROM\MediaManager\MediaManagerII.exe
HKLM-x32\...\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.)
HKLM-x32\...\Run: [bDRegion] "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe" [75048 2009-05-01] (cyberlink)
HKLM-x32\...\Run: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe" [115560 2009-01-22] (Symantec Corporation)
HKLM-x32\...\Run: [FAStartup] [x]
HKLM-x32\...\Run: [FATrayAlert] C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe [95496 2009-03-05] (Sensible Vision )
HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49152 2008-03-25] (Hewlett-Packard)
HKLM-x32\...\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [81920 2008-03-13] (Hewlett-Packard)
HKLM-x32\...\Run: [OSD] c:\Program Files\OSD\Launch.exe [36864 2009-05-12] (HH)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [50472 2007-12-14] ()
HKLM-x32\...\Run: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [91432 2008-10-17] (CyberLink Corp.)
HKLM-x32\...\Run: [bing Bar] "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe" [243544 2010-03-24] (Microsoft Corp.)
HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [288088 2009-11-11] (Microsoft Corporation)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-02] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-12-08] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2010-10-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [821144 2010-10-25] (Adobe Systems Inc.)
HKLM-x32\...\Run: [backupNowEZtray] "C:\Program Files (x86)\NTI\NTI Backup Now EZ\BackupNowEZtray.exe" -k [580632 2011-09-23] (NTI Corporation)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [x]
HKLM-x32\...\Run: [ALUAlert] "C:\Program Files (x86)\Symantec\LiveUpdate\ALuNotify.exe" "/LOWDISKSPACE C" [492912 2008-06-30] (Symantec Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [2255184 2013-05-15] (LogMeIn Inc.)
HKLM-x32\...\Run: [Anvi Smart Defender] C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe [1563720 2013-06-08] (Anvisoft)
HKU\UpdatusUser\...\Winlogon: [shell] Explorer.exe <==== ATTENTION
AppInit_DLLs-x32: [0 ] ()
Lsa: [Notification Packages] scecli FAPassSync
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
ShortcutTarget: GamersFirst LIVE!.lnk -> C:\Program Files (x86)\GamersFirst\LIVE!\Live.exe (No File)
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Austin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameStop Now.lnk
ShortcutTarget: GameStop Now.lnk -> C:\Program Files (x86)\GameStop App\Now\GameStopNow.exe (GameStop Corp.)
Startup: C:\Users\Austin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hauppauge Device Central Tray Tool.lnk
ShortcutTarget: Hauppauge Device Central Tray Tool.lnk -> C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe (Hauppauge Computer Works, Inc.)
Startup: C:\Users\Austin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hauppauge Device Properties.lnk
ShortcutTarget: Hauppauge Device Properties.lnk -> C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe (Hauppauge Computer Works, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ign.com/xbox-360
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: (No Name) - {03402f96-3dc7-4285-bc50-9e81fefafe43} - No File
URLSearchHook: (No Name) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0B4A10D1-FBD6-451d-BFDA-F03252B05984} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&query={searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20110828033131655&tb_oid=28-08-2011&tb_mrud=28-08-2011
SearchScopes: HKCU - {0B4A10D1-FBD6-451d-BFDA-F03252B05984} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&query={searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20110828033131655&tb_oid=28-08-2011&tb_mrud=28-08-2011
BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: FAIESSOHelper Class - {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - C:\Program Files\Alienware\Command Center\AlienSense\FAIESSO.dll (Sensible Vision )
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
BHO-x32: AOL Messaging Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll No File
BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - AOL Messaging Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll No File
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} http://www.support.dell.com/systemprofiler/SysProExe.CAB
DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB
DPF: HKLM-x32 {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/mcfscan/3,0,0,6089/mcfscan.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default

FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin-x32: @gamersfirst.com/LiveLauncher - C:\Program Files (x86)\GamersFirst\LIVE!\nplivelauncher.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.3.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.3.1 - C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpWinExt,version=5.0 - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: No Name - C:\Users\Austin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: Google Toolbar for Firefox - C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF Extension: AOL Toolbar - C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default\Extensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1}
FF Extension: AOL Messaging Toolbar - C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default\Extensions\{c2f863cd-0429-48c7-bb54-db756a951760}
FF Extension: uriloader - C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default\Extensions\uriloader@pdf.js.xpi
FF Extension: wdfopjxrea - C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default\Extensions\wdfopjxrea@wdfopjxrea.org.xpi
FF Extension: No Name - C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
FF Extension: No Name - C:\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\3iesvlyx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: <?xml version="1.0"?>

<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:em="http://www.mozilla.org/2004/em-rdf#">
<Description about="urn:mozilla:install-manifest">
    <em:id>smartwebprinting@hp.com</em:id>
    <em:version>4.60</em:version>

<em:targetApplication>
      
      <Description>
        <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
        <em:minVersion>3.5.0.0</em:minVersion>
        <em:maxVersion>3.5.*.*</em:maxVersion>
      </Description>
    </em:targetApplication>

<em:name>HP Smart Web Printing</em:name>
    <em:description>Print what you want, how you want.</em:description>
    <em:creator>hp.com</em:creator>
    <em:homepageURL>http://www.hp.com/go/smartwebprinting</em:homepageURL>


    <em:targetPlatform>WINNT_x86-msvc</em:targetPlatform>
</Description>
</RDF>
- C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [{3112ca9c-de6d-4884-a869-9855de68056c}] C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}
FF Extension: <?xml version="1.0"?>

<Description about="urn:mozilla:install-manifest">
    <em:id>{3112ca9c-de6d-4884-a869-9855de68056c}</em:id>
    <em:version>3.1.20081127W</em:version>

    
    <em:targetApplication>
      <Description>
        <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
        <em:minVersion>2.0</em:minVersion>
        <em:maxVersion>3.*</em:maxVersion>
      </Description>
    </em:targetApplication>

    <em:targetPlatform>WINNT</em:targetPlatform>
    <em:name>Google Toolbar for Firefox</em:name>
    <em:description>Take the power of Google with you anywhere on the Web!</em:description>
    <em:creator>Google Inc.</em:creator>
    <em:homepageURL>http://www.google.com/</em:homepageURL>
    <em:updateURL><![CDATA[https://tools.google.com/firefox/update?guid=%ITEM_ID%&version=%ITEM_VERSION%&application=%APP_ID%&appversion=%APP_VERSION%&dist=google]]></em:updateURL>

    <em:file>
      <Description about="urn:mozilla:extension:file:google-toolbar.jar">
        <em:package>content/</em:package>
        <em:locale>locale/en-US/</em:locale>
        <em:locale>locale/da-DK/</em:locale>
        <em:locale>locale/de-DE/</em:locale>
        <em:locale>locale/es-AR/</em:locale>
        <em:locale>locale/es-ES/</em:locale>
        <em:locale>locale/fi-FI/</em:locale>
        <em:locale>locale/fr-FR/</em:locale>
        <em:locale>locale/it-IT/</em:locale>
        <em:locale>locale/ja-JP/</em:locale>
        <em:locale>locale/ja-JPM/</em:locale>
        <em:locale>locale/ko-KR/</em:locale>
        <em:locale>locale/nb-NO/</em:locale>
        <em:locale>locale/nl-NL/</em:locale>
        <em:locale>locale/pt-BR/</em:locale>
        <em:locale>locale/ru-RU/</em:locale>
        <em:locale>locale/sv-SE/</em:locale>
        <em:locale>locale/zh-CN/</em:locale>
        <em:locale>locale/zh-TW/</em:locale>
        <em:skin>skin/</em:skin>
      </Description>
    </em:file>
</Description>
</RDF>

- C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}
FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\Firefox
FF Extension: Bing Bar - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\Firefox
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: <?xml version="1.0"?>

<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:em="http://www.mozilla.org/2004/em-rdf#">
<Description about="urn:mozilla:install-manifest">
    <em:id>smartwebprinting@hp.com</em:id>
    <em:version>4.60</em:version>

<em:targetApplication>
      
      <Description>
        <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
        <em:minVersion>3.5.0.0</em:minVersion>
        <em:maxVersion>3.5.*.*</em:maxVersion>
      </Description>
    </em:targetApplication>

<em:name>HP Smart Web Printing</em:name>
    <em:description>Print what you want, how you want.</em:description>
    <em:creator>hp.com</em:creator>
    <em:homepageURL>http://www.hp.com/go/smartwebprinting</em:homepageURL>


    <em:targetPlatform>WINNT_x86-msvc</em:targetPlatform>
</Description>
</RDF>
- C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [{C0B62AAB-8E55-4B42-8670-E066358BE912}] C:\Users\Austin\AppData\Local\{C0B62AAB-8E55-4B42-8670-E066358BE912}\
FF Extension: <?xml version="1.0"?>
<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:em="http://www.mozilla.org/2004/em-rdf#">
<Description about="urn:mozilla:install-manifest">
    <em:name>XULRunner</em:name>
    <em:id>{C0B62AAB-8E55-4B42-8670-E066358BE912}</em:id>
    <em:version>1.9.1</em:version>
    <em:creator>Mozilla Corp.</em:creator>
    <em:description>XULRunner is a Mozilla runtime package</em:description>
    <em:type>2</em:type>
    <em:hidden>true</em:hidden>
    <em:targetApplication>
      <Description>
        <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
        <em:minVersion>1.5</em:minVersion>
        <em:maxVersion>3.*.*.*</em:maxVersion>
      </Description>
    </em:targetApplication>
</Description>
</RDF> - C:\Users\Austin\AppData\Local\{C0B62AAB-8E55-4B42-8670-E066358BE912}\

Chrome:
=======

CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.60\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Coupons Inc., Coupon Printer Manager ) - C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll (Coupons, Inc.)
CHR Plugin: (Coupons Inc., Coupon Printer Manager ) - C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (DivX Player Netscape Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
CHR Plugin: (downloadUpdater) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll No File
CHR Plugin: (downloadUpdater2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll No File
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (DivX Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File

==================== Services (Whitelisted) =================

S2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_41ddbdc34da78989\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
S2 asdsrv; C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe [739400 2013-06-08] (Anvisoft)
S2 ccEvtMgr; C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe [108392 2009-01-22] (Symantec Corporation)
S2 ccSetMgr; C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe [108392 2009-01-22] (Symantec Corporation)
S2 CustomSvc; C:\Program Files\OSD\Service1.exe [13312 2009-02-20] ()
S2 FAService; C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe [2360584 2009-03-05] (Sensible Vision )
S2 gupdate1ca70abb4bf12a0; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [133104 2009-11-29] (Google Inc.)
S3 HcwDevCentralService; C:\PROGRA~2\HAUPPA~1\DEVICE~1\HCWDEV~1.EXE [401232 2013-02-07] (Hauppauge Computer Works, Inc.)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093872 2008-06-30] (Symantec Corporation)
S2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2013-06-08] (LogMeIn, Inc.)
S2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2013-06-08] (LogMeIn, Inc.)
S2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)
S3 Macromedia Licensing Service; C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [68096 2009-07-25] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3505768 2010-06-17] (INCA Internet Co., Ltd.)
S2 NTI BackupNowEZSvr; C:\Program Files (x86)\NTI\NTI Backup Now EZ\BackupNowEZSvr.exe [45592 2011-09-23] (NTI Corporation)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2011-10-22] ()
S2 SmcService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe [3081544 2009-01-22] (Symantec Corporation)
S3 SNAC; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE [388424 2009-01-22] (Symantec Corporation)
S2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-05-07] (Enigma Software Group USA, LLC.)
S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_41ddbdc34da78989\STacSV64.exe [268288 2009-03-19] (IDT, Inc.)
S2 Symantec AntiVirus; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe [2440120 2009-01-22] (Symantec Corporation)
S2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [x]

==================== Drivers (Whitelisted) ====================

S4 ahcix64; C:\Windows\system32\drivers\ahcix64.sys [146944 2008-07-29] (ATI Technologies Inc.)
S1 asdrm; C:\Windows\System32\DRIVERS\asdrm.sys [18768 2012-11-07] (Anvisoft)
S2 asdrs; C:\Windows\system32\DRIVERS\asdrs.sys [23376 2012-11-07] (Anvisoft)
S2 asdrs; C:\Windows\system32\DRIVERS\asdrs.sys [23376 2012-11-07] (Anvisoft)
S2 asdws; C:\Windows\system32\DRIVERS\asdws.sys [17232 2012-11-07] ()
S2 asdws; C:\Windows\system32\DRIVERS\asdws.sys [17232 2012-11-07] ()
R3 DAdderFltr; C:\Windows\System32\drivers\dadder.sys [12672 2007-08-02] (Razer (Asia-Pacific) Pte Ltd)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-04-15] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-04-15] (Symantec Corporation)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S3 hcwE5bda; C:\Windows\System32\drivers\hcwE5bda.sys [945136 2013-02-12] (Hauppauge Computer Work, Inc.)
R0 JGOGO; C:\Windows\System32\drivers\jgogo.sys [8704 2006-02-07] (JMicron )
S2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-29] (LogMeIn, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation)
S4 mv61xx; C:\Windows\system32\drivers\mv61xx.sys [163736 2007-06-15] (Marvell Semiconductor, Inc.)
S3 NAVENG; C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130630.003\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
S3 NAVENG; C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130630.003\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130630.003\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130630.003\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 NPPTNT2; C:\Windows\SysWow64\npptNT2.sys [4682 2005-01-03] (INCA Internet Co., Ltd.)
S4 nvrd64; C:\Windows\system32\drivers\nvrd64.sys [166944 2008-08-18] (NVIDIA Corporation)
S3 OA007Vid; C:\Windows\System32\DRIVERS\OA007Vid.sys [310208 2008-12-27] (Creative Technology Ltd.)
S1 SRTSP; C:\Windows\System32\Drivers\SRTSP64.SYS [441904 2009-01-22] (Symantec Corporation)
S1 SRTSP; C:\Windows\SysWow64\Drivers\SRTSP64.SYS [441904 2009-01-22] (Symantec Corporation)
S3 SRTSPL; C:\Windows\System32\Drivers\SRTSPL64.SYS [480816 2009-01-22] (Symantec Corporation)
S3 SRTSPL; C:\Windows\SysWow64\Drivers\SRTSPL64.SYS [480816 2009-01-22] (Symantec Corporation)
S1 SRTSPX; C:\Windows\System32\Drivers\SRTSPX64.SYS [32304 2009-01-22] (Symantec Corporation)
S1 SRTSPX; C:\Windows\SysWow64\Drivers\SRTSPX64.SYS [32304 2009-01-22] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172080 2009-07-28] (Symantec Corporation)
S3 WinRing0_1_2_0; C:\Program Files\OSD\WinRing0x64.sys [14544 2008-07-25] (OpenLibSys.org)
S3 WinRing0_1_2_0; C:\Program Files\OSD\WinRing0x64.sys [14544 2008-07-25] (OpenLibSys.org)
S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [146928 2009-03-05] (CyberLink Corp.)
S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [146928 2009-03-05] (CyberLink Corp.)
S3 dump_wmimmc; \??\C:\gPotato\Rappelz\GameGuard\dump_wmimmc.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S4 LMIRfsClientNP; No ImagePath
S3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]
S3 X6va001; \??\C:\Users\Austin\AppData\Local\Temp\001724B.tmp [x]
S3 X6va005; \??\C:\Users\Austin\AppData\Local\Temp\0053D8C.tmp [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-07-03 00:40 - 2013-07-03 00:40 - 00000000 ____D C:\FRST
2013-07-03 00:04 - 2013-07-03 00:04 - 00284080 ____A C:\Windows\Minidump\070313-30997-01.dmp
2013-07-02 14:37 - 2013-07-02 14:37 - 00270864 ____A C:\Windows\Minidump\070213-24788-01.dmp
2013-07-02 10:17 - 2013-07-02 10:18 - 00001448 ____A C:\AdwCleaner[s4].txt
2013-07-02 00:52 - 2013-07-02 00:52 - 00000340 ____A C:\AdwCleaner[s3].txt
2013-07-02 00:35 - 2013-07-02 00:36 - 00000288 ____A C:\Users\Austin\Desktop\RootkitRemover20130702003526.txt
2013-06-30 19:34 - 2013-06-30 19:34 - 00000000 ____D C:\ProgramData\hvbhp
2013-06-30 18:33 - 2013-06-30 18:33 - 00001268 ____A C:\AdwCleaner[R3].txt
2013-06-30 18:33 - 2013-06-30 18:33 - 00000340 ____A C:\AdwCleaner[s2].txt
2013-06-30 18:02 - 2013-06-30 18:02 - 00001186 ____A C:\Users\Public\Desktop\Anvi Smart Defender.lnk
2013-06-30 18:02 - 2013-06-30 18:02 - 00000000 ____D C:\Users\Austin\AppData\Roaming\Anvisoft
2013-06-30 18:02 - 2013-06-30 18:02 - 00000000 ____D C:\ProgramData\Anvisoft
2013-06-30 18:02 - 2013-06-30 18:02 - 00000000 ____D C:\Program Files (x86)\Anvisoft
2013-06-30 18:02 - 2012-11-07 03:16 - 00023376 ____A (Anvisoft) C:\Windows\System32\Drivers\asdrs.sys
2013-06-30 18:02 - 2012-11-07 03:16 - 00018768 ____A (Anvisoft) C:\Windows\System32\Drivers\asdrm.sys
2013-06-30 18:02 - 2012-11-07 03:16 - 00017232 ____A C:\Windows\System32\Drivers\asdws.sys
2013-06-30 17:55 - 2013-06-30 17:57 - 00000004 ____A C:\Users\Austin\AppData\Roaming\skype.ini
2013-06-30 17:25 - 2013-06-30 17:26 - 00023306 ____A C:\AdwCleaner[s1].txt
2013-06-30 17:25 - 2013-06-30 17:25 - 00022764 ____A C:\AdwCleaner[R2].txt
2013-06-30 17:24 - 2013-06-30 17:24 - 00991872 ____A (Bleeping Computer, LLC) C:\Users\Austin\Desktop\rkill64-23471.exe
2013-06-30 17:22 - 2013-06-30 17:22 - 00022703 ____A C:\AdwCleaner[R1].txt
2013-06-30 17:18 - 2013-06-30 17:18 - 00991872 ____A (Bleeping Computer, LLC) C:\Users\Austin\Desktop\rkill64.exe
2013-06-30 17:18 - 2013-06-30 17:18 - 00648201 ____A C:\Users\Austin\Desktop\AdwCleaner.exe
2013-06-30 17:17 - 2013-06-30 17:17 - 00000000 ____D C:\Users\Austin\Desktop\rkill
2013-06-30 17:16 - 2013-07-02 11:33 - 00002432 ____A C:\Users\Austin\Desktop\Rkill.txt
2013-06-30 17:16 - 2013-06-30 17:16 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\Austin\Desktop\rkill.exe
2013-06-30 12:31 - 2013-06-30 12:31 - 00002258 ____A C:\Users\Austin\Desktop\SpyHunter.lnk
2013-06-30 12:31 - 2013-06-30 12:31 - 00000000 ____D C:\sh4ldr
2013-06-30 12:31 - 2013-06-30 12:31 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-06-30 12:31 - 2012-06-22 12:01 - 00022704 ____A C:\Windows\System32\Drivers\EsgScanner.sys
2013-06-30 12:30 - 2013-06-30 12:31 - 00000000 ____D C:\Windows\BCD5545077AC4347B24F654B1189F8D4.TMP
2013-06-30 12:17 - 2013-06-30 12:17 - 00000040 ____A C:\Users\Austin\AppData\Roaming\mbam.context.scan
2013-06-30 11:51 - 2013-07-03 00:00 - 00000336 ___AH C:\Windows\Tasks\{D9F027EC-CD7B-4EC4-A8DC-931A2D7DC0DD}.job
2013-06-30 11:51 - 2013-06-30 17:23 - 00000793 ____A C:\Users\Austin\Desktop\Internet Security Pro.lnk
2013-06-30 11:51 - 2013-06-30 11:51 - 00000000 ____D C:\Users\Austin\AppData\Local\adaa6f88-ff87-4fc9-b22e-35a108e2205aad
2013-06-23 13:33 - 2013-06-23 13:33 - 00002021 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-06-23 01:35 - 2013-06-23 13:48 - 00000000 ____D C:\Users\Austin\AppData\Local\Fraps3
2013-06-16 23:25 - 2013-06-16 23:25 - 00466456 ____A (Creative Labs) C:\Windows\System32\wrap_oal.dll
2013-06-16 23:25 - 2013-06-16 23:25 - 00444952 ____A (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2013-06-16 23:25 - 2013-06-16 23:25 - 00122904 ____A (Portions © Creative Labs Inc. and NVIDIA Corp.) C:\Windows\System32\OpenAL32.dll
2013-06-16 23:25 - 2013-06-16 23:25 - 00109080 ____A (Portions © Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2013-06-16 23:25 - 2013-06-16 23:25 - 00000000 ____D C:\Program Files (x86)\OpenAL
2013-06-16 23:10 - 2013-06-16 23:10 - 00000195 ____A C:\Users\Austin\Desktop\Hotline Miami.url
2013-06-16 03:02 - 2013-06-08 10:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-16 03:02 - 2013-06-08 10:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-16 03:02 - 2013-06-08 10:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-16 03:02 - 2013-06-08 10:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-16 03:02 - 2013-06-08 10:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-16 03:02 - 2013-06-08 08:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-16 03:02 - 2013-06-08 07:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-16 03:02 - 2013-06-08 07:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-16 03:02 - 2013-06-08 07:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-16 03:02 - 2013-06-08 07:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-16 03:02 - 2013-06-08 07:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-16 03:02 - 2013-06-08 07:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-13 03:03 - 2013-05-16 21:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 03:03 - 2013-05-16 21:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 03:03 - 2013-05-16 21:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 03:03 - 2013-05-16 21:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 03:03 - 2013-05-16 21:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 03:03 - 2013-05-16 21:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 03:03 - 2013-05-16 21:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 03:03 - 2013-05-16 21:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 03:03 - 2013-05-16 20:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:03 - 2013-05-16 20:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:03 - 2013-05-16 20:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:03 - 2013-05-16 20:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:03 - 2013-05-16 20:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:03 - 2013-05-16 20:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:03 - 2013-05-16 20:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:03 - 2013-05-16 20:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:03 - 2013-05-16 20:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:03 - 2013-05-14 08:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 03:03 - 2013-05-14 04:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 10:04 - 2013-05-08 02:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 10:04 - 2013-04-26 01:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 10:04 - 2013-04-26 00:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 10:02 - 2013-05-10 01:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 10:02 - 2013-05-09 23:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 10:01 - 2013-04-17 03:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 10:01 - 2013-04-17 02:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 09:59 - 2013-05-13 01:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 09:59 - 2013-05-13 01:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 09:59 - 2013-05-13 01:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 09:59 - 2013-05-13 01:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 09:59 - 2013-05-13 00:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 09:59 - 2013-05-13 00:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 09:59 - 2013-05-13 00:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 09:59 - 2013-05-12 23:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 09:59 - 2013-05-12 23:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 09:59 - 2013-05-12 23:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 09:58 - 2013-04-25 19:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 09:58 - 2013-03-31 18:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-11 23:16 - 2013-06-11 23:16 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-10 12:30 - 2013-06-10 12:30 - 00000221 ____A C:\Users\Austin\Desktop\Saints Row The Third.url
2013-06-06 01:53 - 2013-06-06 01:53 - 00000220 ____A C:\Users\Austin\Desktop\Garry's Mod.url
2013-06-05 09:47 - 2013-06-05 09:47 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-05 09:47 - 2013-06-05 09:47 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-05 09:47 - 2013-06-05 09:47 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-05 09:47 - 2013-06-05 09:47 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-05 09:47 - 2013-06-05 09:47 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-05 09:47 - 2013-06-05 09:47 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-05 09:47 - 2013-06-05 09:47 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-05 09:47 - 2013-06-05 09:47 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-05 09:47 - 2013-06-05 09:47 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-06-05 09:43 - 2013-06-05 09:50 - 00008121 ____A C:\Windows\IE10_main.log

==================== One Month Modified Files and Folders =======

2013-07-03 00:40 - 2013-07-03 00:40 - 00000000 ____D C:\FRST
2013-07-03 00:04 - 2013-07-03 00:04 - 00284080 ____A C:\Windows\Minidump\070313-30997-01.dmp
2013-07-03 00:04 - 2011-04-21 10:07 - 00000000 ____D C:\Windows\Minidump
2013-07-03 00:04 - 2009-12-12 04:29 - 714636151 ____A C:\Windows\MEMORY.DMP
2013-07-03 00:01 - 2010-07-23 21:24 - 00000000 ____D C:\Users\Austin\AppData\Local\PMB Files
2013-07-03 00:01 - 2010-05-07 10:46 - 00000000 ____D C:\Users\Austin\AppData\Roaming\uTorrent
2013-07-03 00:00 - 2013-06-30 11:51 - 00000336 ___AH C:\Windows\Tasks\{D9F027EC-CD7B-4EC4-A8DC-931A2D7DC0DD}.job
2013-07-03 00:00 - 2013-03-22 00:34 - 00000000 ____D C:\ProgramData\LogMeIn
2013-07-02 23:57 - 2009-11-29 00:35 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-02 23:55 - 2011-09-05 23:37 - 00000000 ____D C:\Users\Austin\AppData\Local\LogMeIn Hamachi
2013-07-02 23:54 - 2012-02-05 14:55 - 00000000 ____D C:\Users\Austin\.jedit
2013-07-02 23:54 - 2009-07-23 12:36 - 00000000 ____D C:\Program Files (x86)\Steam
2013-07-02 23:52 - 2013-04-11 11:52 - 00000496 ____A C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job
2013-07-02 23:52 - 2012-01-29 23:37 - 00000346 ____A C:\Windows\Tasks\RegistryBooster.job
2013-07-02 23:52 - 2009-07-14 01:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-02 23:51 - 2009-07-14 00:51 - 01930249 ____A C:\Windows\setupact.log
2013-07-02 23:50 - 2009-07-10 19:58 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-02 23:45 - 2009-12-17 00:29 - 00391708 ____A C:\Windows\PFRO.log
2013-07-02 18:26 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\AppCompat
2013-07-02 18:25 - 2013-05-23 14:53 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-07-02 18:25 - 2011-12-22 01:25 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-02 18:25 - 2010-07-23 21:23 - 00000000 ____D C:\ProgramData\PMB Files
2013-07-02 18:24 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\System32\sysprep
2013-07-02 18:24 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration
2013-07-02 14:42 - 2009-12-16 23:57 - 00000000 ____D C:\users\Austin
2013-07-02 14:37 - 2013-07-02 14:37 - 00270864 ____A C:\Windows\Minidump\070213-24788-01.dmp
2013-07-02 11:35 - 2012-07-10 12:03 - 00007594 ____A C:\Users\Austin\AppData\Local\Resmon.ResmonCfg
2013-07-02 11:33 - 2013-06-30 17:16 - 00002432 ____A C:\Users\Austin\Desktop\Rkill.txt
2013-07-02 11:06 - 2009-07-14 03:44 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-02 10:18 - 2013-07-02 10:17 - 00001448 ____A C:\AdwCleaner[s4].txt
2013-07-02 00:52 - 2013-07-02 00:52 - 00000340 ____A C:\AdwCleaner[s3].txt
2013-07-02 00:36 - 2013-07-02 00:35 - 00000288 ____A C:\Users\Austin\Desktop\RootkitRemover20130702003526.txt
2013-07-01 07:44 - 2009-11-29 00:35 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-01 07:43 - 2009-12-16 23:56 - 00011440 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-01 07:43 - 2009-12-16 23:56 - 00011440 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-01 07:20 - 2012-05-09 17:22 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-01 07:15 - 2009-12-17 00:41 - 01886483 ____A C:\Windows\WindowsUpdate.log
2013-06-30 19:34 - 2013-06-30 19:34 - 00000000 ____D C:\ProgramData\hvbhp
2013-06-30 18:33 - 2013-06-30 18:33 - 00001268 ____A C:\AdwCleaner[R3].txt
2013-06-30 18:33 - 2013-06-30 18:33 - 00000340 ____A C:\AdwCleaner[s2].txt
2013-06-30 18:02 - 2013-06-30 18:02 - 00001186 ____A C:\Users\Public\Desktop\Anvi Smart Defender.lnk
2013-06-30 18:02 - 2013-06-30 18:02 - 00000000 ____D C:\Users\Austin\AppData\Roaming\Anvisoft
2013-06-30 18:02 - 2013-06-30 18:02 - 00000000 ____D C:\ProgramData\Anvisoft
2013-06-30 18:02 - 2013-06-30 18:02 - 00000000 ____D C:\Program Files (x86)\Anvisoft
2013-06-30 17:57 - 2013-06-30 17:55 - 00000004 ____A C:\Users\Austin\AppData\Roaming\skype.ini
2013-06-30 17:26 - 2013-06-30 17:25 - 00023306 ____A C:\AdwCleaner[s1].txt
2013-06-30 17:25 - 2013-06-30 17:25 - 00022764 ____A C:\AdwCleaner[R2].txt
2013-06-30 17:24 - 2013-06-30 17:24 - 00991872 ____A (Bleeping Computer, LLC) C:\Users\Austin\Desktop\rkill64-23471.exe
2013-06-30 17:23 - 2013-06-30 11:51 - 00000793 ____A C:\Users\Austin\Desktop\Internet Security Pro.lnk
2013-06-30 17:22 - 2013-06-30 17:22 - 00022703 ____A C:\AdwCleaner[R1].txt
2013-06-30 17:18 - 2013-06-30 17:18 - 00991872 ____A (Bleeping Computer, LLC) C:\Users\Austin\Desktop\rkill64.exe
2013-06-30 17:18 - 2013-06-30 17:18 - 00648201 ____A C:\Users\Austin\Desktop\AdwCleaner.exe
2013-06-30 17:17 - 2013-06-30 17:17 - 00000000 ____D C:\Users\Austin\Desktop\rkill
2013-06-30 17:16 - 2013-06-30 17:16 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\Austin\Desktop\rkill.exe
2013-06-30 12:31 - 2013-06-30 12:31 - 00002258 ____A C:\Users\Austin\Desktop\SpyHunter.lnk
2013-06-30 12:31 - 2013-06-30 12:31 - 00000000 ____D C:\sh4ldr
2013-06-30 12:31 - 2013-06-30 12:31 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-06-30 12:31 - 2013-06-30 12:30 - 00000000 ____D C:\Windows\BCD5545077AC4347B24F654B1189F8D4.TMP
2013-06-30 12:17 - 2013-06-30 12:17 - 00000040 ____A C:\Users\Austin\AppData\Roaming\mbam.context.scan
2013-06-30 11:51 - 2013-06-30 11:51 - 00000000 ____D C:\Users\Austin\AppData\Local\adaa6f88-ff87-4fc9-b22e-35a108e2205aad
2013-06-29 11:30 - 2010-05-07 11:05 - 00000404 ___AH C:\Windows\Tasks\Norton Security Scan for Austin.job
2013-06-29 01:11 - 2010-12-21 20:24 - 00000000 ____D C:\Users\Austin\AppData\Roaming\vlc
2013-06-27 02:20 - 2010-09-05 11:09 - 00000444 ____A C:\Windows\Tasks\ParetoLogic Update Version3.job
2013-06-23 13:51 - 2009-07-23 12:51 - 00000000 ____D C:\Users\Austin\AppData\Roaming\Adobe
2013-06-23 13:48 - 2013-06-23 01:35 - 00000000 ____D C:\Users\Austin\AppData\Local\Fraps3
2013-06-23 13:33 - 2013-06-23 13:33 - 00002021 ____A C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-06-23 13:33 - 2009-07-10 20:45 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-06-23 13:32 - 2009-07-30 19:07 - 00000000 ____D C:\Users\Austin\AppData\Local\Adobe
2013-06-23 13:31 - 2009-07-10 20:45 - 00000000 ____D C:\ProgramData\Adobe
2013-06-23 01:35 - 2012-03-06 14:24 - 00000000 ____D C:\Users\Austin\AppData\Local\Amazon
2013-06-18 12:02 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache
2013-06-16 23:25 - 2013-06-16 23:25 - 00466456 ____A (Creative Labs) C:\Windows\System32\wrap_oal.dll
2013-06-16 23:25 - 2013-06-16 23:25 - 00444952 ____A (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2013-06-16 23:25 - 2013-06-16 23:25 - 00122904 ____A (Portions © Creative Labs Inc. and NVIDIA Corp.) C:\Windows\System32\OpenAL32.dll
2013-06-16 23:25 - 2013-06-16 23:25 - 00109080 ____A (Portions © Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2013-06-16 23:25 - 2013-06-16 23:25 - 00000000 ____D C:\Program Files (x86)\OpenAL
2013-06-16 23:24 - 2009-07-10 20:47 - 00531797 ____A C:\Windows\DirectX.log
2013-06-16 23:10 - 2013-06-16 23:10 - 00000195 ____A C:\Users\Austin\Desktop\Hotline Miami.url
2013-06-13 03:14 - 2009-07-30 14:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-13 03:06 - 2010-08-05 12:26 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-11 23:17 - 2012-05-09 17:22 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 23:17 - 2012-01-20 13:18 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 23:16 - 2013-06-11 23:16 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-10 12:30 - 2013-06-10 12:30 - 00000221 ____A C:\Users\Austin\Desktop\Saints Row The Third.url
2013-06-08 10:54 - 2013-03-22 00:34 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2013-06-08 10:53 - 2013-03-22 00:35 - 00107368 ____A (LogMeIn, Inc.) C:\Windows\System32\LMIRfsClientNP.dll
2013-06-08 10:53 - 2013-03-22 00:35 - 00035656 ____A (LogMeIn, Inc.) C:\Windows\System32\LMIport.dll
2013-06-08 10:53 - 2013-03-22 00:34 - 00100680 ____A (LogMeIn, Inc.) C:\Windows\System32\LMIinit.dll
2013-06-08 10:08 - 2013-06-16 03:02 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 10:07 - 2013-06-16 03:02 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 10:06 - 2013-06-16 03:02 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 10:06 - 2013-06-16 03:02 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 10:06 - 2013-06-16 03:02 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 08:28 - 2013-06-16 03:02 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 07:42 - 2013-06-16 03:02 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 07:40 - 2013-06-16 03:02 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 07:40 - 2013-06-16 03:02 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 07:40 - 2013-06-16 03:02 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 07:40 - 2013-06-16 03:02 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 07:13 - 2013-06-16 03:02 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-06 03:35 - 2012-05-21 11:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-06 03:19 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-06-06 01:53 - 2013-06-06 01:53 - 00000220 ____A C:\Users\Austin\Desktop\Garry's Mod.url
2013-06-05 09:50 - 2013-06-05 09:43 - 00008121 ____A C:\Windows\IE10_main.log
2013-06-05 09:47 - 2013-06-05 09:47 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-05 09:47 - 2013-06-05 09:47 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-05 09:47 - 2013-06-05 09:47 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-05 09:47 - 2013-06-05 09:47 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-05 09:47 - 2013-06-05 09:47 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-05 09:47 - 2013-06-05 09:47 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-05 09:47 - 2013-06-05 09:47 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-05 09:47 - 2013-06-05 09:47 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-05 09:47 - 2013-06-05 09:47 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-05 09:47 - 2013-06-05 09:47 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-05 09:47 - 2013-06-05 09:47 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-2975216493-871587154-3665915270-1003\$afe4b345aebc1cf6ffff527fce0e88d0

ZeroAccess:
C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}
C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}\@
C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}\L
C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}\U

Files to move or delete:
====================
C:\Users\Austin\AppData\Roaming\skype.ini
C:\ProgramData\hash.dat
C:\Windows\Tasks\{D9F027EC-CD7B-4EC4-A8DC-931A2D7DC0DD}.job

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-06-23 14:31

==================== End Of Log ============================

D-FRED-BROWN · July 3, 2013

Please do the following:

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy.
Right-click in the open notepad and select Paste).
Save it on the flashdrive as fixlist.txt

C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}
C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}\@
C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}\L
C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}\U
C:\$Recycle.Bin\S-1-5-21-2975216493-871587154-3665915270-1003\$afe4b345aebc1cf6ffff527fce0e88d0
C:\Users\Austin\AppData\Roaming\skype.ini
C:\ProgramData\hash.dat
C:\Windows\Tasks\{D9F027EC-CD7B-4EC4-A8DC-931A2D7DC0DD}.job
S3 X6va001; \??\C:\Users\Austin\AppData\Local\Temp\001724B.tmp [x]
S3 X6va005; \??\C:\Users\Austin\AppData\Local\Temp\0053D8C.tmp [x]
HKCU\...\Run: [Temp] rundll32 "C:\Users\Austin\AppData\Local\Amazon\Temp\fbiadppl.dll",DllRegisterServer [1810944 2013-06-23] () <===== ATTENTION
HKCU\...\Run: [Fraps3] rundll32.exe C:\Users\Austin\AppData\Local\Fraps3\garmgewv.dll,JXhHYSSCCEqMdWIlJVRUWCnVUqS [593408 2013-06-23] (?????????? ??????????) <===== ATTENTION
HKCU\...\Run: [Adobe CSS5.1 Manager] C:\Users\Austin\AppData\Local\adaa6f88-ff87-4fc9-b22e-35a108e2205aad\adaaffffcbeaeaad.exe [172544 2013-06-30] () <===== ATTENTION
HKCU\...\RunOnce: [Adobe CSS5.1 Manager] C:\Users\Austin\AppData\Local\adaa6f88-ff87-4fc9-b22e-35a108e2205aad\adaaffffcbeaeaad.exe [172544 2013-06-30] () <===== ATTENTION
HKCU\...\Winlogon: [shell] C:\Users\Austin\AppData\Roaming\dbu32.ocx,explorer.exe <==== ATTENTION
HKCR\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0}\n. ATTENTION! ====> ZeroAccess?
HKU\UpdatusUser\...\Winlogon: [shell] Explorer.exe <==== ATTENTION

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options.

Run FRST and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt) please post it in your next reply.

After that- are you able to boot into normal mode? Let me know when you can as we have more malware to remove.

Hellsing · July 3, 2013

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-07-2013
Ran by Austin at 2013-07-03 00:52:58 Run:1
Running from G:\
Boot Mode: Safe Mode (minimal)
==============================================

C:\Users\Austin\AppData\Local\{afe4b345-aebc-1cf6-ffff-527fce0e88d0} => Moved successfully.
X6va001 => Service not found.
X6va005 => Service not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ Temp => Value not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ Fraps3 => Value not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ Adobe CSS5.1 Manager => Value not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\\ Adobe CSS5.1 Manager => Value not found.
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} => Key deleted successfully.
HKU\ UpdatusUser\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found.

==== End of Fixlog ====

I am not able to boot into normal mode, it gets to the starting windows stage, finishes like its going to start then goes to an all black screen and remains like that.

Hellsing · July 3, 2013

so it just now got to the login screen, a full 20 minutes after i turned it on

D-FRED-BROWN · July 3, 2013

Hmm.. For some reason, it couldn't delete much of the malware we wanted it to.

See if you can run FRST again, but only do a scan this time- please post the new FRST.txt in your next reply

Hellsing · July 3, 2013

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-07-2013
Ran by Austin (administrator) on 03-07-2013 01:23:57
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\cmd.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1684264 2009-02-06] (Synaptics Incorporated)
HKLM\...\Run: [AlienFX Controller] "C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe" [52480 2009-04-24] (Alienware Corporation)
HKLM\...\Run: [OSD CC] %ProgramFiles%\OSD\Launch_CC.exe [20480 2009-02-19] (Alienware Corporation)
HKLM\...\Run: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray64.exe [462848 2009-03-19] (IDT, Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [499608 2011-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [jEdit Server] "C:\Program Files\jEdit\jedit.exe" -background -nogui --l4j-dont-wait [42496 2012-01-30] (Contributors)
HKLM\...\Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe" [57928 2012-11-29] (LogMeIn, Inc.)
HKLM\...\Run: [MRT] "C:\Windows\system32\MRT.exe" /R [75825640 2013-06-13] (Microsoft Corporation)
HKLM\...\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-13] (Microsoft Corporation)
HKCU\...\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [steam] "c:\program files (x86)\steam\steam.exe" -silent [1641896 2013-06-06] (Valve Corporation)
HKCU\...\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED [742264 2012-03-30] (BitTorrent, Inc.)
HKCU\...\Run: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US [x]
HKCU\...\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3077528 2011-09-27] ()
HKCU\...\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000 [67456 2011-11-07] (Uniblue Systems Limited)
HKCU\...\Run: [Temp] rundll32 "C:\Users\Austin\AppData\Local\Amazon\Temp\fbiadppl.dll",DllRegisterServer [1810944 2013-06-23] () <===== ATTENTION
HKCU\...\Run: [Fraps3] rundll32.exe C:\Users\Austin\AppData\Local\Fraps3\garmgewv.dll,JXhHYSSCCEqMdWIlJVRUWCnVUqS [593408 2013-06-23] (?????????? ??????????) <===== ATTENTION
HKCU\...\Run: [Adobe CSS5.1 Manager] C:\Users\Austin\AppData\Local\adaa6f88-ff87-4fc9-b22e-35a108e2205aad\adaaffffcbeaeaad.exe [172544 2013-06-30] () <===== ATTENTION
HKCU\...\Run: [Akamai NetSession Interface] [x]
HKCU\...\Run: [svidete] rundll32.exe "C:\Users\Austin\AppData\Local\achzFamg.dll",Startup [x]
HKCU\...\RunOnce: [Adobe CSS5.1 Manager] C:\Users\Austin\AppData\Local\adaa6f88-ff87-4fc9-b22e-35a108e2205aad\adaaffffcbeaeaad.exe [172544 2013-06-30] () <===== ATTENTION
MountPoints2: {1c1a6c67-9403-11de-b5da-0025643a50d8} - E:\LaunchU3.exe -a
MountPoints2: {b6401647-eabf-11de-ae7c-806e6f6e6963} - D:\DVDROM\MediaManager\MediaManagerII.exe
HKLM-x32\...\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.)
HKLM-x32\...\Run: [bDRegion] "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe" [75048 2009-05-01] (cyberlink)
HKLM-x32\...\Run: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe" [115560 2009-01-22] (Symantec Corporation)
HKLM-x32\...\Run: [FAStartup] [x]
HKLM-x32\...\Run: [FATrayAlert] C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe [95496 2009-03-05] (Sensible Vision )
HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49152 2008-03-25] (Hewlett-Packard)
HKLM-x32\...\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [81920 2008-03-13] (Hewlett-Packard)
HKLM-x32\...\Run: [OSD] c:\Program Files\OSD\Launch.exe [36864 2009-05-12] (HH)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [50472 2007-12-14] ()
HKLM-x32\...\Run: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [91432 2008-10-17] (CyberLink Corp.)
HKLM-x32\...\Run: [bing Bar] "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe" [243544 2010-03-24] (Microsoft Corp.)
HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [288088 2009-11-11] (Microsoft Corporation)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-02] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-12-08] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2010-10-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [821144 2010-10-25] (Adobe Systems Inc.)
HKLM-x32\...\Run: [backupNowEZtray] "C:\Program Files (x86)\NTI\NTI Backup Now EZ\BackupNowEZtray.exe" -k [580632 2011-09-23] (NTI Corporation)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [x]
HKLM-x32\...\Run: [ALUAlert] "C:\Program Files (x86)\Symantec\LiveUpdate\ALuNotify.exe" "/LOWDISKSPACE C" [492912 2008-06-30] (Symantec Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [2255184 2013-05-15] (LogMeIn Inc.)
HKLM-x32\...\Run: [Anvi Smart Defender] C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe [1563720 2013-06-08] (Anvisoft)
HKU\UpdatusUser\...\Winlogon: [shell] Explorer.exe <==== ATTENTION
AppInit_DLLs-x32: [0 ] ()
Lsa: [Notification Packages] scecli FAPassSync
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\GamersFirst LIVE!.lnk
ShortcutTarget: GamersFirst LIVE!.lnk -> C:\Program Files (x86)\GamersFirst\LIVE!\Live.exe (No File)
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Austin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameStop Now.lnk
ShortcutTarget: GameStop Now.lnk -> C:\Program Files (x86)\GameStop App\Now\GameStopNow.exe (GameStop Corp.)
Startup: C:\Users\Austin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hauppauge Device Central Tray Tool.lnk
ShortcutTarget: Hauppauge Device Central Tray Tool.lnk -> C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe (Hauppauge Computer Works, Inc.)
Startup: C:\Users\Austin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hauppauge Device Properties.lnk
ShortcutTarget: Hauppauge Device Properties.lnk -> C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe (Hauppauge Computer Works, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ign.com/xbox-360
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: (No Name) - {03402f96-3dc7-4285-bc50-9e81fefafe43} - No File
URLSearchHook: (No Name) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0B4A10D1-FBD6-451d-BFDA-F03252B05984} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&query={searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20110828033131655&tb_oid=28-08-2011&tb_mrud=28-08-2011
SearchScopes: HKCU - {0B4A10D1-FBD6-451d-BFDA-F03252B05984} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&query={searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20110828033131655&tb_oid=28-08-2011&tb_mrud=28-08-2011
BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: FAIESSOHelper Class - {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - C:\Program Files\Alienware\Command Center\AlienSense\FAIESSO.dll (Sensible Vision )
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
BHO-x32: AOL Messaging Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll No File
BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - AOL Messaging Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files (x86)\AIM Toolbar\aimtb.dll No File
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} http://www.support.dell.com/systemprofiler/SysProExe.CAB
DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB
DPF: HKLM-x32 {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/mcfscan/3,0,0,6089/mcfscan.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt