badbandido Posted October 1, 2014 ID:885326 Share Posted October 1, 2014 i want to remove search conduit from my computer and eventually others spymalware Link to post Share on other sites More sharing options...
badbandido Posted October 1, 2014 Author ID:885328 Share Posted October 1, 2014 log from OTL OTL logfile created on: 10/1/2014 3:36:35 PM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Anton\Downloads64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.11.9600.17280)Locale: 00000409 | Country: Sverige | Language: SVE | Date Format: yyyy-MM-dd 3.86 Gb Total Physical Memory | 2.42 Gb Available Physical Memory | 62.80% Memory free7.71 Gb Paging File | 5.96 Gb Available in Paging File | 77.37% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 576.07 Gb Total Space | 156.22 Gb Free Space | 27.12% Space Free | Partition Type: NTFS Computer Name: ANTON-DATOR | User Name: Anton | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current user | Include 64bit ScansCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Anton\Downloads\OTL.exe (OldTimer Tools)PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)PRC - C:\Users\Anton\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)PRC - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()PRC - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe (Autodesk, Inc.)PRC - C:\Program Files (x86)\Launch Manager\LMutilps32.exe (Dritek System Inc.)PRC - C:\Program Files (x86)\Launch Manager\LMworker.exe (Dritek System Inc.)PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)PRC - C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)PRC - C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe (NTI Corporation)PRC - C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe (NTI Corporation)PRC - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe (Acer Incorporated)PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)PRC - c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)PRC - C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe (Acer Incorporated) ========== Modules (No Company Name) ========== MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\27bf12496a31ac45c7f95f646bccff84\IAStorUtil.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\802a9bff6be56d5ea8384d20bee78562\IAStorCommon.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\2508b25b4d961a45659a8a8f128818a1\System.Runtime.Remoting.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3f2952ec748f60fbb5deacfc4db0a2a3\System.Windows.Forms.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8b7f86e5a6f0aa23f4b25dfeeaa6b318\System.Drawing.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3fad44f7fd9f6c117eb02265ab63f80d\System.Xml.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\5bf56d6064af88d8812a3f78e0dfd376\System.Configuration.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4c4507612d22786d45594a65a0213c1f\WindowsBase.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\95854f4f1f37b8eab1b1e3d7103b48ef\System.ni.dll ()MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll ()MOD - C:\Program Files\AVAST Software\Avast\libcef.dll ()MOD - C:\Program Files\AVAST Software\Avast\aswProperty.dll ()MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_sv_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()MOD - C:\Program Files (x86)\NTI\Packard Bell MyBackup\sqlite3.dll ()MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_sv_b77a5c561934e089\mscorlib.resources.dll () ========== Services (SafeList) ========== SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Flexera Software, Inc.)SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)SRV:64bit: - (ZuneWlanCfgSvc) -- C:\Program Files\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)SRV:64bit: - (WMZuneComm) -- C:\Program Files\Zune\WMZuneComm.exe (Microsoft Corporation)SRV:64bit: - (ZuneNetworkSvc) -- C:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)SRV:64bit: - (ePowerSvc) -- C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe (Acer Incorporated)SRV:64bit: - (Live Updater Service) -- C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe (Acer Incorporated)SRV:64bit: - (TurboBoost) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel® Corporation)SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)SRV - (RealNetworks Downloader Resolver Service) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)SRV - (Autodesk Content Service) -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe (Autodesk, Inc.)SRV - (DsiWMIService) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)SRV - (NTI IScheduleSvc) -- C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe (NTI Corporation)SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)SRV - (GamesAppService) -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)SRV - (AdobeActiveFileMonitor9.0) -- c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)SRV - (GREGService) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe (Acer Incorporated) ========== Driver Services (SafeList) ========== DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswsp.sys (AVAST Software)DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswsnx.sys (AVAST Software)DRV:64bit: - (aswVmm) -- C:\Windows\SysNative\drivers\aswVmm.sys ()DRV:64bit: - (aswStm) -- C:\Windows\SysNative\drivers\aswstm.sys (AVAST Software)DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)DRV:64bit: - (aswRvrt) -- C:\Windows\SysNative\drivers\aswRvrt.sys ()DRV:64bit: - (aswHwid) -- C:\Windows\SysNative\drivers\aswHwid.sys ()DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)DRV:64bit: - (mcaudrv_simple) -- C:\Windows\SysNative\drivers\mcaudrv_x64.sys (ManyCam LLC)DRV:64bit: - (ManyCam) -- C:\Windows\SysNative\drivers\mcvidrv_x64.sys (ManyCam LLC)DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)DRV:64bit: - (b57xdmp) -- C:\Windows\SysNative\drivers\b57xdmp.sys (Broadcom Corporation)DRV:64bit: - (b57xdbd) -- C:\Windows\SysNative\drivers\b57xdbd.sys (Broadcom Corporation)DRV:64bit: - (bScsiMSa) -- C:\Windows\SysNative\drivers\bScsiMSa.sys (Broadcom Corporation)DRV:64bit: - (k57nd60a) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)DRV:64bit: - (bScsiSDa) -- C:\Windows\SysNative\drivers\bScsiSDa.sys (Broadcom Corporation)DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel® Corporation)DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)DRV:64bit: - (NTIDrvr) -- C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)DRV:64bit: - (UBHelper) -- C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)DRV:64bit: - (TdsNordecr) -- C:\Windows\SysNative\drivers\nordecr.sys (Todos Data System AB)DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htmIE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBoxIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=AV01IE - HKLM\..\SearchScopes,DefaultScope = {632F07F3-19A1-4d16-A23F-E6CE9486BAB5}IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBoxIE - HKLM\..\SearchScopes\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Anton\DownloadsIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=AV01IE - HKCU\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - No CLSID value foundIE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)IE - HKCU\..\SearchScopes,DefaultScope = {632F07F3-19A1-4d16-A23F-E6CE9486BAB5}IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://www.trovi.com/Results.aspx?gd=&ctid=CT3332202&octid=EB_ORIGINAL_CTID&ISID=MB4A2B6DE-009D-44F0-8F33-A7596C454ECB&SearchSource=58&CUI=&UM=6&UP=SP9C9CA214-10BF-4871-9265-06009C6DB899&q={searchTerms}&SSPV=IE - HKCU\..\SearchScopes\{522355A8-1ED7-46C5-B1E0-3C65D2565647}: "URL" = http://www.google.com/search?hl=sv&q={searchTerms}IE - HKCU\..\SearchScopes\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: {c50ca3c4-5656-43c2-a061-13e717f73fc8}:4.1.5FF - prefs.js..extensions.enabledAddons: {972ce4c6-7e08-4474-a285-3208198ce6fd}:15.0FF - prefs.js..browser.startup.homepage: "about:home"FF - prefs.js..browser.startup.homepage: ""FF - prefs.js..browser.search.selectedEngine: "Google"FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""FF - prefs.js..browser.search.defaulturl: "https://www.google.com/search"FF - prefs.js..browser.search.defaultengine: "Google"FF - prefs.js..browser.search.defaultenginename: "Google"FF - prefs.js..browser.search.defaultthis.engineName: "Google"FF - prefs.js..browser.search.order.1: "Google"FF - prefs.js..keyword.URL: "https://www.google.com/search"FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@bankid.com/BankID säkerhetsprogram,version=5.1.3.2: C:\Program Files (x86)\BankID\npBispBrowser.dll (Finansiell ID-Teknik BID AB)FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.67.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.67.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not foundFF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.3.51: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.3: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.3.51: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)FF - HKLM\Software\MozillaPlugins\@se.nexus/Personal: File not foundFF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Anton\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Anton\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Anton\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOXFF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\FirefoxFF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2014/09/06 17:00:36 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/09/10 13:59:11 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2014/05/12 15:44:04 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/09/10 13:59:11 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014/03/09 11:32:50 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014/05/17 12:12:12 | 000,000,000 | ---D | M] [2012/09/01 04:37:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anton\AppData\Roaming\mozilla\Extensions[2014/07/03 18:54:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anton\AppData\Roaming\mozilla\Firefox\Profiles\x7qgkgra.default\extensions[2013/04/25 18:34:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anton\AppData\Roaming\mozilla\Firefox\Profiles\x7qgkgra.default\extensions\ffxtlbr@babylon.com[2012/09/22 18:46:24 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\Anton\AppData\Roaming\mozilla\Firefox\Profiles\x7qgkgra.default\extensions\OneClickDownload@OneClickDownload.com[2014/01/05 03:30:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Anton\AppData\Roaming\mozilla\Firefox\Profiles\x7qgkgra.default\extensions\staged[2012/09/22 18:46:49 | 000,169,792 | ---- | M] () (No name found) -- C:\Users\Anton\AppData\Roaming\mozilla\firefox\profiles\x7qgkgra.default\extensions\staged\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi[2014/07/03 18:55:01 | 000,002,823 | ---- | M] () -- C:\Users\Anton\AppData\Roaming\mozilla\firefox\profiles\x7qgkgra.default\searchplugins\Google.xml[2013/04/25 18:34:28 | 000,001,296 | ---- | M] () -- C:\Users\Anton\AppData\Roaming\mozilla\firefox\profiles\x7qgkgra.default\searchplugins\mixidj.xml[2012/09/22 18:47:00 | 000,003,998 | ---- | M] () -- C:\Users\Anton\AppData\Roaming\mozilla\firefox\profiles\x7qgkgra.default\searchplugins\sweetim.xml[2012/09/01 04:36:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions[2012/09/01 04:36:59 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}[2012/08/25 04:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll[2014/05/08 13:21:12 | 000,188,272 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll[2013/09/10 13:58:42 | 000,153,736 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll[2014/03/09 11:32:47 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll[2014/03/09 11:32:48 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll[2014/03/09 11:32:48 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll[2014/03/09 11:32:49 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll[2014/03/09 11:32:50 | 000,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll[2013/09/10 13:58:35 | 000,124,504 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll[2012/08/25 08:21:19 | 000,001,470 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\allaannonser-sv-SE.xml[2013/04/25 18:34:23 | 000,006,476 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml[2012/08/25 08:21:19 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml[2012/08/25 08:21:19 | 000,003,581 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\google.xml[2012/08/25 08:21:19 | 000,002,670 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\prisjakt-sv-SE.xml[2012/08/25 08:21:20 | 000,000,948 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\tyda-sv-SE.xml[2012/08/25 08:21:20 | 000,001,387 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-sv-SE.xml[2012/08/25 08:21:20 | 000,001,164 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-sv-SE.xml ========== Chrome ========== CHR - default_search_provider: (Enabled)CHR - default_search_provider: search_url = CHR - default_search_provider: suggest_url = http://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms},CHR - plugin: Error reading preferences fileCHR - Extension: No name found = C:\Users\Anton\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\CHR - Extension: No name found = C:\Users\Anton\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\CHR - Extension: No name found = C:\Users\Anton\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\CHR - Extension: No name found = C:\Users\Anton\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\CHR - Extension: No name found = C:\Users\Anton\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\CHR - Extension: No name found = C:\Users\Anton\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2010/05/13 18:53:40 | 000,001,204 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO1 - Hosts: 127.0.0.1 activate.adobe.comO1 - Hosts: 127.0.0.1 3dns-3.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.comO1 - Hosts: 127.0.0.1 ereg.wip3.adobe.comO1 - Hosts: 127.0.0.1 activate-sea.adobe.comO1 - Hosts: 127.0.0.1 wip3.adobe.comO1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.comO1 - Hosts: 127.0.0.1 activate-sjc0.adobe.comO1 - Hosts: 127.0.0.1 practivate.adobe.comO1 - Hosts: 127.0.0.1 ereg.adobe.comO1 - Hosts: 127.0.0.1 activate.wip3.adobe.comO1 - Hosts: 127.0.0.1 3dns-2.adobe.comO1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: ::1 localhostO2:64bit: - BHO: (no name) - {336D0C35-8A85-403a-B9D2-65C292C39087} - No CLSID value found.O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)O2 - BHO: (no name) - {336D0C35-8A85-403a-B9D2-65C292C39087} - No CLSID value found.O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)O2 - BHO: (no name) - {7825CFB6-490A-436B-9F26-4A7B5CFC01A9} - No CLSID value found.O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)O3:64bit: - HKLM\..\Toolbar: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No CLSID value found.O3:64bit: - HKLM\..\Toolbar: (no name) - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No CLSID value found.O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - No CLSID value found.O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)O4:64bit: - HKLM..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (Autodesk, Inc.)O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [igfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [intelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not foundO4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [Power Management] C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated)O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)O4:64bit: - HKLM..\Run: [Zune Launcher] C:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not foundO4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)O4 - HKLM..\Run: [backupManagerTray] C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe (NTI Corporation)O4 - HKLM..\Run: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE (CANON INC.)O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe (DivX, LLC)O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()O4 - HKLM..\Run: [Freecorder FLV Service] "C:\Program Files (x86)\Freecorder\FLVSrvc.exe" /run File not foundO4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)O4 - HKLM..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)O4 - HKLM..\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)O4 - HKCU..\Run: [Akamai NetSession Interface] "C:\Users\Anton\AppData\Local\Akamai\netsession_win.exe" File not foundO4 - HKCU..\Run: [Facebook Update] C:\Users\Anton\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)O4 - HKCU..\Run: [Google Update] C:\Users\Anton\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)O4 - HKCU..\Run: [spotify Web Helper] C:\Users\Anton\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)O4 - HKLM..\RunOnce: [spUninstallCleanUp] REG delete HKEY_LOCAL_MACHINE\Software\SearchProtect /f File not foundO4 - Startup: C:\Users\Anton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skärmurklipp och start för OneNote 2007.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: = O8:64bit: - Extra context menu item: E&xportera till Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not foundO8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not foundO9 - Extra Button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)O9 - Extra Button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)O1364bit: - gopher Prefix: missingO13 - gopher Prefix: missingO16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab (Microsoft Office Template and Media Control) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivX Web Player Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.67.2) O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.67.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 193.150.193.150 83.255.245.11O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{355A1D78-6AA0-40DF-9321-16392E9DD383}: DhcpNameServer = 130.244.127.161 130.244.127.169O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{96F47FC0-8139-4FFD-A25B-786E02BF1641}: DhcpNameServer = 193.150.193.150 83.255.245.11O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A5C8BE92-0694-46D7-BD29-F3D18A8B9962}: DhcpNameServer = 193.150.193.150 83.255.245.11O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value foundO18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\livecall - No CLSID value foundO18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\ms-help - No CLSID value foundO18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\msnim - No CLSID value foundO18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\skype4com - No CLSID value foundO18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value foundO18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value foundO18:64bit: - Protocol\Handler\wlpg - No CLSID value foundO18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)O20 - AppInit_DLLs: (c:\windows\syswow64\nvinit.dll) - c:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)O29:64bit: - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)O30:64bit: - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)O30:64bit: - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation)O30:64bit: - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)O30:64bit: - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation)O30:64bit: - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation)O30:64bit: - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation)O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)O30:64bit: - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corp.)O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation)O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation)O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation)O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation)O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corp.)O31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2013/09/19 22:01:51 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]O33 - MountPoints2\{55b7a21b-3527-11e1-99ad-b870f4a66e8b}\Shell - "" = AutoRunO33 - MountPoints2\{55b7a21b-3527-11e1-99ad-b870f4a66e8b}\Shell\AutoRun\command - "" = E:\iStudio.exeO34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2014/09/25 12:41:05 | 000,000,000 | ---D | C] -- C:\Users\Anton\AppData\Local\{61D64DCF-B60D-4512-AE92-44CF3947FBB9}[2014/09/25 12:15:19 | 000,000,000 | ---D | C] -- C:\Users\Anton\Documents\studiebesök_mälarparken[2014/09/22 22:39:42 | 000,000,000 | ---D | C] -- C:\Users\Anton\Documents\byggprocess_sammanfatt[2014/09/22 22:37:20 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJScan[2014/09/12 01:10:23 | 000,596,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll[2014/09/12 01:10:23 | 000,440,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll[2014/09/12 01:10:19 | 000,758,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll[2014/09/12 01:10:19 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll[2014/09/12 01:10:19 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll[2014/09/12 01:10:19 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll[2014/09/12 01:10:19 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll[2014/09/12 01:10:19 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll[2014/09/12 01:10:18 | 000,446,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll[2014/09/12 01:10:18 | 000,289,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll[2014/09/12 01:10:18 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe[2014/09/12 01:10:18 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe[2014/09/12 01:10:17 | 000,547,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll[2014/09/12 01:10:17 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll[2014/09/12 01:10:17 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll[2014/09/12 01:10:17 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll[2014/09/12 01:10:16 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll[2014/09/12 01:10:15 | 000,727,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll[2014/09/12 01:10:15 | 000,707,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe[2014/09/12 01:10:15 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll[2014/09/12 01:10:15 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll[2014/09/12 01:10:15 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll[2014/09/12 01:10:14 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll[2014/09/12 01:10:14 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll[2014/09/12 01:10:12 | 000,775,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll[2014/09/12 01:10:12 | 000,678,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll[2014/09/12 01:10:12 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll[2014/09/12 01:10:12 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll[2014/09/12 01:10:11 | 001,249,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll[2014/09/12 01:10:11 | 001,068,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll[2014/09/12 01:10:11 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe[2014/09/12 01:10:11 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe[2014/09/12 01:10:08 | 005,833,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll[2014/09/12 01:10:06 | 002,104,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl[2014/09/12 01:10:06 | 002,014,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl[2014/09/12 00:50:52 | 002,777,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll[2014/09/12 00:50:52 | 002,285,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll[2014/09/11 20:03:06 | 001,031,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWorkspace.dll[2014/09/11 20:03:05 | 000,793,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\TSWorkspace.dll[2014/09/11 20:02:52 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll[2014/09/11 20:02:32 | 001,460,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll[2014/09/11 20:02:30 | 000,578,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll[2014/09/11 20:02:28 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll[2014/09/09 10:14:25 | 000,000,000 | ---D | C] -- C:\Users\Anton\AppData\Local\{1A9BE18D-4D47-45CB-A051-EA90A02FB0E9}[2014/09/07 05:51:18 | 000,000,000 | ---D | C] -- C:\Users\Anton\AppData\Local\Programs[2014/09/06 17:00:34 | 000,043,152 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr ========== Files - Modified Within 30 Days ========== [2014/10/01 15:35:01 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1552932757-3521231636-3012316228-1001UA.job[2014/10/01 15:05:45 | 000,001,004 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1552932757-3521231636-3012316228-1001UA.job[2014/10/01 14:54:00 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job[2014/10/01 13:29:46 | 000,070,144 | ---- | M] () -- C:\Windows\SysWow64\tasks.dll[2014/10/01 13:03:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat[2014/10/01 11:45:02 | 000,000,366 | ---- | M] () -- C:\Windows\tasks\ReclaimerUpdateXML_Anton.job[2014/10/01 09:38:29 | 000,024,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0[2014/10/01 09:38:29 | 000,024,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0[2014/10/01 09:29:20 | 000,000,376 | ---- | M] () -- C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Anton.job[2014/10/01 09:27:58 | 3104,722,944 | -HS- | M] () -- C:\hiberfil.sys[2014/09/30 18:35:01 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1552932757-3521231636-3012316228-1001Core.job[2014/09/30 18:05:00 | 000,000,952 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1552932757-3521231636-3012316228-1001Core.job[2014/09/30 17:39:02 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\ReclaimerUpdateFiles_Anton.job[2014/09/28 13:17:38 | 001,998,183 | ---- | M] () -- C:\Users\Anton\Desktop\IMG_1453.JPG[2014/09/25 10:12:31 | 000,002,379 | ---- | M] () -- C:\Users\Anton\Desktop\Google Chrome.lnk[2014/09/23 22:54:12 | 000,701,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe[2014/09/23 22:54:12 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl[2014/09/12 01:08:40 | 001,556,124 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2014/09/12 01:08:40 | 000,664,068 | ---- | M] () -- C:\Windows\SysNative\perfh01D.dat[2014/09/12 01:08:40 | 000,654,480 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat[2014/09/12 01:08:40 | 000,142,836 | ---- | M] () -- C:\Windows\SysNative\perfc01D.dat[2014/09/12 01:08:40 | 000,122,352 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat[2014/09/12 01:08:30 | 001,556,124 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI[2014/09/09 17:46:12 | 000,052,323 | ---- | M] () -- C:\Users\Anton\Desktop\Svarspost_Teknikdelar.png[2014/09/06 17:17:56 | 000,001,610 | ---- | M] () -- C:\Windows\wininit.ini[2014/09/06 17:00:50 | 000,001,978 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk[2014/09/06 17:00:45 | 000,427,360 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswsp.sys[2014/09/06 17:00:36 | 001,041,168 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswsnx.sys[2014/09/06 17:00:36 | 000,224,896 | ---- | M] () -- C:\Windows\SysNative\drivers\aswVmm.sys[2014/09/06 17:00:36 | 000,092,008 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswstm.sys[2014/09/06 17:00:35 | 000,307,344 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe[2014/09/06 17:00:35 | 000,093,568 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys[2014/09/06 17:00:35 | 000,079,184 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys[2014/09/06 17:00:35 | 000,065,776 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRvrt.sys[2014/09/06 17:00:35 | 000,029,208 | ---- | M] () -- C:\Windows\SysNative\drivers\aswHwid.sys[2014/09/06 17:00:34 | 000,043,152 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr[2014/09/05 10:34:17 | 000,001,820 | ---- | M] () -- C:\Users\Anton\Desktop\Spotify.lnk[2014/09/05 04:10:43 | 000,578,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll[2014/09/05 04:05:42 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll ========== Files Created - No Company Name ========== [2014/09/29 10:12:35 | 001,998,183 | ---- | C] () -- C:\Users\Anton\Desktop\IMG_1453.JPG[2014/09/22 21:35:03 | 000,000,376 | ---- | C] () -- C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Anton.job[2014/09/22 21:35:02 | 000,000,370 | ---- | C] () -- C:\Windows\tasks\ReclaimerUpdateFiles_Anton.job[2014/09/22 21:35:02 | 000,000,366 | ---- | C] () -- C:\Windows\tasks\ReclaimerUpdateXML_Anton.job[2014/09/09 17:46:09 | 000,052,323 | ---- | C] () -- C:\Users\Anton\Desktop\Svarspost_Teknikdelar.png[2014/08/30 15:25:45 | 000,000,045 | ---- | C] () -- C:\Users\Anton\jagex_cl_runescape_LIVE1.dat[2014/08/27 13:29:44 | 000,070,144 | ---- | C] () -- C:\Windows\SysWow64\tasks.dll[2014/05/06 22:08:51 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI[2013/10/16 17:43:47 | 000,000,024 | ---- | C] () -- C:\Users\Anton\jagexappletviewer.preferences[2013/10/04 21:39:34 | 000,001,069 | ---- | C] () -- C:\Windows\disney.ini[2013/09/19 22:33:09 | 000,000,153 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc[2013/09/19 22:10:07 | 001,556,124 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI[2011/11/22 22:32:36 | 000,000,044 | ---- | C] () -- C:\Users\Anton\jagex_cl_runescape_LIVE.dat[2011/11/22 22:32:36 | 000,000,024 | ---- | C] () -- C:\Users\Anton\random.dat ========== ZeroAccess Check ========== [2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64"" = C:\Windows\SysNative\shell32.dll -- [2014/06/25 04:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]"" = %SystemRoot%\system32\shell32.dll -- [2014/06/25 03:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2014/02/23 14:38:22 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Audacity[2013/10/30 16:29:06 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Autodesk[2013/12/05 14:22:45 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\AVAST Software[2013/04/25 18:34:14 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Babylon[2014/07/31 20:56:21 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\BankID[2012/01/03 12:49:14 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Canneverbe Limited[2014/09/22 22:37:20 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Canon[2012/03/12 14:06:50 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant[2014/08/25 00:59:43 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\FDRLab[2012/09/01 16:32:36 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\FileZilla[2014/08/26 13:29:42 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\GetPrivate[2012/10/15 13:43:27 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Helios[2014/04/15 23:11:21 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\IDM[2012/07/09 14:42:48 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\MakeitOne[2013/03/23 01:52:05 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Nico Mak Computing[2014/08/30 15:00:06 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Oracle[2014/02/15 01:16:18 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Personal[2011/12/02 22:28:57 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\SNS[2014/09/05 11:40:03 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Spotify[2014/08/24 21:54:37 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\uTorrent[2012/05/16 08:33:57 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\VoipCheapCom[2012/09/15 18:59:45 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\WildTangent[2012/01/17 20:10:22 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\Windows Live Writer[2012/07/03 21:00:34 | 000,000,000 | ---D | M] -- C:\Users\Anton\AppData\Roaming\xrecode2 ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* >[2011/04/15 11:21:10 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK[2013/11/02 19:52:35 | 000,000,000 | ---- | M] () -- C:\END[2014/10/01 09:27:58 | 3104,722,944 | -HS- | M] () -- C:\hiberfil.sys[2014/10/01 09:28:03 | 4139,630,592 | -HS- | M] () -- C:\pagefile.sys[2012/06/04 17:38:24 | 000,000,511 | ---- | M] () -- C:\user.js < %systemroot%\system32\*.dll /lockedfiles >[2014/08/18 23:15:52 | 011,769,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\ieframe.dll < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\drivers\*.sys /90 > < %systemroot%\system32\Spool\prtprocs\w32x86\*.dll > < End of report > Link to post Share on other sites More sharing options...
badbandido Posted October 1, 2014 Author ID:885329 Share Posted October 1, 2014 OTL extras OTL Extras logfile created on: 10/1/2014 3:36:35 PM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Anton\Downloads64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstationInternet Explorer (Version = 9.11.9600.17280)Locale: 00000409 | Country: Sverige | Language: SVE | Date Format: yyyy-MM-dd 3.86 Gb Total Physical Memory | 2.42 Gb Available Physical Memory | 62.80% Memory free7.71 Gb Paging File | 5.96 Gb Available in Paging File | 77.37% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)Drive C: | 576.07 Gb Total Space | 156.22 Gb Free Space | 27.12% Space Free | Partition Type: NTFS Computer Name: ANTON-DATOR | User Name: Anton | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current user | Include 64bit ScansCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation).url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation).html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)Directory [bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~4\Office12\ONENOTE.EXE "%L"Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)Directory [bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~4\Office12\ONENOTE.EXE "%L"Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"EnableFirewall" = 1"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"EnableFirewall" = 1"DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{1E4A788B-3033-4DAA-9A50-B3CC04DC8CDC}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{227CF71F-0FA8-476E-9227-B230BAFD4209}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{25832453-3E7A-4DF8-B6B2-A4379F1442A3}" = rport=10243 | protocol=6 | dir=out | app=system | "{382FA516-D50E-4CEE-9BC4-4DC3B9DD7D0D}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe | "{397164F7-F811-44EA-A5CD-46C875C06F62}" = lport=137 | protocol=17 | dir=in | app=system | "{3D4A60D4-8EFE-4607-AF4D-3F126DDF1350}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{3F295B18-94AA-4C5F-9E68-E397392FEF0E}" = lport=139 | protocol=6 | dir=in | app=system | "{431852EF-EC33-4D03-B6E0-ABCCD97D0DD6}" = rport=139 | protocol=6 | dir=out | app=system | "{44359481-F852-4715-922A-CABAEF34DD15}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{4FB17FE5-6E51-4D9E-A43D-4DEA21346652}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{57360E2C-C753-4D23-9733-4FB33BA49BD7}" = lport=445 | protocol=6 | dir=in | app=system | "{630DCAA2-9262-42FD-A6DB-9AEC8781E6E7}" = rport=445 | protocol=6 | dir=out | app=system | "{64A86231-2BD2-471C-ACE7-E613127B0493}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{7E09B1C7-6915-4A18-A38B-B6C5DA7CB1DB}" = rport=137 | protocol=17 | dir=out | app=system | "{82581DE2-E578-44F7-A172-514C262B1804}" = lport=138 | protocol=17 | dir=in | app=system | "{92913CE7-9661-4CBF-9B59-A9C41535D4B4}" = lport=50248 | protocol=6 | dir=in | name=autodesk content service | "{98DDCB6F-F86D-4174-9B32-8CC7F3F04ECB}" = lport=10243 | protocol=6 | dir=in | app=system | "{9B731E8A-FD57-4920-B914-9B3F4AE3CEFA}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | "{A2A63ABA-E340-4DAE-A0E0-BBADB048C87D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{A94B9806-B294-4378-9F7D-D9B93D8A0245}" = lport=2869 | protocol=6 | dir=in | app=system | "{AC8DC28C-959A-4031-A100-21919D6823CE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{C07C1F6A-B390-434E-AE91-C2ECB07EE188}" = rport=138 | protocol=17 | dir=out | app=system | "{CCDA1459-D66C-4520-A72C-6E9D1946E90B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{CD89D707-7A72-47F5-8451-E816B19EB47C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{DC58143B-40AF-4EDA-BB4D-B8393E54AD29}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | "{F5FDE4F1-615D-4F40-8083-4A0D6859028B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{F72A86BA-0736-4D67-AAE2-AA307CAD9F82}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{FF130AC7-2789-4C50-A39E-73E3196337E0}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{062D1431-5CB9-4BD7-8E69-8C8205DFE350}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | "{0FC3FFD6-15F2-4F3E-851D-10479A7B1213}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{10FAA0B4-D784-43CA-9AE7-29FAC47090E3}" = protocol=6 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe | "{2E8A6D95-5CFC-40B8-BF35-EED487B96596}" = dir=in | app=c:\program files (x86)\cyberlink\homemedia\homemedia.exe | "{31FC6357-A210-4A55-BAA2-42AF956FF1EF}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | "{31FC8C5B-3EC8-4C43-B28D-DAEEDDC6D778}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{3EF4427A-4C77-4FF8-9C92-3D721E802970}" = protocol=6 | dir=in | app=c:\users\anton\appdata\roaming\utorrent\utorrent.exe | "{40C896BB-4D66-4DE2-B71B-6C776DB3C8DD}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{42F11BA3-9000-4F03-B826-9F3162596D6F}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe | "{45B0F527-38C6-4BC4-9A6A-7D78F7AA7B92}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{4D903EDE-02EC-4436-B7C8-4B6CAEA0BDB6}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | "{4E864B31-3FDA-4C14-A877-5FFDDE7C4054}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{4FDD2A02-69CB-4103-8D0E-9B0558105391}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{504CA816-303D-4B5C-A62C-1A0952BE6471}" = protocol=6 | dir=out | app=system | "{50DAA16B-756D-47F5-9D4A-1DF6F88F9335}" = protocol=17 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe | "{52EE8279-7FED-4C56-86B4-D4FBDC83D7DF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{551F00E6-8D44-4908-9E90-56DC4DBA9CDC}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{5A02C50A-01DE-41ED-8856-5FE8E9DF035D}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | "{5D5C5D43-F1FB-45ED-9AAB-16874CF96DCA}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe | "{60F93FAF-925E-4E07-B10E-28DF6B0E1063}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{690142BB-20FF-4AA6-9C55-C44252E84FDA}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | "{6F588E92-4130-4959-AF63-D36B0A4ECF9B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{827FC309-AFBE-47E7-8B6A-864744EAC098}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{828565FA-5075-46E3-A6FE-67476CD80DDE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{850F06B4-447B-465C-BC82-60FDE48276C3}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | "{9C05D377-E17C-4D3C-98A0-A042DC59BC30}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{A35047A6-26F9-4FE7-A2E5-2AEDECF54D6D}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | "{A499A626-74C5-40D6-8790-26444E3F5942}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | "{AD186F0D-99ED-412E-AA6E-BA0E284E279E}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | "{B110D267-BAFF-4DE6-AED9-A50718EB7AC6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{B7266470-813F-4309-99DA-4D63D192160D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{B8C89817-62D3-4141-A689-B167F6967778}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | "{BF8FC0AF-7B14-407E-B616-BD24142A576D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{C2084B72-8E1D-4CE3-933B-DDDF2A40D85A}" = dir=in | app=c:\users\anton\appdata\local\facebook\video\skype\facebookvideocalling.exe | "{C6BAC8EE-486D-4FD7-B3A6-417863AB067F}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | "{C89E2C9E-72CE-4FE4-95FC-24698E200375}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe | "{C8CDC675-BDF3-44FE-BDD2-CD8BC56F5C19}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{C90F6110-7AE3-48B9-AA22-2313243DA1F4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{D3A52144-78AF-4AB9-BC54-37FD47DAE276}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | "{D44C3D50-5233-4CE9-B366-0145106CDE9C}" = protocol=17 | dir=in | app=c:\users\anton\appdata\roaming\utorrent\utorrent.exe | "{D6277379-5CD5-4844-8F28-1EAEF8B364C7}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | "{DE4F6237-C42D-41B8-9CBF-36F83AD70378}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{E01BBB11-A3AC-49AE-ABF5-E86BF1FE55D3}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe | "{E058A8D7-2D37-4BC8-B459-0F8E78CB44E4}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe | "{E0A6808C-2823-49EE-AB18-8E816935D1B4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{EA0E930B-B7D4-4091-A289-FBC6D93EF28C}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{ED1CBD71-8FA1-4C7C-9BA7-C5F93425FDE3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{F7652D9B-47D4-446A-B5D1-12857B8C6321}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "TCP Query User{049E7139-8242-44C5-A1CC-DBA2AFFA2872}C:\program files (x86)\voipcheapcom.com\voipcheapcom\voipcheapcom.exe" = protocol=6 | dir=in | app=c:\program files (x86)\voipcheapcom.com\voipcheapcom\voipcheapcom.exe | "TCP Query User{1A0A41C4-2A19-45EB-A1E3-DC8F150848E2}C:\users\anton\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\anton\appdata\roaming\spotify\spotify.exe | "TCP Query User{1B55122C-7FD6-4979-AFFE-3111DCD1A2CC}C:\users\anton\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\anton\appdata\local\akamai\netsession_win.exe | "TCP Query User{1FA131A2-CE58-446B-9B80-BF1BE3BF8FCE}C:\program files (x86)\ares\ares.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ares\ares.exe | "TCP Query User{391F9925-281E-4E53-A6F3-E0334F231BCB}C:\program files (x86)\microsoft games\age of empires\empires.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\age of empires\empires.exe | "TCP Query User{48F1AEE5-6A70-4FD7-9612-21628E9EA4F3}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | "TCP Query User{98CB622A-F15C-45AC-9C94-EB927288D245}C:\users\anton\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\anton\appdata\local\akamai\netsession_win.exe | "TCP Query User{9FDCA8E9-6E8C-4209-A521-6273B65640D5}C:\program files (x86)\voipcheapcom.com\voipcheapcom\voipcheapcom.exe" = protocol=6 | dir=in | app=c:\program files (x86)\voipcheapcom.com\voipcheapcom\voipcheapcom.exe | "TCP Query User{CAC13054-8E49-41C1-AC4E-5140A88A7F63}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | "TCP Query User{D43701B9-840F-49B9-944F-7ED1577ABC34}C:\program files (x86)\ares\ares.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ares\ares.exe | "TCP Query User{D7E406DD-7FBD-4551-88F5-47697A6661E0}C:\users\anton\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\anton\appdata\roaming\spotify\spotify.exe | "TCP Query User{EDC4DD69-FBCA-4BD7-8252-6AFD316A27D1}C:\program files (x86)\dsnet corp\atube catcher 2.0\yct.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dsnet corp\atube catcher 2.0\yct.exe | "UDP Query User{1AB0BFB6-FB02-4BE3-8C84-AB7E2C4357C0}C:\program files (x86)\voipcheapcom.com\voipcheapcom\voipcheapcom.exe" = protocol=17 | dir=in | app=c:\program files (x86)\voipcheapcom.com\voipcheapcom\voipcheapcom.exe | "UDP Query User{42777A70-B883-4709-ADD7-5C6BC0163172}C:\program files (x86)\ares\ares.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ares\ares.exe | "UDP Query User{54B2AA32-F148-40BB-AA3E-2ACD4A460E5F}C:\users\anton\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\anton\appdata\roaming\spotify\spotify.exe | "UDP Query User{5A5F101A-8011-48F0-B6F4-5E37A53154E7}C:\program files (x86)\dsnet corp\atube catcher 2.0\yct.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dsnet corp\atube catcher 2.0\yct.exe | "UDP Query User{5C61154E-32CC-4FB5-A1C9-1C95FDA32E3C}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | "UDP Query User{671F6ABF-32A7-4C49-BB4D-AF9B3A9F4DD9}C:\users\anton\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\anton\appdata\roaming\spotify\spotify.exe | "UDP Query User{73BC1B2F-48AF-46E4-8633-DF2D55CED5F5}C:\program files (x86)\ares\ares.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ares\ares.exe | "UDP Query User{9901C4BB-8301-4E9F-A921-8893A0DDA4EE}C:\users\anton\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\anton\appdata\local\akamai\netsession_win.exe | "UDP Query User{99529123-1FC4-4209-B3C0-527E0387F23A}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | "UDP Query User{C1F4A3D5-F9CB-408D-AF17-0B5D0EB4C2C1}C:\program files (x86)\voipcheapcom.com\voipcheapcom\voipcheapcom.exe" = protocol=17 | dir=in | app=c:\program files (x86)\voipcheapcom.com\voipcheapcom\voipcheapcom.exe | "UDP Query User{D7A447EC-7310-4B87-8CDA-EC70DFEE490D}C:\program files (x86)\microsoft games\age of empires\empires.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\age of empires\empires.exe | "UDP Query User{F4558A62-356F-4E48-9853-0008E805F63A}C:\users\anton\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\anton\appdata\local\akamai\netsession_win.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources"{1553D712-B35F-4A82-BC72-D6B11A94BE3E}" = Windows Live Remote Service Resources"{1685AE50-97ED-485B-80F6-145071EE14B0}" = Windows Live Remote Service Resources"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources"{22AB5CFD-B3DB-414E-9F99-4D024CCF1DA6}" = Windows Live Remote Client Resources"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources"{2C1A6191-9804-4FDC-AB01-6F9183C91A13}" = Windows Live Remote Client Resources"{2F304EF4-0C31-47F4-8557-0641AAE4197C}" = Windows Live Remote Client Resources"{34384A2A-2CA2-4446-AB0E-1F360BA2AAC5}" = Windows Live Remote Service Resources"{350FD0E7-175A-4F86-84EF-05B77FCD7161}" = Windows Live Remote Service Resources"{3921492E-82D2-4180-8124-E347AD2F2DB4}" = Windows Live Remote Client Resources"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64"{456FB9B5-AFBC-4761-BBDC-BA6BAFBB818F}" = Windows Live Remote Client Resources"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148"{4C2E49C0-9276-4324-841D-774CCCE5DB48}" = Windows Live Remote Client Resources"{5141AA6E-5FAC-4473-BFFB-BEE69DDC7F2B}" = Windows Live Remote Service Resources"{5151E2DB-0748-4FD1-86A2-72E2F94F8BE7}" = Windows Live Remote Service Resources"{57F2BD1C-14A3-4785-8E48-2075B96EB2DF}" = Windows Live Remote Service Resources"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources"{5F44A3A1-5D24-4708-8776-66B42B174C64}" = Windows Live Remote Client Resources"{5FCD6EFE-C2E7-4D77-8212-4BA223D8DF8E}" = Windows Live Remote Client Resources"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources"{61407251-7F7D-4303-810D-226A04D5CFF3}" = Windows Live Remote Service Resources"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources"{6C9D3F1D-DBBE-46F9-96A0-726CC72935AF}" = Windows Live Remote Service Resources"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)"{702A632F-99CE-4E2D-B8F2-BF980E9CF62F}" = Windows Live Remote Client Resources"{7AEC844D-448A-455E-A34E-E1032196BBCD}" = Windows Live Remote Service Resources"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources"{850B8072-2EA7-4EDC-B930-7FE569495E76}" = Windows Live Remote Client Resources"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources"{8F7F2D9C-2DBE-4F10-9C7C-2724110A3339}" = Windows Live Remote Service Resources"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007"{90120000-002A-041D-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Swedish) 2007"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1053" = Microsoft .NET Framework 4.5.1 (svenska)"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{97A295A7-8840-4B35-BB61-27A8F4512CA3}" = Windows Live Remote Service Resources"{9E9C960F-7F47-46D5-A95D-950B354DE2B8}" = Windows Live Remote Service Resources"{A060182D-CDBE-4AD6-B9B4-860B435D6CBD}" = Windows Live Remote Client Resources"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64"{A508D5A2-3AC1-4594-A718-A663D6D3CF11}" = Windows Live Remote Service Resources"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources"{A6E0F6BE-30AC-4D36-97B0-1AC20E23CB83}" = Windows Live Remote Client Resources"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources"{B45A0D14-2208-32C6-9DB6-4F413FC67B9D}" = Microsoft .NET Framework 4.5.1 (SVE)"{B680A663-1A15-47A5-A07C-7DF9A97558B7}" = Windows Live Remote Client Resources"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources"{CFF3C688-2198-4BC3-A399-598226949C39}" = Windows Live Remote Client Resources"{D1C1556C-7FF3-48A3-A5D6-7126F0FAFB66}" = Windows Live Remote Client Resources"{D3E4F422-7E0F-49C7-8B00-F42490D7A385}" = Windows Live Remote Service Resources"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service"{ED421F97-E1C3-4E78-9F54-A53888215D58}" = Windows Live Remote Client Resources"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources"{F2CB8C3C-9C9E-4FAB-9067-655601C5F748}" = Windows Mobile Device Updater Component"{F6CB2C5F-B2C1-4DF1-BF44-39D0DC06FE6F}" = Windows Live Remote Service Resources"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{00884F14-05BD-4D8E-90E5-1ABF78948CA4}" = Windows Live Mesh"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh"{04668DF2-D32F-4555-9C7E-35523DCD6544}" = Control ActiveX de Windows Live Mesh para conexiones remotas"{0557BBDA-69D3-4FA4-A93C-A5300F7034B4}" = Windows Live Writer"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack"{062E4D94-8306-46D5-81B6-45E6AD09C799}" = Windows Live Messenger"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common"{06B05153-97E4-427E-B1A8-E098F6C5E52F}" = Windows Live Essentials"{073F306D-9851-4969-B828-7B6444D07D55}" = Windows Live Photo Common"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86"{09922FFE-D153-44AE-8B60-EA3CB8088F93}" = Windows Live UX Platform Language Pack"{09B7C7EB-3140-4B5E-842F-9C79A7137139}" = Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack"{0C975FCC-A06E-4CB6-8F54-A9B52CF37781}" = Windows Liven sähköposti"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86"{10186F1A-6A14-43DF-A404-F0105D09BB07}" = Windows Live Mail"{110668B7-54C6-47C9-BAC4-1CE77F156AF5}" = Windows Live Mesh"{11417707-1F72-4279-95A3-01E0B898BBF5}" = Windows Live Mesh"{11778DA1-0495-4ED9-972F-F9E0B0367CD5}" = Windows Live Writer"{1203DC60-D9BD-44F9-B372-2B8F227E6094}" = Windows Live Temel Parçalar"{120C160F-F53D-4A15-A873-E79BF5B98B48}" = Windows Live Photo Common"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack"{133D9D67-D475-4407-AC3C-D558087B2453}" = Windows Live Movie Maker"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common"{17835B63-8308-427F-8CF5-D76E0D5FE457}" = Windows Live Essentials"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker"{19CBDE24-2761-49A5-816B-D2BA65D0CA8D}" = Kontrola Windows Live Mesh ActiveX za daljinske veze"{1A72337E-D126-4BAF-AC89-E6122DB71866}" = Windows Liven valokuvavalikoima"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger"{1D6C2068-807F-4B76-A0C2-62ED05656593}" = Windows Live Writer"{1DA6D447-C54D-4833-84D4-3EA31CAECE9B}" = Windows Live UX Platform Language Pack"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{1FC83EAE-74C8-4C72-8400-2D8E40A017DE}" = Windows Live Writer"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions"{20381A8A-808E-4A53-B6CD-AD2B85E16365}" = Windows Live UX Platform Language Pack"{220C7F8C-929D-4F71-9DC7-F7A6823B38E4}" = Windows Live UX Platform Language Pack"{226F0D93-76DE-4F1C-B14D-DE10443ADB60}" = Windows Live Movie Maker"{241E7104-937A-4366-AD57-8FDDDB003939}" = Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi"{249EE21B-8EDD-4F36-8A23-E580E9DBE80A}" = Windows Live Mail"{24DF33E0-F924-4D0D-9B96-11F28F0D602D}" = Windows Live UX Platform Language Pack"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail"{25CD4B12-8CC5-433E-B723-C9CB41FA8C5A}" = Windows Live Writer"{260E3D78-94E6-47EC-8E29-46301572BB1E}" = Control ActiveX Windows Live Mesh pentru conexiuni la distanță"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources"{28B9D2D8-4304-483F-AD71-51890A063A74}" = Windows Live Photo Common"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger"{2BA5FD10-653F-4CAF-9CCD-F685082A1DC1}" = Windows Live Writer"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh"{2D3E034E-F76B-410A-A169-55755D2637BB}" = Windows Live Mesh"{2E50E321-4747-4EB5-9ECB-BBC6C3AC0F31}" = Windows Live Writer Resources"{2F54E453-8C93-4B3B-936A-233C909E6CAC}" = Windows Live Messenger"{3125D9DE-8D7A-4987-95F3-8A42389833D8}" = Windows Live Writer Resources"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common"{376D59B1-42D9-4FA2-B6CC-E346B6BE14F5}" = ActiveX-kontroll för fjärranslutningar för Windows Live Mesh"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack"{39B3184E-0BFB-40FA-ADDC-E7E2D535CDA9}" = Controle ActiveX do Windows Live Mesh para Conexões Remotas"{39F95B0B-A0B7-4FA7-BB6C-197DA2546468}" = Windows Live Mesh"{3B72C1E0-26A1-40F6-8516-D50C651DFB3C}" = Windows Live Essentials"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack"{410DF0AA-882D-450D-9E1B-F5397ACFFA80}" = Windows Live Essentials"{4264C020-850B-4F08-ACBE-98205D9C336C}" = Windows Live Writer"{429DF1A0-3610-4E9E-8ACE-3C8AC1BA8FCA}" = Windows Live Photo Gallery"{43B43577-2514-4CE0-B14A-7E85C17C0453}" = Windows Live Essentials"{443B561F-DE1B-4DEF-ADD9-484B684653C7}" = Windows Live Messenger"{4444F27C-B1A8-464E-9486-4C37BAB39A09}" = Фотогалерия на Windows Live"{458F399F-62AC-4747-99F5-499BBF073D29}" = Windows Live Writer Resources"{4664ED39-C80A-48F7-93CD-EBDCAFAB6CC5}" = Windows Live Writer Resources"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh"{4736B0ED-F6A1-48EC-A1B7-C053027648F1}" = Galeria fotogràfica del Windows Live"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer"{48F597DD-D397-4CFA-91A0-4C033A0113BD}" = Windows Live Mail"{4A04DB63-8F81-4EF4-9D09-61A2057EF419}" = Windows Live Essentials"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer"{4B744C85-DBB1-4038-B989-4721EB22C582}" = Windows Live Messenger"{4C378B16-46B7-4DA1-A2CE-2EE676F74680}" = Windows Live UX Platform Language Pack"{4CF6F287-5121-483C-A5A2-07BDE19D8B4E}" = Windows Live Meshin etäyhteyksien ActiveX-komponentti"{4D141929-141B-4605-95D6-2B8650C1C6DA}" = Windows Live UX Platform Language Pack"{4D7BAC8A-51B8-4243-8567-1415C4272D13}" = Windows Live Writer"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack"{523DF2BB-3A85-4047-9898-29DC8AEB7E69}" = Windows Live UX Platform Language Pack"{5275D81E-83AD-4DE4-BC2B-6E6BA3A33244}" = Windows Live Writer Resources"{542DA303-FB91-4731-9F37-6E518368D3B9}" = Windows Live Messenger"{5495E9A4-501A-4D4C-87C9-E80916CA9478}" = Windows Live UX Platform Language Pack"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance"{57220148-3B2B-412A-A2E0-82B9DF423696}" = Windows Live Mesh ActiveX-objekt til fjernforbindelser"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack"{5C2F5C1B-9732-4F81-8FBF-6711627DC508}" = Windows Live Fotogalleri"{5CF5B1A5-CBC3-42F0-8533-5A5090665862}" = Windows Live Mesh"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker"{5D2E7BD7-4B6F-4086-BA8A-E88484750624}" = Windows Live Writer Resources"{5DA7D148-D2D2-4C67-8444-2F0F9BD88A06}" = Windows Live Writer"{5E627606-53B9-42D1-97E1-D03F6229E248}" = Windows Live UX Platform Language Pack"{60C3C026-DB53-4DAB-8B97-7C1241F9A847}" = Windows Live Movie Maker"{622DE1BE-9EDE-49D3-B349-29D64760342A}" = 適用遠端連線的 Windows Live Mesh ActiveX 控制項"{625D45F0-5DCB-48BF-8770-C240A84DAAEB}" = Windows Live Mesh"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86"{63CF7D0C-B6E7-4EE9-8253-816B613CC437}" = Windows Live Mail"{640798A0-A4FB-4C52-AC72-755134767F1E}" = Windows Live Movie Maker"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live"{644063FA-ABA3-42AC-A8AC-3EDC0706018B}" = Windows Live Mesh"{6491AB99-A11E-41FD-A5E7-32DE8A097B8E}" = Windows Live Essentials"{64B2D6B3-71AC-45A7-A6A1-2E07ABF58341}" = Windows Live Movie Maker"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE"{69C9C672-400A-43A0-B2DE-9DB38C371282}" = Windows Live Writer"{69CAC24D-B1DC-4B97-A1BE-FE21843108FE}" = Windows Live Writer Resources"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack"{6A67578E-095B-4661-88F7-0B199CEC3371}" = Windows Live Messenger"{6ABE832B-A5C7-44C1-B697-3E123B7B4D5B}" = Windows Live Mesh"{6B556C37-8919-4991-AC34-93D018B9EA49}" = Windows Live Photo Common"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker"{6E29C4F7-C2C2-4B18-A15C-E09B92065F15}" = Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger"{6EF2BE2C-3121-48B7-B7A6-C56046B3A588}" = Windows Live Movie Maker"{6F37D92B-41AA-44B7-80D2-457ABDE11896}" = Windows Live Photo Common"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{71527C7C-5289-4CB2-88C9-23344C0FF6C1}" = Windows Live Movie Maker"{71A81378-79D5-40CC-9BDC-380642D1A87F}" = Windows Live Writer"{71C95134-F6A9-45E7-B7B3-07CA6012BF2A}" = Windows Live Mesh"{7272F232-A7E0-4B2B-A5D2-71B7C5E2379C}" = Windows Live Fotótár"{7327080F-6673-421F-BBD9-B618F357EEB3}" = Windows Live UX Platform Language Pack"{734104DE-C2BF-412F-BB97-FCCE1EC94229}" = Windows Live Writer Resources"{7373E17D-18E0-44A7-AC3A-6A3BFB85D3B3}" = Windows Live Movie Maker"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack"{76454862-992F-4A12-9D61-76E52A1C6922}" = Windows Live Messenger"{76C064E2-BB99-4453-8FDA-42BC01AD0734}" = Control ActiveX del Windows Live Mesh per a connexions remotes"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live"{78906B56-0E81-42A7-AC25-F54C946E1538}" = Windows Live Photo Common"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh"{78DBE8CE-61F6-4D6C-806C-A0FFF65F5E1D}" = Windows Live Messenger"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live"{7ADFA72D-2A9F-4DEC-80A5-2FAA27E23F0F}" = Windows Live Photo Common"{7AF8E500-B349-4A77-8265-9854E9A47925}" = Windows Live Movie Maker"{7BA19818-F717-4DFB-BC11-FAF17B2B8AEE}" = Pošta Windows Live"{7BA6DF02-B094-45D7-A3C9-BE3684253922}" = Urruneko konexioetarako Windows Live Mesh ActiveX kontrola"{7C2A3479-A5A0-412B-B0E6-6D64CBB9B251}" = Windows Live Photo Common"{7CB529B2-6C74-4878-9C3F-C29C3C3BBDC6}" = Windows Live Writer Resources"{7D0DE76C-874E-4BDE-A204-F4240160693E}" = Windows Live Photo Common"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials"{7D926AD2-16D6-42C2-8CA1-AB09E96040BA}" = Windows Live Writer Resources"{7D99B933-E29C-4599-92F0-DAED2AF041E3}" = Windows Live Essentials"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer"{7E90B133-FF47-48BB-91B8-36FC5A548FE9}" = Windows Live Writer Resources"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer"{80E8C65A-8F70-4585-88A2-ABC54BABD576}" = Windows Live Mesh"{820D0BA3-ACD7-4FB9-A3A7-0ADF0C66A4BE}" = Windows Live Messenger"{827D3E4A-0186-48B7-9801-7D1E9DD40C07}" = Windows Live Essentials"{82803FF3-563F-414F-A403-8D4C167D4120}" = Windows Live Mail"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh"{84267681-BF16-40B6-9564-27BC57D7D71C}" = Windows Live Photo Common"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials"{85373DA7-834E-4850-8AF5-1D99F7526857}" = Windows Live Photo Common"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer"{861B1145-7762-4794-B40C-3FF0A389DFE6}" = Windows Live Photo Gallery"{86F444A5-C9B9-41DC-AF28-B5E46F5497C7}" = Windows Live Argazki Galeria"{885F1BCD-C344-4758-85BD-09640CF449A5}" = Windows Live Photo Gallery"{8909CFA8-97BF-4077-AC0F-6925243FFE08}" = Windows Liven asennustyökalu"{8CF5D47D-27B7-49D6-A14F-10550B92749D}" = Windows Live UX Platform Language Pack"{8E285C75-9BE2-4349-972B-DECDDF472656}" = Windows Live Writer Resources"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger"{90120000-0015-041D-0000-0000000FF1CE}" = Microsoft Office Access MUI (Swedish) 2007"{90120000-0015-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0016-041D-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Swedish) 2007"{90120000-0016-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0018-041D-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Swedish) 2007"{90120000-0018-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-0019-041D-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Swedish) 2007"{90120000-0019-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-001A-041D-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Swedish) 2007"{90120000-001A-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-001B-041D-0000-0000000FF1CE}" = Microsoft Office Word MUI (Swedish) 2007"{90120000-001B-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-001F-040B-0000-0000000FF1CE}" = Microsoft Office Proof (Finnish) 2007"{90120000-001F-040B-0000-0000000FF1CE}_ENTERPRISER_{C3B4672B-3FE7-4D6F-AFF3-80D290C1131E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-001F-041D-0000-0000000FF1CE}" = Microsoft Office Proof (Swedish) 2007"{90120000-001F-041D-0000-0000000FF1CE}_ENTERPRISER_{4A960AFC-E28F-4233-953F-1903BE859B79}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-002A-041D-1000-0000000FF1CE}_ENTERPRISER_{18651597-9190-4C03-902A-6F8F58A91A3E}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-002C-041D-0000-0000000FF1CE}" = Microsoft Office Proofing (Swedish) 2007"{90120000-0044-041D-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Swedish) 2007"{90120000-0044-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-006E-041D-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Swedish) 2007"{90120000-006E-041D-0000-0000000FF1CE}_ENTERPRISER_{18651597-9190-4C03-902A-6F8F58A91A3E}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-00A1-041D-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Swedish) 2007"{90120000-00A1-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90120000-00BA-041D-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Swedish) 2007"{90120000-00BA-041D-0000-0000000FF1CE}_ENTERPRISER_{6DB23E19-BC1C-4C62-8158-391F65D84457}" = Microsoft Office 2007 Service Pack 3 (SP3)"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)"{924B4D82-1B97-48EB-8F1E-55C4353C22DB}" = Windows Live Mail"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker"{93C4B7D5-4E00-491F-BA3E-25B7B63EE7F6}" = Windows Live Mail"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources"{97F77D62-5110-4FA3-A2D3-410B92D31199}" = Windows Live Fotogaléria"{99BE7F5D-AB52-4404-9E03-4240FFAA7DE9}" = Windows Live Mesh"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}" = פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail"{9DA3F03B-2CEE-4344-838E-117861E61FAF}" = Windows Live Mail"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker"{9E2C5B0E-7A2D-4767-A9B2-77469FB1873A}" = Windows Live Mesh"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh"{A101F637-2E56-42C0-8E08-F1E9086BFAF3}" = Windows Live Movie Maker"{A199DB88-E22D-4CE7-90AC-B8BE396D7BF4}" = Windows Live Movie Maker"{A2EDAEEB-C981-46D5-8163-CF8F5F640EEE}" = ตัวควบคุม ActiveX ใน Windows Live Mesh สำหรับการเชื่อมต่อระยะไกล (ไทย)"{A3389C72-1782-4BB4-BBAA-33345DE52E3F}" = Windows Live Messenger"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery"{A7056D45-C63A-4FE4-A69D-FB54EF9B21BB}" = Windows Live Messenger"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer"{AB0B2113-5B96-4B95-8AD1-44613384911F}" = Windows Live Mesh"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger"{AB78C965-5C67-409B-8433-D7B5BDB12073}" = Windows Live Writer Resources"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials"{ABE2F2AA-7ADC-4717-9573-BF3F83C696AC}" = Windows Live Mail"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh"{AD001A69-88CC-4766-B2DB-3C1DFAB9AC72}" = Windows Live Mesh"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh"{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}" = Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych"{B0AD205F-60D0-4084-AFB8-34D9A706D9A8}" = Windows Live Essentials"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger"{B33B61FE-701F-425F-98AB-2B85725CBF68}" = Windows Live Photo Common"{B3BA4D1C-23EF-4859-9C11-1B2CCB7FADBB}" = ActiveX контрола на Windows Live Mesh за отдалечени връзки"{B3BE54A4-8DFE-4593-8E66-56AB7133B812}" = Windows Live Writer"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials"{B6190387-0036-4BEB-8D74-A0AFC5F14706}" = Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená připojení"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86"{B7B67AA5-12DA-4F01-918D-B1BF66779D8A}" = Windows Live Writer Resources"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger"{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}" = Элемент управления Windows Live Mesh ActiveX для удаленных подключений"{BD0C3887-64E6-41D8-9A38-BC6F34369352}" = Windows Live Messenger"{BD4EBDB5-EB14-4120-BB04-BE0A26C7FB3E}" = Windows Live Photo Common"{BD695C2F-3EA0-4DA4-92D5-154072468721}" = Windows Live Fotoğraf Galerisi"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh"{BFC47A0B-D487-4DF0-889E-D6D392DF31E0}" = Windows Live Messenger"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live"{C01FCACE-CC3D-49A2-ADC2-583A49857C58}" = Windows Live Essentials"{C08D5964-C42F-48EE-A893-2396F9562A7C}" = Windows Live Mesh"{C1C9D199-B4DD-4895-92DD-9A726A2FE341}" = Windows Live Writer"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common"{C2FD7DB5-FE30-49B6-8A2F-C5652E053C31}" = Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia"{C32CE55C-12BA-4951-8797-0967FDEF556F}" = Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen"{C454280F-3C3E-4929-B60E-9E6CED5717E7}" = Windows Live Mail"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail"{C8421D85-CA0E-4E93-A9A9-B826C4FB88EA}" = Windows Live Mail"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common"{C95A5A77-622F-45CA-9540-84468FCB18B1}" = Windows Live Messenger"{C9E1343D-E21E-4508-A1BE-04A089EC137D}" = Windows Live Messenger"{CA227A9D-09BE-4BFB-9764-48FED2DA5454}" = Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live"{CB66242D-12B1-4494-82D2-6F53A7E024A3}" = Galerie foto Windows Live"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker"{CBFD061C-4B27-4A89-ADD8-210316EEFA11}" = Windows Live Messenger"{CD442136-9115-4236-9C14-278F6A9DCB3F}" = Windows Live Movie Maker"{CD7CB1E6-267A-408F-877D-B532AD2C882E}" = Windows Live Photo Common"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform"{CF671BFE-6BA3-44E7-98C1-500D9C51D947}" = Windows Live Photo Gallery"{D07B1FDA-876B-4914-9E9A-309732B6D44F}" = Windows Live Mail"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack"{D31169F2-CD71-4337-B783-3E53F29F4CAD}" = Windows Live Mail"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail"{D6CBB3B2-F510-483D-AE0D-1CF3F43CF1EE}" = Windows Live Writer Resources"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86"{DA29F644-2420-4448-8128-1331BE588999}" = Windows Live Writer"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker"{DB1208F4-B2FE-44E9-BFE6-8824DBD7891B}" = Windows Live Movie Maker"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail"{DCAB6BA7-6533-44BF-9235-E5BF33B7431C}" = Windows Live Writer"{DDC1E1BD-7615-4186-89E1-F5F43F9B6491}" = Windows Live Movie Maker"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials"{DF71ABBB-B834-41C0-BB58-80B0545D754C}" = Windows Live UX Platform Language Pack"{E18B30AA-6E2D-480C-B918-AF61009F4010}" = عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker"{E5377D46-83C5-445A-A1F1-830336B42A10}" = Windows Live Galerija fotografija"{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}" = Controlo ActiveX do Windows Live Mesh para Ligações Remotas"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer"{E59969EA-3B5B-4B24-8B94-43842A7FBFE9}" = Fotogalerija Windows Live"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger"{E5DD4723-FE0B-436E-A815-DC23CF902A0B}" = Windows Live UX Platform Language Pack"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live"{E8524B28-3BBB-4763-AC83-0E83FE31C350}" = Windows Live Writer"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live"{E9AD2143-26D5-4201-BED1-19DCC03B407D}" = Windows Live Messenger"{E9D98402-21AB-4E9F-BF6B-47AF36EF7E97}" = Windows Live Writer Resources"{EA777812-4905-4C08-8F6E-13BDCC734609}" = Windows Live UX Platform Language Pack"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"{F0F5D89A-197C-495B-827E-3E98B811CD2E}" = Windows Live Photo Common"{F0F9505B-3ACF-4158-9311-D0285136AA00}" = Windows Live Essentials"{F2979AAA-FDD7-4CB3-93BC-5C24D965D679}" = Windows Live Messenger"{F35DC85A-E96B-496B-ABE7-F04192824856}" = Windows Live Messenger"{F4BEA6C1-AAC3-4810-AAEA-588E26E0F237}" = Windows Live UX Platform Language Pack"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources"{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}" = Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις"{F783464C-C7C6-4E9B-AC40-BC90E5414BAF}" = Windows Live Messenger"{F7A46527-DF1F-4B0F-9637-98547E189442}" = Windows Live Galeria de Fotos"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials"{FA6CF94F-DACF-4FE7-959D-55C421B91B17}" = Windows Live Mail"{FB3D07AE-73D0-47A9-AC12-6F50BF8B6202}" = Windows Live Movie Maker"{FB79FDB7-4DE1-453D-99FE-9A880F57380E}" = Windows Live Fotogalerie"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials"{FE62C88B-425B-4BDE-8B70-CD5AE3B83176}" = Windows Live Essentials"{FEEF7F78-5876-438B-B554-C4CC426A4302}" = Windows Live Essentials"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker"{FF737490-5A2D-4269-9D82-97DB2F7C0B09}" = Windows Live Movie Maker"{FFFA0584-8E3D-4195-8283-CCA3AD73C746}" = Windows Live Messenger"Adobe Flash Player ActiveX" = Adobe Flash Player 15 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 15 Plugin"ENTERPRISER" = Microsoft Office Enterprise 2007"WinLiveSuite" = Windows Live Essentials ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"Google Chrome" = Google Chrome"Spotify" = Spotify"uTorrent" = µTorrent ========== Last 20 Event Log Errors ========== [ Application Events ]Error - 10/1/2014 6:18:22 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 1480528 Error - 10/1/2014 6:18:22 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 1480528 Error - 10/1/2014 6:42:42 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: Continuously busy for more than a second Error - 10/1/2014 6:42:42 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 1014 Error - 10/1/2014 6:42:42 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 1014 Error - 10/1/2014 6:42:43 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: Continuously busy for more than a second Error - 10/1/2014 6:42:43 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 2013 Error - 10/1/2014 6:42:43 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 2013 Error - 10/1/2014 6:42:44 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: Continuously busy for more than a second Error - 10/1/2014 6:42:44 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledEvent 3027 Error - 10/1/2014 6:42:44 AM | Computer Name = Anton-Dator | Source = Bonjour Service | ID = 100Description = Task Scheduling Error: m->NextScheduledSPRetry 3027 [ System Events ]Error - 9/24/2014 1:19:33 PM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7000Description = Tjänsten Autodesk Content Service kunde inte startas på grund av följande fel: %%1053 Error - 9/25/2014 10:00:09 AM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7009Description = En timeout (30000 ms) inträffade vid väntan på att tjänsten Autodesk Content Service skulle ansluta. Error - 9/25/2014 10:00:09 AM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7000Description = Tjänsten Autodesk Content Service kunde inte startas på grund av följande fel: %%1053 Error - 9/26/2014 1:32:28 AM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7009Description = En timeout (30000 ms) inträffade vid väntan på att tjänsten Windows Media Player Network Sharing Service skulle ansluta. Error - 9/26/2014 1:32:28 AM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7000Description = Tjänsten Windows Media Player Network Sharing Service kunde inte startas på grund av följande fel: %%1053 Error - 9/28/2014 11:48:37 AM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7009Description = En timeout (30000 ms) inträffade vid väntan på att tjänsten Autodesk Content Service skulle ansluta. Error - 9/28/2014 11:48:37 AM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7000Description = Tjänsten Autodesk Content Service kunde inte startas på grund av följande fel: %%1053 Error - 9/30/2014 9:28:40 AM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7009Description = En timeout (30000 ms) inträffade vid väntan på att tjänsten iPod Service skulle ansluta. Error - 9/30/2014 9:28:41 AM | Computer Name = Anton-Dator | Source = DCOM | ID = 10005Description = Error - 9/30/2014 9:28:41 AM | Computer Name = Anton-Dator | Source = Service Control Manager | ID = 7000Description = Tjänsten iPod Service kunde inte startas på grund av följande fel: %%1053 < End of report > Link to post Share on other sites More sharing options...
badbandido Posted October 1, 2014 Author ID:885350 Share Posted October 1, 2014 report from gmer GMER 2.1.19357 - http://www.gmer.netRootkit scan 2014-10-01 16:43:25Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD64 rev.01.0 596,17GBRunning: 67bygrg1.exe; Driver: C:\Users\Anton\AppData\Local\Temp\agryqpog.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 666 fffff8000320708a 7 bytes [00, 00, 00, 00, 00, 00, 03]INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 674 fffff80003207092 4 bytes [00, 00, 00, 00] ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\services.exe[1000] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Windows\System32\svchost.exe[992] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Windows\system32\svchost.exe[816] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1376] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007710a400 7 bytes JMP 000000016fff0260.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077113f20 5 bytes JMP 000000016fff01b8.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!RegDeleteValueW 000000007712ffb0 5 bytes JMP 000000016fff01f0.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007713f2e0 5 bytes JMP 000000016fff0148.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077169a30 7 bytes JMP 000000016fff00d8.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000771794c0 5 bytes JMP 000000016fff0180.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077179630 5 bytes JMP 000000016fff0110.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000771987e0 7 bytes JMP 000000016fff0228.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd3e2db0 5 bytes JMP 000007fffd3d0180.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd3e37d0 7 bytes JMP 000007fffd3d00d8.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd3e8ef0 6 bytes JMP 000007fffd3d0148.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd3faf60 5 bytes JMP 000007fffd3d0110.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0589f0 8 bytes JMP 000007fffd3d01f0.text C:\Windows\system32\Dwm.exe[1552] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff05be50 8 bytes JMP 000007fffd3d01b8.text C:\Windows\Explorer.EXE[1584] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Windows\system32\taskhost.exe[1988] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe[1468] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files\Elantech\ETDCtrl.exe[2404] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2572] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files\Zune\ZuneLauncher.exe[2716] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2748] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe[2824] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[2080] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2276] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2344] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[1324] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[1324] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075f21465 2 bytes [F2, 75].text C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe[1324] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075f214bb 2 bytes [F2, 75].text ... * 2.text C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE[3596] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe[3644] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files (x86)\Launch Manager\LManager.exe[3740] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Windows\system32\igfxext.exe[4268] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4364] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62]? C:\Windows\system32\mssprxy.dll [4364] entry point in ".rdata" section 000000006aa071e6.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[4404] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075c08791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...].text C:\Program Files\AVAST Software\Avast\AvastUI.exe[4404] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Windows\system32\wbem\unsecapp.exe[4440] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files\Windows Media Player\wmpnetwk.exe[5608] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007715ef8d 1 byte [62].text C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe[1396] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3784] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075f21465 2 bytes [F2, 75].text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075f214bb 2 bytes [F2, 75].text ... * 2.text C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe[1132] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62].text C:\Users\Anton\Downloads\67bygrg1.exe[6996] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000075c2a2fd 1 byte [62] ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\svchost.exe [1120:1332] 000007fefb4a8274Thread C:\Windows\system32\svchost.exe [1120:1524] 000007fefb4a8274Thread C:\Windows\system32\WLANExt.exe [1432:1560] 000000018000b6d4Thread C:\Windows\system32\WLANExt.exe [1432:1564] 000000018000b6f0Thread C:\Windows\system32\WLANExt.exe [1432:1568] 000000018000b6b8Thread C:\Windows\system32\WLANExt.exe [1432:1572] 00000001800221a0Thread C:\Windows\system32\WLANExt.exe [1432:1576] 000007fef97f2f9cThread C:\Windows\system32\Dwm.exe [1552:1804] 000007fef878abf0Thread C:\Windows\System32\spoolsv.exe [1912:4252] 000007fefa8010c8Thread C:\Windows\System32\spoolsv.exe [1912:4720] 000007fef2f86144Thread C:\Windows\System32\spoolsv.exe [1912:4724] 000007fef6285fd0Thread C:\Windows\System32\spoolsv.exe [1912:4728] 000007fef31e3438Thread C:\Windows\System32\spoolsv.exe [1912:4732] 000007fef62863ecThread C:\Windows\System32\spoolsv.exe [1912:4740] 000007fef3445e5cThread C:\Windows\System32\spoolsv.exe [1912:4936] 000007fefa828760Thread C:\Windows\system32\taskhost.exe [1988:2056] 000007fef9ca1010Thread C:\Windows\system32\taskhost.exe [1988:3468] 000007fef8015170---- Processes - GMER 2.1 ---- Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F8D55729-7462-4471-9B45-4B2ADC58E47C}\offreg.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [3144](2014-10-01 02:22:46) 000007fef67e0000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{590E5770-9C99-4849-AEC0-26858061F35B}\Connection@Name isatap.{A7102816-EBDD-4E21-9932-B99E7888F711}Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{C44D2A9E-724F-4703-ACC2-6000EAF8D802}?\Device\{337D862F-B6F1-4AF6-A0BD-94814E316FB8}?\Device\{590E5770-9C99-4849-AEC0-26858061F35B}?\Device\{4D7F8203-3896-4A20-AF6A-A22A4E05C7B3}?Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{C44D2A9E-724F-4703-ACC2-6000EAF8D802}"?"{337D862F-B6F1-4AF6-A0BD-94814E316FB8}"?"{590E5770-9C99-4849-AEC0-26858061F35B}"?"{4D7F8203-3896-4A20-AF6A-A22A4E05C7B3}"?Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{C44D2A9E-724F-4703-ACC2-6000EAF8D802}?\Device\TCPIP6TUNNEL_{337D862F-B6F1-4AF6-A0BD-94814E316FB8}?\Device\TCPIP6TUNNEL_{590E5770-9C99-4849-AEC0-26858061F35B}?\Device\TCPIP6TUNNEL_{4D7F8203-3896-4A20-AF6A-A22A4E05C7B3}?Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{590E5770-9C99-4849-AEC0-26858061F35B}@InterfaceName isatap.{A7102816-EBDD-4E21-9932-B99E7888F711}Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{590E5770-9C99-4849-AEC0-26858061F35B}@ReusableType 0 ---- EOF - GMER 2.1 ---- Link to post Share on other sites More sharing options...
badbandido Posted October 5, 2014 Author ID:886687 Share Posted October 5, 2014 Please help!!! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 7, 2014 Root Admin ID:887268 Share Posted October 7, 2014 Hello and Sorry for the delay but by not following the directions from this post often causes a slower response time. https://forums.malwarebytes.org/index.php?/topic/119858-available-assistance-for-possibly-infected-computers/ Please read the following and post back the logs when ready and we'll see about getting you cleaned up. General P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided. If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Before we proceed further, please read all of the following instructions carefully. If there is anything that you do not understand kindly ask before proceeding. If needed please print out these instructions.Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.If the log is too large then you can use attachments by clicking on the More Reply Options button.Please enable your system to show hidden files: How to see hidden files in WindowsMake sure you're subscribed to this topic:Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to InstantlyRemoving malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drivePlease don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you.The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone.Perform everything in the correct order. Sometimes one step requires the previous one.If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue.You can check here if you're not sure if your computer is 32-bit or 64-bitPlease disable your antivirus while running any requested scanners so that they do not interfere with the scanners.When we are done, I'll give you instructions on how to cleanup all the tools and logsPlease stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.Your topic will be closed if you haven't replied within 3 days(If I have not responded within 24 hours, please send me a Private Message as a reminder)STEP 0 RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools. When finished it will display a log file that shows the processes that were terminated while the program was running. As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot your computer as any malware processes that are configured to start automatically will just be started again. Instead, after running RKill you should immediately scan your computer using the requested scans I've included. Please download Rkill by Grinler from one of the links below and save it to your desktop. Link 1 Link 2On Windows XP double-click on the Rkill desktop icon to run the tool.On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As AdministratorA black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.If not, delete the file, then download and use the one provided in Link 2.If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.If the tool does not run from any of the links provided, please let me know.Do not reboot the computer, you will need to run the application again.STEP 01 Backup the Registry: Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.Please download ERUNT from one of the following links: Link1 | Link2 | Link3ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.Double click on erunt-setup.exe to Install ERUNT by following the prompts.NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.Choose a location for the backup.Note: the default location is C:\Windows\ERDNT which is acceptable.Make sure that at least the first two check boxes are selected.Click on OKThen click on YES to create the folder.Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exeSTEP 02 Please run a Threat Scan with MBAM. If you're unable to run or complete the scan as shown below please see the following: MBAM Clean Removal Process 2x When reinstalling the program please try the latest version. Right click and choose "Run as administrator" to open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware. Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply. STEP 03 Please download RogueKiller and save it to your desktop. You can check here if you're not sure if your computer is 32-bit or 64-bitRogueKiller 32-bit | RogueKiller 64-bitQuit all running programs.For Windows XP, double-click to start.For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.Read and accept the EULA (End User Licene Agreement)Click Scan to scan the system.When the scan completes Close the program > Don't Fix anything!Don't run any other options, they're not all bad!!Post back the report which should be located on your desktop.Thank you Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 2, 2014 Root Admin ID:914658 Share Posted December 2, 2014 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts